Edit tour

Windows Analysis Report
lz3EbiqoK4.exe

Overview

General Information

Sample name:	lz3EbiqoK4.exe renamed because original name is a hash value
Original sample name:	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
Analysis ID:	1571838
MD5:	33c2adebfe2c3acedfb34ffff8151b7d
SHA1:	8e93f7ecafa92017a7d528423574ab5cfeec754a
SHA256:	773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd
Tags:	exeQuasarRATRATuser-abuse_ch
Infos:

Detection

Quasar

Score:	46
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Quasar RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Installation of TeamViewer Desktop

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious desktop.ini Action

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

lz3EbiqoK4.exe (PID: 7484 cmdline: "C:\Users\user\Desktop\lz3EbiqoK4.exe" MD5: 33C2ADEBFE2C3ACEDFB34FFFF8151B7D)

Client-built.exe (PID: 7612 cmdline: "C:\Users\user\AppData\Local\Temp\Client-built.exe" MD5: 181719B653C83D0463D89A625A7F5C3E)

TeamViewer_Setup_x64.exe (PID: 7856 cmdline: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" MD5: D15511E4B90CC6729FEDAF86D080D1F6)

TeamViewer_.exe (PID: 7964 cmdline: "C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" MD5: 8318FC63158C01368AADC6D4BE89FAD1)

schtasks.exe (PID: 8044 cmdline: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4464 cmdline: C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

TeamViewer_.exe (PID: 8092 cmdline: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE MD5: 8318FC63158C01368AADC6D4BE89FAD1)

schtasks.exe (PID: 3524 cmdline: C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "167.71.56.116:22269;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "3470ac31-30aa-4cf6-ab0a-1ed0dd64656f", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "flgSE4SpXYfH0xcfLTe0iNrh2SeQBvNG44BtoMkxQ/T+DRAgnPzzPI13Eed+g9CiOhWxTcQ4rBGiEohyz5eQ1DvqWAcx7FHBiVlioCxa9o3s2Di7DtimucOXtlSh4LTyZq/qoQbOzkeXO7/0unghQ7pjMzNB1Xr/SNB2tIRVcTdEqpy74fYJ6cocilX8Eb2i3AuEpiYlPtpqujGq/1uutyvPCEGIJu28WT9i75GrAom6etZ++VpuHWw33I16MzKdxOjLZ4w5gHdhiybBfRenF2XXPqcEFMH78okk/Jmk3sUsueppieYz3jgjrXyqIfg9Ayqy89/lJW/B6sm5q5nbX2TzhmeI0bxRl02j2TOwPVJjgx3ySJevStEV8SJEFazuggWRFjbW7A/0TAbGRgBtDu378rLxwiqWCnedkKFuSJVEYLWb1rkRnymb8kWHRFZM+wi+cmaWTdNz+u8VvAwUxUAxlfQaLYamguJbJD+MZZzRhLNIHMJm1DcnJdECI6P3rtd6d6YJI2+TdyXRb8bNg+obsU+ppH+yxLw4NlWFbvXREBZB6trXaIf3fhI+f4FbA2+lb5IJ5euHGu5FabDFvABadac+bVMBFsmLTQEKOGWnEyX038mvTSpS5MLw+NfCXIlMW94wwokBZ/0I0mEhPAflB+p9xZVJUHd3qYbTnMs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAJq3Mj8c1rXwra3rDC0BgzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTIwNDA5Mzc1OFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgDdz73u2oR4NOea2y1Gy+ejcDZB7rD3j8AcyTdfqU60MW8K4UCvWDATRHvg0Q+WxaHgJjvGGAOzSgmLJF/sKanAHM+Ejhya1aOTADACluOYW9YcZ4hhpmvAgq9IZKr3VXAH6AlDVb6EYlFvNUzQMRbMzZflnnYPpoKtj96/xEllcqnYYe5iiIF25objFBsOivILrD8r5zzl30bfwt6bcs7EZ77qOOajuTqF5VPneX/C1mgSqnK1KeE4MyI6vfJvaWAQ7sjNLWflauxXUMALmiEssTwcfJ1+GOhoXngcZ6TzTQqdzBGbaEmgWvsIvZSgGu/ddDnX01P26IKwLVHCFRdDY82m3FXkPv/WpK+P95yeUA3uzIIZlbFPXr+8pdylqs/E5+b7LNIAxQRhXI4NfwAhUfLq4MhYlLh844vRdBda+7g19pW6rrU+R5BObTIE5pry54Stz+rgS9I81k7Kaqzq2MbOMYoHBSQkfH/whUILDnSvm+J/7nAm1kYbamCUZQY27NYhcHWmBEBEwSDe4K2MlHzn2nEXY7H1GRTvdCtUnHoLbGGue4J64dnTA1mL4XYWgmKjNWUcemFuo3lkQD+M3GkW5nTPlEkP6X116nlzIH1tm3fp2PRQphJvowVrcA/Ch6Me4VYt7vEV4gUPn9o+tqu2QDvFBjS+iFx8YYXcCAwEAAaMyMDAwHQYDVR0OBBYEFM0CBviNX3UM6cXNdgOhJ1Q8+Tu5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBABtf3WU07+re45SWDknjH/SP021fFZEXLh9u7mE/zGyJw2C3vhs9+47GhCp6jNjZg7NntWJboiyj4VhNHRuLnqItAPF60JGo3Q3TuSRDdCcDg/9DSdbODMg2EcH/kk1yVQgE6+qDC7H+SbNn6JgTnFTH1KesnSHl/m/Y3Bg2+ZTiJuDwxBXsAfRjSuhjaMe/k2oCWE5PngTtcSSOLbhMQ7kAZMl3++MSFe3Q8vUnpyKq5gELt1RnACtyPInqCM2gXA1rRw407+6AoyjnUo5M5/jwYIicQEJVkkJSSO7opyR1t9SNh8nrjxEtJIgsitQRrGh0vJLQYeTJDCy4RGwR8o7sruyrJcfHZjX3D1QujdUl1C6mSTR9E/LW2pEq4EkaifcG4WOejyIsspkrCDSeyWyRXjMxq4FlVGgtbzVZbIQbPOpSbDMNIHr4QKgsp0Xa/cgb830U6g5TFUNX2C7ueZrDpV0nAvOUsm2OQ9SBPLSgds4hESjjSxh2I2/WwYJl1TB642zOPUPfOuYN2xvBm9D0sZWMZe7l8ou899vN3zogGQwX1wJTyVorX/IgpNljOZDNVYSL7YEAiQI6YM03H1pkjY9EgeboVCIpWbRBvx0bjk1GRHpRM2Hst3mDU7F7AOepmS8xBatuBKRIEHWJ00a55Pb6d7CoySAxY7aN0FT7"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Client-built.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
C:\Users\user\AppData\Local\Temp\Client-built.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\Client-built.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ee9d:$x1: Quasar.Common.Messages 0x29f1c6:$x1: Quasar.Common.Messages 0x2ab83e:$x4: Uninstalling... good bye :-( 0x2ad033:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
C:\Users\user\AppData\Local\Temp\Client-built.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadf0:$f1: FileZilla\recentservers.xml 0x2aae30:$f2: FileZilla\sitemanager.xml 0x2aae72:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0be:$b1: Chrome\User Data\ 0x2ab114:$b1: Chrome\User Data\

Memory Dumps

Source	Rule	Description	Author
00000001.00000000.1871811766.00000000012E0000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.3667738198.00000000036D6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.3667738198.0000000003581000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Client-built.exe PID: 7612	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.Client-built.exe.fc0000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
1.0.Client-built.exe.fc0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.Client-built.exe.fc0000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ee9d:$x1: Quasar.Common.Messages 0x29f1c6:$x1: Quasar.Common.Messages 0x2ab83e:$x4: Uninstalling... good bye :-( 0x2ad033:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
1.0.Client-built.exe.fc0000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadf0:$f1: FileZilla\recentservers.xml 0x2aae30:$f2: FileZilla\sitemanager.xml 0x2aae72:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0be:$b1: Chrome\User Data\ 0x2ab114:$b1: Chrome\User Data\ 0x2ab3ec:$b2: Mozilla\Firefox\Profiles 0x2ab4e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd46c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab640:$b4: Opera Software\Opera Stable\Login Data 0x2ab6fa:$b5: YandexBrowser\User Data\ 0x2ab768:$b5: YandexBrowser\User Data\ 0x2ab43c:$s4: logins.json 0x2ab172:$a1: username_value 0x2ab190:$a2: password_value 0x2ab47c:$a3: encryptedUsername 0x2fd3b0:$a3: encryptedUsername 0x2ab4a0:$a4: encryptedPassword 0x2fd3ce:$a4: encryptedPassword 0x2fd34c:$a5: httpRealm
1.0.Client-built.exe.fc0000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab928:$s3: Process already elevated. 0x28eb9c:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e925:$s5: GetKeyloggerLogsDirectory 0x28ebbf:$s6: set_PotentiallyVulnerablePasswords 0x2fea9a:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Sigma Signatures

System Summary

Sigma detected: Installation of TeamViewer Desktop

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe, ProcessId: 7964, TargetFilename: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F, CommandLine: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe, ParentProcessId: 7964, ParentProcessName: TeamViewer_.exe, ProcessCommandLine: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F, ProcessId: 8044, ProcessName: schtasks.exe

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\Desktop\lz3EbiqoK4.exe, ProcessId: 7484, TargetFilename: C:\Windows\assembly\Desktop.ini

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T18:52:47.774466+0100	2035595	1	Domain Observed Used for C2 Detected	167.71.56.116	22269	192.168.2.4	49731	TCP

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T18:52:47.774466+0100	2027619	1	Domain Observed Used for C2 Detected	167.71.56.116	22269	192.168.2.4	49731	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.0.Client-built.exe.fc0000.0.unpack

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "167.71.56.116:22269;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "3470ac31-30aa-4cf6-ab0a-1ed0dd64656f", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "flgSE4SpXYfH0xcfLTe0iNrh2SeQBvNG44BtoMkxQ/T+DRAgnPzzPI13Eed+g9CiOhWxTcQ4rBGiEohyz5eQ1DvqWAcx7FHBiVlioCxa9o3s2Di7DtimucOXtlSh4LTyZq/qoQbOzkeXO7/0unghQ7pjMzNB1Xr/SNB2tIRVcTdEqpy74fYJ6cocilX8Eb2i3AuEpiYlPtpqujGq/1uutyvPCEGIJu28WT9i75GrAom6etZ++VpuHWw33I16MzKdxOjLZ4w5gHdhiybBfRenF2XXPqcEFMH78okk/Jmk3sUsueppieYz3jgjrXyqIfg9Ayqy89/lJW/B6sm5q5nbX2TzhmeI0bxRl02j2TOwPVJjgx3ySJevStEV8SJEFazuggWRFjbW7A/0TAbGRgBtDu378rLxwiqWCnedkKFuSJVEYLWb1rkRnymb8kWHRFZM+wi+cmaWTdNz+u8VvAwUxUAxlfQaLYamguJbJD+MZZzRhLNIHMJm1DcnJdECI6P3rtd6d6YJI2+TdyXRb8bNg+obsU+ppH+yxLw4NlWFbvXREBZB6trXaIf3fhI+f4FbA2+lb5IJ5euHGu5FabDFvABadac+bVMBFsmLTQEKOGWnEyX038mvTSpS5MLw+NfCXIlMW94wwokBZ/0I0mEhPAflB+p9xZVJUHd3qYbTnMs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAJq3Mj8c1rXwra3rDC0BgzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTIwNDA5Mzc1OFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgDdz73u2oR4NOea2y1Gy+ejcDZB7rD3j8AcyTdfqU60MW8K4UCvWDATRHvg0Q+WxaHgJjvGGAOzSgmLJF/sKanAHM+Ejhya1aOTADACluOYW9YcZ4hhpmvAgq9IZKr3VXAH6AlDVb6EYlFvNUzQMRbMzZflnnYPpoKtj96/xEllcqnYYe5iiIF25objFBsOivILrD8r5zzl30bfwt6bcs7EZ77qOOajuTqF5VPneX/C1mgSqnK1KeE4MyI6vfJvaWAQ7sjNLWflauxXUMALmiEssTwcfJ1+GOhoXngcZ6TzTQqdzBGbaEmgWvsIvZSgGu/ddDnX01P26IKwLVHCFRdDY82m3FXkPv/WpK+P95yeUA3uzIIZlbFPXr+8pdylqs/E5+b7LNIAxQRhXI4NfwAhUfLq4MhYlLh844vRdBda+7g19pW6rrU+R5BObTIE5pry54Stz+rgS9I81k7Kaqzq2MbOMYoHBSQkfH/whUILDnSvm+J/7nAm1kYbamCUZQY27NYhcHWmBEBEwSDe4K2MlHzn2nEXY7H1GRTvdCtUnHoLbGGue4J64dnTA1mL4XYWgmKjNWUcemFuo3lkQD+M3GkW5nTPlEkP6X116nlzIH1tm3fp2PRQphJvowVrcA/Ch6Me4VYt7vEV4gUPn9o+tqu2QDvFBjS+iFx8YYXcCAwEAAaMyMDAwHQYDVR0OBBYEFM0CBviNX3UM6cXNdgOhJ1Q8+Tu5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBABtf3WU07+re45SWDknjH/SP021fFZEXLh9u7mE/zGyJw2C3vhs9+47GhCp6jNjZg7NntWJboiyj4VhNHRuLnqItAPF60JGo3Q3TuSRDdCcDg/9DSdbODMg2EcH/kk1yVQgE6+qDC7H+SbNn6JgTnFTH1KesnSHl/m/Y3Bg2+ZTiJuDwxBXsAfRjSuhjaMe/k2oCWE5PngTtcSSOLbhMQ7kAZMl3++MSFe3Q8vUnpyKq5gELt1RnACtyPInqCM2gXA1rRw407+6AoyjnUo5M5/jwYIicQEJVkkJSSO7opyR1t9SNh8nrjxEtJIgsitQRrGh0vJLQYeTJDCy4RGwR8o7sruyrJcfHZjX3D1QujdUl1C6mSTR9E/LW2pEq4EkaifcG4WOejyIsspkrCDSeyWyRXjMxq4FlVGgtbzVZbIQbPOpSbDMNIHr4QKgsp0Xa/cgb830U6g5TFUNX2C7ueZrDpV0nAvOUsm2OQ9SBPLSgds4hESjjSxh2I2/WwYJl1TB642zOPUPfOuYN2xvBm9D0sZWMZe7l8ou899vN3zogGQwX1wJTyVorX/IgpNljOZDNVYSL7YEAiQI6YM03H1pkjY9EgeboVCIpWbRBvx0bjk1GRHpRM2Hst3mDU7F7AOepmS8xBatuBKRIEHWJ00a55Pb6d7CoySAxY7aN0FT7"}

Yara detected Quasar RAT

Source: Yara match	File source: 1.0.Client-built.exe.fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1871811766.00000000012E0000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3667738198.00000000036D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3667738198.0000000003581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7612, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.1% probability

Source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_06f1787b-1

Source: lz3EbiqoK4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe

Window detected: Accept - next Welcome to TeamViewerRemote Support unattended access meetings and presentationsLicense Agreement: By continuing you agree to the terms of the license agreement.License Agreement:Default installationInstall and set up unattended access to this deviceRun only (one time use)Show advanced settingsHow do you want to proceed?

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfiles.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\CopyrightFULL.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils\MicrosoftEdgeWebview2Setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfilesx64.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\tvmonitor.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewerVPN.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\TeamViewerVPN.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfiles_printer_WithPDFSupport_x64.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TV15Install.log			Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log			Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: E:\WS\tv_prel_dcr\ApplicationPlugins\Win\OutlookAddIn\BuildTarget\Release\TeamViewerMeetingAddinShim.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\DriverBuild\Drivers\Win\VirtualMonitor\bin\x64\Release\TVVirtualMonitorDriver.pdb source: TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64dll.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\ApplicationPlugins\Win\OutlookAddIn\ManagedAggregator\obj\Release\ManagedAggregator.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win64\Release\TVWebRTC.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000B4AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb{ source: TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_w32exe.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Sources\teamviewer_2\Installer\plugins\TvGetVersion\Release_Unicode\TvGetVersion.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64exe.pdbV source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\ApplicationPlugins\Win\OutlookAddIn\BuildTarget\Release\TeamViewerMeetingAddinShim64.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb source: TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64exe.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\DriverBuild\Drivers\RemotePrintingDriver\Win\XPSDriverFilter\Build\XPSFilter\x64\Release\TeamViewer_XPSDriverFilter.pdb source: TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Sources\teamviewer_2\Installer\plugins\TvGetVersion\Release\TvGetVersion.pdb source: TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win64\Release\WriteDump.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\DriverBuild\Drivers\Win\DeviceRedirection\bin\x64\Release\TeamViewer_VirtualDeviceDriver.pdb source: TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win64\Release\WriteDump.pdb_ source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\openvpn-2.1_rc4\tap-win32\amd64\teamviewervpn.pdb source: TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\teamviewer_tvmonitordriver\drivers\win\monitor\objfre_win7_amd64\amd64\TVMonitor.pdb source: TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win64\FULL\Release\TeamViewer_Service.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_w32exe.pdbX source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Documents\Programming\OpenSourceProjects\tap-windows6\src\x64\Hlk\teamviewervpn.pdb source: TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_w32dll.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_00405FFD FindFirstFileA,FindClose,	5_2_00405FFD
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	5_2_0040559B
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_00402688 FindFirstFileA,	5_2_00402688
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Code function: 6_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	6_2_0040596F
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Code function: 6_2_004064C1 FindFirstFileW,FindClose,	6_2_004064C1
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Code function: 6_2_004027FB FindFirstFileW,	6_2_004027FB
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	9_2_0040596F
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004064C1 FindFirstFileW,FindClose,	9_2_004064C1
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004027FB FindFirstFileW,	9_2_004027FB

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 167.71.56.116:22269 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 167.71.56.116:22269 -> 192.168.2.4:49731

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 167.71.56.116

Yara detected Generic Downloader

Source: Yara match	File source: 1.0.Client-built.exe.fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 167.71.56.116:22269

Source: Joe Sandbox View

IP Address: 167.71.56.116 167.71.56.116

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116

Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0K
Source: TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://client.teamviewer.com/shutdown/index.aspx?lng=en
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://connect.teamviewer.com/v15Hhttp://www.teamviewer.com/download/version_15x/TeamViewer_Host_Set
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
Source: Client-built.exe, 00000001.00000002.3695571535.000000001C0B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Client-built.exe, 00000001.00000002.3695571535.000000001C1DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: Client-built.exe, 00000001.00000002.3695571535.000000001C1DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Client-built.exe, 00000001.00000002.3695571535.000000001C12B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?181a5260ae
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dojofoundation.org/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://github.com/jquery/jqueryui.com
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jquery.com/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jquery.org/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://knockoutjs.com/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: TeamViewer_Setup_x64.exe, TeamViewer_Setup_x64.exe, 00000005.00000000.1931898193.0000000000409000.00000008.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: TeamViewer_Setup_x64.exe, 00000005.00000000.1931898193.0000000000409000.00000008.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000000.1972346777.000000000040A000.00000008.00000001.01000000.0000000C.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000000.2051228247.000000000040A000.00000008.00000001.01000000.00000015.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Client-built.exe, 00000001.00000002.3667738198.0000000003581000.00000004.00000800.00020000.00000000.sdmp, Client-built.exe, 00000001.00000002.3667738198.00000000036D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFL
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tanyabrassie.com/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://underscorejs.org/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.boost.org/users/license.html).
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2312085882.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301300487.0000000007100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/download/version_15x/TeamViewerQJ.exe
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/download/version_15x/TeamViewer_Setup.exe
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/favicon.ico
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=103286
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=130291
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=141508
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=144319
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=148325
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=181342
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=190014
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=233248
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000002.2373504628.0000000002757000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2256496709.000000000155A000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=271351
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=271351#Th
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=271351$Pridae
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=271351&Adicionar
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=301635
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=301635#
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635$
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635F
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635POm
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635SAko
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635TAk
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635_
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635aDac
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635c
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635g
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635lSe
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=301635sN
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=308980
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=362946
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=364893
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=413309
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=441415
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=456463
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=456463#~b
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=456463OKh
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463YD
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463mScript-urile
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463mSkript
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463p
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463qSkripte
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463r
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463xScripts
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=475051
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=517756
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=522447
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=526914
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=539523
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=539523%
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=539523)
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=539523)Installation
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=5395230Configura
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=5395239
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=539523?
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=563890
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=591924
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=613217
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=632515
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=632515.
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=632515/Op
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=6325150Alternativ
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=6325150TeamViewer
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=6325155
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=6325156Ca
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=6325157
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=632515:Opc
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=633113
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=649250
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=649250M
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=649250U
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=649250f
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=649250y
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=659842
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=666256
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=696517
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=696517$E-Mail
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=703800
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=720679
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679aInloggningen
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679aLogin
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679gPrihl
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679hPrijavljivanje
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=720679n
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679p
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679t
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679yLog
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679yOturum
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=740465
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=801210
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210#
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210Q
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210YFj
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210c
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210eO
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210gVo
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=801210jMa
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210jUdaljeni
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210kUzak
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210xComputerul
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=861823
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=861823?
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823NDu
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823P
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823Q
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823R
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823SOtomatik
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823XTrebuie
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823gAby
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=866109
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=874259
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=891850
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=891850&Bezpe
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=891850)
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=891850/O
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=8918502Codul
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=8918503Sigurnosna
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=899369
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=907878
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=922587
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=934954
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=9349542Sua
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=9349547
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=934954=
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=934954=Tiden
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=934954=Zahtev
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=934954F
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=934954J
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=934954MSolicitarea
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=942683
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=954698
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=964412
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=999999
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=999999tS
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=999999wFil
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=999999~
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://%1%.teamviewer.com/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://%1%.teamviewer.com/%2%
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%1%.teamviewer.com/%2%)Introducec
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://%1%.teamviewer.com/0
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%1%.teamviewer.com/5
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%1%.teamviewer.com/z
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/fabric-assets-license
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/fluentui-assets-license
Source: Client-built.exe, 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://api.ipify.org/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/chromium/src/third_party/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/libyuv/libyuv/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cla.developers.google.com/clas
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://client.teamviewer.com/blizzintro/?language=%1%&os=%2%&client=%3%
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://client.teamviewer.com/intro/index.aspx?lng=%1%&version=%2%&os=%3%&tab=%4%DSorry.
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://client.teamviewer.com/whatsnew/index.aspx?lng=%1%&version=%2%&os=%3%&tab=%4%&insiderbuild=%5
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://community.teamviewer.com/kb/articles/106782-managed-devices-general-information
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/kb/articles/106782-managed-devices-general-information(Zobrazovae
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/kb/articles/106782-managed-devices-general-information3
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz$Radnja
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz)Platnose
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz0Tidsgr
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz2Acc
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz30
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz3Thao
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz6
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by-sa/4.0/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by/4.0/)
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://dev-trunk.teamviewer.com/CommentSession/CommentAfterSession?token=%1%&lng=%2%&version=%3%&os
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: https://dev-trunk.teamviewer.com/CommentSession/CommentDuringSession?token=%1%&lng=%2%&version=%3%&o
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://feedbackservice-test.teamviewer.com
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://feedbackservice.teamviewer.com
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://feedbackservice.teamviewer.com/upload/index8https://feedbackservice-test.teamviewer.com/uplo
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fontawesome.com/license/free.
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://get.teamviewer.com/v15/%1%vYou
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://get.teamviewer.com/v15/%2%
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://getassistar.teamviewer.com/%1%
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://getassistar.teamviewer.com/%1%C%1%
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getassistar.teamviewer.com/%1%K%1%
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://getassistar.teamviewer.com/%2%
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getassistar.teamviewer.com/%2%8
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://getassistar.teamviewer.com/%2%9
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://git.coolaj86.com/coolaj86/atob.js.git
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://git.tukaani.org/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/101arrowz/fflate
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DefinitelyTyped/DefinitelyTyped
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/FortAwesome/Font-Awesome
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/FortAwesome/react-fontawesome
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Gamote/lottie-react
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JedWatson/classnames
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/MrRio/jsPDF
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Popmotion/hey-listen
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Popmotion/popmotion
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Qix-/color-convert
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Raynos/duplexer
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Raynos/function-bind
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/RebeccaStevens/deepmerge-ts
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ReneNyffenegger/cpp-base64
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/SamVerschueren/decode-uri-component
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/SergiusTheBest/exceptxx
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ShiqiYu/libfacedetection
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/adobe/react-spectrum
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/airbnb/lottie-web
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/alexindigo/asynckit
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/axios/axios
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/babel/babel
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/benjamn/reify
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/boostorg/boost
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/browserslist/browserslist
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/browserslist/caniuse-lite
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/canvg/canvg
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/caolan/async
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-regex
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-styles
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/chalk
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chartjs/Chart.js
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cisco/libsrtp
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/colorjs/color-name
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/component/escape-html
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cure53/DOMPurify
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/curl/curl
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/date-fns/date-fns
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/emotion-js/emotion/tree/main/packages/hash
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/emotion-js/emotion/tree/master/packages/is-prop-valid
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/emotion-js/emotion/tree/master/packages/memoize
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/epoberezkin/fast-deep-equal
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ericf/css-mediaquery
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/farzher/fuzzysort
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/felixge/node-combined-stream
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/felixge/node-delayed-stream
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/fengyuanchen/cropperjs
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/follow-redirects/follow-redirects
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/form-data/form-data
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/framer/motion
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/frenic/csstype
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/glennrp/libpng
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/boringssl/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/farmhash
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/googlefonts/dm-fonts/tree/main/Sans
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/henrikjoreteg/html-parse-stringify
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/i18next/i18next
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/i18next/i18next-browser-languageDetector
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/i18next/i18next-http-backend
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/i18next/i18next-resources-to-backend
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/immerjs/immer
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/infusion/Fraction.js
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/functions-have-names
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/has-property-descriptors
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/has-symbols
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/has-tostringtag
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/is-arguments
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/is-date-object
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/is-regex
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/fs.realpath
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/inherits
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/node-glob
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jakejs/jake
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaredLunde/react-hook
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jhchen/fast-diff
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/joyent/libuv
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jquense/react-common-hooks
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jquery-validation/jquery-validation
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jquery/jquery
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jquery/jqueryui.com
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jshttp/cookie
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/juggle/resize-observer
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/juliangruber/balanced-match
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/juliangruber/brace-expansion
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/justmoon/node-extend
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/kilian/electron-to-chromium
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/knockout/knockout
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/libjpeg-turbo/libjpeg-turbo
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/libuv/libuv
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/libuv/libuv/tree/master/src
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ljharb/call-bind
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ljharb/define-properties
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ljharb/get-intrinsic
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lodash/lodash
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lquixada/cross-fetch
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lukeed/clsx
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lukeed/dequal
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lukeed/escalade
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lydell/js-tokens
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lz4/lz4
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mantinedev/mantine
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mathiasbynens/emoji-regex
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mde/ejs
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mde/filelist
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/fluentui
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/fluentui-system-icons
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/griffel
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/rushstack
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/missive/emoji-mart
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mit-plv/fiat-crypto/blob/master/AUTHORS).
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/moment/luxon
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mridgway/hoist-non-react-statics
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/niklasvh/base64-arraybuffer
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/niklasvh/css-line-break
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/niklasvh/html2canvas
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nolimits4web/dom7
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/inflight
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/open-cli-tools/concurrently
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/open-source-parsers/jsoncpp
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/popperjs/popper-core
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/postcss/autoprefixer
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pradel/esbuild-node-externals
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/primus/eventemitter3
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pvorb/node-clone
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/reach/observe-rect
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-bootstrap/dom-helpers
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-dropzone/attr-accept
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-dropzone/file-selector
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-native-async-storage/async-storage
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-restart/ui
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/reduxjs/redux-toolkit
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/remix-run/react-router
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/rexxars/hyphenate-style-name
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/rochal/jQuery-slimScroll
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/simonbengtsson/jsPDF-AutoTable
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/simonbengtsson/jspdf-autotable
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/filter-obj
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/find-up
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/gzip-size
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/has-flag
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/is-docker
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/is-fullwidth-code-point
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/is-plain-obj
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/is-wsl
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/locate-path
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/query-string
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/standard-things/esm
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/stefanpenner/get-caller-file
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/substack/node-deep-equal
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/suren-atoyan/monaco-loader
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/suren-atoyan/monaco-react
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/swc-project/swc
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tanstack/react-virtual
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tanstack/table
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tarruda/has
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/thlorenz/convert-source-map
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/twbs/bootstrap
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/weidai11/cryptopp
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/wojtekmaj/date-utils
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/wojtekmaj/get-user-locale
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/yargs/cliui
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/invariant
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zloirock/core-js
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://go.teamviewer.com/v15
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://go.teamviewer.com/v15/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://go.teamviewer.com/v15b
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.teamviewer.com/v15c
Source: Client-built.exe, 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://ipwho.is/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jquery.org/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kossnocorp.mit-license.org
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://login.teamviewer.com/nav/license-activation-guidance
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://meeting.teamviewer.com/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr	String found in binary or memory: https://meeting.teamviewer.com/._Please
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://meeting.teamviewer.com/join/-https://www.teamviewer.com/meeting/telephone/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://meeting.teamviewer.com/join/-https://www.teamviewer.com/meeting/telephone/Y
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meeting.teamviewer.com/join/-https://www.teamviewer.com/meeting/telephone/Z:N
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://npm.runkit.com/concat-map
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nsis.sourceforge.io/Base64_plug-in
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nsis.sourceforge.io/DialogsEx_plug-in
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nsis.sourceforge.io/Invoke_Shell_Verb_plugin
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nsis.sourceforge.io/Linker_plug-in
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://openjsf.org/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://opensource.org/licenses/MIT)
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://opensource.org/licenses/Zlib)
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://quicksupport.me/s%1%
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scripts.sil.org/OFL)
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sindresorhus.com)
Source: Client-built.exe, 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Client-built.exe, 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp, Client-built.exe, 00000001.00000002.3667738198.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, Client-built.exe, 00000001.00000002.3667738198.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Client-built.exe, 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tukaani.org/xz/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webrtc.googlesource.com/src/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.npmjs.com/package/
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.npmjs.com/package/btoa
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.cn/cn/lo-assist-ar/YUsers
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/en/gdpr/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/en/gdpr/#
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/en/gdpr/)
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/en/lo-assist-ar/YUsers
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=116574
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=125377
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=165388
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=165388#Tyv
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=1653880R
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=1653883Ne
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=1653885=
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=1653888
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=180010
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=261802
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=279064$(WK
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=279064NKh
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064UY
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064VScripts
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064YSkript
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064ZD
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064b
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064lScript-urile
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064oSkripte
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064rOs
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=290947
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=290947#
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=290947$
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=290947%Dezactiva
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=290947%Donan1
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=293922
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=300792
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=364272
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=364272&
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=364272)Naozaj
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=3642722Doric
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=3642724Da
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=3642728Ba#
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=3642728Devam
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=378443
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=382377
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377dPristajem
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377g/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377lAutorizo
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377lJag
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=382377nT
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377p/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377sS
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377tConsimt
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377wKi_
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=418720
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=461825ZYour
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=462409
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=462409IMQ
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=462409JMQ9
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=514937
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=572005
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=572005S
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=572005T
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=601593
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=601593C
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=737863
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=773631
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=780538
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=790045
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=7900459/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=790045s/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=850268&utm_source=mainwindow&utm_medium=client&utm_content=wind
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=879333
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=879333~Tento
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=881911
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=940942
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=9409420Experimente
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/meeting
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/meeting/telephone/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/ru/lo-assist-ar/YUsers
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/teamviewer-tensor/single-sign-on/
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/teamviewer-tensor/single-sign-on/1
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/teamviewer-tensor/single-sign-on/6
Source: TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/ticket
Source: TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yworks.com/

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe

Code function: 5_2_00405050 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

5_2_00405050

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 1.0.Client-built.exe.fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1871811766.00000000012E0000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3667738198.00000000036D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3667738198.0000000003581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7612, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\tvmonitor.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.0.Client-built.exe.fc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 1.0.Client-built.exe.fc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 1.0.Client-built.exe.fc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,CoUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	5_2_004030D9
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Code function: 6_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	6_2_004033B6
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	9_2_004033B6

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	File created: C:\Windows\assembly\Desktop.ini			Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches			Jump to behavior

Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe

File deleted: C:\Windows\Temp\nsw8A6C.tmp

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Code function: 0_2_06B900CD	0_2_06B900CD
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9BD35BE1	1_2_00007FFD9BD35BE1
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9BD393C1	1_2_00007FFD9BD393C1
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9BD34DC6	1_2_00007FFD9BD34DC6
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9BD3A7CD	1_2_00007FFD9BD3A7CD
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9BD38A61	1_2_00007FFD9BD38A61
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9BD310D1	1_2_00007FFD9BD310D1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_00406344	5_2_00406344
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_0040488F	5_2_0040488F
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Code function: 6_2_00406846	6_2_00406846
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Code function: 6_2_00404C59	6_2_00404C59
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_00406846	9_2_00406846
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_00404C59	9_2_00404C59

Source: TeamViewer_Resource_ar.dll.6.dr	Static PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped
Source: TeamViewer_Resource_cs.dll.6.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: TeamViewer_Resource_de.dll.6.dr	Static PE information: Resource name: RT_STRING type: MIPSEB-LE ECOFF executable not stripped - version 0.101
Source: TeamViewer_Resource_el.dll.6.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: TeamViewer_Resource_es.dll.6.dr	Static PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-II ECOFF executable not stripped - version 0.100
Source: TeamViewer_Resource_it.dll.6.dr	Static PE information: Resource name: RT_STRING type: 370 XA sysV executable not stripped
Source: TeamViewer_Resource_it.dll.6.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: TeamViewer_Resource_nl.dll.6.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: TeamViewer_Desktop.exe.6.dr	Static PE information: Number of sections : 13 > 10
Source: TeamViewer.exe.6.dr	Static PE information: Number of sections : 12 > 10

Source: TeamViewer_Resource_ja.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_cs.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_it.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_hu.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_hr.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_ar.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_ko.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_lt.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_en.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_nl.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_he.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_fr.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_fi.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_es.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_id.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_el.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_bg.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_da.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_de.dll.6.dr	Static PE information: No import functions for PE file found

Source: lz3EbiqoK4.exe, 00000000.00000002.1937736155.0000000004C2A000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVenomless.exe0 vs lz3EbiqoK4.exe
Source: lz3EbiqoK4.exe, 00000000.00000002.1941549710.0000000004EEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs lz3EbiqoK4.exe

Source: lz3EbiqoK4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.0.Client-built.exe.fc0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 1.0.Client-built.exe.fc0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 1.0.Client-built.exe.fc0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers

Source: classification engine

Classification label: mal46.troj.evad.winEXE@17/109@0/1

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Code function: 0_2_0689AA8E AdjustTokenPrivileges,	0_2_0689AA8E
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Code function: 0_2_0689AA57 AdjustTokenPrivileges,	0_2_0689AA57
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,CoUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	5_2_004030D9
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Code function: 6_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	6_2_004033B6
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	9_2_004033B6

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe

Code function: 5_2_0040431C GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

5_2_0040431C

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe

Code function: 5_2_0040205E CoCreateInstance,MultiByteToWideChar,

5_2_0040205E

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe

File created: C:\Program Files\TeamViewer

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\lz3EbiqoK4.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Mutant created: \Sessions\1\BaseNamedObjects\TeamViewer_Win32_Instance_Mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2172:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\3470ac31-30aa-4cf6-ab0a-1ed0dd64656f
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File created: C:\Users\user\AppData\Local\Temp\Client-built.exe

Jump to behavior

Source: lz3EbiqoK4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: unknown	Process created: C:\Users\user\Desktop\lz3EbiqoK4.exe "C:\Users\user\Desktop\lz3EbiqoK4.exe"
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\Client-built.exe "C:\Users\user\AppData\Local\Temp\Client-built.exe"
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe"
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Process created: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe "C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe"
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\Client-built.exe "C:\Users\user\AppData\Local\Temp\Client-built.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Process created: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe "C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F	Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File written: C:\Windows\assembly\Desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Automated click: Accept - next
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\24.0\Outlook

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfiles.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\CopyrightFULL.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils\MicrosoftEdgeWebview2Setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfilesx64.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\tvmonitor.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewerVPN.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\TeamViewerVPN.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfiles_printer_WithPDFSupport_x64.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log	Jump to behavior

Source: lz3EbiqoK4.exe

Static file information: File size 75655168 > 1048576

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: lz3EbiqoK4.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x4804800

Source: lz3EbiqoK4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\WS\tv_prel_dcr\ApplicationPlugins\Win\OutlookAddIn\BuildTarget\Release\TeamViewerMeetingAddinShim.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\DriverBuild\Drivers\Win\VirtualMonitor\bin\x64\Release\TVVirtualMonitorDriver.pdb source: TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2306927283.0000000007100000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64dll.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\ApplicationPlugins\Win\OutlookAddIn\ManagedAggregator\obj\Release\ManagedAggregator.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win64\Release\TVWebRTC.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000B4AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb{ source: TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_w32exe.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Sources\teamviewer_2\Installer\plugins\TvGetVersion\Release_Unicode\TvGetVersion.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64exe.pdbV source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\ApplicationPlugins\Win\OutlookAddIn\BuildTarget\Release\TeamViewerMeetingAddinShim64.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb source: TeamViewer_.exe, 00000009.00000002.2256775334.00000000017C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64exe.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\DriverBuild\Drivers\RemotePrintingDriver\Win\XPSDriverFilter\Build\XPSFilter\x64\Release\TeamViewer_XPSDriverFilter.pdb source: TeamViewer_.exe, 00000006.00000003.2312212372.00000000091D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2311975542.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Sources\teamviewer_2\Installer\plugins\TvGetVersion\Release\TvGetVersion.pdb source: TeamViewer_Setup_x64.exe, 00000005.00000002.2381220145.000000000292D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win64\Release\WriteDump.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\DriverBuild\Drivers\Win\DeviceRedirection\bin\x64\Release\TeamViewer_VirtualDeviceDriver.pdb source: TeamViewer_.exe, 00000006.00000003.2305866692.0000000008C59000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2307146959.00000000091F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win64\Release\WriteDump.pdb_ source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\openvpn-2.1_rc4\tap-win32\amd64\teamviewervpn.pdb source: TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\teamviewer_tvmonitordriver\drivers\win\monitor\objfre_win7_amd64\amd64\TVMonitor.pdb source: TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win64\FULL\Release\TeamViewer_Service.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_w32exe.pdbX source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Documents\Programming\OpenSourceProjects\tap-windows6\src\x64\Hlk\teamviewervpn.pdb source: TeamViewer_.exe, 00000006.00000003.2303691049.000000000869E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_w32dll.pdb source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp

Source: TVWebRTC.dll.6.dr	Static PE information: section name: _RDATA
Source: tv_w32.dll.6.dr	Static PE information: section name: .shared
Source: TeamViewer_XPSDriverFilter.dll.6.dr	Static PE information: section name: _RDATA
Source: tv_x64.dll.6.dr	Static PE information: section name: _RDATA
Source: tv_x64.dll.6.dr	Static PE information: section name: .shared
Source: crashpad_handler.exe.6.dr	Static PE information: section name: _RDATA
Source: crashpad_handler.exe.6.dr	Static PE information: section name: CPADinfo
Source: MicrosoftEdgeWebview2Setup.exe.6.dr	Static PE information: section name: .didat
Source: TeamViewer.exe.6.dr	Static PE information: section name: IPPCODE
Source: TeamViewer.exe.6.dr	Static PE information: section name: .didat
Source: TeamViewer.exe.6.dr	Static PE information: section name: .rodata
Source: TeamViewer.exe.6.dr	Static PE information: section name: IPPDATA
Source: TeamViewer.exe.6.dr	Static PE information: section name: _RDATA
Source: TeamViewer.exe.6.dr	Static PE information: section name: CPADinfo
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: .orpc
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: IPPCODE
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: .didat
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: .rodata
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: IPPDATA
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: _RDATA
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: CPADinfo
Source: TeamViewer_Note.exe.6.dr	Static PE information: section name: .didat
Source: TeamViewer_Note.exe.6.dr	Static PE information: section name: _RDATA
Source: TeamViewer_Service.exe.6.dr	Static PE information: section name: IPPCODE
Source: TeamViewer_Service.exe.6.dr	Static PE information: section name: .didat
Source: TeamViewer_Service.exe.6.dr	Static PE information: section name: IPPDATA
Source: TeamViewer_Service.exe.6.dr	Static PE information: section name: _RDATA
Source: tv_w32.exe.6.dr	Static PE information: section name: .didat
Source: tv_x64.exe.6.dr	Static PE information: section name: .didat
Source: tv_x64.exe.6.dr	Static PE information: section name: _RDATA
Source: WriteDump.exe.6.dr	Static PE information: section name: _RDATA
Source: TeamViewerMeetingAddinShim64.dll.6.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Code function: 0_2_068C089F push es; ret	0_2_068C08D0
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Code function: 0_2_068C091F push es; retf	0_2_068C092C
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Code function: 0_2_068C08D3 push es; ret	0_2_068C0950
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Code function: 0_2_06B93BD4 push ecx; retf	0_2_06B93BEC
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9BACE32C push ss; ret	1_2_00007FFD9BACE35A
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9BACE194 push cs; ret	1_2_00007FFD9BACE19C
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9BAC7569 push ebx; iretd	1_2_00007FFD9BAC756A
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9BAC8163 push ebx; ret	1_2_00007FFD9BAC816A

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\TvGetVersion.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nseC5E0.tmp\nsArray.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\linker.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\UAC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\utils\MicrosoftEdgeWebview2Setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	File created: C:\Users\user\AppData\Local\Temp\Client-built.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\nsArray.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nseC5E0.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	File created: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nseC5E0.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	File created: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	File created: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\TvGetVersion.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll	Jump to dropped file

Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nseC5E0.tmp\nsArray.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nseC5E0.tmp\System.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nseC5E0.tmp\nsExec.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TV15Install.log			Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log			Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe

File opened: C:\Users\user\AppData\Local\Temp\Client-built.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 6970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 120C0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 1BA90000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 25160000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 29FF0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 3FD10000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Memory allocated: 1760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Memory allocated: 1B580000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Dropped PE file which has not been started: C:\Windows\Temp\nseC5E0.tmp\nsArray.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\linker.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\UAC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\utils\MicrosoftEdgeWebview2Setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\nsArray.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Dropped PE file which has not been started: C:\Windows\Temp\nseC5E0.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Dropped PE file which has not been started: C:\Windows\Temp\nseC5E0.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll	Jump to dropped file

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe TID: 7572	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe TID: 7680	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_00405FFD FindFirstFileA,FindClose,	5_2_00405FFD
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	5_2_0040559B
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_00402688 FindFirstFileA,	5_2_00402688
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Code function: 6_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	6_2_0040596F
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Code function: 6_2_004064C1 FindFirstFileW,FindClose,	6_2_004064C1
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Code function: 6_2_004027FB FindFirstFileW,	6_2_004027FB
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	9_2_0040596F
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004064C1 FindFirstFileW,FindClose,	9_2_004064C1
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004027FB FindFirstFileW,	9_2_004027FB

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2380880462.00000000006C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630X'8
Source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000B4AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMnet
Source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000B4AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %loethwlanv4-wlanipsectunutuntapWebRTC-SignalNetworkPreferenceChangeany../../f57cf8/1/webrtc/src/rtc_base/network.ccToo many network interfaces to handle!WebRTC-AllowMACBasedIPv6WebRTC-BindUsingInterfaceNameNetwork change was observedVMnetrtc::BasicNetworkManager::StartUpdatingSocket creation failedConnect failed with rtc::BasicNetworkManager::UpdateNetworksContinuallyNetworkManager detected , active ? , IgnoredWebRTC-UseDifferentiatedCellularCostsWebRTC-AddNetworkCostToVpnNet[:id=rtc::BasicNetworkManager::set_vpn_list
Source: Client-built.exe, 00000001.00000002.3693688639.000000001BF7F000.00000004.00000020.00020000.00000000.sdmp, Client-built.exe, 00000001.00000002.3695571535.000000001C23B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Client-built.exe, 00000001.00000002.3695571535.000000001C103000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.windowsupdate.commsdownloadupdatev3statictrustedrenauthrootstl.cab8

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	API call chain: ExitProcess graph end node	graph_5-3279
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	API call chain: ExitProcess graph end node	graph_6-3624
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	API call chain: ExitProcess graph end node	graph_9-3561

Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\Client-built.exe "C:\Users\user\AppData\Local\Temp\Client-built.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F	Jump to behavior

Source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BA32000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2301476020.000000000D0C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SharedMem_SetLogLevel: %u -> %u***** assertion failed: 'release', line %i, err %i*** assertion failed: 'setev', line %i, err %i*** assertion failed: '(type == State_x64) \|\| (type == State_w32)', line %i, err %iSetDirectXHookStatus %u -> %uStarting Single Window*** assertion failed: 'hwnd', line %i, err %iStopping Single Window*** assertion failed: 'unhooksc', line %i, err %iStarting Update HookProgmanSHELLDLL_DefViewSysListView32Stopping Update Hook*** assertion failed: 'hdc', line %i, err %i*** assertion failed: 'ctos1 && ctos2', line %i, err %i***** assertion failed: 'wrect', line %i, err %i
Source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;PEmptyAction%Y-%m-%dT%H:%M:%S, window title "Changed focus to ", PID processIDwindowTitlefileDescriptionapplicationNameCheckbox "" was toggled Spinner "" value changedText field "" changedPassword field "" changed.newValueautomationIDelementName to ""." was changed" to toggle it toggleStatebuttoncontrolType "Collector was stopped.Collector was started.resumepausestartCollector operation: Collector was resumed.Collector was paused.command" entered in shell , prompt "shellpromptExternal: message" with URL " on link "urlKey combination pressed: " pressed on ": "Special key with value " on columncolumnValuecolumnName of Menu "" opened.Clicked on radio button "" in group "groupNamedoubleRightdoublemiddlerightleftDouble right clickedDouble clickedMiddle clickedRight clickedClickedWMIHelper::Query(): ExecQuery failed %1%WQLSELECT Name, Version, BuildNumber FROM Win32_OperatingSystemWMIHelper::CreateWMIService(): Set proxy blanket failed: %1%WMIHelper::CreateWMIService(): Failed to connect to wmi namespace %1%: %2%WMIHelper::CreateWMIService(): Failed to create locator instance %1%'WMIHelper::GetStringProperty(): Property %1% not string (type: %2%)WMIHelper::GetStringProperty(): Get failed for prop %1%: %2%WMIHelper::Query(): Next returned no resultsWMIHelper::Query(): Next failed %1%WM_MBUTTONUPWM_MBUTTONDOWNWM_RBUTTONUPWM_RBUTTONDOWNWM_LBUTTONUPWM_LBUTTONDOWNChromeProgmanSysListView32tvuicollector::LLMouseHookHandler::GetUIAutomationElementAtFailed to get UIA element from position, hr = 0x%1$xtvuicollector::LLMouseHookHandler::GetAccessibleElementAtFailed to call AccessibleObjectFromPoint, hr = %1$xdesktop icondesktopregedit.exeScintillatvuicollector::LLMouseHookHandler::HandleMouseEventMouse hook function took %1% ms for action %2%.tvuicollector::LLMouseHookHandler::StartLLHooksFailed to start mouse hooks.tvuicollector::LLMouseHookHandler::CreateCacheRequestFailed to create cache request for mouse hooks, hr = 0x%1$x#32769

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Client-built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe

Code function: 5_2_00405D1B GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

5_2_00405D1B

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: 1.0.Client-built.exe.fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1871811766.00000000012E0000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3667738198.00000000036D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3667738198.0000000003581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7612, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: 1.0.Client-built.exe.fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1871811766.00000000012E0000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3667738198.00000000036D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3667738198.0000000003581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7612, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Access Token Manipulation	33 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	4 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Hidden Files and Directories	Cached Domain Credentials	16 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lz3EbiqoK4.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	4%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\utils\MicrosoftEdgeWebview2Setup.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://%1%.teamviewer.com/5	0%	Avira URL Cloud	safe
https://%1%.teamviewer.com/0	0%	Avira URL Cloud	safe
https://%1%.teamviewer.com/	0%	Avira URL Cloud	safe
https://%1%.teamviewer.com/%2%)Introducec	0%	Avira URL Cloud	safe
https://getassistar.teamviewer.com/%1%C%1%	0%	Avira URL Cloud	safe
https://getassistar.teamviewer.com/%2%8	0%	Avira URL Cloud	safe
https://getassistar.teamviewer.com/%2%9	0%	Avira URL Cloud	safe
https://nsis.sourceforge.io/Base64_plug-in	0%	Avira URL Cloud	safe
https://scripts.sil.org/OFL)	0%	Avira URL Cloud	safe
https://dev-trunk.teamviewer.com/CommentSession/CommentAfterSession?token=%1%&lng=%2%&version=%3%&os	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.teamviewer.com/link/?url=456463mScript-urile	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/standard-things/esm	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=1653885=	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/browserslist/browserslist	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://getassistar.teamviewer.com/%1%C%1%	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/SamVerschueren/decode-uri-component	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/immerjs/immer	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=271351$Pridae	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=633113	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://get.teamviewer.com/v15/%1%vYou	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=301635lSe	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/inspect-js/is-regex	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=861823?	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=954698	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://www.teamviewer.com/link/?url=418720	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.opensource.org/licenses/mit-license.php	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://creativecommons.org/licenses/by/4.0/)	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%1%.teamviewer.com/5	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.teamviewer.com/link/?url=456463mSkript	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/popperjs/popper-core	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nsis.sourceforge.io/Base64_plug-in	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.teamviewer.com/link/?url=290947$	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr	false		high
https://www.teamviewer.com/link/?url=773631	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://%1%.teamviewer.com/0	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://www.teamviewer.com/link/?url=290947#	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=364272)Naozaj	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/DefinitelyTyped/DefinitelyTyped	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/ShiqiYu/libfacedetection	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=3642722Doric	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=382377tConsimt	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/chartjs/Chart.js	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mde/filelist	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://openjsf.org/	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://client.teamviewer.com/intro/index.aspx?lng=%1%&version=%2%&os=%3%&tab=%4%DSorry.	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/babel/babel	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/i18next/i18next	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=362946	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=934954	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	false		high
https://stackoverflow.com/q/14436606/23354	Client-built.exe, 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp, Client-built.exe, 00000001.00000002.3667738198.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, Client-built.exe, 00000001.00000002.3667738198.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/react-dropzone/attr-accept	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=116574	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://www.teamviewer.com/link/?url=279064oSkripte	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/airbnb/lottie-web	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=7900459/	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/form-data/form-data	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/sindresorhus/is-fullwidth-code-point	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=861823R	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://scripts.sil.org/OFL)	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.teamviewer.com/nav/license-activation-guidance	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=861823Q	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=461825ZYour	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=861823P	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=462409	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=666256	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/i18next/i18next-resources-to-backend	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=279064NKh	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=301635sN	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/sindresorhus/gzip-size	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz2Acc	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/googlefonts/dm-fonts/tree/main/Sans	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/libuv/libuv	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	TeamViewer_Setup_x64.exe, TeamViewer_Setup_x64.exe, 00000005.00000000.1931898193.0000000000409000.00000008.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmp	false		high
https://github.com/sindresorhus/query-string	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/thlorenz/convert-source-map	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=659842	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/i18next/i18next-browser-languageDetector	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://getassistar.teamviewer.com/%2%8	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getassistar.teamviewer.com/%2%9	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/lz4/lz4	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/axios/axios	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/download/version_15x/TeamViewerQJ.exe	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://%1%.teamviewer.com/%2%)Introducec	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/farzher/fuzzysort	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/nolimits4web/dom7	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/open-source-parsers/jsoncpp	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=456463qSkripte	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=801210xComputerul	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=293922	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=801210c	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/juliangruber/balanced-match	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=261802	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://%1%.teamviewer.com/	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://client.teamviewer.com/whatsnew/index.aspx?lng=%1%&version=%2%&os=%3%&tab=%4%&insiderbuild=%5	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/react-dropzone/file-selector	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=300792	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://www.teamviewer.com/link/?url=737863	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/simonbengtsson/jsPDF-AutoTable	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Gamote/lottie-react	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/emotion-js/emotion/tree/master/packages/is-prop-valid	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=301635	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/FortAwesome/Font-Awesome	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://client.teamviewer.com/blizzintro/?language=%1%&os=%2%&client=%3%	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://api.ipify.org/	Client-built.exe, 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp	false		high
https://dev-trunk.teamviewer.com/CommentSession/CommentAfterSession?token=%1%&lng=%2%&version=%3%&os	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000C6D2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2296291885.000000000BCD2000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://www.teamviewer.com/link/?url=801210jUdaljeni	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=632515:Opc	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Qix-/color-convert	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=3642728Ba#	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=9349547	TeamViewer_.exe, 00000006.00000003.2296291885.0000000008C2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/isaacs/fs.realpath	TeamViewer_.exe, 00000006.00000003.2164143577.00000000087F8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
167.71.56.116	unknown	United States		14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571838
Start date and time:	2024-12-09 18:51:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lz3EbiqoK4.exe renamed because original name is a hash value
Original Sample Name:	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
Detection:	MAL
Classification:	mal46.troj.evad.winEXE@17/109@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 251 Number of non-executed functions: 70
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: lz3EbiqoK4.exe

Simulations

Behavior and APIs

Time	Type	Description
17:52:59	Task Scheduler	Run new task: TVInstallRestore path: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" s>/RESTORE

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
167.71.56.116	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Get hash	malicious	XWorm	Browse
	X.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe	Get hash	malicious	XWorm	Browse
	WinScanGuard_v.2.1.bat	Get hash	malicious	Quasar	Browse
	Shadow-Stealer.bat	Get hash	malicious	Quasar	Browse
	OvA6x5v34G.exe	Get hash	malicious	AsyncRAT	Browse
	zUYpYikG7T.exe	Get hash	malicious	njRat	Browse
	SdwkQEBnc3.exe	Get hash	malicious	Nanocore	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	199.232.210.172
	xMaSQ3Bn10.docx	Get hash	malicious	Unknown	Browse	199.232.214.172
	lLNOwu1HG4.js	Get hash	malicious	RHADAMANTHYS	Browse	199.232.214.172
	XUTLbT1Wd1.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	XUTLbT1Wd1.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Aktarma,pdf.vbs	Get hash	malicious	Remcos	Browse	199.232.210.172
	tQoSuhQIdC.msi	Get hash	malicious	Unknown	Browse	199.232.210.172
	W-2Updated.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	199.232.214.172
	BL COAU7249606620-pdf.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	https://reader.egress.com/remote.aspx/s/storage.phe.gov.uk/email/e0599f812894d1904a8fe3cf7f605bcb	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	deeffrot.doc	Get hash	malicious	Unknown	Browse	165.227.215.208
	https://sendgb.com/vdRYC6Nal34?utm_medium=HlyZfLISdD8Bj1i	Get hash	malicious	Unknown	Browse	185.14.184.154
	xxx.doc	Get hash	malicious	Unknown	Browse	165.227.215.208
	Potvrda_o_uplati.docx.doc	Get hash	malicious	Unknown	Browse	165.227.215.208
	RUCkZvoDjG.htm	Get hash	malicious	WinSearchAbuse	Browse	68.183.112.81
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	45.55.200.184
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	Unknown	Browse	134.209.143.125
	https://villageforddearborn-my.sharepoint.com/:b:/g/personal/robert_wheat_villageford_net/EaAilHqK5PhBneaYfVtjii0ByKmI10BU9zhQ73pqIHj-uQ?e=FnQ6KL	Get hash	malicious	Unknown	Browse	188.166.2.160
	mips.elf	Get hash	malicious	Gafgyt, Okiru	Browse	209.97.160.137

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	teamviewer_Px-yDq1.exe	Get hash	malicious	Unknown	Browse
	teamviewer_Px-yDq1.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log

Download File

Process:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	5.069834218498263
Encrypted:	false
SSDEEP:	24:law+zzDkwlaTDn+Ula4+BlaD+Ila/Me/MIf19rjMqjMvjMzG6jM34K:R+zcwWnbraK9mfB8
MD5:	5DD349777F08062514C16D30AF84A705
SHA1:	315253AE32A17B3D54BFC3D481A97148A038D0F8
SHA-256:	911E27A8E969EDC7D44133389DEF95420C01D9C54C2EFD05962A974F33E3350E
SHA-512:	6735012E87DF79C17E61AD561E3A90D79CB3ED649679BE6F2D7B636C8C39AA90B758848C676CB0382BBCE0C0438BF3BA4BF36566ED87D72DCC9761D74B5204A0
Malicious:	false
Preview:	2024-12-09-12-53-19 ..2024-12-09-12-53-19 TVRollbackInstallation(): Rollback installation.....2024-12-09-12-53-19 ..2024-12-09-12-53-19 RollbackDrvChanges(): Rollback all driver changes.....2024-12-09-12-53-19 RollbackDrvChanges(): No driver entries to restore...2024-12-09-12-53-19 ..2024-12-09-12-53-19 RollbackRegChanges(): Rollback all registry changes.....2024-12-09-12-53-19 RollbackRegChanges(): No registry entries to restore...2024-12-09-12-53-19 ..2024-12-09-12-53-19 RollbackFileChanges(): Rollback all file changes.....2024-12-09-12-53-19 RollbackFileChanges(): No file entries to restore...2024-12-09-12-53-19 ..2024-12-09-12-53-19 CleanUp(): Clean up.....2024-12-09-12-53-19 CleanUp(): Unload previously loaded user registry profiles.....2024-12-09-12-53-20 CleanUp(): Install restore task successful removed...2024-12-09-12-53-20 CleanUp(): Warning! Backup key could not be removed...2024-12-09-12-53-20 CleanUp(): Backup directory C:\Program Files\TeamViewer\Rollback

C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	71272344
Entropy (8bit):	7.999987306679704
Encrypted:	true
SSDEEP:	1572864:re9Md8ir5RcKqhxdJjHKO56/nMgt5LhZx5oZiJG2Ol40hi7id:C2NdRTqhXJDLenHhZx+ZiJcl4m
MD5:	8318FC63158C01368AADC6D4BE89FAD1
SHA1:	88F4AEFCBDD5A748EC21469A565D9C57B7F6CB46
SHA-256:	B64A8F72105117FF71ECA4692DF030B6E60C4ABA2631E0FE01411086BB42B1DC
SHA-512:	DB7601C5A1AD25CF3F076C8C504EB885D3EBE6358A6490492DEE967C7FF5AC72319AAF75EDBFFD7FB0F7102473A2C16830408C7762283C67A374535EF8420076
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L....z.W.................b...*.......3............@.................................0k@...@..........................................`..............hX?.0/...........................................................................................text...]a.......b.................. ..`.rdata...............f..............@..@.data...8............z..............@....ndata...................................rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\CopyrightFULL.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	665954
Entropy (8bit):	5.152510122622251
Encrypted:	false
SSDEEP:	12288:/Um3jjLBanosurgrN7pF2YSz9xSnwET9XSXWOyiMilFLBuvSamXe4O7m:r9bx
MD5:	BEE0CF8EB0E6B5FE2B216EBA63DE763C
SHA1:	7B83B00CAB5529232A1B3A14253901B4E5762B97
SHA-256:	4161254F13B5A5326456E71B67B3179203DF162279183F929C8678A6FDC91B49
SHA-512:	1A56DDB9AD5D6464A88634824D4225593600D4DFFA26ABCDC5AC9D8D7B575C931A49ECA68F8AB4687B5DB8D0E9072D51AF3698B4628360C5C02B1CE0BA557BFB
Malicious:	false
Preview:	##########....@babel/runtime....https://github.com/babel/babel....License type: MIT....MIT License....Copyright (c) 2014-present Sebastian McKenzie and other contributors....Permission is hereby granted, free of charge, to any person obtaining..a copy of this software and associated documentation files (the.."Software"), to deal in the Software without restriction, including..without limitation the rights to use, copy, modify, merge, publish,..distribute, sublicense, and/or sell copies of the Software, and to..permit persons to whom the Software is furnished to do so, subject to..the following conditions:....The above copyright notice and this permission notice shall be..included in all copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDE

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	4.963079132684424
Encrypted:	false
SSDEEP:	24:nRLN+HfIPXHfMuubDUHeLNIWfpInUH2LpjLFAON+HfIPXHfROubDUHV5yn:C/IPX/ib2CISABm/IPX/RXb26
MD5:	E5121693356198A36982BABB96272404
SHA1:	EFF3A59DE3B562BED53FD08C5C91FAE739109D4A
SHA-256:	8E24B8D8D0305962542DBB21492ACA797F20D624ED4B0194105FBFE52E1CDBEB
SHA-512:	A862949D782607961882AAA62D1CA03BF86C61E8DD902E92AE7BF784E9B225F99613D843B16AE94EBDDA2E30B5568E202C16784CE09309B92922CE7D00EF1E55
Malicious:	false
Preview:	<Filters>.. <Filter dll = "TeamViewer_XPSDriverFilter.dll".. clsid = "{40D118AB-04EA-4CFC-8C8B-85D1C7ECB046}".. name = "TeamViewer_XPSDriverFilter1">.. <Input guid = "{4d47a67c-66cc-4430-850e-daf466fe5bc4}" comment="IID_IPrintReadStream"/>.. <Output guid = "{65bb7f1b-371e-4571-8ac7-912f510c1a38}" comment="IID_IPrintWriteStream"/>.. </Filter>.. <Filter dll = "PDFRenderFilter.dll".. clsid = "{CD087E95-A362-4A50-B233-20DC89DED268}".. name = "MS XPS to PDF">.. <Input guid = "{b8cf8530-5562-47c4-ab67-b1f69ecf961e}" Comment ="IID_IXpsDocumentProvider"/>.. <Output guid = "{65bb7f1b-371e-4571-8ac7-912f510c1a38}" comment="IID_IPrintWriteStream" />.. </Filter>.. <OptionalFilterServiceProvider dll="XpsRasterService.dll"/>.. <Filter dll = "TeamViewer_XPSDriverFilter.dll".. clsid = "{40D118AB-04EA-4CFC-8C8B-85

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	Generic INItialization configuration [DriverRender]
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.371163047122097
Encrypted:	false
SSDEEP:	6:/5KsGXMfVCzpIcPxYDXQyW59bCO2MngN+jAJh6O4BVAZVhe81W8l2y:bHfkzpha8dnCOztKh6tKe8xh
MD5:	A578F666C0CB526085384D35C536B5D9
SHA1:	F019631640D4BAA684CD589696CDCF1F8252F302
SHA-256:	9C8859987D13AE53C5B206A7D59660C7754A7940185B599AC97E1E806551730F
SHA-512:	E0FBF7054A32B5C370E98A644AEC0478CC68FE5018E7B7720574E5E656C8B61FD51E712A20289DD72B38A9560D7D8633156CCF4E4302390BC180EFF1D2983729
Malicious:	false
Preview:	[DriverConfig]..DataFile=TeamViewer_XPSDriverFilter.gpd..PrinterDriverID={4949F9E6-DB2F-47B7-9489-56815A5847C8}..RequiredFiles=UNIRES.DLL,PDFRENDERFILTER.DLL,STDNAMES.GPD,MSXPSINC.GPD..DriverCategory=PrintFax.Printer.Virtual..UserPropertyBagScope=Queue....[DriverRender]..XpsFormat=XPS..

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	66209
Entropy (8bit):	4.11237765266599
Encrypted:	false
SSDEEP:	768:3E513+/TLYbpmS1Gx5M7ytzk9wjKS0ff8sEOxPOwhKGhBmAAGFD4iaKhvmOaoGJd:Cv8
MD5:	B58E72E75C1CF590FA2722ECDA95F64A
SHA1:	651B69DAADE01DBFD7CB470B24D1C3EF2369B821
SHA-256:	9C77255FA10B116C1E5D1F8AB7D12A956455AD7610905DBD05EFD6FCE465C11F
SHA-512:	6A44613F66B93DD671546042FBD0FBE2A4B78C78AC3127E69AD8794FC53AD45F2D889E6FB59D3DA5E302B9EC3CDB787818E3DDC503A47707B9FF16B7BBE5A265
Malicious:	false
Preview:	%..% Copyright (c) TeamViewer GmbH..%..% All rights reserved...%....GPDFileVersion: "1.0"..GPDSpecVersion: "1.0"..GPDFileName: "TeamViewer_XPSDriverFilter.GPD"..Include: "StdNames.gpd"..Include: "msxpsinc.gpd"..ModelName: "TeamViewer Printer"..MasterUnits: PAIR(1200, 1200)..PrinterType: PAGE..MaxCopies: 999..PrintSchemaPrivateNamespaceURI:"http://www.teamviewer.com/printschema/2018"....%*****************************************************************************..% Orientation..%****************************************************************************..Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.... Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. }.... Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. }..}....%****************************************************************************..%

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1507
Entropy (8bit):	5.236509327317478
Encrypted:	false
SSDEEP:	24:f2O7xJoF+hiEvHf+My83n8rELHfVoHfusb9ooHfhHfr7BHfVoHfusb9ooHfpHfra:uO9dhiEv/+4X1/Vo/uHo/h/PB/Vo/uHD
MD5:	2C5FD2866B91861275917ADB4CED33E2
SHA1:	E76DEB1717D3B1610A769571943A9C5C5A00699A
SHA-256:	B7F148ED1BA6293F323E9834182D64E8756D414FF8A5B9B826E3EE2986E0B259
SHA-512:	EFAAB915AD8BFA769073B4CE1FEA689FF379216D04204F8B21CFC6AA41413A94EA08E19A61613DCA29649F36E82B854861397E5E1F7C450AF7A1B656A0547267
Malicious:	false
Preview:	;..; Copyright (c) 2022 TeamViewer GmbH..;..; All rights reserved...;..[Version]..Signature="$Windows NT$"..Class=Printer..ClassGuid={4d36e979-e325-11ce-bfc1-08002be10318}..Provider=%ManufacturerName%..CatalogFile=TeamViewer_XPSDriverFilter.cat..ClassVer=4.0..DriverVer=04/13/2022,1.2022.413.641....[DestinationDirs]..DefaultDestDir = 66000....[SourceDisksNames]..1 = ,,,\....[SourceDisksFiles.x86]..TeamViewer_XPSDriverFilter.gpd = 1..TeamViewer_XPSDriverFilter-PipelineConfig.xml = 1..TeamViewer_XPSDriverFilter.dll = 1,\x86..TeamViewer_XPSDriverFilter-manifest.ini = 1....[SourceDisksFiles.amd64]..TeamViewer_XPSDriverFilter.gpd = 1..TeamViewer_XPSDriverFilter-PipelineConfig.xml = 1..TeamViewer_XPSDriverFilter.dll = 1,\x64..TeamViewer_XPSDriverFilter-manifest.ini = 1....[Manufacturer].."TeamViewer"=TeamViewer,NTamd64.6.1....[TeamViewer].."TeamViewer Printer" = TeamViewer_XPSDriverFilter.gpd,,TeamViewer_XPS_Printer....[TeamViewer.NTamd64.6.1].."TeamViewer Printer" = TeamViewer_XPSDriverFilte

C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	12658
Entropy (8bit):	7.077237390641632
Encrypted:	false
SSDEEP:	192:28vvoHISmpMCRsGyV2uR8OL7yKnUi8rFWQFgy50Nr7OxX01k9z3Azsx+ZPb9Vt9r:2Yo3U/4CFR+y50ZSxR9zusx+x3
MD5:	74134E66B593D16717C8124B0DEFA42B
SHA1:	5FA1072B57FCE09C70904464602C1FB7AD07BDAA
SHA-256:	3D4201227D709C49B77031C8BEFFBFDB09337AD6E0A171A7E058B0E0B04320F6
SHA-512:	B3A07AF69F7F0F0163CA275C153A2155BA69D7AE5371D3390F57D6448B9B17DBA60EAA3394344F8588E0102F6EC3DE72DE8E1AB6F94B5A03F2A6C192BBD9837E
Malicious:	false
Preview:	0.1n..*.H........1_0.1[...1.0...`.H.e......0..3..+.....7.....$0.. 0...+.....7...../.'._LDJ.z....!...220505065722Z0...+.....7.....0...0....R6.5.1.B.6.9.D.A.A.D.E.0.1.D.B.F.D.7.C.B.4.7.0.B.2.4.D.1.C.3.E.F.2.3.6.9.B.8.2.1...1..g0E..+.....7...17050...+.....7.......0!0...+........e.i......G.$...#i.!0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0`..+.....7...1R0P...F.i.l.e.......>t.e.a.m.v.i.e.w.e.r._.x.p.s.d.r.i.v.e.r.f.i.l.t.e.r...g.p.d...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R7.9.9.2.5.B.8.8.3.5.7.E.0.9.2.0.8.C.8.1.E.C.5.4.4.A.5.C.9.5.2.5.B.F.D.0.9.4.C.4...1..o0M..+.....7...1?0=0...+.....7...0...........0!0...+........y.[.5~. ...TJ\.%...0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0`..+.....7...1R0P...F.i.l.e.......>t.e.a.m.v.i.e.w.e.r._.x.p.s.d.r.i.v.e.r.f.i.l.t.e.r...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.

C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	773552
Entropy (8bit):	6.562891536553011
Encrypted:	false
SSDEEP:	12288:E2qWLii0HeFTzBTqtO/zKSeAWgSd6kLsjJLPJC5Wdp24XgI7wK3l+aG7X:5qvxwdqtO/zFbWZ6WsjJzJ52Y7wK3l7i
MD5:	D47FE8D92AF08C8FCA8E1C71DA05CEC5
SHA1:	F53C8DEF485712748315BEFEB631453B594FC67F
SHA-256:	698FED30F5715BAA387C89D043FB0E1C8A1C4F4C8F837510DA292A943ED778ED
SHA-512:	DCCDC640981B68C3DDA4F949DAEED12F39C08E456588DE6BDD061CFE7BC7AEB18EC237E0358B6D6F368BC74F9B939D712363B2556BD9321C43900435BFAE6256
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: teamviewer_Px-yDq1.exe, Detection: malicious, Browse Filename: teamviewer_Px-yDq1.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................3..d.....d.....d.........................."..].....].....].&......N....].....Rich...........PE..d.....Vb.........." ................................................................G.....`............................................................. ....`...V.......I..............p.......................(.......8............ ...............................text...$........................... ..`.rdata..J.... ......................@..@.data....P.......:..................@....pdata...V...`...X..................@..@_RDATA...............j..............@..@.rsrc... ............l..............@..@.reloc...............r..............@..B........................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8306992
Entropy (8bit):	6.537707320579697
Encrypted:	false
SSDEEP:	98304:K02Ucv1JqiXcI3NOppRGG4yf5WxSr2XdlI36mW:X2UcvGDmNONGMf5y++lI3S
MD5:	7C231D826B3BFD109350534C054EE950
SHA1:	59D3907B41AA5D1FA75127941EF542C142769097
SHA-256:	DAE032ABDB85EFB75CF6AAC20B45A7B70A1C69CA727AD52DD378C9CAAA635C44
SHA-512:	71A387790855FF661F6642D3BA561C90DAC1831423EE3C2D8670046F25BE62B757666020C87AE99F4F05A46E9DF065D45709B47F80F6675AB5038C6401FCBC9E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........-W_.C._.C._.C...@.L.C...F...C...G.O.C...@.U.C...F...C...F.z.C...@.^.C...G.D.C...B.R.C._.B...C...G...C._.C.~.C...F...C...J.K.C...C.^.C....^.C._...^.C...A.^.C.Rich_.C.................PE..d....3g.........." ...".V`...........V......................................P.......D....`A..........................................v.P...0.v.......~.x.....y.......~.0/....~.x...@.k.T.....................k.(.....k.@............p`..............................text.../T`......V`................. ..`.rdata......p`......Z`.............@..@.data...T.....w..b....v.............@....pdata........y......Dy.............@..@_RDATA..\.....~.......}.............@..@.rsrc...x.....~.......}.............@..@.reloc..x.....~.......}.............@..B................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85625136
Entropy (8bit):	6.658650600522072
Encrypted:	false
SSDEEP:	786432:PB4Hds6xPbqWDmXjJDGzKLZNLt+SiqDOlpf8/F8:PKHe6xPbqWyXdaaZNLqlz
MD5:	EF03E2E8B6BE62936FFB28EFAADB6514
SHA1:	FF668698839A663043B40A8017A37D56AF60A183
SHA-256:	A57EDCEB5C04052AA799EE821087C959FF6ED06351C98C0DA7C7D2FD05167C3F
SHA-512:	F5B3EDF394F939BE8A3B4FB9BDBF9A6904DD2E629070A761A28653B8837F671A975EFF5B29529C0FCEEBEFA44141768D9FE74A3B5B19E1BAF75B49B4275CECE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......^.=...SN..SN..SNU..N..SNU.WO..SNU.PO..SNQ.PO?.SNU.VOd.SN@).Nn.SNQ.TO..SNQ.UO..SNQ.WO@.SNu..N..SNQ.VO..SNQ.RO..SN.PO..SN..SN..SN.WOe.SN.VO..SN..RN..SN.ZO..SN..N..SN...N..SN.QO..SNRich..SN........................PE..d...P.3g.........."....".T....................@..............................L...........`................................................. O..P.....D...... &.p....Z..0/....D.X.....7.T.....................7.(.......@............p..............................text...c........................... ..`IPPCODE............................ ..`.rdata.......p.......Z..............@..@.data.............`..b..............@....pdata..p.... &.....................@..@.didat........B.. ..................@....rodata.......C.....................@..@IPPDATA...... C.....................@..._RDATA........C.....................@..@CPADinfo8.....D.................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	24812
Entropy (8bit):	5.642850515262277
Encrypted:	false
SSDEEP:	192:y/TQsT49/RA+ho5NhNsuOMVWFSY5o3VpWSYE8q3QeKT89NKqkfpqyRidOJe:XAb5hNVQStfWSr8q31NfPkfIp
MD5:	CDB33F6074944D1E46820B43B3AA5155
SHA1:	C48BA3161407C21F0FE2F1C37A93599B4B6C7AB7
SHA-256:	12D5C4D656533096A594E1EF4EB75C5EA6EA9F5DF616D84480EE6B41D41F6343
SHA-512:	9D5679E8911972D0600CD489E099F5633CAE5102F09F2808748CD4D3550F6052129407B68C624D04973EFB6264C2DCF0A66F0A014B5E8FDB1987E517218CDDB4
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V......... ..%...:..(....... ..... .........................R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...U...................U...R...R...R...R...R...R...R...R...R...................................R...R...R...R...R...R...R...........................................R...R...R...R...R...................................................R...R...R...U...................................................U...R...R...........................................................R...R...............`76.R...~fe..vv..vv.~fe.R...`76.............R...R...............`76.R...~fe..vv..vv.~fe.R...`76.............R...R...........................................................R...R...U...................................................U...R...R...R...................................................R...R...R...R...R...........................................R...R...R...R...R...R...R...................................R...R...R.

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16315184
Entropy (8bit):	6.642593896924685
Encrypted:	false
SSDEEP:	98304:fOIvW9Mrz/hauvwhVr/LvISP/xHLhrUNkVQ4b4d1qGICyweztZKWs3Mxdg7hBP+b:fOIV/4uvYnvH/RtcqV1wIZ2OiVFVomO
MD5:	D3184FE9DF9AF2651D8B285978B8CC65
SHA1:	F1FF6CC86A242D09A1994D62CC96F9B8D95FE76F
SHA-256:	0D3F258763D8D5C601B558A8CD815065EE96E21C9B7800643EE2041F205D9EEA
SHA-512:	1A16D5D448DB50BA0267B70BA678E1023C8B53619DCAB36005DCF4721D518B0B089F83D06B2675305E0F48BC12753BBF958C3FC330FB8ACBBA4B858FD08B8AA0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......9.{`}..3}..3}..32..3u..32..2n..32..2q..36..2n..32..2...36..2[..36..2\|..36..2v..3'y.3..3...2...36..2\|..3...2..36..2...3}..3l..3}..3..3...2..3...2\|..3...3\|..3}..3\|..3...2\|..3Rich}..3................PE..d.....3g.........."....".....zL................@..........................................`.................................................p#..x....@..`l...P..........0/..............T.......................(....6..@............................................text...x......................... ..`.orpc............................. ..`IPPCODE.a......................... ..`.rdata..p.>.......>.................@..@.data...4....P.......*..............@....pdata.......P......................@..@.didat.......0......................@....rodata......@......................@..@IPPDATA......P......................@..._RDATA..\.... ......................@..@CPADinfo

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	652080
Entropy (8bit):	5.121982276129856
Encrypted:	false
SSDEEP:	6144:GEPLX+/+PlxYFSCHAFUEojFN6zqDsXuiohhLdM2HBG5z87L:GEPLX+/OldjFiFN6gsXdoxaz87L
MD5:	49F29369B987D17428689C0B40754654
SHA1:	E8899D0409001C06734D8CFA865CB1DD6929E651
SHA-256:	69D3667F77429AA1E109CE766B46E8E79D9A4A496385FF7A8AEC388D329E35BF
SHA-512:	38361907CB1371ABBEB278F384792802A860B2CF61D71F74DCDFDDF7BB08006DEA16B6BEAC53E78C2E08A45969B3D46C6462785B9BC1B95F4A08CADD16F4F71B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H&m..G...G...G..G?...G..C;...G..C;...G..G?...G..C;..VG..G?...G..G?...G...G...G...;...G...;...G...G...G...;...G..Rich.G..........................PE..d.....3g.........."....".j...p.......}.........@............................. ...........`.....................................................(.......X....0..x-......0/..........P...T.......................(......@...................8... ....................text....i.......j.................. ..`.rdata...t.......v...n..............@..@.data..../..........................@....pdata..x-...0......................@..@.didat..8....`.......(..............@..._RDATA..\....p.......,..............@..@.rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	382768
Entropy (8bit):	4.336723902201868
Encrypted:	false
SSDEEP:	3072:qNtIX+j7T4YXQwhoLZtXICyULHFjHJxnPYl+awPZVYlN6sMsd/b:qNN7T8who7DZiwP/YlN6YD
MD5:	513FFC1FB618095C2EF8C1930D782ED0
SHA1:	9175900F4A5710A1847E6FDBA47EBEEC98C1FAAC
SHA-256:	10504607478067A86BEE1DC69AB349A736B1137521A09111DFAD5721D297D00E
SHA-512:	7AA5B419438A6F8AC081B5DFE5CF6665451251F0211FEB51E58C6F293A93E0775EB319DB3D262427807CCC9DFFAE18052AE62D02924F7396C7DD8DFC18B90F05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."..................................................................@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...d...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	447792
Entropy (8bit):	4.274671808882741
Encrypted:	false
SSDEEP:	3072:sNsGpzFbhhqXjJbAMDZpRA01jr0fabYjby/59BoliII7psM8ZosNx2akpOxlsRaL:sNOmMYDOi8wL
MD5:	64B881D33CEFA652BC99A533296AB23F
SHA1:	218505017B86DF511B354BF5B29D4EA8131831B3
SHA-256:	9DAF7C0153B764151C1FD4D3EF0657930A0DDB5C22F51B0872B89945865B5BB9
SHA-512:	9666204AD515316D30198D591C98E9EFB45C5D675E8D1CEBBA5542D9E01E76F9478175BDDDEFD808C3729A7306A1F88AAF2593C17816086780E64FFA697CE513
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L....3g...........!..."............................................................+.....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.....3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..pd...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417584
Entropy (8bit):	3.944204457073994
Encrypted:	false
SSDEEP:	3072:PNE0kkALenmGn5ea0hOL/LbDusFbBtQFNWP6ZPOxjMaWg5iCFvVGZCo1yUvq5AEp:PNzlH2MQAO9u70EFUu3rbP2OoY4U
MD5:	57A20B60BDCCF1A339C607C74693D3F9
SHA1:	22C0EAD23CF35F2BE9E812CFF6B0CD5D7589514A
SHA-256:	795F05F3B9B02AEEFD6FA2165BD72A570488EB18EDD33CAFFBC96507C37DDFF9
SHA-512:	F2046606B86C429F7EEEF25BC2095EE558361ECEA5BE07691337D486BC8DE814281EFEC9CCC7421DF6A3BA2463A90757B08CE1880C2B52826ADA8DA16D32499E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....................................................P.......0....@.......................................... ..@+...........0..0/...........................................................................................rdata..............................@..@.rsrc...@+... ...,..................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	411440
Entropy (8bit):	3.6900986952283032
Encrypted:	false
SSDEEP:	3072:NNRn5gGpUXPql7P07P6W2ZOxCT5OShtiOncyct7HeDzMC+/CDedchrfi/wzcJpHF:NN5q70sErYR
MD5:	0F7BEA067FD543BB1E216A4937724759
SHA1:	62E0D96758D1E6C127DA742653759CDE8F658051
SHA-256:	DAD39A828E6CFD77B1CEB94C2F251054097F73F20412C1F2F2F512A1BDEA5F69
SHA-512:	92093542B47F568F4D5982D0F5B440CE260012D8B6A10A3A700DB87EC1F0D59530D5954A980081D62EEAF8DFCB0F484D48C4803FD7A4FEAC5AA6097E320660B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...g.3g...........!...".....................................................@......M.....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@....g.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	460080
Entropy (8bit):	3.677814163230104
Encrypted:	false
SSDEEP:	3072:ZNs9PNMHDB74Zpf97C0QpqlCumdO5XyzTFmyGOak1vofx9fuxMBFcKjXSSnNCxpx:ZNycq6uWtvvXbG4PD
MD5:	E2803A653F35630C69E85A069A33AE73
SHA1:	BA68DF18D7DA064F6A657B2C4765A218EFF212E8
SHA-256:	C5441729770210CF2A62003293B851653F35C95014189477BB2EB8264076D6E9
SHA-512:	F025B2613A7C570F86F718B7C688D820880518BBAA0BBC876D05EEBBDC8964445B6E175B6BAC74829D0EB1F5BB6C85A728D5A4A63644D5EE6D4C90C8235A5A92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...<.3g...........!...".............................................................e....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@....<.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	487728
Entropy (8bit):	4.3924282228119935
Encrypted:	false
SSDEEP:	3072:ZNNLyTZk1/K/UKMw8LTFc61Kpl4n3INi1N5F78zocrJkdd2wQfafv+nAXFFHrfC+:ZNp7TuwSoPNdVIM44DPcB5GJj4NvFe5x
MD5:	6C8C859DFE8A16BBE7D56E18095051E5
SHA1:	FE150A6226C0D70D5CE330437AD206B6E7613377
SHA-256:	C98259E3B5942304AC53F0E8A5A95BBB1519E8DF2A292805FA67AF795B18FA35
SHA-512:	EE8C4336C219CBA6ADC2CA56450975CC0E930E7E16183598E284ECA8748736C40973CA11A0DBDF4F5289E337552340F6136FE7AFE1BD608E7F9A7164C47FA281
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....@...............................................`............@.......................................... ...<...........B..0/...........................................................................................rdata..............................@..@.rsrc....<... ...>..................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	401712
Entropy (8bit):	3.677935838671882
Encrypted:	false
SSDEEP:	3072:eN5pZMf+PIMS6rIakScR7344Pad+onG7n69vjk8Kt9ue9pQuKK5WF0g/4u:eNl0den8nILPKSeaxrD
MD5:	2D8ED226FE227D0D9BC66929712A10A4
SHA1:	5180C433F2B1BAB818B07E269F2A6B6E057C58DC
SHA-256:	92814DABD4BE397781321918006A6488FFDFD224EFA03F9487C0E42DD79B8AC2
SHA-512:	7D5929C56DFF56CFAB5981A9048B6A4032102DF7DB1645C76DD49EB185096B40189D4DB317BD79FA815807E8208BB8F1BDEE386EED1C6530996B9757574CC833
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...F.3g...........!..."............................................................{u....@.......................................... .. ...............0/...........................................................................................rdata..............................@..@.rsrc... .... ......................@..@....F.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455984
Entropy (8bit):	3.61117792135751
Encrypted:	false
SSDEEP:	6144:MNn2TasbUVcbHah2003ABms5OU92QxLdsxwXU93sxw39uy7SBJunhLYAD75/Q7Ex:wJ/G
MD5:	3D978EABD81511C62229CA9A848D2F0A
SHA1:	F95AD8A9FBAEFF72ED36607D4388D0C2A715B8BC
SHA-256:	DE958DC2A60D9AA396EC8720D5BB39348A6785D9A4732F4EE380B663AE6E1C22
SHA-512:	D4B05C281596A00960CC3B93F3011D71EA1DB9E1073689B886F0FBC205B2A9C205D7121A3CD219D2CC14448FD0FEDD7F939C17BF3FE633DC9387157418C4EEAA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...}.3g...........!..."..................................................................@.......................................... ..@...............0/...........................................................................................rdata..............................@..@.rsrc...@.... ......................@..@....}.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	412976
Entropy (8bit):	3.6696075372697208
Encrypted:	false
SSDEEP:	6144:INdqyrKYCoUgVWOZWrmHMyJTGkCCHvG9hutYcWQjr0:bXq0
MD5:	0DC85892D76CD1102A3E6FF6E058E2CE
SHA1:	A65535E0D2BDB158F2DD6642BAAA99EBC988269D
SHA-256:	664BD7E12FFC04A71B2A8E37E8355561184737757ECB18E6806B39D011E8F642
SHA-512:	C22A90B29602A096ACA792F91FF164E68DF7126A44E8429C0B4B9724C50B459B3CF9C835582FD704397F031AF27EBC9D608A4AF484B56B774388202925395EFF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....................................................@......']....@.......................................... ..`...............0/...........................................................................................rdata..............................@..@.rsrc...`.... ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..@....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	475952
Entropy (8bit):	3.6413069266245923
Encrypted:	false
SSDEEP:	3072:ANi0IvRbnBkCYE4fMhAJZ2W6Y+ZyeApDk9557FjZwntu0Nj/C:ANMneOI38W6Y+ZFlVwnD6
MD5:	5B97F99ED3B5A99DC413500F3A7020B8
SHA1:	BD4395CC149E4079E24A5DF5998EA700E3825E1D
SHA-256:	10B0460BB5F0B94C15231FEC7054F1B6991E039FCBAC20C93173A5A6F1D9BD1D
SHA-512:	7262984BE72D878618DA0344E235079D4C5CAE19093D2B553923716D931A568FEEB3AEF11290E794B0D3E230FA13A012E922F472F55EFE261ED9BD41452237E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...Q.3g...........!...".....................................................0............@.......................................... ..P...............0/...........................................................................................rdata..............................@..@.rsrc...P.... ......................@..@....Q.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..0....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336688
Entropy (8bit):	4.465302989031539
Encrypted:	false
SSDEEP:	6144:HNwE86CVLIADQQLjQOu1r7bihsvEojtJkKsQ/ILEis:J868UQLjQOu1nbiO4KsQSs
MD5:	A0D36CD17EF93A6052432FD90120FABD
SHA1:	4C4720305FF8C2D8547B93D5E8779849FF24039B
SHA-256:	CBCE1AA9CD42F5DA131D303B7D2B89ACE839F55C570DBB3BB8283A63676CFA2A
SHA-512:	7E8148444BB4F748C73D03FD0A133B05330E46CF9415133E14DECA5A7F1BA6B36BFEF37518D2DD1D3AD512E60DBB98CFA44FDFA48CDA454AEA4066ECFD56988F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."..................................................................@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..`....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434992
Entropy (8bit):	3.7404379881615846
Encrypted:	false
SSDEEP:	3072:zN26UDABostCju38Zwxl7OafE+KSBA5fEMumY0oR17ifc+Wv0kk7n3/SUvb18R/+:zNFxztCSsZw37DkSWsZRW
MD5:	C1E3F2D4FCBE719BE85D55673B63BC4D
SHA1:	8D8F12A4B968BF4B91F92663BB2ED90ACF2C9947
SHA-256:	3DD5EDB2ECD62DF1CD05D9797223F3E464DC10D7052B38352094627A41EE7BA4
SHA-512:	E2287157B693DF4EBE7557D41DAB7BE098348BBD7A93FB72E8E1F31DE64DBBA89F67C3467AC53417716FDC34310CDE88D44CEC709EE7E48F6BFDA27F59D48B3A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....r......................................................X:....@.......................................... ...n...........t..0/...........................................................................................rdata..............................@..@.rsrc....n... ...p..................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...1...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	448304
Entropy (8bit):	3.819894570217334
Encrypted:	false
SSDEEP:	3072:0NJBaDYxtVtcuehcMLhg5RcQ98xYKpYNtwzqPs1U5ihwv+Yk/l2SPyiHo/c5ZQRT:0NEQRyT50yXB13oFn32+sdgwVsT
MD5:	0598E989FDBAC8A3BEECCB82228EFEF7
SHA1:	B687B2F33BBDE2D3CB91FB794AB4717E7C56508E
SHA-256:	CA5AFDEACE4F99DF885DC1CCA7E8A5430B91E193610A2B05585CE7DD26D83379
SHA-512:	35163A1DFA7CF622B088E8872901C0ED17C2CD3E2BE000AC28F3B30D75AD9131FC063813CF91161B4B1910F9F48D2CC5C1BB1967E7AD07FA7A574F250F0675A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."..................................................................@.......................................... ..8...............0/...........................................................................................rdata..............................@..@.rsrc...8.... ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...e...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	419120
Entropy (8bit):	3.647004993502636
Encrypted:	false
SSDEEP:	3072:vNAk95jHDue/7RhlV1MjqnsIjydlyjOWPvma+pnGAg4NtgHzOi/hX:vNd/T7FbRjydgCC1
MD5:	7837FB6EF7DF09CB67CAFA715334B819
SHA1:	32986BF01298CAAF7FB897D6CA78D3642A4E96D9
SHA-256:	703C9BC5288175973AED875954767170ACBA696364181952872BC0C162DA6B96
SHA-512:	40859ACC024EC464FDA1C788ABF429186B56DC01345D423AF20EB2B8EDB5EE988EC14F44A85706882142615A7EC23A0FF1AD94D17FE1A30C4727EF557CFE1B79
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...#.3g...........!...".....4...............................................`............@.......................................... ...1...........6..0/...........................................................................................rdata..............................@..@.rsrc....1... ...2..................@..@....#.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..p....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	451376
Entropy (8bit):	3.61660465185004
Encrypted:	false
SSDEEP:	3072:tN5p1SOwQZ0I/09YiX4EJDH8efKHDu3wZMBTwvl0VAaRIwQ3/oMtdCmr4O+Aa02f:tN5TNwWLEtHt0MIWAaQm8dQ
MD5:	08664CDEE9083323BD2A512A422F4442
SHA1:	2D22989ED8FDFAB69FDA83E9D3AC122235AE96A5
SHA-256:	6811A198C67AF6909BA0A9E36974E8BC7A0D247F577041E66F13B9DEDCEDB4E5
SHA-512:	6A6AAD8BDE712F4BEFA37040D4D2FD7CF1174D6C7A0865F4499418671EEBCE359EE169FE429D331DDCB2CB2778C3416B78FD39C959FE75C5BC54E54AD72FC4E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...].3g...........!...".............................................................:....@.......................................... ..X...............0/...........................................................................................rdata..............................@..@.rsrc...X.... ......................@..@....].3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..8q...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	255792
Entropy (8bit):	5.5239889037798156
Encrypted:	false
SSDEEP:	3072:BNHSBUYYv/SV54CE9J+45tpVCQGu7lUzVWSqZAxXakiAVwz/YDTgcDcO2t3qdcB9:BNHpXlzgVw0YPBGl9hk
MD5:	BA4482F5BB4FE1AC104E64F0315B342D
SHA1:	DDFD3DB8FAF065D6E80A02DC49A974D818B3F862
SHA-256:	E488FA29DE9FE6700B9870D1BEA99BED95906ABEE53D5445AC61D246B0D10FE7
SHA-512:	C803DF25F6DF0B32D92AB9D8E6F6D5B5F65B965EBA0E60B9132E54FB0E3FCE3A8C969B0CDFB23ECAB9F9E7AAD6C164D726ECF4A43D53F1D0CB897B15AEDB9D9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."..................................................................@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...u...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	249648
Entropy (8bit):	5.644474255154363
Encrypted:	false
SSDEEP:	3072:tN4uHCzHKIQnZcmPTp9vgeSneem/QVBbTHvui9BqV4DSjlkSdlCHCqze/a/E:tN1C+5cm+9BUys
MD5:	12AD084B7547058CAD474BB3951E912E
SHA1:	0F33E3CE36CDC1B6317661E29F5C3ECBCCADFFC4
SHA-256:	0CB6F9D7E08CCF07BDDF825AEAF45AAFE3E7D9E89666737890F4813BD63BF57C
SHA-512:	35DB3181C3D5103F615A7435C96E7E7FF9CB216CD6367829BD513D168F04AA5A375542E1D81B732685E81D567F9D5733598334642826BCB1B777E5EDFB4813DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."............................................................e.....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...\...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	441648
Entropy (8bit):	3.824660956670209
Encrypted:	false
SSDEEP:	3072:5NF28cWe59Jjva4odQDyPh8rp2NgFgXkLZB3fUEO9VZ8vllQBSCTupSCjh0fDxd6:5NM8+ZInNXIok7
MD5:	2DC459ABDBAC050BC9BF128687E4B3DF
SHA1:	B2E74BFE4F7624BE4BF9D5980E8D58988742F367
SHA-256:	560D9DFF99F732ECAC7A66C48643352D0FEB92C65469CFCFD4B480627796FEE4
SHA-512:	62629AEA3AD82FB4BFD2D58DCE2E6BEBA5DD8397C721F9809AE59000A9A025CC502C65FAC69A801F144A1A0EFEB50D0378882A2E0AE06C867FFF5A31F4ABE8E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.../.3g...........!..."............................................................O.....@.......................................... .................0/...........................................................................................rdata..............................@..@.rsrc....... ......................@..@..../.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...L...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	444720
Entropy (8bit):	3.628002476208683
Encrypted:	false
SSDEEP:	3072:PNxfX37/LbVWPIogpG2QVUNw/rn3teH/QURrFkaVYx9jUrptaasWaT8FxaKTJvZG:PNxfhqvWUF1vr2vFVsWSlB
MD5:	51C094716CDEF71171609903C8AAFFFF
SHA1:	AFB6CAC59BEC2540191B4FFA746D7CD90F4E6D96
SHA-256:	02988E72FC4383C09FC88CD08558B8C8D882B4D8E011A887354DCC093C14D267
SHA-512:	4F06E2AA6A52FD7A9BA329B1F93B11C3ABEC03103F5BB9B241C37B8F93B3D8EE9BE988FD1A907EB4DA67C3F613818D8FBB7D95CD3F3547CD32F0CF67E12B8944
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...r.3g...........!...".............................................................G....@.......................................... ..x...............0/...........................................................................................rdata..............................@..@.rsrc...x.... ......................@..@....r.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..XW...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	406832
Entropy (8bit):	3.685184360796393
Encrypted:	false
SSDEEP:	3072:pNEcw/9/mYX/bXrQPo1vhctz/psJAQsJATfhzxATelfVJ5ZQNU/J2JMw19CgMhnX:pNRlx3Zfmd
MD5:	0F3A79C7B0C1E12363DD667B68EEE909
SHA1:	D7195A330B9F3CB240D1C4B587F4C39E84D6171E
SHA-256:	12541948539D17AC3B1CF7D08A24060920719B9129790CD3A63167A32055FCE8
SHA-512:	8A7C2C395630CEC128BD1DBF3D4C2C788216356E0BBE6A8BE6FBAF608D279676A1B16457BCB5941A8E1CDB3CCEF2889ECF8FC61659C557A641F8F6BC2EB1A260
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....................................................0......P.....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	444720
Entropy (8bit):	3.8844397051722477
Encrypted:	false
SSDEEP:	3072:7NaAQtPb/oZo4synbxIkqZd87eEIspDhDYDt/dch+jEa6OXyPZU/r:7NkmvHpD9YDta+gCBz
MD5:	61E43AD0B8D5FF40D0DE1FC348050D9F
SHA1:	A91BE32D753A281AA7E2D186A100DDA0821D8BC1
SHA-256:	180D2590B2474C310D33F5E1C386004A36A517EC1A0E857D9758A001D9590ACF
SHA-512:	BDE04951299F53DBB4B9B96AEAC2FD293FC794E56F06517EF820D032FFCC422C5FDE6F7560BCD0DB7C113E2B34F7B059E6010413CD47561705DCAD8A7D352C2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L....3g...........!..."..................................................................@.......................................... ..x...............0/...........................................................................................rdata..............................@..@.rsrc...x.... ......................@..@.....3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..XW...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	438576
Entropy (8bit):	3.662598624261109
Encrypted:	false
SSDEEP:	3072:UN99HXpcYqo/SB+keVl6RQ1OMQLEvDDaS7kpx/Xz:UN37/naRqlW7
MD5:	7FC44921490C9B659CE21014F29E02B5
SHA1:	41841820C81E84B3A153D1E71BAD90A1CCB9E8D9
SHA-256:	B772E0F9EB92A7D79FD6E383E446727CABA1A0BCA1725E719EDE2B2A75A35B57
SHA-512:	6CFA2404F2D000CD16F139D41DE7A0F5DE58E279FA2857AB7EF477AA06B645CB37D326C7EC2EF1D7609191286B7B93C81F3361BBBAC5C653CE887EB6979EACE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."..................................................................@.......................................... ..8\|..............0/...........................................................................................rdata..............................@..@.rsrc...8\|... ...~..................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...?...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462640
Entropy (8bit):	3.760042685339397
Encrypted:	false
SSDEEP:	6144:GNxlPqoAmTY+mO/5z2ap8ImhBpr9pmZsnecOHOPCC4ui3gXXjtRUpgJKlAqlwSoi:Dls
MD5:	64368FFD42598CEEC16C5CB6EF28B086
SHA1:	CA81EFA15B0C115F741D325747F1248A2A1BDF73
SHA-256:	9BA335C6BF51352EA96474A0216415942D361744B5D96CA1B53FE80A9CC89C3D
SHA-512:	DD2F825A66987173AC7D214F933B11F97C0C3F334DDA09B50D726C5602A4D9E59F86772C50CF573A02A184B9CE3761455D9D524B8453E2F3FA6AB06CE293FE02
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...:.3g...........!...".................................................................@.......................................... ..h...............0/...........................................................................................rdata..............................@..@.rsrc...h.... ......................@..@....:.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..H....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445232
Entropy (8bit):	4.345162063583558
Encrypted:	false
SSDEEP:	3072:8NZQWwJlyo2D4i/IvBgWrCd+y5jsgj2eaqh/6y1wBMktt+WX8dLTOsiU/d:8Nw04mut+tPl
MD5:	976A3EF9EE5553B73F36A6CA646A3A35
SHA1:	E5667986292B0D25B333F94C23BA4A582DE4C2C6
SHA-256:	F02163EBBE7C856374057E979B2CC8D7D1841EF5A58815CA4F7F9DEE2F9E373F
SHA-512:	E231DBADDB70E47F2DD983E3A45C699C68B66E0C9EF4ED995299E6579F0DFE04BF206C650D85C8580EB6478548B3A1286D3D53D00A1CD84AE2DD53434EAC614F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."............................................................q.....@.......................................... .................0/...........................................................................................rdata..............................@..@.rsrc....... ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...Y...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	430384
Entropy (8bit):	3.881624332655778
Encrypted:	false
SSDEEP:	3072:6NVr+CzkliVLjgTllqcfO5BT7bF9mQeLF7A2ubIr3S4WWe/jHHtc6B0qzDWA5lP0:6N+vp0qlSg8N/ZBHPg
MD5:	E6929C83BA3FB74DF718BA370BF88AE4
SHA1:	6F833CCDFDA5DF382D87DA3CE15215A1B53791D5
SHA-256:	0F0CE1A8C2B07896C04D378B5B8187BD3106FB16A239CC79C595DB30431D32C9
SHA-512:	7BE761D5407ABF4CE1E7EBF9C171A695232071E32578F339707FADE588E0EB26B6B45875E9936B3EE279CD5780559E88B6C9A3CEDA7ED752DC390938D1F2F64D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...E.3g...........!...".....`......................................................(.....@.......................................... ...\...........b..0/...........................................................................................rdata..............................@..@.rsrc....\... ...^..................@..@....E.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..h....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	429872
Entropy (8bit):	3.742433535213962
Encrypted:	false
SSDEEP:	3072:LNPOD/v+AHa291uVZVAZcMMv40K4+0stMpNu3k3+hB/S5Hs7hUvEnfS755P1ER1/:LNsVaYW540JHpUUIn+3PHmXWbsmdstr
MD5:	F46651A9BEC66D71EF2A7554B3731463
SHA1:	49B0E0FDB9438848B86244F47BF2999A4FDE4144
SHA-256:	1A5DD2142C66BECEB99415B0A1ABF2BD0310857B6A4B61E099506CEEE59A73E3
SHA-512:	B495070B05A87E6D232532EE0C0A68258BEF153E8F626FAB3473D33BA74351951D7C7D3BD89978F55A5BC2C645B3D902661BE56CC4BBC8387AB337305A1A71F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...P.3g...........!...".....^......................................................M.....@.......................................... ...Z...........`..0/...........................................................................................rdata..............................@..@.rsrc....Z... ...\..................@..@....P.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410416
Entropy (8bit):	3.724018748105119
Encrypted:	false
SSDEEP:	3072:8NeQ4ns/DX8CNRbjDr1E4kHk7IFBMlU/Wo7UwQddabm7Doe51jaO/YV+tL8tVL3l:8NeDnp4XkoB1bhFBY
MD5:	C9B3394CBF0FD17C4CE80933754392B3
SHA1:	37A51405221AA2CCFED69021EB097F8D579FB399
SHA-256:	30BCB07C1A52B6D49A1816377EB6D2F34E8CF63DECBCBF2256339DFD515E2FFD
SHA-512:	FFC6EC98A16B9FE9DE7A5B0ED3EEAE2649F1E883596786AF8CF860E32B5E9ABE714C8D3DD2EE2405CC9DD7C6643BD8886AB5373B2596BA9ECE2C542B5D7B2881
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....................................................0.......Z....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	397616
Entropy (8bit):	4.5378484416090945
Encrypted:	false
SSDEEP:	3072:gNSiyD1Ja7bVSCCn8a/uO9NanCBhBh79pwhZpk1gFMGSI3yeB73u+bf/DC:gNUgRSHQaI352
MD5:	99289969CA72D6E7B5AD982730A1641C
SHA1:	3ED18D9FAAF32DC00D11F3377ED6FF59841BCC35
SHA-256:	837783AAEF963F2F5DEB0B22A7CE875F9900FF61CA41E9362295E457FE1DD959
SHA-512:	A21BE03A91E646A441CA4427428F9594D79427F3F7EA0001374EA214E09B7AB9C585D8DF1ADA682D3086DAB29052170B0713E69E00D4C31FE803712FD09CFBF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...[.3g...........!..."............................................................q.....@.......................................... ..@...............0/...........................................................................................rdata..............................@..@.rsrc...@.... ......................@..@....[.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	415536
Entropy (8bit):	3.8945278850522436
Encrypted:	false
SSDEEP:	3072:DNP/M4v2h5ooD6qrQrxO9VEaOy/4EZPvsnNM+cJRS1klrD5oNAr0sJIS8HEEiLnM:DNX6zvsnNCoXw9hRacRzc7yj4
MD5:	AFE6CF3CEA7F0453F5B678CC9AF1CDE9
SHA1:	17566D68DC26838C51274295CD1B519D49F22691
SHA-256:	48015D7439ED9FB3D86B778525BE8C9B1C49E75855BD82DC55B616C0D05B4956
SHA-512:	FB44757317ACD945960C6FF728E0FAE05ADB0AA865C95F05A63E1EFDC49B50775C09D7CA25986354E8B0DCF345A4449950356EE285062A419E83DD022B73CC30
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L....3g...........!...".....&...............................................P............@.......................................... ..."...........(..0/...........................................................................................rdata..............................@..@.rsrc...."... ...$..................@..@.....3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440112
Entropy (8bit):	4.368660233666246
Encrypted:	false
SSDEEP:	3072:MN8D1xxNKRcO5TyZUUJPKY4jgUgRQiXYL7fe/7UVitNbwyjCAyyaaiiQjFqZ0UFd:MNQxhTGkt/Ljok
MD5:	0B8832DE8B98424331A3CEA77561DB3D
SHA1:	3AA10F7B386706EB95E7126051BDA8313AE7A79A
SHA-256:	D1A86642F816EACB751D997E53557916F79213CA994B5FC1CA5F98B65868DF0D
SHA-512:	B25D703A187327D3C253B259EAEF6D136069CCF0D86605E6B98698275FD5BCDC42F83C43C1E444F3272BBEAB3D441481D7B353F55C689836FA431BED026818AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...f.3g...........!..."..................................................................@.......................................... .................0/...........................................................................................rdata..............................@..@.rsrc....... ......................@..@....f.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...F...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445232
Entropy (8bit):	4.197917458611077
Encrypted:	false
SSDEEP:	6144:fN0F+xOdgYDbwp68tkyfTdHid5s2ZMQkeMZs5rceohHLx:SvpUaSrx
MD5:	A28F6234836449378972FA4C49B1B573
SHA1:	F11556BA5621B9C844625717F7713D6A294AB984
SHA-256:	9A4DDF7E4F561ECFEF63956FCF23304724E6B5DA30FA1734BC22AB8129E00F3E
SHA-512:	02649268CE8E7AF99E63CD47659160853BFCEBDF9DAE026CDCFA98CD4A0F7D23B5A41763EA4B41D19B742BDEEDD8AC483752FCFB516ABCDB8114A4C761B2A187
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...q.3g...........!..."..................................................................@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@....q.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..pZ...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194352
Entropy (8bit):	6.058995434031819
Encrypted:	false
SSDEEP:	3072:XNV5FxIjlioSnfY9yIGJD4Gh+jrOZUiXQU+k4yLfg8OQWQRt3/b:XNAjonQ9yIGcjniek4iX3T
MD5:	21EAD4236D0DD62F19A48E657DFB342B
SHA1:	206E222004E281D5C21E99C2FE4807A0776F5F81
SHA-256:	CC9F0B70C3496FF16302F3CF52703E4D98040419D5948EB8651C2357B9BFDD53
SHA-512:	8050175B360FF1FBC18756FDF81C7BCCB7BF18BCFA5A9DECFA422D4DBC3A28676C05D2068DCFF9340F2308166A61A6E915A8664251B77D3E0BC1D48DBE6ABA55
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L....3g...........!..."..................................................................@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.....3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..`....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194864
Entropy (8bit):	6.099202422195636
Encrypted:	false
SSDEEP:	3072:gNIm5gMYHcWLiw7iHuvCwRNMdMHa/5MuAi3ZQUhkZVx8906OU/SF:gNImcHc6HUkNRHa/5MuA4QUhYAOUaF
MD5:	D31C5EC36B40C97A970E5DFBDA2A0C44
SHA1:	141C4A2918C6305B02E2683121F4B385BE51ED4C
SHA-256:	A3F0622DADABB8264DCB0CE1C25959347614F54448F781F69CF4825E8BBAA3D3
SHA-512:	2B53489CD34E828346BC0F1C77F288510A3BC69D3E69456786BC80DD665FF051AEB32A90169D7D09A7007A8F6DC6FDB6E4FAB906857808970594714A60AD48BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...\|.3g...........!..."............................................................W.....@.......................................... ..x...............0/...........................................................................................rdata..............................@..@.rsrc...x.... ......................@..@....\|.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..X....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22681904
Entropy (8bit):	6.631480939944556
Encrypted:	false
SSDEEP:	393216:KcTW/8hgQcbLqItw/cIqiQwxhWt24zvIR:KqQcOs
MD5:	E901C556A63E8738AFFA2D2F1C82DA4C
SHA1:	87092E6C7A60C8E8595A7C034DADFAA55DFF417D
SHA-256:	4E40C3381FB5A99BCC4ADF2E3B6F3ECD1E224C4CC22B39648552EF4514EA933B
SHA-512:	314BED464671B2B5E9A94B3EA2E3BB2E3899A5B5CAFAD146691B5A6A009D50414DE2A84B518E2F7B253F55CD7393EECF7F5C3D73A9D443164689174069FF21B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......O#...B}J.B}J.B}J@:xK.B}JD>.J.B}JD>yK.B}JD>~K.B}J@:~K.B}JD>xKqB}J@:{K.B}J@:\|K.B}JQ..JQB}J.>~K.B}J@:yK'B}J.B\|J.@}J.>xK.B}J.B}J.C}J.>yK.A}J.>tK.E}J.>.J.B}J.B.J.B}J.>.K.B}JRich.B}J........................PE..d.....3g.........."....".F...vo......?.........@.............................._.......Z...`..................................................VC.(.....\......`S.49....Y.0/...@].8....^..T...................._..(...@...@............`..`... &C. ....................text............................... ..`IPPCODE............................ ..`.rdata..B.T..`....T..J..............@..@.data...\.....C......`C.............@....pdata..49...`S..:...jN.............@..@.didat..H.....[.......V.............@...IPPDATA.g.....[.......V.............@..._RDATA..\.....\......xW.............@..@.rsrc.........\......zW.............@..@.reloc..8....@]......"X.............@..B........

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36885808
Entropy (8bit):	7.909820490100587
Encrypted:	false
SSDEEP:	786432:KSLjrC6ES0BCVUx2qRw4nZnv69fakl8Q8kpwDQ6/Y:VLf+2m3hqSCZoI
MD5:	4161468092501B8739E3411C5E423002
SHA1:	F3007F049E8E3272058CAD1D32195E28580359E3
SHA-256:	FCD688CA0D1DE2AEDE56E5736D63F7A12BD6BEC5C2C927F149028375762DC736
SHA-512:	8F06DF358486259509CB73C3C73387524E73C563B2388F50F59F77BA52F187378DBA2BEDB675F2EE7A65B55DC20228FFEEA03AC0E1A3BE7E78E6B8AFDEFFFCB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........................PE..d.....3g.........." ..."......2...............................................2......03...`.......................................................... ....2...........2.0/...........................................................................................rdata..............................@..@.rsrc.....2.. ....2.................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	518960
Entropy (8bit):	6.393116974761183
Encrypted:	false
SSDEEP:	12288:IjcUW8R1ZXBVmLpjmjXY57NIk/Vo693Qe9:IjcUDRnQsXY5h7/VfBQO
MD5:	3075E4759956DCAA841ED4C416F89C92
SHA1:	A650F1FBFC3DBB9A1DCCED09EC9B4F342F22C0BE
SHA-256:	9B9B433FEB51663EA5351C7FE63881B1F721AD8B16A9ACC27D7EBED0A639CEC9
SHA-512:	E6AB3EB08C8087F5015FF85D4CB82AEC7A14E1909F75A25FC7B61D662096C47C82637C1B545F16AF791FAC61E4A082C3E68E45575A4DEEC12907C85F72F35006
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IS..(=..(=..(=.P8.u(=.T9..(=..T8..(=.T>..(=.P>..(=.P9..(=.T8.(=.P<..(=..(<.u(=..T4..(=..T...(=..(...(=..T?..(=.Rich.(=.........................PE..d.....3g.........."....".......................@.....................................?....`.................................................H...(........l...0...C......0/......L.......T.......................(....(..@...............`............................text............................... ..`.rdata..............................@..@.data....J.......2..................@....pdata...C...0...D..................@..@_RDATA..\............<..............@..@.rsrc....l.......n...>..............@..@.reloc..L...........................@..B................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1714992
Entropy (8bit):	6.546953457862245
Encrypted:	false
SSDEEP:	49152:xpQyGyf6Rxzu54UP7OKkxlFsuKdHVTtajlGA:xfGfRpUA
MD5:	248C2A80CBD5647C23C55CFE70D843BC
SHA1:	31275E7C87AED241D3871C9A805B2D2EA10F3758
SHA-256:	99464B26D99A8187194E7580011FD0E5FCEEF9BCFD5FC85A36400F5CBF533060
SHA-512:	133150B983C61C7CA28D5C35728092CAB2FFD822FCE8C42B8D29BE9355D1C294D97E8ED76B56EA0D4E18C06C89D55A98E6D4859D82258FE38A627C05C4E14D9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................[..............................:..................;...:.......:...s...:.R.....:.......Rich....................PE..d....j.f.........."....".....l.................@.............................p............`.........................................................@..................0/...P..@.......T....................!..(.......@............................................text............................... ..`.rdata..............................@..@.data...(`.......>..................@....pdata..............................@..@_RDATA..\.... ......................@..@CPADinfo8....0......................@....rsrc........@......................@..@.reloc..@....P......................@..B................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	6.949643172483514
Encrypted:	false
SSDEEP:	384:2LGBxtmkhZSf+VIYic51LgdkSJIVE8E9VF0NytJ:2LIxtmkw/Yic5A2Ep
MD5:	4D6089A8744DA5197DF65AFF0567E893
SHA1:	31F6D32398CD3E465A95B1E40383981E4979167A
SHA-256:	D96179353562C8C7F39C3CB8D7D3F9815CF8AC6F19A00627480CF37EA6DE1515
SHA-512:	4E60F4891EB101F076BFDC59EB0EDFE48AEFAF7336F0D5818BB52BA2A50FB757F7D1165C0AA77A2C65BFB501A6ABB0B69445C0278A94F51930792395047F0773
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....3g.........." ..0..............,... ...@....... ...............................T....`..................................+..O....@..................0/...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ..4...........................................................0..b.......~.....~......(.....(......o.......(.......o.....0.~....(....,..(....&.~....(....,..(....&.(....&...........%1.0......(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......d...#Blob...........G..........3..................................................-...........................0.......f...\|.f...].f.....f.....f.....f.....f...7.f.........B.....

C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	355632
Entropy (8bit):	6.544582451742204
Encrypted:	false
SSDEEP:	3072:NY4IB2B+o2FgZEdOD/eSsgp2YX58ODnEpt0El4NnUszFoSqrzqwX9ZDuaoos0aEo:OOdqZ8lJDn20ElV0QmQg308
MD5:	A3448D601918784C38F202FEC27FF8A4
SHA1:	1254E9362FBA584C7CC5634EBEDEB71F74ED195C
SHA-256:	027BC60E1C036D170398A289B7FA2F6C9161A198C48346D6F847E3EA63F4AAC6
SHA-512:	224949BE3684AA7EB4812E8A3FD34580898B8645E242C52E0C10EBE776C878BB925482FE11264E9C74855E63AE6680ADF310B3563BEFEA7829133531802BAB25
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3g...........!.....4..........rS... ...`....@.. ...............................D....@..................................S..W.......`............>..0/...`....................................................... ............... ..H............text...x3... ...4.................. ..`.reloc.......`.......6..............@..B.rsrc...`............8..............@..@................TS......H.......(....f..........$....\............................................(.....{...."..}.........{...."..}.........{...."..}.........{...."..}.........{...."..}.........{...."..}.........(......{...."..}........0.. .......s.......{....o......(....o.....2.(............6.......(..........0............o....(.....o......E............#......>..........Z...u...........................;....8......t....o....(....8......t....o....(+...(....8......tS...o....j

C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139056
Entropy (8bit):	6.532462408923504
Encrypted:	false
SSDEEP:	3072:miieN9+xseRPLVfO2jiQpp0woz/cLruLwNiCoJa/Y:mpU9heFLRjCQadJaA
MD5:	E5D8A7EB95C608523C9F8D1753691474
SHA1:	0D20930588A8EC799D97A7DD13967E6CCF9973A7
SHA-256:	63BC815B7896DF84C73489BB12C3845E5C3978AB9BACD5BE69B91F6528EB86DE
SHA-512:	28AC0BD57201455CF5D157DAED6D8FF0F52AD5550ABD3B6505CF6FD5C1108537296F7A218C413ADD83395A0AF98AA52E8C35F7F2768CAA68E98A77A7637AEF6D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........`E...+...+...+.y(...+.y..\|.+.}/...+.}(...+.}....+.y/...+.y...+..S....+......+.:}....+.:}/...+.:}+...+.:}....+.......+.:})...+.Rich..+.........................PE..L....3g...........!...".0...........{.......@............................... ...........@A...........................................P...............0/.............T...............................@............@...............................text...*/.......0.................. ..`.rdata.......@.......4..............@..@.data...............................@....rsrc...P...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	182064
Entropy (8bit):	6.2310805988584175
Encrypted:	false
SSDEEP:	3072:9gRdGN0Ik4/3dGctH4Xmyw0hHRhzopV+9JmTBZ1wuwbPz4efAAYVqsLiy/q:kC0r4/3dRHSmv0hHRlI+9VSPV1y
MD5:	61AD15F02535262E120D16CC1642ED07
SHA1:	B179B3ABA71D55A022361B0DF30946316FB318DC
SHA-256:	54AEA2D51D13F0ADD6B5738D7A0D7399C4531F012358245AF85932784BF44ABB
SHA-512:	A671493B783DC9C9D4C5D95E64C84940EF352E4BB4C5B5E6691DE56332855920065A22173BA87FA84545A28EEED16BA96D6217E96171EC5A23676FFDCA4C771D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......B....\|.].\|.].\|.]M..\.\|.]I..\.\|.]I..\.\|.]I..\)\|.]M..\.\|.]M..\.\|.]M..\.\|.]...].\|.].\|.]{\|.]...\.\|.]...\.\|.]...\.\|.]..f].\|.].\|.].\|.]...\.\|.]Rich.\|.]........................PE..d.....3g.........." ...".~...(......`.....................................................`A.........................................S.......S..........X...............0/..............T...........................p...@............................................text....\|.......~.................. ..`.rdata..B...........................@..@.data....$...`.......R..............@....pdata...............f..............@..@_RDATA..\...........................@..@.rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	479536
Entropy (8bit):	6.914122396366591
Encrypted:	false
SSDEEP:	12288:ITbmbvN1jVKS3+dIPIkuFRYoevk2gpb45w3n:ITbmbvN1VKRdIA12gpb4i
MD5:	2499441F9DA7A30E39B38EAF9D38BA1B
SHA1:	7150959613391297B73EBD918F0F5BFDAD4921A5
SHA-256:	6459A030059A3054ED1C42D7F195DE1B0B04348300BFC1469016E2D5D4A65FFA
SHA-512:	0487CF992E16BFE87F1FB12722086DD3647F3650031F72266D4C16118FF9233972B746897A7B3F4BDF5D0826FBD8E9C1F3077DC9C155324B16D96003085EE6C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[......T...T...TT..U...TT..U...TP..U...TP..U...TP..U...TT..U...TT..U...T...T...T..U...T..U...T..T...T..U...TRich...T................PE..L....3g...........!...".l.......... ...............................................K4....@A........................ ...t............0..............."..0/...@...;.....T...............................@............................................text....k.......l.................. ..`.rdata...e.......f...p..............@..@.data....$..........................@....shared.$.... ......................@....rsrc........0......................@..@.reloc...;...@...<..................@..B........................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	362288
Entropy (8bit):	6.600580188701235
Encrypted:	false
SSDEEP:	6144:VAFcz4hAtmr5rMSKW7g+JZFUEEgwbGfQASFCQk4AOUo56Gt4mE2R:u+21Bvk+JZiEE/GfQpHj6mE2R
MD5:	048CC47BE05A3D22BB5019015F8286B1
SHA1:	E7D5836562B028763D107E8372B5914A7CEE35F2
SHA-256:	74C5FAB3BCC1542EF0A92D6EB54CBB72ECABA72D50A981B07A7104A18A1F12C9
SHA-512:	C51CC6E8CC23B0C36957E9E6F95C49F77D80468D38DDAE8A45FCF69A7AA7B62B2A754458F323A0D59DFD933E037527CB699AA8F7E618B14DDB611E5A2290603D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.U.J...J...J...2...J...2...J...6...J...6...J...2...J...6...J...2...J...J..[J..u6...J..u6)..J...JA..J..u6...J..Rich.J..........................PE..L....3g..............."............p.............@.................................V.....@.....................................(....`...............X..0/...p..$1..0...T...............................@....................... ....................text............................... ..`.rdata..PH.......J..................@..@.data...l"... ......................@....didat.......P......................@....rsrc........`....... ..............@..@.reloc..$1...p...2...&..............@..B................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	612656
Entropy (8bit):	6.6296860228182775
Encrypted:	false
SSDEEP:	6144:e779BVP6hn9cQ9u/esIMyUXOR7nXxBFUOU8I/Ubzi2G6PpqBlgXAjR+UhGhsoS05:e7prP6hnyb7jeNx73F+Ai+AZsbseCiwu
MD5:	9F597B5EBB2EAB9E85E4B5BD1FEB27AE
SHA1:	0EA591E2A6541B012BB702F13D4A93E6E5AC8ACD
SHA-256:	136B724BF8A88AEAABF186E5F3617EDBBF090231C3047E1447D6A5261EA63684
SHA-512:	48B072A4952D953A9D136796A7CE191515DB352FA73503280A987205AB1CE7B8F2C4C7794C76014D28C019319CC8D00DDBF0D523FA1D55FC550AE13808EB2EF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8Xy.\|9..\|9..\|9..7A..z9..7A...9..3E..\9..3E..r9..3E..u9..7A..p9..7A..q9..\|9...9...E..p9...E..}9...E..}9...E..}9..Rich\|9..........PE..d....3g.........." ..."............@...............................................7@....`A............................................t........................U...*..0/........... ..T...............................@............................................text............................... ..`.rdata..6...........................@..@.data...H1..........................@....pdata...U.......V..................@..@_RDATA..\....p......................@..@.shared.H...........................@....rsrc...............................@..@.reloc............... ..............@..B................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	429360
Entropy (8bit):	6.403512694173202
Encrypted:	false
SSDEEP:	12288:7CvCVmlq3sJ0WyvoY9phDKTFVZodiMyhsw:7CqVmlq8rcoUp1KTHZgy
MD5:	C2569AFDF453FF8EDC35546C6CD99F25
SHA1:	AFBFF67E0DD01BB43804C2D861A3ED385BEEFC6E
SHA-256:	82DEB0B2CFD81447C6EF19CC8620793E143D0F7D543EEC4DB2939C29EED34ED1
SHA-512:	FBB0DB2DDFFDE7CDCAB2D5B0EA98A4D88AEF1000A6F5FD11650EFD3F3EDA3DF8D774E71DB0DC3946D1F98677272DA16484C7B8DD03D00598348722EC5FF21091
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I...I...I...............F.......C.......D.......]...............J...I.........i....v.H...I...H......H...RichI...........PE..d.....3g.........."....".L...*......P..........@.....................................k....`.....................................................(............P..T3...^..0/..............T.......................(....~..@............`......d... ....................text....K.......L.................. ..`.rdata.......`.......P..............@..@.data...\|2..........................@....pdata..T3...P...4..................@..@.didat...............H..............@..._RDATA..\............J..............@..@.rsrc................L..............@..@.reloc...............R..............@..B................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\tvfiles.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	68012141
Entropy (8bit):	7.999996391476119
Encrypted:	true
SSDEEP:	1572864:7tHGL2imNGck9gTKQtEZjZjb914komphRDrGdXCl2EXTcAeUu:Jm3gtEZR4KfR/l2EeP
MD5:	6481BE826C6C0E4E5044B7AEFD798C8F
SHA1:	A158D4C2A009803D4AEA0F266B34CBB4AE65DCCD
SHA-256:	0E6C4D5CC07EE959F526295E79C56FE2ED8A8D1023F688555F1FB6F1A154D69A
SHA-512:	1640A148D63FA843D3B85BCD49A9AF3BE7358BF96A82B9032D557783785951647D1DCC290EC494A913E5B2E9BDD9897B3D71B1386EB3C2F7601243743A06074C
Malicious:	false
Preview:	7z..'....d.b(.......%.......y.C...`...Q....}.=m.u`...Ah3u.kv!.. Kg)...%.....ii....j..:0..Q.x~..".....y34~D..c...0..k.O..W.....G^....:].ce.#.q.$TzuW...h..'imfv.,UK...D;... (.l..z..A...5.y.4..........M.y...3.....)'......80ILrPF...@..bU.!.<.... .:o....^.T....-...^.Ytuq.. .WI.i.j.[.7.. s....H..<......./Ad3...p[..%Y,..2.s[.H6"..jF.7..e-.E.7T.....0....K./.MW../.6.l..<.k...2..(..f....t.Bv..~.m)...1....z.j.\|.v....5..ui.@_.~...>.@W..Y..qF.V..y..A.,@."......j....e].....A.t.1..1...SQ..g/.s.b.<D.).X6./.}UbYe.+.n.;..{....]...(....e.!R....h...G....S..CC..$f...N......m..{....e\/....I..\|n<.u...d..\|. .-3QjpY. oKu..H](........a....YRA.n.u..E..w.C~..d..`..xF..,.DK.#.t.e.._B8H\$.u.!lS...9-u@.3f......, ).Z....^...........8i-.........._..]..e...t.8......]....M.'.,+%....v....pFz>..q2..u%AV.O............5....Tm....:.f...PO>~......e..7O.,&8.....W.R.....<;.!a.e....KY3v..b..5........Pk...{.~O...R........B.F.m.G......h..f..=$k....4.._b7C2.....o.8.p...s...F.........

C:\Program Files\TeamViewer\TVExtractTemp\tvfiles_printer_WithPDFSupport_x64.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	364560
Entropy (8bit):	7.9995333112503495
Encrypted:	true
SSDEEP:	6144:ZF/r31fRSYFtbAtnX98TKt1f4ymTN0fvez0bMYJlcBHALHmULTk:ZFb1ftC6TKt1fWJqveobMYJlcBHuXLY
MD5:	113DE28B4DC4D132A53AACB43D88D064
SHA1:	927B206CB925D73D48E1D626B148453055748C40
SHA-256:	35641CACBEB210DD857F9CF3C8AD1AA81A74F8EDCDD2526BE07E16580C7EF08C
SHA-512:	92867E0914E4A1F06FB80D89E68E1EF0ABB4AF6EB4FAF302E05FF6DD21F46758AA8150BF2267F6DC052702FB9C99F055254A2F7CB5F6AF26F672119B729ADFFD
Malicious:	false
Preview:	7z..'....w-s.......$.......3......&....FnP..p<......o..:.D.y.2...;N...$.....R%.$.+.y.4N.T...I..!...W.iX.u..>c.......>....hU.}V...!E.......>1...`.........-\?.&S....9...A.(1.O[kOK..\|.a.=.`XK..%..9F.S8..\|.D=.5.b.z....]....?..........SV1.Pj.W.....z....<P....DU\..._7.Z..W..W..cL...Me..@j.0=]I.....Y...Va.J.Lu.)B.1.@+0...)e.....[.x."!.UX.........P!../7.$..."R.....j. 3.Pxp.W...JN...5../.?G9b.C..>...=y7. ..~TV.......T.y.......{#.Hm[k.x0..WB\|..=..7sY.f..t...fs...e...V!.g..6s./,n.D?..`.t..H...^jPv....>...]K./...,ej_..D,....T..)..h[##..i...'b...e......7.$.od'.5.K.K.V.G..[....CUn.Y.......J.....$...y.-J^....V.,...,.\../...g....:....i.kp8%..i....Y..x.....m..Ne..........~.i..+..G:B....#`.-^.+..%gS-L..P).Zz.....8.s........Bx.... ..>h.2...2..J....~l..G.z....).b.C.^Rtd.....s-.b..3:Hb.qXG...f.0 =.^...5..q.&.z.8.g....d.76.....&..==.....[]./0.....).:7P..y.w.F4...jr#..;.....*L>z.j.`Q...6.X.J.....6..R......b.........@.....9P.._..,..Y.c#+..I.bS.(.C..F..!

C:\Program Files\TeamViewer\TVExtractTemp\tvfilesx64.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	310194
Entropy (8bit):	7.999382001365806
Encrypted:	true
SSDEEP:	6144:4S2ruVvp26RNW2ee98lcMXZ7cOxmFb4tFzaUNrDw394mV6L2JAyLw:auVEQW2r0cMlAB4tVaUJ+94mu
MD5:	846AF7A620836D57195ADBA6CB2F9327
SHA1:	AFE4FBF75BCAFE480997387F74633CB34D667290
SHA-256:	612A8D33CB8B6E5BAA0E9C91189C13873664DB0846B9FDFECB345961BD11CB5B
SHA-512:	C78B719A00AE1064EA62A2FF685069699166333678AD5D485B3982FBBDD685019B1B57EACD88133BDAFDD8D3FA1E7EB9F93E7BD3409ECFE686D24F95E4A8CAED
Malicious:	false
Preview:	7z..'....~.hn.......$.......r..+.. .(.....H.U......6.PXGp..F.5J..E=I..2..A/@.%....P)..H..Sp..u>=C..C...N).......(..."ZZS ....W..@[_f%...$..E!..a..B...v...L.'.`.~.b..F.._Rbc2......^.s..D@.?..8,z_S.xY...............YJ0gzd...J...jYl......DD.. .'M...C.....h~.6.....r...K?-.m..]."........5..Q5!b......7...^......s.....g2j.S.'.;.K.3'.s.=^b...)%2.'...~=...!...m>JmGS~D.......s...P..._...G...h...%..M......#.[.B...Y.N8..J,..H+O2.....d......R.Q..R.t.....qU.3i.[..z7...NcB>Tig...\K5.,.P4y....}..w.....j<..O9.....[A.-..]...L8.K..B..LT.H3.bF./.FaX...."wD..ss.N.I....7......]m,.m{.E.7b..6..R;Z..^Q....o{.+.)g.a.....C....\|.,...3...).xQ..}..D. ?........ H5..4X.r...K...X..u.H].o&..nU..E..a.T.$.....f....3...Vr/._;..Cw.`+..@&d..}..-;)..d1j q.t.S...Y%}[K....]:.sP........x.F.2NU%..<.>VE..9$_KP.....H.w.7......H...lg7.."^.`K0....8.....1........8t....F...}.i..N....i....S..^.`.g..42...:..`{.V..7...V...f..,...C.m04...I.j.d...h...D9.}.hPQ......Q.N2!..K.I..jB9.....x.q...;.....S

C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1165840
Entropy (8bit):	6.419383926919195
Encrypted:	false
SSDEEP:	24576:Gnzn0vN6aSoGsZwXV22NNNKwhfmH5abENDcCBV:A0vSoGsZwXV2ExnbENDcC3
MD5:	E217DB9E269FF85272513E81B9F191B3
SHA1:	FA493446A28D9CC3B0578E7136068048E140134B
SHA-256:	43E868678463F759F4CE8EA235486B955EF6426977C869BDA308622E3D57855D
SHA-512:	5833DEF4E078D73196019318B62EC104DC1CC016E53599EC70785FFCD39A9A031244B066E21841429884EB0B02DC9762CFF7C4DDAA757A475F9C7F622A343E8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L....z.W.................d...........2............@.......................... .......f....@.............................................................0/...........................................................................................text...{c.......d.................. ..`.rdata...............h..............@..@.data...............~..............@....ndata...@...P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\utils\MicrosoftEdgeWebview2Setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1592616
Entropy (8bit):	7.928355704554102
Encrypted:	false
SSDEEP:	24576:Uwyf3Su4a/KnwYtDXl42hxt3q7lR3hVtTcKaBQ7SdBZpeUY:Zyf3L4aGweXl1h/C3Jc9BQ7SdPMh
MD5:	B32D72DAEEE036E2B8F1C57E4A40E87A
SHA1:	564CAA330D077A3D26691338B3E38EE4879A929D
SHA-256:	65F6EFDF6DF4095971A95F4BF387590AE63109388344632A22458265AB7DD289
SHA-512:	B5D62CE1462D786C01D38E13D030AD6236CE63321819CF860CC6169F50F6309E627BC7709B305422851779E37DBAE9FB358008AAD8D6C124CD33CDEC730288D5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d..[ e.. e.. e..4...+e..4....e..B...1e..B...4e......-e..B....e..4...3e..4...!e..4...-e.. e...e....@.!e.. e(.ve......!e..Rich e..................PE..L....(.c.....................t...... }............@..........................p......m.....@..................................?..x.......................(/...P.. ....1..p....................1..........@...............H...T>..`....................text...*........................... ..`.rdata..............................@..@.data...,....P.......8..............@....didat..,....p.......B..............@....rsrc................D..............@..@.reloc.. ....P......................@..B................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	5.282965170818026
Encrypted:	false
SSDEEP:	48:+vsh8Q2XFbsf0z6Joq7mgHwuMgHPgHxGFWlFVfXj/g:+vM4QI6JoimIMsCGFWlFZE
MD5:	5C05880E0ED65FAC3A4DFB7B6802B898
SHA1:	55EA8DAC7093123E26584A49012517818C0F586D
SHA-256:	60FA2925C589AC38BAB74713E1B0BB2A205A8C825D614B971FC3426991CD86CA
SHA-512:	5176504DE06E6F8249815F8F8472ED7C9A26003E92ECD80299DA8B611A630A1BA8179419CDF50F02B78A19CAF221D6E0AE59452B224DC55FEEF72A93CD4D147D
Malicious:	false
Preview:	; Copyright 2010 TeamViewer GmbH All rights reserved...[Version]..Signature="$WINDOWS NT$"..Class=Monitor..ClassGUID={4d36e96e-e325-11ce-bfc1-08002be10318}..Provider= TeamViewer GmbH..DriverVer=02/01/2017,1.02.0000..CatalogFile=TVMonitor.cat....[SourceDisksNames]..3426 = %SourceName%....[SourceDisksFiles]..TVMonitor.sys = 3426....[DestinationDirs]..DefaultDestDir = 10..MonitorFunction_Files_Driver = 12....[Manufacturer]..%MfgName% = Driver_Mfg,NTAMD64....[Driver_Mfg.NTAMD64]..%Driver_DeviceDesc%=Driver_DDI, *PNP09FF....[Driver_DDI.NT]..CopyFiles=MonitorFunction_Files_Driver....[Driver_DDI.NT.Services]..Addservice = MonitorFunction, %FLG_ADDREG_NOCLOBBER%, MonitorFunction_Service....[MonitorFunction_Service]..DisplayName = %MonitorFunction_SvcDesc%..ServiceType = %SERVICE_KERNEL_DRIVER%..StartType = %SERVICE_DEMAND_START%..ErrorControl = %SERVICE_ERROR_NORMAL%..ServiceBinary = %12%\TVMonitor.sys..LoadOrderGroup = Extended Base....[MonitorFunction_Files_Driver]..TVMonito

C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18336
Entropy (8bit):	6.275348584247018
Encrypted:	false
SSDEEP:	192:qumQmspn15C9l0HDRRdrauc056CAyIKGNsuIeInYe+PjPtrwnc8ijtlAur9ZCsp5:qmF100Hzdrau/NAyoauQnYPLWUUHeMt
MD5:	B7CA6668278FBAE3FBD649285F8CCC35
SHA1:	DD5CD2FB0E6818EB56268F0D6E72D0F5AC74AEF4
SHA-256:	78318C6A8AE65FB3AFE6BA06CF1BDA69903390E250950D3BF78895CD79AFD4D8
SHA-512:	7305B979ABBEF7BEB4789261E9FC0EBDE00415BB00ECEEE2289CD1FCF91467CCC7C84ED77E7F5CD042243508B5FC8C3384EA59D6A1A17497781110FE5238103C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..S%.S%.S%.S%.s%.Z]I.P%.Z]O.Q%.Z]Y.W%.Z]P.R%.Z]N.R%.Z]K.R%.RichS%.................PE..d...)x.Y..........".................d`.......................................................................................................`..(....p.......@.......(...............!............................................... ...............................text............................... ..h.rdata..t.... ......................@..H.data... ....0......................@....pdata.......@......................@..HPAGE....z....P...................... ..`INIT....x....`...................... ....rsrc........p.......$..............@..B........................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	11393
Entropy (8bit):	7.262775900557745
Encrypted:	false
SSDEEP:	192:qtxI5sxyQJCxSFBkyKuqwFWQFH5JUoowcLK+X01k9z3A4ZdMXrWp:80GFRdfUo6R9zrvMu
MD5:	746441B276B24B7A5B487A429F60D214
SHA1:	657258CBAF47D6FAA2EC58C77B948C6398828F96
SHA-256:	2C714A3687424C798B565128C0720322A7EA0FB779D91963048394EA471707AA
SHA-512:	F734829EC6D6AD84848FA5CD2B866337360481B596A383A49AE3BA5176FFD74850C8DFA345F1DD3BC4644DA6FA905AD91644E450DA02C413D39849EA3C35753C
Malicious:	false
Preview:	0.,}..*.H........,n0.,j...1.0...`.H.e......0.....+.....7......0...0...+.....7.....<.O....E.L........240125134120Z0...+.....7.....0...0..'. `.........5.[.}.....t..oB.....1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6t.v.v.i.r.t.u.a.l.m.o.n.i.t.o.r.d.r.i.v.e.r...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... `.........5.[.}.....t..oB.....0.......@i...E@8z!:D^ze./1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6t.v.v.i.r.t.u.a.l.m.o.n.i.t.o.r.d.r.i.v.e.r...i.n.f...0.....]..n..\|...{.;....n.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6t.v.v.i.r.t.u.a.l.m.o.n.i.t.o.r.d.r.i.v.e.r...d.l.l...0.... .^......%f..u`.c.l.IJ...5d.x.o.A1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .^......%f..u`.c.l.I

C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72056
Entropy (8bit):	6.655826001710673
Encrypted:	false
SSDEEP:	768:Mdq9xYKLIHVgKqnS/OLlGkQctwE/uf95v13d6YHU3/Yic5Hf+AMxkEBsF9zmGW:MUYK7xxacKYS5vBHU3/7IHkxuXznW
MD5:	5DA3DD0A7761D1C1678D65F22005175A
SHA1:	13EDDA1695D1080379ADF30596F149CFE09E865D
SHA-256:	CD858C1A37D9599181285CE55E38BBD7CEF8637F8DF1D3BA425B78C2670E345E
SHA-512:	54C14B06F3CF373DD4A6D77030D7908FC6CB42BF151760877EF2EA0C5662B56F2DD09A334BB55602A4F1920CDF91FBA140AAEA14113DA369CD25B89AB8B3CA3A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3t..w.a.w.a.w.a.%`e.~.a.%`b.q.a.%`d.T.a.gd.v.a.~m..e.a.g`.r.a.w.`.4.a.gf.u.a.gb.u.a.ge.u.a.`d...a.`a.v.a.`c.v.a.Richw.a.........PE..d....6.e.........." .....v...R......@>...............................................%....`A........................................0...`...............................xU.............8...............................8............................................text....t.......v.................. ..`.rdata..R7.......8...z..............@..@.data...............................@....pdata..............................@..@_RDATA..............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4640
Entropy (8bit):	3.7271215593412443
Encrypted:	false
SSDEEP:	96:Kw/Pg6KAXlFHmk9/BabDIWebYNnitU42S42Lx:s1E
MD5:	6CCC14F0F72BB4398F0A15CC96BBBB86
SHA1:	891A0A4069C8CCEC4540387A213A445E7A65982F
SHA-256:	F35E1BED01D9EFDD2566F6A07560D263CE6CD9494AED03CD3564A7788F6FFA41
SHA-512:	1EF640FEC7F68587E938646AB2771F5BFA8384542E401B097CFCE3A0D0B67A3F5A6F756FC9F66C77D7D8AC6DAA87D227864E7B44FC81A64BEBC42254DEE906EE
Malicious:	false
Preview:	..;.....;. .T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r.D.r.i.v.e.r...i.n.f.....;.........[.V.e.r.s.i.o.n.].....P.n.p.L.o.c.k.D.o.w.n.=.1.....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s.G.U.I.D. .=. .{.4.D.3.6.E.9.6.8.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s. .=. .D.i.s.p.l.a.y.....C.l.a.s.s.V.e.r. .=. .2...0.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....C.a.t.a.l.o.g.F.i.l.e.=.T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r.D.r.i.v.e.r...c.a.t.....D.r.i.v.e.r.V.e.r. .=. .0.1./.2.5./.2.0.2.4.,.1.1...2.4...5.4...2.8.4.............[.M.a.n.u.f.a.c.t.u.r.e.r.].....%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.=.S.t.a.n.d.a.r.d.,.N.T.a.m.d.6.4.........[.S.t.a.n.d.a.r.d...N.T.a.m.d.6.4.].....%.D.e.v.i.c.e.N.a.m.e.%.=.T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r._.I.n.s.t.a.l.l.,. .R.o.o.t.\.T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r._.I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.....%.D.e.v.i.c.e.N.a.m.e.%.=.T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r._.I.n.s.t.a.l.l.,. .T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r._.I.n.d.i.r.

C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewerVPN.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5852
Entropy (8bit):	4.8898985616021315
Encrypted:	false
SSDEEP:	96:q2i3bD2JlgdmibjR+iAz4C7bZ7xTMPTtQ2rtu3DcNSjXKjvKY8kz7s7wfQTXvMYk:ri3WJlgdmibjR+iAUC7bQPu6o3DcNSju
MD5:	65FA1C2E7127E7B7D42A712574BE0877
SHA1:	2BEA89F8A0D9A867C6BB7711F51ECB7ECDB0F988
SHA-256:	07C7CFF907E6BCC9C3B587728C055DF6DE9F5089AC1C4BAB4014A8993A5FF788
SHA-512:	27BDC76B443DABC72FE7EA9338716B3BD4520858A2CB40BB4F4C00E1FA423F3A2FD339E305C68A81AC8474B794FE8BA5AC7DD07FDC9FBAE52D48E2AC37DB5874
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2021 TeamViewer Germany GmbH ..; ***************************************************************************....[Version].. Signature = "$Windows NT$".. CatalogFile = teamviewervpn.cat.. ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}.. Provider = %Provider%.. Class = Net....; This version number should match the version..; number given in ..\version.m4... DriverVer = 10/08/2020,9.24.6.601....[Strings].. DeviceDescription = "TeamViewer VPN Adapter".. Provider = "TeamViewer Germany GmbH"....;----------------------------------------------------------------..; Manufacturer + Product Section (Done)..;----------------------------------------------------------------..[Manufacturer].. %Provider% = teamviewervpn, NTamd64....[teamviewervpn.NTamd64].. %DeviceDescription% = teamviewervpn.ndi, root\teamviewervpn ; Root enumera

C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	11460
Entropy (8bit):	7.27311231791528
Encrypted:	false
SSDEEP:	192:6F7Y/7MMMyECxPpramyKQFWQFN4p7El+X01k9z3ApdzO4:dg4h8FR7oY+R9z6p
MD5:	7BDE799A1F3A2D770E132E646DCB7FBE
SHA1:	D8FA17ADFB97E97F7604BCDA40B3B0A3AA3A17FA
SHA-256:	9A3039C3D44BAF9B38302C73F5D1EDEF209A6A56E3A4BB1BE325479C1883C4F9
SHA-512:	0FD462F2D6DC3DFB18F83EE235207C8B435D2D4A3BFBB51CEC04D3CF12B57068F130D9494D1AF5034AA9E89B8268EC334D8F61171F2BB62CD7B254CF0FB0FF7C
Malicious:	false
Preview:	0.,...*.H........,.0.,....1.0...`.H.e......0.....+.....7......0...0...+.....7......,.c.w)K....Z..^..231018055851Z0...+.....7.....0...0..7. \..P....W8..oY.C.Dd.~...QT..5m<1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... \..P....W8..oY.C.Dd.~...QT..5m<0h..+.....7...1Z0X...F.i.l.e.......Ft.e.a.m.v.i.e.w.e.r._.v.i.r.t.u.a.l.d.e.v.i.c.e.d.r.i.v.e.r...d.l.l...0....{.j.......H..N.E..:1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0h..+.....7...1Z0X...F.i.l.e.......Ft.e.a.m.v.i.e.w.e.r._.v.i.r.t.u.a.l.d.e.v.i.c.e.d.r.i.v.e.r...d.l.l...0.....a.]QI,.A..Te.W.H..71..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0h..+.....7...1Z0X...F.i.l.e.......Ft.e.a.m.v.i.e.w.e.r._.v.i.r.t.u.a.l.d.e.v.i.c.e.d.r.i.v.e.r...i.n.f...0../. .!e..W....^.b.&..~Q;.......#}..1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+...

C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	604952
Entropy (8bit):	6.471942712240294
Encrypted:	false
SSDEEP:	12288:FKt/PGMjuTxFzMp25O5sXwYTSaqU6LwonnRDt8:FiGDIKAYTSaRfunRDi
MD5:	A380586D76C8AC7D594FCC584D3EB3D5
SHA1:	67B07EB2B6DE9BBE2485A5B9075218DC70752388
SHA-256:	816DEFEC7889C3B4F69D253492402E2E3D0F0016CD5A22136828D5B60A2AA33E
SHA-512:	14D09A692964202300D71506E2741A46EB8BB2A54332E2B370AFDE3B5021DB2DC06737718D6EAFC680DD05BCD130872B5EC860CB80EB2BE3C2910B7B2536F306
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...Z...Z...Z..."...Z..."..*Z..."...Z...&...Z...&...Z...&...Z..."...Z...Z..PZ..."...Z..I&...Z..I&...Z..I&...Z..Rich.Z..................PE..d...r.'e.........." ...".h..........................................................xY....`A.........................................W..h...8X..<...............tX.......U.............8.......................(...0...@...............H....T.......................text....f.......h.................. ..`.rdata...............l..............@..@.data........p...$...T..............@....pdata..tX.......Z...x..............@..@.didat.......`......................@..._RDATA..\....p......................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2420
Entropy (8bit):	5.324223103982517
Encrypted:	false
SSDEEP:	48:x+FhiEAMeGZIVsomMGVWtbAM62fUifVwqgPbKJn0Fjeu70Fpn0Fpa70FLe4CAo0f:x+zinSZIVstMXtsM62fUif1gGJ0Ku704
MD5:	7A630E28A84F90884018048A034D3AB4
SHA1:	B661B95D51492CE7410ADC5465E157FE48A7C837
SHA-256:	FD2165838357E9FE0BCA5EBB621326950F7E513B9E85A2ABE8A5D006237D8317
SHA-512:	EA566268AE74FDF9A930442DAFE415A9FFCD892B9E1EF4A43D3BCA9862CD5FAD23A8CEE5CE7AD11C242CF1183FA4BD2F5E6FC93BE1D8789F4D92579E2FD89F6E
Malicious:	false
Preview:	;..; TeamViewer_VirtualDeviceDriver.inf..;....[Version]..Signature="$Windows NT$"..Class=System..ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318}..Provider=%ManufacturerName%..CatalogFile=TeamViewer_VirtualDeviceDriver.cat..DriverVer = 10/12/2023,9.33.58.52..PnpLockDown=1....[Manufacturer]..%ManufacturerName%=Standard,NTamd64....[Standard.NTamd64]..%DeviceName%=Device_Install, root\TVVirtualSmartCardReader....[SourceDisksFiles]..TeamViewer_VirtualDeviceDriver.dll=1....[SourceDisksNames]..1 = %DiskName%....; =================== UMDF Device ==================================....[Device_Install.NT]..CopyFiles=UMDriverCopy..Addreg=LogParams_AddReg....[Device_Install.NT.hw]....[Device_Install.NT.Services]..AddService=WUDFRd,0x000001fa,WUDFRD_ServiceInstall....[Device_Install.NT.CoInstallers]..AddReg=CoInstallers_AddReg ....[Device_Install.NT.Wdf]..UmdfService=TeamViewer_VirtualDeviceDriver,TeamViewer_VirtualDeviceDriver_Install..UmdfServiceOrder=TeamViewer_VirtualDeviceDriver..UmdfMethodNei

C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\TeamViewerVPN.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5391
Entropy (8bit):	4.832043523407305
Encrypted:	false
SSDEEP:	96:s2iQJD2WlsdGebjR+iAz4C7bZ7xpRStQ2rtu3DcNSjXKjvKY8ks7nuwfQTXv/zof:FiQQWlsdGebjR+iAUC7bpR6o3DcNSj6e
MD5:	447FC733747DB11CD4492AE01C5652FE
SHA1:	2A70DCD391464CB8D3736322E07E966E105D396E
SHA-256:	A817B0E8A669D5ACAF2DDFBC95ACF2A1213B092B44DC896A0EE4A5301D06EBC3
SHA-512:	238099DB072AF55445D421E941944ABE8A6F52A124A26CAE84C1DD52FFFAFC4DAC5586D0C7407B461CD0DB8E771E1DBB6CA34AEE84581B24347F401410B2AFE5
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2007 TeamViewer GmbH.. ..; ***************************************************************************......[Version].. Signature = "$Windows NT$".. CatalogFile = teamviewervpn.cat.. ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}.. Provider = %Provider%.. Class = Net.. DriverVer=11/27/2007,2.10.00.0000....[Strings].. DeviceDescription = "TeamViewer VPN Adapter".. Provider = "TeamViewer GmbH"....;----------------------------------------------------------------..; Manufacturer + Product Section (Done)..;----------------------------------------------------------------..[Manufacturer].. %Provider% = teamviewervpn,NTamd64....[teamviewervpn.NTamd64].. %DeviceDescription% = teamviewervpn.ndi, teamviewervpn....;---------------------------------------------------------------..; Driver Section (Don

C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	10645
Entropy (8bit):	7.272624114612594
Encrypted:	false
SSDEEP:	192:H64PyG0o6orbfUG3afdjIafdjShjFivhE:jnrbVafdjIafdjcjFiJE
MD5:	5CFFE65F36B60BC151486C90382F1627
SHA1:	F2A66EAE89B4B19D4CAB2AC630536AF5EEEEF121
SHA-256:	AA7C09A817EB54E3CC5C342454608364A679E231824F83BA5A2D0278EDCC1851
SHA-512:	1BD48EF66F8714E7E9591043D03BD69A30881ED3D0F2463B15750A3282DF667FFB076B3A92358EECEDAE0E54485B07D702667E8FE0AF64C52BE04DB47145920B
Malicious:	false
Preview:	0.)....H........).0.)~...1.0...+......0.....+.....7......0...0...+.....7.....^FZ..t.K.........071228163009Z0...+.....7.....0..^0....R2.A.7.0.D.C.D.3.9.1.4.6.4.C.B.8.D.3.7.3.6.3.2.2.E.0.7.E.9.6.6.E.1.0.5.D.3.9.6.E...1..O0>..+.....7...100....O.S.A.t.t.r........2.:.5...2.,.2.:.6...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...i.n.f...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........p..FL..sc".~.n.]9n0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R8.7.C.A.9.7.9.F.2.2.A.E.3.2.A.2.6.8.5.5.1.C.A.1.9.6.2.C.D.9.5.2.F.D.E.2.3.8.6.9...1..W0>..+.....7...100....O.S.A.t.t.r........2.:.5...2.,.2.:.6...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........".2.hU...,.R..8i...L0..H0

C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35112
Entropy (8bit):	6.279693420486803
Encrypted:	false
SSDEEP:	768:/a/ZSDKMhnknetMdlHJRXz0yjSDomtN6l5cJQGftSSXakqEqLXb9:C/ZWnkn0uTRXz00Ss1m1YvEq/9
MD5:	F5520DBB47C60EE83024B38720ABDA24
SHA1:	BC355C14A2B22712B91FF43CD4E046489A91CAE5
SHA-256:	B8E555D92440BF93E3B55A66E27CEF936477EF7528F870D3B78BD3B294A05CC0
SHA-512:	3C5BB212467D932F5EAA17A2346EF8F401A49760C9C6C89C6318A1313FCBABB1D43B1054692C01738EA6A3648CC57E06845B81BECB3069F478D5B1A7CBCB0E66
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mN... ... ... ...... ...N... ...!... ...[... ...]... ...M... ...Q... ...\... ...X... .Rich.. .........................PE..d.....`G.........."......Z..........................................................\|......................................................0...<....................t..(...........0q...............................................p..(............................text....P.......R.................. ..h.rdata.......p.......V..............@..H.data...x............`..............@....pdata...............b..............@..HINIT.................f.............. ....rsrc................n..............@..B.reloc..<............r..............@..B................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	10136
Entropy (8bit):	7.111963563245086
Encrypted:	false
SSDEEP:	192:xpkA4I/yo2JC6vyyKwnsFWQF3lrIzLMmDWqnajKs57wczb:J52lrnsFRJlrEQmDWlGs53
MD5:	87F9F85E95F9FBE3846E145CEC886E42
SHA1:	BAA55A0CFA3DBAAC1D082C4A2FEE1DA43DEABCF1
SHA-256:	CC2359A2FBF7962B3DF4D88D75A878A393F8C2694465D629F67593C107F94B0C
SHA-512:	D80DEC2C15FF05B9E6468BF5841BB024F48B0EB6822E932D65EED024B4A8FAE352AFE370E798CEE9AA2C06773E2163E849AF40B14C3B7D2C3657186F61278FBF
Malicious:	false
Preview:	0.'...*.H........'.0.'....1.0...`.H.e......0..u..+.....7.....f0..b0...+.....7.......~.?..A./:.d.)...211208152411Z0...+.....7.....0.. 0....R2.B.E.A.8.9.F.8.A.0.D.9.A.8.6.7.C.6.B.B.7.7.1.1.F.5.1.E.C.B.7.E.C.D.B.0.F.9.8.8...1..+0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0E..+.....7...17050...+.....7.......0!0...+........+....g.w....~...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R7.9.9.D.C.6.4.0.E.9.9.5.E.4.2.7.5.6.B.D.C.2.E.5.9.3.9.A.7.0.4.1.3.D.6.5.4.A.2.3...1..=0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........y..@..'V...pA=eJ#0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l.

C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46936
Entropy (8bit):	6.656488161316276
Encrypted:	false
SSDEEP:	768:XD0lMrZrZwFu/xdw9/oxBwNNyElQWmjI11YiWJ1hP4n2u41z2:6MT1ZyFoElQWAI11772H2
MD5:	6317A1890582D5ABB3E3E3EE6B217411
SHA1:	78F44D94212467FC61B98EFBDA91F2BC701E1A39
SHA-256:	3A09C3A24EC480BA4AD466760996E0F3CED30C1499ABDA32DA6EAD9DE5D08836
SHA-512:	6241DC81EF29736972D2E8CE3FE0C52371445CF80E5EBF22630D9F29B1953470A0F2C15A57262E400F90773EB74428AF4521C744ACFE7D202F19EBF9B7AE3E03
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........JF..+(.+(.+(.@..+(.@).+(.+).+(.@+.+(.@,.+(..^,.+(..^..+(..^*.+(.Rich.+(.........................PE..d..../La.........."......X.....................@..........................................`A....................................................<............p..T....v..XA...........R..8............................S...............P...............................text....=.......>.................. ..h.rdata.......P.......B..............@..H.data........`.......N..............@....pdata..T....p.......P..............@..HPAGE.................T.............. ..`INIT.................b.............. ..b.rsrc................n..............@..B.reloc...............t..............@..B................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\tvmonitor.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	8881
Entropy (8bit):	7.27496797439638
Encrypted:	false
SSDEEP:	192:Ast9AnYe+PjPtrwnc8ijtlAur9ZCspE+TM4rwMcA0qTv0a:NAnYPLWUUHeM4cAVv0a
MD5:	1F2380A5474583DBA929F761A760546F
SHA1:	561248613C6F443D8A993900E2DBEBF3B718A660
SHA-256:	143DF27418B1EAF375BED6291765E2E77166830D6216A6BFB71A075735F05DA5
SHA-512:	4309403DF0A29C53190833AA13A6E67A4501650B77106BC62925F691DFFEDCAB184B6DF3B8BA750E0A8FD4C9B6E0919B729F5BD250413178CD7A4CE287241AED
Malicious:	false
Preview:	0."...*.H........".0."....1.0...+......0..\|..+.....7.....m0..i0...+.....7......i.&...E..l....N..170512092819Z0...+.....7.....0..F0....R2.9.6.0.7.A.C.D.0.3.F.6.4.A.B.F.5.2.3.9.8.B.F.3.D.E.0.4.E.8.1.9.D.1.A.0.8.C.3.4...1..K0>..+.....7...100....F.i.l.e........t.v.m.o.n.i.t.o.r...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........)`z...J.R9........40V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.5.E.A.8.D.A.C.7.0.9.3.1.2.3.E.2.6.5.8.4.A.4.9.0.1.2.5.1.7.8.1.8.C.0.F.5.8.6.D...1..C0>..+.....7...100....F.i.l.e........t.v.m.o.n.i.t.o.r...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........U.p..>&XJI.%....Xm0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0....+.....7......0.....O.S

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\Client-built.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\Client-built.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKAplL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:zDImsLNkPlE99SNxAhUe/3
MD5:	54C8475C895CC8BFF53396A57A94E411
SHA1:	4A1735471B8A9CF13E89428F1E583858D8C2C926
SHA-256:	CF5F5D2633C78C73EBBA144B22A8E0843953A486E01F47A94C913CB4C6141E3E
SHA-512:	6C233170EEC71DD2A016008935EDDB39468A64BE32169A1E46C112E0B106417273E53A936E1E621B4FA6BC3E4A1F6D49DE593CAF599919E3364875C6F3FBDB3E
Malicious:	false
Preview:	p...... .........x.*cJ..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\lz3EbiqoK4.exe.log

Download File

Process:	C:\Users\user\Desktop\lz3EbiqoK4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	388
Entropy (8bit):	5.20595142366915
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10U29xtUz1B0U2uk71K6xhk7v:MLF2CpI329Iz52Ve
MD5:	2452328391F7A0B3C56DDF0E6389513E
SHA1:	6FE308A325AE8BFB17DE5CAAF54432E5301987B6
SHA-256:	2BC0F7D1CBD869EF4FD93B95495C8081B01B3FD627890B006B6A531D8C050AA2
SHA-512:	AC65283B0959E112B73160BB4322D0725C7D0EC79E3BB93555B1412204AA72F1F66BB9EB8D8B24B6570EC8717A1A4A129454588C3EA9ACE206B6E9CCB7F2ABDC
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Client-built.exe

Download File

Process:	C:\Users\user\Desktop\lz3EbiqoK4.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3266048
Entropy (8bit):	6.0837240941236725
Encrypted:	false
SSDEEP:	98304:bvk22SsaNYfdPBldt6+dBcjHwKRJ6JQa:TJ7jjM
MD5:	181719B653C83D0463D89A625A7F5C3E
SHA1:	1173005BE27979DC74779E60DC790299E4F2B0A4
SHA-256:	03A4B081B4966130CBE615FF249954E7E9A0D62A79FAF8E56AC3830929748E43
SHA-512:	D05E6FC586A8731903DF4CFFE3BDCB92F99E2CDBE15E40706E87ECC038E4E9B1EF1FC9A39F8ADEDA4341E3507F2F8F81AE50D590FF9F4233CD7694B26FB3FA04
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: ditekSHen
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1...........1.. ........@.. .......................@2...........@...................................1.W.....2...................... 2...................................................... ............... ..H............text...4.1.. ....1................. ..`.rsrc.........2.......1.............@..@.reloc....... 2.......1.............@..B..................1.....H........................k..p............................................0..M....... ....(.....(...........s....(....(...........s....o....(.....(....s....(........0..8.......(....(0....s....%.o....%.o....%.o....(....&..&...(.............--..........00.......0..@........o....,7(....(0....s....%.o....%.o....%.o....(....&..&...(.............-5..........08......f~w...,.~....(....(.....v.(.....s....}.....s....}....r..(......(.....(......(....*....0..L........{....r...po....

C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe

Download File

Process:	C:\Users\user\Desktop\lz3EbiqoK4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	72005560
Entropy (8bit):	7.999967414230672
Encrypted:	true
SSDEEP:	1572864:Ve9Md8ir5RcKqhxdJjHKO56/nMgt5LhZx5oZiJG2Ol40hi7iU:E2NdRTqhXJDLenHhZx+ZiJcl4n
MD5:	D15511E4B90CC6729FEDAF86D080D1F6
SHA1:	F793057F848979822C892AD135AF23C6B45EE15B
SHA-256:	F5BA0D0FAB79FAFF553D77B2BE94AD3B21D978AF62C716D580995978E2A316D6
SHA-512:	6661E262B9C0D2FFEE467F4503257FC3DE4736A47B805660315E813EE0523C5A1696628DC89B77EC2662E52D6D8EF069F9D9B0E91B51B7BDBF7FFD3916495341
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F..v...F...@...F.Rich..F.........................PE..L....z.W.................^...........0.......p....@..........................`......?MK...@.................................(t..........hk............J.0/...........................................................p...............................text...[\.......^.................. ..`.rdata..F....p.......b..............@..@.data................v..............@....ndata.......@...........................rsrc...hk.......l...z..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\TvGetVersion.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	702776
Entropy (8bit):	6.74302767407908
Encrypted:	false
SSDEEP:	12288:H9bt5E1nHSqUSCX0UD0GgUGLt9jkqvaStOIkWk5Yu5yclFQxq8p0:H9btgnHSqUSCXnD0GgUGLt9jkm3Ask5v
MD5:	878C644C12C3D96438C2909FBB7375CD
SHA1:	4FB206E213BD088E28A1C10AB815D1BFD1B522F1
SHA-256:	75CF60D72A2CB6A748DB6F69E2BFA065422DF7BB6636D3C214F5435341574A66
SHA-512:	DF0D1903901FFAF7CA1EE22CC5B8BAC37CB554F78ED07A8CCAF84A2CD6FB7F9AC5599CAAD83D92079E170190701A9391468331EC8AA562BFDF32376703E05BD8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..(.p.{.p.{.p.{...z.p.{...z.p.{...z.p.{...z.p.{.p.{.p.{Z..zNp.{Z..z.p.{Z..z.p.{\S.{.p.{...z.p.{...z.p.{...{.p.{.pq{.p.{...z.p.{Rich.p.{........PE..L......d...........!................................................................C.....@.........................P... ...p ..........@...............8/.......Q..\|...T.............................@...............$............................text............................... ..`.rdata.............................@..@.data....@...@......................@....rsrc...@............2..............@..@.reloc...Q.......R...8..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TV15Install.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3354
Entropy (8bit):	5.085404755027287
Encrypted:	false
SSDEEP:	48:8RLHoRhbqlLACBeky7yaEHhRMoKZgMian0i6Xmj/t84ht4fPLtfLI92x0w:ILH+laKTEBYZgMiaJaCteLV1
MD5:	C2B771362CB13ECA6AB87B6A5B935755
SHA1:	BDF0CE6B5B7E45414BD2FEC131C118376AB14823
SHA-256:	E910BBDD7DB7755F273740CB5A3692686F67AB910A020D7F7B965E017CBCB6B0
SHA-512:	FC8819E516AFDD487A12E80C45103CF7AF7FC531718AF16CEA0B613F3967C32A0D8EF4317EC25611DE73B9A5F11B13D07CD7798D191DC25A5127CFD6CD33F84C
Malicious:	false
Preview:	2024-12-09-12-52-56 ----------------------------------------------------------------------------------------------------..2024-12-09-12-52-56 Installer: TeamViewer..2024-12-09-12-52-56 Version: 15.59.5 (JMP-91.4)..2024-12-09-12-52-56 Install mode: Admin..2024-12-09-12-52-56 Account type: Admin, UAC supported:1, Elevation:2..2024-12-09-12-52-56 Time: 2024-12-09-12-52-56..2024-12-09-12-52-56 OS-Version: 10.0.19045(64-bit) SP:0, Type:1..2024-12-09-12-52-56 OS-Info: Server:0 Home server:0..2024-12-09-12-52-56 User-SID: S-1-5-21-2246122658-3693405117-2476756634-1002..2024-12-09-12-52-56 Log level: 100 (default)..2024-12-09-12-52-56 ----------------------------------------------------------------------------------------------------..2024-12-09-12-52-56 ..2024-12-09-12-52-58 TVInitRollback(): create scheduled task for restore..2024-12-09-12-52-59 Create backup directory:<C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TVInstallTemp>..

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	71272344
Entropy (8bit):	7.999987306679704
Encrypted:	true
SSDEEP:	1572864:re9Md8ir5RcKqhxdJjHKO56/nMgt5LhZx5oZiJG2Ol40hi7id:C2NdRTqhXJDLenHhZx+ZiJcl4m
MD5:	8318FC63158C01368AADC6D4BE89FAD1
SHA1:	88F4AEFCBDD5A748EC21469A565D9C57B7F6CB46
SHA-256:	B64A8F72105117FF71ECA4692DF030B6E60C4ABA2631E0FE01411086BB42B1DC
SHA-512:	DB7601C5A1AD25CF3F076C8C504EB885D3EBE6358A6490492DEE967C7FF5AC72319AAF75EDBFFD7FB0F7102473A2C16830408C7762283C67A374535EF8420076
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L....z.W.................b...*.......3............@.................................0k@...@..........................................`..............hX?.0/...........................................................................................text...]a.......b.................. ..`.rdata...............f..............@..@.data...8............z..............@....ndata...................................rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\install.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.299916880895009
Encrypted:	false
SSDEEP:	3:HWRBXUrDikRLWvSGXR1mQWRKRL4RLJ:H8XUWkRL+TWgL4RLJ
MD5:	A3C26DD25FC88922E9297E2A9D04AC53
SHA1:	807B0CA16C4080B6CE7AE8B09E7DCCE7E52D5C19
SHA-256:	1C5231379C3025A42D51F956F649C445EBC550F9AD9B9F5CC4AE5E627EF456B3
SHA-512:	1D36EE7B43D82B72000520C0B0C37585576363FCD506AEAB362C544000B0BF9702A357E118B2AE3499D8F8C9A7529F56169CC14E5281A5246AE9EFD342C4FA59
Malicious:	false
Preview:	[Installer]..DefaultInstallation=1..UnattendedAccess=0..CustomInstallation=0..

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\tvinfo.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.703465189601647
Encrypted:	false
SSDEEP:	3:HWRFRLMKxKAhdXCzTtA7:H4RLMqKAh8zm
MD5:	A48B05E8E36F7F4E9096ADE8950B87E4
SHA1:	C743C68FB5798389435927338D1C8ED1C59496A2
SHA-256:	72935BCB05A31B405A0E4A13EB0BABD1640BBE03FAD52FF85FFA91390D0E8EEE
SHA-512:	7943A5C44C136347F199A1A3E1AA8AF3F4EE9D5024D4588E3FAA95F57DCD51292E606A057D567D45C8BC9D62EBFCFEBD199654D1F1214B205124418C592F47F7
Malicious:	false
Preview:	[Installation]..INSTEXE=TeamViewer_Setup_x64.exe..

C:\Users\user\AppData\Local\Temp\nsn5C48.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	73450358
Entropy (8bit):	7.942447696919663
Encrypted:	false
SSDEEP:	1572864:AZQtHGL2imNGck9gTKQtEZjZjb914komphRDrGdXCl2EXTcAeUL:aAm3gtEZR4KfR/l2EeA
MD5:	8501B26923CBA585012B43C6E2ED1507
SHA1:	05B7FDAE45254680888186EF51A188C80903D7E9
SHA-256:	39C57507250071C76253592748EA2AA9ED19D370AD3F16FB73EBD78F34159564
SHA-512:	3FDB930BB02BFB803B88FF5A25D6DAE98450C476F4ABAEFC0157EE8B157DA462EB0AB0CE8B241C10C3F9F6627E72AE0981AFEFC1810349916EC3655197AE785A
Malicious:	false
Preview:	.b%.....,.......................<.......r1%.!....b%.....................................................~...................................................................................................................................................................................G...J.......................F.......y.......................................................................................................................%...............................................................................................................................D.......k..............................................j.......l...r...t..............................................................................................................................4.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\InstallOptions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27960
Entropy (8bit):	6.728473100924503
Encrypted:	false
SSDEEP:	384:E4C43tPegZ3eBaRwCPOYY7nNYXCT/YosaiZSf+VIYiWL3LU9Pxh8E9VF0NyzDcHF:ElTgZ3eBTCmrnNAho/YiWk9PxWEZsOe
MD5:	E87068563FC18E67A78230067CC240E5
SHA1:	37CD2CB5581FC575B8C46383D877926BDA85883B
SHA-256:	822F75B69DD87332B5995528771923EC74DC5329C65094BF4E372EB8EF42BB8E
SHA-512:	DAB6B330D73ABADB63F6EB02A5BC87CE9B9D1BC64FCB9289581CFC2E04BE0254893945B3BDB762B382BB491388E34BC018F098A489908DFBC9FECA2A9BA13D5D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.px.q.+.q.+.q.+.q.+[q.+.~C+.q.+^R.+.q.+^R/+.q.+.w.+.q.+.Q.+.q.+Rich.q.+........PE..L....z.W...........!.........`.......+.......0......................................................................8......X1.......................>..8/......X....................................................0..X............................text............................... ..`.rdata..G....0......."..............@..@.data...DL...@.......,..............@....rsrc................6..............@..@.reloc..x............8..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23864
Entropy (8bit):	6.996623524463238
Encrypted:	false
SSDEEP:	384:58QIl975eXqlWBrz7YLOlACZSf+VIYiWLbLWQaZdPxh8E9VF0Ny0W3N9:5gPgrfYLOWJ/YiW8PxWE6Y9
MD5:	938C37B523D7FC08166E7A5810DD0F8E
SHA1:	47B9663E5873669211655E0010E322F71B5A94BE
SHA-256:	A91AA7C0EAD677FC01B1C864E43E0CACE110AFB072B76AD47F4B3D1563F4DC20
SHA-512:	77AFE83FB4E80A775DAE0A54A2F0FF9710C135F9F1CF77396BC08A7FE46B016A8C079B4FA612E764EEA5D258703F860688E38B443E33B1F980E04831739517C1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....z.W...........!..... ...........'.......0...............................`......\|#...............................2.......0..P.......................8/...P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\TvGetVersion.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	713528
Entropy (8bit):	6.691023897960291
Encrypted:	false
SSDEEP:	12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
MD5:	41C3A6594060581D3BF1A16ED4AE6A72
SHA1:	62BDF8C2A3FA5F70E8B25E83C946DEBF80C8FD47
SHA-256:	E35396C7D7E32A8FE771895ED9EA16BD85C8544410BF4DC70A42CCD2884CFD83
SHA-512:	3FEE7EA74B4173B2815D631C8E69F5A21F2A170A46CE60424F9B9FB03CF7A35EAB6933210497F851816A1A85EB3FDB682781CCB5E2607B7ADE6DBC7A098368BD
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........E.;.$eh.$eh.$eh.Vfi.$eh.V`im$eh.Vai.$eh.Vdi.$eh.$dh\|$eh.Q`i.$eh.Qai.$eh.Qfi.$eh..Uh.$eh.Q`i.$eh.Qei.$eh.Q.h.$eh.$.h.$eh.Qgi.$ehRich.$eh........................PE..L......d...........!.........Z......>........................................ ...........@.........................P8.. ...p>..........@...............8/......pQ......T...............................@...............,............................text............................... ..`.rdata..............................@..@.data...LO...`.......B..............@....rsrc...@............\..............@..@.reloc..pQ.......R...b..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\UAC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30520
Entropy (8bit):	6.8630485708295605
Encrypted:	false
SSDEEP:	384:QqVibvTh4qnFP+OPEzinclP+RZSf+VIYiWLglLoPxh8E9VF0NyH5TV:QqVavVfPkzhlmg/YiWLPxWEFX
MD5:	488819F838ABFCAD73A2220C151292EE
SHA1:	4A0CBD69300694F6DC393436E56A49E27546D0FE
SHA-256:	B5BB8D301173C4DD2969B1203D2C7D9400BA3F7F2E34EE102905BD2724162430
SHA-512:	B00D6CF712FE4CEFCE41479F6E6F4AA5EA006694D10F2837204DE5BDE1C5A4BEF1368F2B0EB4B66D57A66E8CE6DC335FA91E9C8017E8E125C27EB1F5DF4DE9A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......DH.".)lq.)lq.)lq.)mqP)lq.!1q.)lq./jq.)lqT.]q.)lq..hq.)lqRich.)lq........................PE..L...lKPJ...........!.....4...........:.......P.......................................................................B..J....:..x....`...............H..8/...p..........................................................L............................text...Z3.......4.................. ..`.data........P.......8..............@....rsrc........`.......@..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\UserInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16184
Entropy (8bit):	6.9836578650009375
Encrypted:	false
SSDEEP:	192:hxvcecjqZSF8VG+VIYiYF8u7a7JV+A0MLyfP+noPOJB3hy2sE9jBF0NyH0lQkzkT:QrWZSf+VIYiWLyLvPxh8E9VF0NyHka
MD5:	77FF6A927940A0E4B8DC07BDDE6AB5DB
SHA1:	8D0035242289504D050D237F7E3E548C1DDFF077
SHA-256:	E1CB80A23786B02CB2C6A2F9E391B63CBF3AD911E42BBDC14CC6879C84B7404E
SHA-512:	6A3050DC8E3F4EAAA85A43CDF1AC4F69745C07EFE48268103EE7D8927EC574B6866740F95E6B3AFF154BA74CD05024223A3EA4957CB773DD065CFD797F8A07E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..................[.........Rich..........................PE..L....z.W...........!................j........ ...............................P......_............................... "......L ..<.......................8/...@..p.................................................... ..L............................text............................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\advanced_unicode.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	3.6031642286014898
Encrypted:	false
SSDEEP:	24:Q+soqioC/irl1vSCm6a/gC863pXH/aKCo6sSljRF3Cb6LlTQ8CC6Llfnq84RUv:rs4Yx1vEFhaoWXrEJfq86a
MD5:	F68824A4130EBAF6BC7AB0F62256D7D7
SHA1:	40AF19A0D92B3C9E1A8B1EAAB7D12C69E5DF436A
SHA-256:	CD8149A2E89373075EE6DB800B7F2496BACBFE21B23E4A06A3453632503B3965
SHA-512:	6A173AAA183BE0E5A516CAD484802DAE1FC53A414F870F93EA846A9EF9F9DF35153766EF632EB5E8CED8F94C2ED09A9DECDF3465D46B0DCC44A6918D88E242CB
Malicious:	false
Preview:	..[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.6.....R.T.L.=.0.........[.F.i.e.l.d. .2.].....T.y.p.e.=.T.e.x.t.....L.e.f.t.=.1.0.....T.o.p.=.1.4.....R.i.g.h.t.=.1.7.3.....B.o.t.t.o.m.=.2.6.....S.t.a.t.e.=.C.:.\.P.r.o.g.r.a.m.m.e.\.T.e.a.m.V.i.e.w.e.r.........[.F.i.e.l.d. .1.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.0.....T.o.p.=.0.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.7.....T.e.x.t.=.D.e.s.t.i.n.a.t.i.o.n. .d.i.r.:.........[.F.i.e.l.d. .3.].....T.y.p.e.=.B.u.t.t.o.n.....L.e.f.t.=.1.8.9.....T.o.p.=.1.2.....R.i.g.h.t.=.2.6.9.....B.o.t.t.o.m.=.2.7.....T.e.x.t.=.B.r.o.w.s.e...........F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .4.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....L.e.f.t.=.1.0.....T.o.p.=.3.6.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.4.5.....T.e.x.t.=.I.n.s.t.a.l.l. .T.e.a.m.V.i.e.w.e.r. .P.r.i.n.t.e.r. .D.r.i.v.e.r.....F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .5.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....L.e.f.t.=.1.0.....T.o.p.=.5.5.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.6.4.....T.e.x.t.

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\finish_unicode.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	3.530715965349217
Encrypted:	false
SSDEEP:	24:Q+soh1v05h6KPlUwmCX6sXxoByx2/uwmpCG6sULAQl6R5wJCD6sUqQ8lICx/L1:rss1vqDUwrXxRxMuwM+AQowQtICxT1
MD5:	DB0713808219E4D7334171F9E1E6C2BC
SHA1:	8D8C463837CFCE60B6F501DD75B398E3C7ED8A06
SHA-256:	51B57CF2C70006646A76797CADAA5D014C9FF707DA8A4B4E17BCDFCCC3C00FD8
SHA-512:	EF0F8FF01E4F6419BC64AF3A0FADADA15F0C1F23F95A544460DD4FAC83C1DDE3758537FD5F93CC8E3B39A45B310261B3F6511A286D95EE5EDF615EC40AAC08AF
Malicious:	false
Preview:	..[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.5.....R.T.L.=.0.........[.F.i.e.l.d. .1.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.5.....T.o.p.=.2.0.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m. .=. .3.0.....T.e.x.t.=.H.o.w. .d.o. .y.o.u. .w.a.n.t. .t.o. .u.s.e. .T.e.a.m.V.i.e.w.e.r.?.........[.F.i.e.l.d. .3.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5.....T.o.p.=.5.5.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.7.1.....T.e.x.t.=.I. .w.a.n.t. .t.o. .t.e.s.t. .t.h.e. .c.o.m.m.e.r.c.i.a.l. .f.e.a.t.u.r.e.s. .w.i.t.h. .a. .f.r.e.e. .1.4.-.d.a.y. .c.o.m.m.e.r.c.i.a.l. .t.r.i.a.l.....S.t.a.t.e.=.0.....F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .4.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5.....T.o.p.=.7.1.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.8.7.....T.e.x.t.=.I. .w.a.n.t. .t.o. .u.s.e. .t.h.e. .f.r.e.e. .v.e.r.s.i.o.n. .f.o.r. .p.e.r.s.o.n.a.l. .u.s.e.....S.t.a.t.e.=.0.....F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .5.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5...

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\ioSpecial.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	546
Entropy (8bit):	3.657658544544843
Encrypted:	false
SSDEEP:	6:Q+slAm+fpIKiieXtAP9IHauQl33CslECmsCpi8lnMm2RKUEZ+lX1AWm5LlcTcpi4:Q+samuIfHaHNCsgsSaJRKQ1AJLJpDTV9
MD5:	C33C779207C18F367DE4158CB6BA12CA
SHA1:	7589131A6C1478A080CD3FD00AC4FEB596E32170
SHA-256:	B6FD863D06A2E82B9F938296232D5206E2F7E6C3AB4996D5AA6FC5630235C43E
SHA-512:	C7A4937DA0488BC867F313F3A6BFF07D6101F0A9F209AA499B4A5EE1771BF2ECF391074A9D5E363991062B90BDDD9D02C48060D1798D03E90FE775EBFA6A824A
Malicious:	false
Preview:	..[.S.e.t.t.i.n.g.s.]...R.e.c.t.=.1.0.4.4...N.u.m.F.i.e.l.d.s.=.3...R.T.L.=.0.....[.F.i.e.l.d. .1.]...T.y.p.e.=.b.i.t.m.a.p...L.e.f.t.=.0...R.i.g.h.t.=.1.0.9...T.o.p.=.0...B.o.t.t.o.m.=.1.9.3...F.l.a.g.s.=.R.E.S.I.Z.E.T.O.F.I.T...T.e.x.t.=.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.n.s.y.5.D.7.2...t.m.p.\.m.o.d.e.r.n.-.w.i.z.a.r.d...b.m.p.....[.F.i.e.l.d. .2.]...T.y.p.e.=.l.a.b.e.l...L.e.f.t.=.1.2.0...R.i.g.h.t.=.3.1.5...T.o.p.=.1.0...[.F.i.e.l.d. .3.]...T.y.p.e.=.l.a.b.e.l...L.e.f.t.=.1.2.0...R.i.g.h.t.=.3.1.5.....

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\linker.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58168
Entropy (8bit):	6.650537239673466
Encrypted:	false
SSDEEP:	768:ZmTLl3rmEgLMP/rLqgidfwHJQDEExmE+Ji4RdVt//wf/YiWGoPxWEfQy:ZgLFm8OdfwpJS/fqt//wf/70Pxf
MD5:	B05A97BB3F532B7CF57B8EEDF198D7AF
SHA1:	83C13A90F4A3C1C62E132F5F3BC70C97C2ECFC80
SHA-256:	7817F79BCDF54EF8617F15B5C0B9B92053549D5A51FA280722EE7179311B69A1
SHA-512:	40706C5FC72198148962D24046722FC5E488C0CC4B3374A9F4B652175919E97A8712E882940DB8C26479619A26EC4E2D41744627A9CA52EC7CB1CE4F91D7EE8C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6e..X6..X6..X6...6..X6..Y6..X6.X.6..X6..%6..X6..66..X6..56..X6.."6..X6..$6..X6.. 6..X6Rich..X6........PE..L......Q...........!.....n...N.......................................................O.................................d......d.......x...............8/.............................................@............................................text....m.......n.................. ..`.rdata..4........ ...r..............@..@.data...............................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
Category:	dropped
Size (bytes):	26494
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:	24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5:	CBE40FD2B1EC96DAEDC65DA172D90022
SHA1:	366C216220AA4329DFF6C485FD0E9B0F4F0A7944
SHA-256:	3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
SHA-512:	62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
Malicious:	false
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\nsArray.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.329913522821918
Encrypted:	false
SSDEEP:	384:nqqedh6EHFRksp7KpFX1ZSf+VIYiWLALiqPxh8E9VF0NymgEy:Ted/FR9mXc/YiWMPxWEspy
MD5:	9761D708EA7C49662A21F6690D439E06
SHA1:	B2E757E7EEE5C788F16D666FB6CF9D41CACCB04B
SHA-256:	8B8BE21FA7BCA491C93683C9F84BB49370CA7E1E864BD0658FF9E1D2809B67E4
SHA-512:	25990A993373009CCBD9E89CAE3FC601928121775D0D5FE326C55A305CE8DE51F35A2CB160E9DFBF3BE82A53DDF7B9864116E7F5D3325AFD7403CD3B7740C652
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%)y.aH..aH..aH..h0..dH..aH..jH..h0..`H..z..cH..z..`H..z..`H..z..`H..RichaH..........................PE..L.....iO...........!.............p..0................................................\....@.........................$.......X...........X...............8/.........................................................................................UPX0.....p..............................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\nsExec.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.099446360233213
Encrypted:	false
SSDEEP:	384:BqbGgezxEqoyGgmkN7ZSf+VIYiWLSL/Pxh8E9VF0Ny4LN2:431yGLk8/YiWePxWEOZ2
MD5:	9EA6EC7934495CC757639B5095362CA7
SHA1:	EF2C14142B70689483576CC09083DB4A2A363E02
SHA-256:	4D8C8353641BBB26BF9EA2AB2DBF126BE6EF164B1CE80E3EF5030B873BE166CD
SHA-512:	414B08F75BD7FEBB56784D8534CEE028F6420776F07CE5797F66A78748C34B52F443AA35F72C8D7C81DD5366B34998B56D99A9D0D2B4B2B6BFC9775E4FF66531
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....z.W...........!......................... ...............................P.......................................$..l.... ..P.......................8/...@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\nsis7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	191800
Entropy (8bit):	6.526825420894023
Encrypted:	false
SSDEEP:	3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
MD5:	7FE20CEE9277556F4EF137E61D29D9F5
SHA1:	D53C37DBF548914ED20C8EBB21186A95BEEF1EE3
SHA-256:	5D71AAEEFBC81732017E9040C8087E6686A16DD54E6D9BCD5BA7A47AF68CC925
SHA-512:	A90250214C6C5048B098E031FCA5A8097854A8667330551D7694740E3BC83F7D77791D314E3AC75617EF1834B75C41E3E3D3C74DA9794A207894C13FB2D4BEF7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.I............7y......7y..9...7y..c...........................i.....7y..~...7y......7y......7y......Rich............................PE..L......M...........!.................w....................................... .......o.............................. {.......q..P.......H...............8/......0...................................8;..@............................................text............................... ..`.rdata...k.......l..................@..@.data...._...........p..............@....rsrc...H...........................@..@.reloc...........0..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\start_unicode.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2132
Entropy (8bit):	3.67500518582924
Encrypted:	false
SSDEEP:	48:ArTYGhjKyTwsJf4VpwX+U2wIoqKb1Cj7n:+T5KyHJgV8+vqb1CHn
MD5:	FF187ECEFC70B4C7B362F91E5B364BCA
SHA1:	002369D2CEA8326CB323E17319CD8D4E766E0B5E
SHA-256:	4255E309D08D7CC98EBFE3644932478EB781878DADED9A2B7F244BC9306DD156
SHA-512:	9B61ACE4500A3234DCCA0AADB78DAC77F34287F19D9D01B7ACA81FB90C0893A34428F8C49BE0A7F9B79CAA959FDBD4EDC3032FE55CA643050D2472F15E076969
Malicious:	false
Preview:	..;. .A.u.t.o.-.g.e.n.e.r.a.t.e.d. .b.y. .E.c.l.i.p.s.e.N.S.I.S. .I.n.s.t.a.l.l.O.p.t.i.o.n.s. .S.c.r.i.p.t. .W.i.z.a.r.d.....;. .3.0...0.1...2.0.0.6. .1.1.:.1.9.:.5.5.....[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.9.....R.T.L.=.0.....S.t.a.t.e.=.0.........[.F.i.e.l.d. .8.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.0.....T.o.p.=.1.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.1.0.....T.e.x.t.=.H.o.w. .d.o. .y.o.u. .w.a.n.t. .t.o. .p.r.o.c.e.e.d.?.....H.W.N.D.=.6.6.7.2.6.........[.F.i.e.l.d. .1.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5.....T.o.p.=.1.3.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.2.9.....T.e.x.t.=.D.e.f.a.u.l.t. .i.n.s.t.a.l.l.a.t.i.o.n.....S.t.a.t.e.=.1.....F.l.a.g.s.=.G.R.O.U.P.\|.N.O.T.I.F.Y.....H.W.N.D.=.6.6.7.1.6.........[.F.i.e.l.d. .7.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....L.e.f.t.=.1.0.....T.o.p.=.1.5.2.....R.i.g.h.t.=.2.1.5.....B.o.t.t.o.m.=.1.6.3.....T.e.x.t.=.S.h.o.w. .a.d.v.a.n.c.e.d. .s.e.t.t.i.n.g.s.....S.t.a.t.e.=.0.....F.l.a.g.s.=.N.O.T.I.F.Y.....H.W.N.D.=.

C:\Windows\Temp\nseC5E0.tmp\System.dll

Download File

Process:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23864
Entropy (8bit):	6.996623524463238
Encrypted:	false
SSDEEP:	384:58QIl975eXqlWBrz7YLOlACZSf+VIYiWLbLWQaZdPxh8E9VF0Ny0W3N9:5gPgrfYLOWJ/YiW8PxWE6Y9
MD5:	938C37B523D7FC08166E7A5810DD0F8E
SHA1:	47B9663E5873669211655E0010E322F71B5A94BE
SHA-256:	A91AA7C0EAD677FC01B1C864E43E0CACE110AFB072B76AD47F4B3D1563F4DC20
SHA-512:	77AFE83FB4E80A775DAE0A54A2F0FF9710C135F9F1CF77396BC08A7FE46B016A8C079B4FA612E764EEA5D258703F860688E38B443E33B1F980E04831739517C1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....z.W...........!..... ...........'.......0...............................`......\|#...............................2.......0..P.......................8/...P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\nseC5E0.tmp\nsArray.dll

Download File

Process:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.329913522821918
Encrypted:	false
SSDEEP:	384:nqqedh6EHFRksp7KpFX1ZSf+VIYiWLALiqPxh8E9VF0NymgEy:Ted/FR9mXc/YiWMPxWEspy
MD5:	9761D708EA7C49662A21F6690D439E06
SHA1:	B2E757E7EEE5C788F16D666FB6CF9D41CACCB04B
SHA-256:	8B8BE21FA7BCA491C93683C9F84BB49370CA7E1E864BD0658FF9E1D2809B67E4
SHA-512:	25990A993373009CCBD9E89CAE3FC601928121775D0D5FE326C55A305CE8DE51F35A2CB160E9DFBF3BE82A53DDF7B9864116E7F5D3325AFD7403CD3B7740C652
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%)y.aH..aH..aH..h0..dH..aH..jH..h0..`H..z..cH..z..`H..z..`H..z..`H..RichaH..........................PE..L.....iO...........!.............p..0................................................\....@.........................$.......X...........X...............8/.........................................................................................UPX0.....p..............................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Windows\Temp\nseC5E0.tmp\nsExec.dll

Download File

Process:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.099446360233213
Encrypted:	false
SSDEEP:	384:BqbGgezxEqoyGgmkN7ZSf+VIYiWLSL/Pxh8E9VF0Ny4LN2:431yGLk8/YiWePxWEOZ2
MD5:	9EA6EC7934495CC757639B5095362CA7
SHA1:	EF2C14142B70689483576CC09083DB4A2A363E02
SHA-256:	4D8C8353641BBB26BF9EA2AB2DBF126BE6EF164B1CE80E3EF5030B873BE166CD
SHA-512:	414B08F75BD7FEBB56784D8534CEE028F6420776F07CE5797F66A78748C34B52F443AA35F72C8D7C81DD5366B34998B56D99A9D0D2B4B2B6BFC9775E4FF66531
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....z.W...........!......................... ...............................P.......................................$..l.... ..P.......................8/...@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\nszC4D6.tmp

Download File

Process:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	4373449
Entropy (8bit):	4.833524282835361
Encrypted:	false
SSDEEP:	24576:iJEhVu0vN6aSoGsZwXV22NNNKwhfmH5abENDzfL00+3JGqlxCsKEjzSKJ:rNvSoGsZwXV2ExnbEND00QssKEjOKJ
MD5:	EDF7280BB63AB1B61C0570FE45F88C03
SHA1:	0A62C191B86D43167FF9DFBBA1B07BF43E78F9AA
SHA-256:	9C0A7FCF2D343D53A05FB2A8D3487BEC96A32CE0A1FD16AC887AEFE4D26F1640
SHA-512:	E3606BAA52879EF78DED7BE0CA1D10168C2F6C3A201B404AF332EE72DF0EB66830D047C538E72E972D12ACE8FD72E298FF9F8AFF89A0A6053501B170CD44F435
Malicious:	false
Preview:	.b%.....,.......................<.......r1%.!....b%.....................................................~...................................................................................................................................................................................G...J.......................F.......y.......................................................................................................................%...............................................................................................................................D.......k..............................................j.......l...r...t..............................................................................................................................4.......................................................................................................................................................................................................................................

C:\Windows\assembly\Desktop.ini

Download File

Process:	C:\Users\user\Desktop\lz3EbiqoK4.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	227
Entropy (8bit):	5.2735028737400205
Encrypted:	false
SSDEEP:	6:a1eZBXVNYTF0NwoScUbtSgyAXIWv7v5PMKq:UeZBFNYTswUq1r5zq
MD5:	F7F759A5CD40BC52172E83486B6DE404
SHA1:	D74930F354A56CFD03DC91AA96D8AE9657B1EE54
SHA-256:	A709C2551B8818D7849D31A65446DC2F8C4CCA2DCBBC5385604286F49CFDAF1C
SHA-512:	A50B7826BFE72506019E4B1148A214C71C6F4743C09E809EF15CD0E0223F3078B683D203200910B07B5E1E34B94F0FE516AC53527311E2943654BFCEADE53298
Malicious:	false
Preview:	; ==++==..; ..; Copyright (c) Microsoft Corporation. All rights reserved...; ..; ==--==..[.ShellClassInfo]..CLSID={1D2680C9-0E2A-469d-B787-065558BC7D43}..ConfirmFileOp=1..InfoTip=Contains application stability information...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999972392721924
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lz3EbiqoK4.exe
File size:	75'655'168 bytes
MD5:	33c2adebfe2c3acedfb34ffff8151b7d
SHA1:	8e93f7ecafa92017a7d528423574ab5cfeec754a
SHA256:	773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd
SHA512:	6f545b4da55412ec78de6d1c3bddbcc6bb857b7d13b15fe4bb832259dbe1842d44a02b46395233c23ca57abd34239226a60c9f7ee26fcf82ba383a836f8d61ad
SSDEEP:	1572864:yIWs/6+mI5n17YTIytz8ATFiQiFGaaoE13gIFxXtzM/zMfCOA6Z:ssJmIBiTvR8UFiQYGvoq35FVEeCOr
TLSH:	FAF73320BC930947E55128B9B4E1FE3F080DAF376F74A47B1D753E07BE38666A09644A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k...8...8...8...8...8.m.8...8...8...8...8...8...8#..8...8...8Rich...8........PE..L.....Sg..........#........................

File Icon


Icon Hash:	71e0d49292c0f033

Static PE Info

General

Entrypoint:	0x40ccef
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x675394E3 [Sat Dec 7 00:20:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	9dd8c0ff4fc84287e5b766563240f983

Entrypoint Preview

Instruction
call 00007F77B4820886h
jmp 00007F77B481AA49h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0041F058h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F77B481ABAEh
test byte ptr [eax], 00000008h
je 00007F77B481ABA9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0041B000h]
leave
retn 0008h
ret
mov eax, 00413523h
mov dword ptr [004228E4h], eax
mov dword ptr [004228E8h], 00412C0Ah
mov dword ptr [004228ECh], 00412BBEh
mov dword ptr [004228F0h], 00412BF7h
mov dword ptr [004228F4h], 00412B60h
mov dword ptr [004228F8h], eax
mov dword ptr [004228FCh], 0041349Bh
mov dword ptr [00422900h], 00412B7Ch
mov dword ptr [00422904h], 00412ADEh
mov dword ptr [00422908h], 00412A6Bh
ret
mov edi, edi
push ebp
mov ebp, esp
call 00007F77B481AB3Bh
call 00007F77B48213C0h
cmp dword ptr [ebp+00h], 00000000h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x215b4	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x4804714	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b1d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20da0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x196d8	0x19800	bbd3e5395b15b06d2967530b6b59018e	False	0.5780292585784313	data	6.745940569149453	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x6df2	0x6e00	2a36cd4e315443b43c4620372d9a9076	False	0.5467329545454546	data	6.443128575748918	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22000	0x30c0	0x1600	b37653ac83a62b9683f8689b82ddcb74	False	0.3126775568181818	data	3.2624449625054814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x26000	0x4804714	0x4804800	49cc2cd8fc6ad777f21fa40d77936351	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x261fc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.17641843971631205
RT_ICON	0x26664	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.10834896810506567
RT_ICON	0x2770c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.08651452282157676
RT_ICON	0x29cb4	0x25ee	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9794026776519053
RT_RCDATA	0x2c2a4	0x47fe11b	data	1.0003108978271484
RT_RCDATA	0x482a3c0	0x20	data	1.28125
RT_GROUP_ICON	0x482a3e0	0x3e	data	0.7903225806451613
RT_VERSION	0x482a420	0x2f4	data	0.4470899470899471

Imports

DLL	Import
KERNEL32.dll	RaiseException, GetLastError, MultiByteToWideChar, lstrlenA, InterlockedDecrement, GetProcAddress, LoadLibraryA, FreeResource, SizeofResource, LockResource, LoadResource, FindResourceA, GetModuleHandleA, Module32Next, CloseHandle, Module32First, CreateToolhelp32Snapshot, GetCurrentProcessId, SetEndOfFile, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetLocaleInfoA, CreateFileA, HeapFree, GetProcessHeap, HeapAlloc, GetCommandLineA, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, ReadFile, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, FlushFileBuffers, SetFilePointer, SetHandleCount, GetFileType, GetStartupInfoA, RtlUnwind, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CompareStringA, CompareStringW, SetEnvironmentVariableA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle
ole32.dll	OleInitialize
OLEAUT32.dll	VariantInit, SafeArrayCreate, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayDestroy, SafeArrayCreateVector, VariantClear, SysFreeString, SysAllocString
mscoree.dll	CorBindToRuntimeEx

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-09T18:52:47.774466+0100	2027619	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)	1	167.71.56.116	22269	192.168.2.4	49731	TCP
2024-12-09T18:52:47.774466+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	167.71.56.116	22269	192.168.2.4	49731	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 18:52:45.914556980 CET	49731	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:46.034420013 CET	22269	49731	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:46.034502029 CET	49731	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:46.045758009 CET	49731	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:46.166585922 CET	22269	49731	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:47.650424957 CET	22269	49731	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:47.650532007 CET	22269	49731	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:47.650593996 CET	49731	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:47.655101061 CET	49731	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:47.774466038 CET	22269	49731	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:48.760284901 CET	22269	49731	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:48.805975914 CET	49731	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:51.244883060 CET	49731	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:51.373608112 CET	22269	49731	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:51.373666048 CET	49731	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:54.917768002 CET	49737	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:55.037065983 CET	22269	49737	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:55.037139893 CET	49737	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:55.037513971 CET	49737	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:55.156994104 CET	22269	49737	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:56.656696081 CET	22269	49737	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:56.658111095 CET	49737	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:56.684508085 CET	49737	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:52:56.779582977 CET	22269	49737	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:56.804809093 CET	22269	49737	167.71.56.116	192.168.2.4
Dec 9, 2024 18:52:56.804864883 CET	49737	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:00.345165014 CET	49739	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:00.464634895 CET	22269	49739	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:00.465275049 CET	49739	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:00.466001987 CET	49739	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:00.585247993 CET	22269	49739	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:02.123843908 CET	22269	49739	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:02.124569893 CET	49739	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:02.152107954 CET	49739	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:02.244021893 CET	22269	49739	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:02.271822929 CET	22269	49739	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:02.271894932 CET	49739	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:06.094727993 CET	49740	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:06.215048075 CET	22269	49740	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:06.215130091 CET	49740	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:06.215490103 CET	49740	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:06.334804058 CET	22269	49740	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:07.839298010 CET	22269	49740	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:07.841795921 CET	49740	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:07.849725008 CET	49740	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:07.961283922 CET	22269	49740	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:07.970082045 CET	22269	49740	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:07.970191002 CET	49740	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:11.694304943 CET	49741	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:11.813775063 CET	22269	49741	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:11.813849926 CET	49741	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:11.814301968 CET	49741	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:11.933593035 CET	22269	49741	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:13.459006071 CET	22269	49741	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:13.462239981 CET	49741	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:13.464045048 CET	49741	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:13.581604004 CET	22269	49741	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:13.584192991 CET	22269	49741	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:13.584239960 CET	49741	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:17.177974939 CET	49742	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:17.297625065 CET	22269	49742	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:17.297708988 CET	49742	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:17.298069000 CET	49742	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:17.417360067 CET	22269	49742	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:18.934458971 CET	22269	49742	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:18.935055971 CET	49742	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:18.936487913 CET	49742	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:19.060481071 CET	22269	49742	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:19.062793016 CET	22269	49742	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:19.062836885 CET	49742	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:22.566176891 CET	49744	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:22.686355114 CET	22269	49744	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:22.686439991 CET	49744	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:22.686794996 CET	49744	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:22.806077957 CET	22269	49744	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:24.355647087 CET	22269	49744	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:24.356369019 CET	49744	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:24.369719028 CET	49744	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:24.475766897 CET	22269	49744	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:24.489455938 CET	22269	49744	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:24.489500046 CET	49744	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:28.010126114 CET	49755	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:28.131351948 CET	22269	49755	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:28.131441116 CET	49755	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:28.131786108 CET	49755	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:28.252947092 CET	22269	49755	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:29.725255966 CET	22269	49755	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:29.725963116 CET	49755	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:29.726892948 CET	49755	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:29.845338106 CET	22269	49755	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:29.846561909 CET	22269	49755	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:29.846613884 CET	49755	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:33.197348118 CET	49767	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:33.316870928 CET	22269	49767	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:33.317035913 CET	49767	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:33.317472935 CET	49767	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:33.436924934 CET	22269	49767	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:34.956608057 CET	22269	49767	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:34.957283020 CET	49767	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:34.958317995 CET	49767	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:35.081316948 CET	22269	49767	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:35.082431078 CET	22269	49767	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:35.082479000 CET	49767	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:38.510016918 CET	49783	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:38.629646063 CET	22269	49783	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:38.629743099 CET	49783	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:38.630120039 CET	49783	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:38.749567986 CET	22269	49783	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:40.305145025 CET	22269	49783	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:40.305789948 CET	49783	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:40.306849003 CET	49783	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:40.426027060 CET	22269	49783	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:40.427253962 CET	22269	49783	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:40.427318096 CET	49783	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:43.791279078 CET	49794	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:43.910736084 CET	22269	49794	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:43.910835981 CET	49794	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:43.911443949 CET	49794	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:44.030900955 CET	22269	49794	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:45.593015909 CET	22269	49794	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:45.593626022 CET	49794	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:45.594593048 CET	49794	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:45.713088989 CET	22269	49794	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:45.714317083 CET	22269	49794	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:45.714373112 CET	49794	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:49.010149002 CET	49810	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:49.129698038 CET	22269	49810	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:49.129800081 CET	49810	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:49.130161047 CET	49810	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:49.250066996 CET	22269	49810	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:50.733612061 CET	22269	49810	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:50.734277010 CET	49810	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:50.735503912 CET	49810	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:50.853640079 CET	22269	49810	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:50.855602026 CET	22269	49810	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:50.855699062 CET	49810	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:54.275758982 CET	49821	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:54.395375013 CET	22269	49821	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:54.395550013 CET	49821	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:54.396032095 CET	49821	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:54.515405893 CET	22269	49821	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:56.759954929 CET	22269	49821	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:56.761007071 CET	49821	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:56.762542963 CET	49821	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:53:56.881608963 CET	22269	49821	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:56.890553951 CET	22269	49821	167.71.56.116	192.168.2.4
Dec 9, 2024 18:53:56.890620947 CET	49821	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:00.510096073 CET	49837	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:00.629561901 CET	22269	49837	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:00.629688025 CET	49837	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:00.630053997 CET	49837	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:00.750034094 CET	22269	49837	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:03.265657902 CET	22269	49837	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:03.267065048 CET	49837	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:03.269221067 CET	49837	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:03.386449099 CET	22269	49837	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:03.392818928 CET	22269	49837	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:03.392973900 CET	49837	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:06.635144949 CET	49853	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:06.754683971 CET	22269	49853	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:06.754777908 CET	49853	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:06.755088091 CET	49853	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:06.875035048 CET	22269	49853	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:08.712308884 CET	22269	49853	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:08.713129997 CET	49853	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:08.714106083 CET	49853	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:08.833177090 CET	22269	49853	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:08.834477901 CET	22269	49853	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:08.834532976 CET	49853	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:12.135279894 CET	49864	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:12.254745960 CET	22269	49864	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:12.254872084 CET	49864	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:12.255178928 CET	49864	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:12.375690937 CET	22269	49864	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:14.254487038 CET	22269	49864	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:14.255224943 CET	49864	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:14.256287098 CET	49864	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:14.375061035 CET	22269	49864	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:14.376806021 CET	22269	49864	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:14.376862049 CET	49864	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:17.651021004 CET	49880	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:17.770447969 CET	22269	49880	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:17.770564079 CET	49880	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:17.770853996 CET	49880	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:17.890718937 CET	22269	49880	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:19.359498978 CET	22269	49880	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:19.360122919 CET	49880	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:19.361124039 CET	49880	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:19.479522943 CET	22269	49880	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:19.481873989 CET	22269	49880	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:19.481964111 CET	49880	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:22.901201963 CET	49891	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:23.021102905 CET	22269	49891	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:23.021218061 CET	49891	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:23.021631002 CET	49891	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:23.141160965 CET	22269	49891	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:24.627521038 CET	22269	49891	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:24.628268957 CET	49891	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:24.629255056 CET	49891	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:24.747733116 CET	22269	49891	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:24.749641895 CET	22269	49891	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:24.749696016 CET	49891	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:28.260494947 CET	49907	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:28.381359100 CET	22269	49907	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:28.381454945 CET	49907	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:28.381793022 CET	49907	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:28.501569986 CET	22269	49907	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:30.019188881 CET	22269	49907	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:30.019831896 CET	49907	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:30.020891905 CET	49907	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:30.139709949 CET	22269	49907	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:30.140661955 CET	22269	49907	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:30.140815973 CET	49907	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:33.411936998 CET	49918	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:33.532088995 CET	22269	49918	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:33.532202959 CET	49918	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:33.533946037 CET	49918	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:33.653924942 CET	22269	49918	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:35.227840900 CET	22269	49918	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:35.228532076 CET	49918	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:35.229737997 CET	49918	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:35.354645967 CET	22269	49918	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:35.356317997 CET	22269	49918	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:35.356368065 CET	49918	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:38.984467983 CET	49929	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:39.105173111 CET	22269	49929	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:39.105295897 CET	49929	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:39.105545044 CET	49929	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:39.225013018 CET	22269	49929	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:40.767601013 CET	22269	49929	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:40.768340111 CET	49929	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:40.769505978 CET	49929	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:40.887613058 CET	22269	49929	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:40.889153004 CET	22269	49929	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:40.890141964 CET	49929	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:44.307584047 CET	49944	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:44.427580118 CET	22269	49944	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:44.427643061 CET	49944	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:44.427854061 CET	49944	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:44.547813892 CET	22269	49944	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:46.063290119 CET	22269	49944	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:46.064028978 CET	49944	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:46.064987898 CET	49944	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:46.183474064 CET	22269	49944	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:46.184542894 CET	22269	49944	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:46.184623957 CET	49944	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:49.354477882 CET	49956	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:49.473841906 CET	22269	49956	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:49.473933935 CET	49956	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:49.474261045 CET	49956	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:49.593559027 CET	22269	49956	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:51.118738890 CET	22269	49956	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:51.131206989 CET	49956	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:51.139187098 CET	49956	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:51.250533104 CET	22269	49956	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:51.260195971 CET	22269	49956	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:51.260356903 CET	49956	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:54.682468891 CET	49971	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:54.804635048 CET	22269	49971	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:54.804744959 CET	49971	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:54.805062056 CET	49971	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:54.924319983 CET	22269	49971	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:56.420449018 CET	22269	49971	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:56.421160936 CET	49971	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:56.422113895 CET	49971	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:56.540616989 CET	22269	49971	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:56.542201996 CET	22269	49971	167.71.56.116	192.168.2.4
Dec 9, 2024 18:54:56.542258024 CET	49971	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:54:59.932457924 CET	49983	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:00.052089930 CET	22269	49983	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:00.052198887 CET	49983	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:00.052580118 CET	49983	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:00.173430920 CET	22269	49983	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:01.728997946 CET	22269	49983	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:01.729631901 CET	49983	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:01.730818033 CET	49983	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:01.848959923 CET	22269	49983	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:01.851236105 CET	22269	49983	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:01.851320028 CET	49983	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:05.291834116 CET	49995	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:05.411412954 CET	22269	49995	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:05.411509037 CET	49995	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:05.411942959 CET	49995	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:05.531230927 CET	22269	49995	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:07.055562019 CET	22269	49995	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:07.056251049 CET	49995	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:07.057600975 CET	49995	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:07.175774097 CET	22269	49995	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:07.178618908 CET	22269	49995	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:07.178702116 CET	49995	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:10.432521105 CET	50008	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:10.551973104 CET	22269	50008	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:10.555444956 CET	50008	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:10.555800915 CET	50008	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:10.675228119 CET	22269	50008	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:12.150042057 CET	22269	50008	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:12.151242018 CET	50008	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:12.152216911 CET	50008	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:12.273356915 CET	22269	50008	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:12.274765015 CET	22269	50008	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:12.274842978 CET	50008	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:15.901374102 CET	50021	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:16.024651051 CET	22269	50021	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:16.024792910 CET	50021	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:16.025166035 CET	50021	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:16.145374060 CET	22269	50021	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:17.616538048 CET	22269	50021	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:17.617181063 CET	50021	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:17.618145943 CET	50021	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:17.736555099 CET	22269	50021	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:17.738182068 CET	22269	50021	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:17.738240957 CET	50021	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:21.213846922 CET	50031	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:21.333883047 CET	22269	50031	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:21.335212946 CET	50031	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:21.335464001 CET	50031	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:21.455431938 CET	22269	50031	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:22.943120003 CET	22269	50031	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:22.943953991 CET	50031	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:22.945086002 CET	50031	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:23.065702915 CET	22269	50031	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:23.066566944 CET	22269	50031	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:23.066622019 CET	50031	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:26.495878935 CET	50032	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:26.615320921 CET	22269	50032	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:26.615402937 CET	50032	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:26.615983009 CET	50032	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:26.735266924 CET	22269	50032	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:28.236211061 CET	22269	50032	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:28.236855984 CET	50032	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:28.237802982 CET	50032	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:28.356961012 CET	22269	50032	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:28.358063936 CET	22269	50032	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:28.358122110 CET	50032	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:31.970688105 CET	50033	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:32.090248108 CET	22269	50033	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:32.090326071 CET	50033	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:32.093627930 CET	50033	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:32.213030100 CET	22269	50033	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:33.716212034 CET	22269	50033	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:33.717000008 CET	50033	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:33.718199968 CET	50033	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:33.836293936 CET	22269	50033	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:33.838084936 CET	22269	50033	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:33.838138103 CET	50033	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:37.137234926 CET	50034	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:37.257246971 CET	22269	50034	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:37.257349014 CET	50034	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:37.259663105 CET	50034	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:37.382658958 CET	22269	50034	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:39.306700945 CET	22269	50034	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:39.307393074 CET	50034	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:39.308353901 CET	50034	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:55:39.427537918 CET	22269	50034	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:39.429155111 CET	22269	50034	167.71.56.116	192.168.2.4
Dec 9, 2024 18:55:39.429212093 CET	50034	22269	192.168.2.4	167.71.56.116

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 18:52:47.776994944 CET	1.1.1.1	192.168.2.4	0x58f8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 9, 2024 18:52:47.776994944 CET	1.1.1.1	192.168.2.4	0x58f8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	12:52:28
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\lz3EbiqoK4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lz3EbiqoK4.exe"
Imagebase:	0x400000
File size:	75'655'168 bytes
MD5 hash:	33C2ADEBFE2C3ACEDFB34FFFF8151B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:52:41
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Client-built.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Client-built.exe"
Imagebase:	0xfc0000
File size:	3'266'048 bytes
MD5 hash:	181719B653C83D0463D89A625A7F5C3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000000.1871811766.00000000012E0000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.3667738198.00000000036D6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.3667738198.0000000003581000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000000.1865166351.0000000000FC2000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:52:48
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe"
Imagebase:	0x400000
File size:	72'005'560 bytes
MD5 hash:	D15511E4B90CC6729FEDAF86D080D1F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:52:52
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe"
Imagebase:	0x400000
File size:	71'272'344 bytes
MD5 hash:	8318FC63158C01368AADC6D4BE89FAD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:52:58
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
Imagebase:	0x630000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:52:58
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0xc10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:53:00
Start date:	09/12/2024
Path:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE
Imagebase:	0x400000
File size:	71'272'344 bytes
MD5 hash:	8318FC63158C01368AADC6D4BE89FAD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:53:20
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Imagebase:	0x630000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:53:20
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:53:26
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Imagebase:	0x630000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:53:26
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.3%
Total number of Nodes:	53
Total number of Limit Nodes:	2

Executed Functions

Function 06B900CD Relevance: 2.9, Strings: 2, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@tk, xrefs: 06B90529
:@tk, xrefs: 06B9031C

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID: :@tk$:@tk
API String ID: 0-1155632973
Opcode ID: 0dee570370a4e4312e75785599be128fdf6080b60144956ccab4b41551734d7f
Instruction ID: 450551fa7df4174d3bc01442d4a3f6c96bb077a0e27e0c4d15c45b07a4008401
Opcode Fuzzy Hash: 0dee570370a4e4312e75785599be128fdf6080b60144956ccab4b41551734d7f
Instruction Fuzzy Hash: A1F17D70B00210CFDB58EB39C894B6977E7AF8A308F1580B9D90ACB765EB769C45CB51

Function 0689AA57 Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0689AAD7

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 0f69afcee472b413e78127f303b2c5ad81218a064c62d808ff98f315520d9507
Instruction ID: 75a5b500c12be39ae49e52fe69a5b1edc27e5bc7e5f4a0d4ae59e4d9a6bd1b5a
Opcode Fuzzy Hash: 0f69afcee472b413e78127f303b2c5ad81218a064c62d808ff98f315520d9507
Instruction Fuzzy Hash: A521BF75509384AFEB228F25DC44B56BFB4EF06310F0884DAE985CB163D231A908DB71

Function 0689AA8E Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0689AAD7

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 24b86e7ccee535e6b1f1ea8d1d28ea850591df47bc56027345b05af18ccb257a
Instruction ID: 3f231dc2d121bca3815ee2e80b49e102675e2007dcbdbbf353dd5a8b80143632
Opcode Fuzzy Hash: 24b86e7ccee535e6b1f1ea8d1d28ea850591df47bc56027345b05af18ccb257a
Instruction Fuzzy Hash: 55115E316002449FEB608F55D944B6AFBE4FF08224F08C4AAED49DB652D375E458DBB1

Function 0689B2C7 Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0689B37D

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ecaeb9a6ca630f007e12e88142d27779c20ff9b222be2de43cb55a9cec166b40
Instruction ID: 4a4b6821109eae01e87db36ed84b08146d7142630caf4aa563fc672907729ba5
Opcode Fuzzy Hash: ecaeb9a6ca630f007e12e88142d27779c20ff9b222be2de43cb55a9cec166b40
Instruction Fuzzy Hash: 6431B2B1505380AFE722CB65DC44F66BFE8EF06214F08849AE985CB262D375E509DB71

Function 0689ACC4 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcessModules.KERNEL32(?,00000E30,38AF7DA2,00000000,00000000,00000000,00000000), ref: 0689AD5E

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: dcc071b320437135f7020850e970f280e67210c95806da90223b19eead872f12
Instruction ID: 649e4352e85a18730b2c06d31da5c9d9c023e1c4d22a936fbdb2fe08199c07e2
Opcode Fuzzy Hash: dcc071b320437135f7020850e970f280e67210c95806da90223b19eead872f12
Instruction Fuzzy Hash: 7121D8715057806FEB128F61DC44FA6BFB8EF46324F0884DAE984DF193D265A909CB71

Function 0689ADBD Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleInformation.KERNEL32(?,00000E30,38AF7DA2,00000000,00000000,00000000,00000000), ref: 0689AE4E

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: bd361821a74064ca095a3c43fe23f118690ef7888e89ec9f123a31eb2306c9b9
Instruction ID: 9004632e151e6726cc7aeff2a0d47f4463a29fc7ef47f865ab8c116224d20146
Opcode Fuzzy Hash: bd361821a74064ca095a3c43fe23f118690ef7888e89ec9f123a31eb2306c9b9
Instruction Fuzzy Hash: 792197715053846FEB22CB51DC44FAABFB8EF46310F0884AAE985DB652D265E908CB71

Function 0689AEB4 Relevance: 1.6, APIs: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleBaseNameW.KERNEL32(?,00000E30,?,?), ref: 0689AF5A

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: 4cc2313ad109d85e331d3837c851a63b0c08fb89460864eba3ad122c33c168f4
Instruction ID: 10fe25ef70e8a82da0bc0876f47c53fdbecc16915479d4b0443b759e4cf28ff8
Opcode Fuzzy Hash: 4cc2313ad109d85e331d3837c851a63b0c08fb89460864eba3ad122c33c168f4
Instruction Fuzzy Hash: 4F21DD715093C06FD312CB21CC55B66BFB4EF87210F0984DBE884DB6A3C624A919CBB2

Function 0689B3D4 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E30,38AF7DA2,00000000,00000000,00000000,00000000), ref: 0689B469

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 0659646264445f97c9b9d8cee1aefa205c801ad10d28033754de08319bd371e1
Instruction ID: 9e1b216646ac030543c6f4e2399121e2fa2dcaa1709c87a24d73c2a9e7350d11
Opcode Fuzzy Hash: 0659646264445f97c9b9d8cee1aefa205c801ad10d28033754de08319bd371e1
Instruction Fuzzy Hash: 4321F8754053806FE7128F15DC85BA6BFACEF47724F0984D6ED848F2A3D2646909CB71

Function 0689B2FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0689B37D

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2e3992f6e3c7a6f6989a36fa3a58899e0cc6eae7b9556feb40f9b67bd82bb619
Instruction ID: 44d0113fede726992ecc63fb9ec4820376a2ba5591f91b96a66154fe1a33685b
Opcode Fuzzy Hash: 2e3992f6e3c7a6f6989a36fa3a58899e0cc6eae7b9556feb40f9b67bd82bb619
Instruction Fuzzy Hash: 3F216B71500244AFEB20CF65DC85F6AFBE8EF08214F088869EA85DB652D375E518DB72

Function 0689B4A4 Relevance: 1.6, APIs: 1, Instructions: 75
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E30,38AF7DA2,00000000,00000000,00000000,00000000), ref: 0689B535

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: bf018c54f00aad0888d23e8c77b97ea880ccc95d37c7e4a553af72131bcb325f
Instruction ID: 908dd495882155cdb2bdb035f286fef3d8555ebf51f4265274404869e14a8bcd
Opcode Fuzzy Hash: bf018c54f00aad0888d23e8c77b97ea880ccc95d37c7e4a553af72131bcb325f
Instruction Fuzzy Hash: 6521A171509380AFDB22CB61DC44FA6BFB8EF46314F0884DBE9849B563C225A509CB72

Function 0689ADEA Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleInformation.KERNEL32(?,00000E30,38AF7DA2,00000000,00000000,00000000,00000000), ref: 0689AE4E

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: e7209135eb2ec20dfbb2b56ebcae71e5c2cf748f6ebc4a47a161241f7cf25b84
Instruction ID: c43b7a6684e254bad81aa7717dbac31920cd7703ca71b9b7ac7284564dc5de40
Opcode Fuzzy Hash: e7209135eb2ec20dfbb2b56ebcae71e5c2cf748f6ebc4a47a161241f7cf25b84
Instruction Fuzzy Hash: F211BE71600244AFEB21CF55DC85FAABBA8EF44324F08886AED45DB691D774E508CBB1

Function 0689A84B Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0689A8BA

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: ec63d1ad88c5ddf18d846e9235e2240c9fcf22ec281ef7954ff6df1537a9aaee
Instruction ID: 492cf9b20051d5aaaa2c8ee826e4a41f98b7a791d733ee4366f319fb1f4a76e7
Opcode Fuzzy Hash: ec63d1ad88c5ddf18d846e9235e2240c9fcf22ec281ef7954ff6df1537a9aaee
Instruction Fuzzy Hash: 5621A2716053C09FDB21CF25DC44B66BFA8EF46210F0884AAED45DB652D235E804CB71

Function 0689AD02 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcessModules.KERNEL32(?,00000E30,38AF7DA2,00000000,00000000,00000000,00000000), ref: 0689AD5E

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: aad3ee90c6457a4fc31dc46638d4a0800fc9bd107343cc92926df2b13e57fa40
Instruction ID: 2410192dec300df926c84a502150712d8e6e76ad383c9ff276cf3e957eec5d2b
Opcode Fuzzy Hash: aad3ee90c6457a4fc31dc46638d4a0800fc9bd107343cc92926df2b13e57fa40
Instruction Fuzzy Hash: 4C110172500244AFEB60CF55DC45FAAFBA8EF44324F08846AED45DB791D375A508CBB2

Function 0689B640 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 0689B69C

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: ac823c4ca3d68577c050f0899e4ee313538f135a8146b7ec3f0600ac4d56b8ed
Instruction ID: 2401f575ecc54af4c9e92ff0ae979d0bb45f41a45b989f4f765a1e319c635c7e
Opcode Fuzzy Hash: ac823c4ca3d68577c050f0899e4ee313538f135a8146b7ec3f0600ac4d56b8ed
Instruction Fuzzy Hash: 591160715093C49FDB12CF25DC94B56BFB8EF46220F0884EAED85CF652D265E908CB61

Function 0689B4D6 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E30,38AF7DA2,00000000,00000000,00000000,00000000), ref: 0689B535

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 5d2d9c0955008de8aa52e597be75016d8305f4e7ef7ec572ef13f340c9884160
Instruction ID: 2c353bbb8d7bec7a7020160f9aed31f31384ece3edf23b6339cefdfcbf48a30a
Opcode Fuzzy Hash: 5d2d9c0955008de8aa52e597be75016d8305f4e7ef7ec572ef13f340c9884160
Instruction Fuzzy Hash: BC11C471500244AFEB21CF51DC44FABFBA8EF44314F08846AED45DB651C375A508CBB2

Function 0689A872 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0689A8BA

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 82dc1410dc52c845a6c27b17b472767e761422e7e1a6d44b492f8df3078fa53c
Instruction ID: b41c14dc6dbd376c774372df03382a468614c4efbf2c4d18098fdfbd75dcd1c5
Opcode Fuzzy Hash: 82dc1410dc52c845a6c27b17b472767e761422e7e1a6d44b492f8df3078fa53c
Instruction Fuzzy Hash: 62118271A003848FEB64CF19D84576AFBD8EF44224F0CC4AADD45EB742D675E444CAB1

Function 0689B416 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E30,38AF7DA2,00000000,00000000,00000000,00000000), ref: 0689B469

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f610c5c96962420b6337c22eab938d1f6a75022112ccbc0d91673959538a1127
Instruction ID: 05e01ffd704f1ebfe10b4155a2c54ee402745b9621ec984a376399d9bae791cc
Opcode Fuzzy Hash: f610c5c96962420b6337c22eab938d1f6a75022112ccbc0d91673959538a1127
Instruction Fuzzy Hash: 4C01C471500244AEEB208B05EC85FAAB798DF44624F48C4A6ED459B781D274A548CEB6

Function 0689A677 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0689A6D4

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 29458088dae377df483f2d5d7ef3cff3c7910d0bc022a8b2cb19893a72e6ad61
Instruction ID: fb48a8405580754dab5eed9757fcb84206ebbfe36e54e15a0dae0b7fd1da210d
Opcode Fuzzy Hash: 29458088dae377df483f2d5d7ef3cff3c7910d0bc022a8b2cb19893a72e6ad61
Instruction Fuzzy Hash: 0311C6714053C0AFD712CF55DC44B56FFB4EF46220F0984DADD848B262C279A848CB61

Function 0689AF0A Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameW.KERNEL32(?,00000E30,?,?), ref: 0689AF5A

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: 25af2d6daad0aee32f60a8fe80faf3730cdc24047202c74105abc2b7b7f7dafa
Instruction ID: b7322ec7499c0ddf704a56d192ccd6d415bcff8a3939066970c3185db820211a
Opcode Fuzzy Hash: 25af2d6daad0aee32f60a8fe80faf3730cdc24047202c74105abc2b7b7f7dafa
Instruction Fuzzy Hash: 73017171600200AFD310DF16DC45F76FBA8FB88A20F14856AED489BB41D775B515CBE6

Function 0689B662 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0689B69C

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 04ac2afe7b7aa46d0a308957aaac39dd8cb7f0ec2728f0117a215a7dad346302
Instruction ID: 6c213e85aae2baec3a42c0082d5d9624520220bef8bb4c54eb763be455fe586d
Opcode Fuzzy Hash: 04ac2afe7b7aa46d0a308957aaac39dd8cb7f0ec2728f0117a215a7dad346302
Instruction Fuzzy Hash: DE018071A042448FEB60CF15E98576ABBE4EF44224F0CC4AADE49CF642D675E544CBA1

Function 0689A6A2 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0689A6D4

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 36decf8a67df2657f066ade017a3171c6e4686d42e6726154a78f8a6857444d6
Instruction ID: 14f992c47c17a8e3b4f1fd66ba5779e909193efa256918326abea7001332178b
Opcode Fuzzy Hash: 36decf8a67df2657f066ade017a3171c6e4686d42e6726154a78f8a6857444d6
Instruction Fuzzy Hash: A7F0A4359002449FEF618F09DC85765FBA0EF04228F4CC0AADE454B752D675E448CEB2

Function 0689AB24 Relevance: 1.3, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0689AB90

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f932ff880119acbe6ded46a3a2b701f012a082dc8d3e55276619c39d80dbe40a
Instruction ID: 8882a0aabe2fe1c2a35ee79951f1b07ea4c16bc5b6d22be0515c7f6de29dbe2f
Opcode Fuzzy Hash: f932ff880119acbe6ded46a3a2b701f012a082dc8d3e55276619c39d80dbe40a
Instruction Fuzzy Hash: EA21F0725093C05FDB128B25DC94B96BFB4AF07324F0C84DAEC858F663D265A908CB72

Function 0689A705 Relevance: 1.3, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0689A768

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: dbedfdd22675f72a0ea20941429a880b970fe1af8c557ee927152eacb8ac0a58
Instruction ID: d0bc8b4a0250df6056ad11bf623e57c8831d4d7564cc472de06539928251d2e7
Opcode Fuzzy Hash: dbedfdd22675f72a0ea20941429a880b970fe1af8c557ee927152eacb8ac0a58
Instruction Fuzzy Hash: C1116A75509380AFDB128B25DC45B56BFB4EF46220F0984EBED85CB263C239A948CB61

Function 0689A736 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0689A768

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2593e6ee7c60485a2c12087abd8820e2a43536371d552756f2d063c64f6af5c2
Instruction ID: fae84dccc2c6e55e661c4dc0ed28e08192c4c6f9581a9eb15515c65df002a612
Opcode Fuzzy Hash: 2593e6ee7c60485a2c12087abd8820e2a43536371d552756f2d063c64f6af5c2
Instruction Fuzzy Hash: 7701D431900244AFEB508F15D885769FBB4EF44224F48C4AADD45DF746D275E544CAB1

Function 0689AB5E Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0689AB90

Memory Dump Source

Source File: 00000000.00000002.1944312663.000000000689A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0689A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_689a000_lz3EbiqoK4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1a2d421c6e80bd40313fae3fbc07c9fff084c01fbc98b97fa93f7ec4b1fb2fc3
Instruction ID: cbe09738949d2083c54be31d1b09943ba796ad8ff8298cef83bde56ca40f61d6
Opcode Fuzzy Hash: 1a2d421c6e80bd40313fae3fbc07c9fff084c01fbc98b97fa93f7ec4b1fb2fc3
Instruction Fuzzy Hash: 5301D4716002488FEB50CF59D88576AFBA4EF44224F08C4AADD49CB742C275E448CFB2

Function 06B91A2C Relevance: 1.3, Strings: 1, Instructions: 4COMMON

Download Yara Rule

Strings

?, xrefs: 06B91A38

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 284022f25ef5ca5d4d92aefa382503b3afc4b56f9f08bbbab41eed9b41b8fc94
Instruction ID: 045851e5766502019213316611b1a42613fa5f66ce9649bfec817d5ebbd62543
Opcode Fuzzy Hash: 284022f25ef5ca5d4d92aefa382503b3afc4b56f9f08bbbab41eed9b41b8fc94
Instruction Fuzzy Hash: 09B01270C02108CFFB001F10C5083E97A32EF00320F0400F9DD19212C1C7B40980CED1

Function 06B9B1F0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08f241a8847d9ec0a78c56d35b38c734071e0614a37fc5cac9045ddc1391773
Instruction ID: 2d359cf0788af84d42f658de6120df3481e7ce323dbf74110cee3fee85fa26ac
Opcode Fuzzy Hash: b08f241a8847d9ec0a78c56d35b38c734071e0614a37fc5cac9045ddc1391773
Instruction Fuzzy Hash: D641B634B102208FEF94ABB8D4E837F36A3FB89300F1446B8D616D7384DA759C459B92

Function 06B98A50 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2449ea40ef29ee5d0b6bc1093f87766bb151bcaeb642a317877b1dfbc5a5f00
Instruction ID: 06b29b35127573ba24ff9d046b286f5163f6c2b727d9596c9dcaf16424dfac76
Opcode Fuzzy Hash: e2449ea40ef29ee5d0b6bc1093f87766bb151bcaeb642a317877b1dfbc5a5f00
Instruction Fuzzy Hash: 3631E670E002558FEF8497B4D8187AE3772EB86300F0841B8CA1AD72D4DA355D45D7E2

Function 068C05DF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1945684267.00000000068C0000.00000040.00000020.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68c0000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c55281a497568ebba71f27c88aed07ad90b94d4be8db6ac0c845c9c33e2886a
Instruction ID: 132de9f6d1e9db41f1b05249900e4f60133b63e0770709969906094880f9100e
Opcode Fuzzy Hash: 2c55281a497568ebba71f27c88aed07ad90b94d4be8db6ac0c845c9c33e2886a
Instruction Fuzzy Hash: D101DB764097845FD7118B06DC50862FFA8EB86220708C4DFEC498B612D135B909CB71

Function 06B9CA00 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5300afbcc3d0be87afab3b99f8589164912886241b27834cf8d63c146bc5400a
Instruction ID: 1f33a92c605206fbb2e69ef0d5cec1ebbe68909a431d2c1b6d688edb4abe5160
Opcode Fuzzy Hash: 5300afbcc3d0be87afab3b99f8589164912886241b27834cf8d63c146bc5400a
Instruction Fuzzy Hash: 7EF0A772E041289FEF50CE66940865EFFAAEB846A5F05D1BADD0AF3144E73489019BE1

Function 06B99A58 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799b37973193f9a60f15be848f0f3a25f40fdb5f1e1c4c26c1a44301036b0577
Instruction ID: 50b891c31a940137e618650e1315423670e2cbeeeef33dad4b4d6b57d410895f
Opcode Fuzzy Hash: 799b37973193f9a60f15be848f0f3a25f40fdb5f1e1c4c26c1a44301036b0577
Instruction Fuzzy Hash: CDF0A772E041289FDF94DE9A9C449DFF7AEFF88371B09813AEA09D3100D671890187E4

Function 068C0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1945684267.00000000068C0000.00000040.00000020.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_68c0000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1177c7832734aa9f247fec7c9752c88970aa345dbd112e50cadc6061bb116a
Instruction ID: 07e10c6f6ed56d29c38aa9515e07d896259ba3ae18545f054bb15c60f5756af1
Opcode Fuzzy Hash: ac1177c7832734aa9f247fec7c9752c88970aa345dbd112e50cadc6061bb116a
Instruction Fuzzy Hash: 9AE092766006444F9650CF0BEC41462F794EB84630B48C47FDC0D8B711D636B509CEA5

Function 06B98438 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 506179c7525eba28b5dcb009ca59ff238c4a8c771c2a02d38455ed44bde10b11
Instruction ID: c8bcca9ba7ea8736de5d6b22147086ebd65d0c4ff9551a09b85b3f85acc0e464
Opcode Fuzzy Hash: 506179c7525eba28b5dcb009ca59ff238c4a8c771c2a02d38455ed44bde10b11
Instruction Fuzzy Hash: E4E08C3479031C8FEB40EB39D882B2A33EBB785648B104065EE28C7349FB71E800CB84

Function 068923F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1944283324.0000000006892000.00000040.00000800.00020000.00000000.sdmp, Offset: 06892000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6892000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7559407ff30c01d885f9924df55a7eb2adba40bee8ad0f44cd291c522dded7
Instruction ID: e9cf7f3bfa6a143a2bae41e03643fb0f541b07965e4d6627ed04f571a6da3f49
Opcode Fuzzy Hash: 7c7559407ff30c01d885f9924df55a7eb2adba40bee8ad0f44cd291c522dded7
Instruction Fuzzy Hash: C2D05B757156C15FD726CA1CC164B9937D47B51704F4A44F99840CB763C768D681D610

Function 068923BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1944283324.0000000006892000.00000040.00000800.00020000.00000000.sdmp, Offset: 06892000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6892000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9397d25c303347904b483e62446ec432bf2910c5c4f47a500905e19687644a
Instruction ID: 818a5f4d86db8965e4aacd86b8dc650e7f764a5de64c484702ad410638344277
Opcode Fuzzy Hash: ec9397d25c303347904b483e62446ec432bf2910c5c4f47a500905e19687644a
Instruction Fuzzy Hash: 56D05E346011814FCB19CA1CC2E4F5D37D4AB40704F0A84E9AC10CBB72C3B4EA80DA10

Function 06B9B4D0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d036cda3cc94ab369dd624cf615589fa707479190eaf3fa2f08571b0cfc5f62e
Instruction ID: 37634fc1ee066ff72930da9c91aa76a57e15e0281c5b66a0538f48a42b7602ca
Opcode Fuzzy Hash: d036cda3cc94ab369dd624cf615589fa707479190eaf3fa2f08571b0cfc5f62e
Instruction Fuzzy Hash: FCC04C752041086B8204DA89D851C16F7A9DBD9664714C06DA90D87351DA33ED13C594

Function 06B95052 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e535847eea9d200a55a7b9121c5e52c72b7fa1b377b3058a9cd8bb67c22957c
Instruction ID: 52c19d469e859c453677675bb5d1ae547f7399b5ac81cc39b91743df5e53efe5
Opcode Fuzzy Hash: 6e535847eea9d200a55a7b9121c5e52c72b7fa1b377b3058a9cd8bb67c22957c
Instruction Fuzzy Hash: 68D09E74D00158CFDB64CF15C84868CBBF5AB48300F1481EA845DA2250EA700A85CF05

Function 06B99698 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 06B995F0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 06B99888 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad0490bf8d588379b3603ffd05e2db81b9b37b7a4bffb300c00b0d04beba70f
Instruction ID: 8f365d7df00a802b9b1c247908488a05fb5f40169af76d265f500abbb4342449
Opcode Fuzzy Hash: 3ad0490bf8d588379b3603ffd05e2db81b9b37b7a4bffb300c00b0d04beba70f
Instruction Fuzzy Hash: FCA011B000C20C8A2EC03BF02808008B20CAA00022B8088B8EA2C000020EA8A00088B2

Function 06B98BF0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62dc1e2f5d043d0986854ae407b62e4d3d8c9a12a95c5707238d6a5dfc86f7ff
Instruction ID: 0e700d061e89e1a7b43fb686bd77ea7821b0c78e0095d2a2ab51930c09cc2e86
Opcode Fuzzy Hash: 62dc1e2f5d043d0986854ae407b62e4d3d8c9a12a95c5707238d6a5dfc86f7ff
Instruction Fuzzy Hash: B4B0123420420C472AC037E0240441D320ED640010B840058DF1E422449D85140406E1

Function 06B903D8 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e00c4d8ee2ff1d6b95079c6e96fea265a3b601f3fdb161c7a571fc4e60b0d1
Instruction ID: 1ce1ec16add382fa6998837622c2f30f70d04d3b1f6899db5813839c4707b38f
Opcode Fuzzy Hash: 68e00c4d8ee2ff1d6b95079c6e96fea265a3b601f3fdb161c7a571fc4e60b0d1
Instruction Fuzzy Hash: 3AB09231000108CFEB402B70F80C0087B7AEA042023688021FF0A80119AE271884CA51

Function 06B98318 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce55394fdebe9550227d2baf19b053896d9326e54e6d8e6671171e8da3d05b6b
Instruction ID: b81b226c40479863fcae3296d97ad2dce41065a8071f49cc5e581d4d2b6afec9
Opcode Fuzzy Hash: ce55394fdebe9550227d2baf19b053896d9326e54e6d8e6671171e8da3d05b6b
Instruction Fuzzy Hash: 4AA02230002B0C82822C22B02082220338C280020C3E000B8830C0AA200E3FE0A8C880

Function 06B98358 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c0e04e3ed907a51530cd0810b24dc9c221fe1a817db9fc546c6330603e07fb
Instruction ID: 773e8ca5683ad99331fbda1888c017f2429096348400aa63baa10f18137b44aa
Opcode Fuzzy Hash: 54c0e04e3ed907a51530cd0810b24dc9c221fe1a817db9fc546c6330603e07fb
Instruction Fuzzy Hash: 34B0123200010CE78A001B41E808845BF2DD7102907008022FE0401011D7335460D594

Function 06B98A30 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f1ad9ec8c666c62c55b511cf7e69aa69cb93921d57ff9b8ea408ddb3318e2a
Instruction ID: 5b1b30199374080c8ab521e4393a3a9ef6c7c73401a4260cc7ffe9d7ec767abc
Opcode Fuzzy Hash: a1f1ad9ec8c666c62c55b511cf7e69aa69cb93921d57ff9b8ea408ddb3318e2a
Instruction Fuzzy Hash: C890023504460C8B9540279575096957B9D95859157804091AF0D415015AA56C2055A5

Function 06B97FD8 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1950519314.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe8e222efe346ea7f1a7766b0894f12657f71557c7b90cf83d728458dd68e4c
Instruction ID: 46c171dbcce3d86c7e6e6e7ac50496d0e7c1c034ef3e77402396ed001ec29e5a
Opcode Fuzzy Hash: 6fe8e222efe346ea7f1a7766b0894f12657f71557c7b90cf83d728458dd68e4c
Instruction Fuzzy Hash:

Analysis Process: Client-built.exePID: 7612, Parent PID: 7484COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BD393C1 Relevance: 1.4, Instructions: 1433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c159d2e7d7479717fcba865965e879a70009c72875042cc9a6395208600d029a
Instruction ID: 45f6da467ae30debd1865ca2cbea660fc2a8b8ef98aa174e8f82349eef890119
Opcode Fuzzy Hash: c159d2e7d7479717fcba865965e879a70009c72875042cc9a6395208600d029a
Instruction Fuzzy Hash: B192293171D90D4FEBA8EB5C9469AB933D1EF99314F0501BAE44FC72A7DE29AC028741

Function 00007FFD9BD34DC6 Relevance: 1.3, Instructions: 1272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d06d9e08ac48f04da346639e47cd6b6ce16b88fc4ec53bd5709d582905a8352
Instruction ID: cc40c51e91ffd81b5c966a3f182a1ec912d8fe3ab1943a6812701ba81f317c23
Opcode Fuzzy Hash: 0d06d9e08ac48f04da346639e47cd6b6ce16b88fc4ec53bd5709d582905a8352
Instruction Fuzzy Hash: 7F92A370A19A0D8FDFA8DF58C4A0BA977E1FF58308F1541A9D04ED72A6DB35E941CB40

Function 00007FFD9BD3A7CD Relevance: .9, Instructions: 934
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74a7ec73e17bd4a9dfc4e2aaaca1c724b6188707f373319e2e425753c16f812
Instruction ID: bf010ec8b8a7a778cc34696620af8a995761d3fb195e9d85879bdbf3ba556adb
Opcode Fuzzy Hash: d74a7ec73e17bd4a9dfc4e2aaaca1c724b6188707f373319e2e425753c16f812
Instruction Fuzzy Hash: DF625230708A4D8FEBA8EB2CC465B6977E1FF99304F1541B9E44DC72A6DE35E8428B41

Function 00007FFD9BD38A61 Relevance: .7, Instructions: 696COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc81f786f4599d104507fe1e426c02699cd3a39bda3d01ba004eefd4fbe5cb69
Instruction ID: 19ee3debfb7d1582698fbe80418a9c8afe1b2e690e94a30a81b910265b5c0505
Opcode Fuzzy Hash: bc81f786f4599d104507fe1e426c02699cd3a39bda3d01ba004eefd4fbe5cb69
Instruction Fuzzy Hash: 1122C430B09A0D4FEBA8EB5884A57B873E2FF98304F55517DD44FD32A3DE29A9428740

Function 00007FFD9BD35BE1 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a180f367a276acac14d09c262d4099f685c5b87fd15ba6c666a4a4fd756546f
Instruction ID: 8255c18c9a466f873059cfea008fd7a4d40efe11cf6ed230702f62b1efb034c0
Opcode Fuzzy Hash: 7a180f367a276acac14d09c262d4099f685c5b87fd15ba6c666a4a4fd756546f
Instruction Fuzzy Hash: 35327274A18A1D8FDBA8EF58C895BB973E1FF58304F1145B9D04ED32A6DB34A981CB40

Function 00007FFD9BD33F3D Relevance: 1.7, Strings: 1, Instructions: 436
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00007FFD9BD34457

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f9643d2e3f41011b4d1b6bd6ca317a21d0539d47152163d996f678bf002d156a
Instruction ID: 6a3fa0a679d28694ca6b6cd58f5b246514daeace75f1585efb0ea210e8eb1660
Opcode Fuzzy Hash: f9643d2e3f41011b4d1b6bd6ca317a21d0539d47152163d996f678bf002d156a
Instruction Fuzzy Hash: 06D13631B0E64E4FEBA99B5894613B83BD1EF46314F0511BED48AC72E3DE5CAD428B41

Function 00007FFD9BAC3525 Relevance: 1.6, APIs: 1, Instructions: 137
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00007FFD9BAC3607

Memory Dump Source

Source File: 00000001.00000002.3704974952.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bac0000_Client-built.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ff4c06a8fe4da34da5363538982ba66788c9f5f0409ee1b9c912f0cf1c89fa57
Instruction ID: 6d8f08e142bccd7dac9eaf1dc2837a6d944439bc5ad07eaf4ba5016919700c5a
Opcode Fuzzy Hash: ff4c06a8fe4da34da5363538982ba66788c9f5f0409ee1b9c912f0cf1c89fa57
Instruction Fuzzy Hash: 4641273190DB8C8FDB19EBA888596F97FF0EF56320F0542AFD049C72A2DA746905C781

Function 00007FFD9BAC3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00007FFD9BAC3607

Memory Dump Source

Source File: 00000001.00000002.3704974952.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bac0000_Client-built.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 6e59957cdfb2e566a1579c4f0508e2beebc3ebd6d47ffe110bb419ca7a33e5e0
Instruction ID: 7f525e4d1a79d62bb277be22578c0979f32f9e9a113ac78ae3b4499452dab595
Opcode Fuzzy Hash: 6e59957cdfb2e566a1579c4f0508e2beebc3ebd6d47ffe110bb419ca7a33e5e0
Instruction Fuzzy Hash: 7731D23190DB5C8FDB19DB988859AF9BBF0FF66320F04426BD049D3292DB74A805CB81

Function 00007FFD9BD33451 Relevance: 1.6, Strings: 1, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%_L, xrefs: 00007FFD9BD33673

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID: %_L
API String ID: 0-1469106525
Opcode ID: 83c527aad200a74c774f520652724567f53b757d8fd6c7bb55883db0592eb0b3
Instruction ID: 60793375dfd7d6d8905738b4284904457d56de6759094338acfdde0ce283c08c
Opcode Fuzzy Hash: 83c527aad200a74c774f520652724567f53b757d8fd6c7bb55883db0592eb0b3
Instruction Fuzzy Hash: 13912631B0EA4E4FDBA9EB6888645F577E1EF54324B0601BED04EC72A3DE29E845C740

Function 00007FFD9BD3C349 Relevance: 1.4, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a%_H, xrefs: 00007FFD9BD3C373

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID: a%_H
API String ID: 0-3648799560
Opcode ID: c07a96b22c59a06d153802bbdcdfb980f6e967adedb91af318feccda9bc543f7
Instruction ID: 57519fad953cd026bbb7a7336aa312de31c6271ee7244fc1b460141dbe95e5b9
Opcode Fuzzy Hash: c07a96b22c59a06d153802bbdcdfb980f6e967adedb91af318feccda9bc543f7
Instruction Fuzzy Hash: F1510873B1AF4E0BE7ACDA6844626B573C2FF98358B54017DD45EC7297DD29B9024300

Function 00007FFD9BD320E2 Relevance: 1.4, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#&_^, xrefs: 00007FFD9BD32101

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID: #&_^
API String ID: 0-519297270
Opcode ID: b5e99527a296d5aea0e1d2c15144a1df2817b7473daa9f28ce9d1dc242a732b8
Instruction ID: 0ec03f6ef6cc080a5519158d6927ba5d8598362dac0fddf411ebfdc19234a810
Opcode Fuzzy Hash: b5e99527a296d5aea0e1d2c15144a1df2817b7473daa9f28ce9d1dc242a732b8
Instruction Fuzzy Hash: 7B312837B081294AC324BABDF8958E87390DF9933F70882B7D59DCF097DA286485C6D4

Function 00007FFD9BD320D7 Relevance: 1.4, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#&_^, xrefs: 00007FFD9BD32101

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID: #&_^
API String ID: 0-519297270
Opcode ID: e66a2d830c76b8084a5431be5c391d2096be799b2b69257718f989d6868f7009
Instruction ID: e6bf987dab4c30ba6da6b754185234966fcb90985803641327cc61a519bd1912
Opcode Fuzzy Hash: e66a2d830c76b8084a5431be5c391d2096be799b2b69257718f989d6868f7009
Instruction Fuzzy Hash: 41312637B081294AC324BABDF8958E87390DF9933F70842B7D599CF097DA286085C6D4

Function 00007FFD9BD320CF Relevance: 1.4, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#&_^, xrefs: 00007FFD9BD32101

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID: #&_^
API String ID: 0-519297270
Opcode ID: 4972cd19531dab7de17bda05ffcb5b0ed25abc255377d121293b8e1765df9ec8
Instruction ID: 9df572001f7aa44e1ae1206f893caa9d74d2ee6aec0c12a522bf935210c4c76e
Opcode Fuzzy Hash: 4972cd19531dab7de17bda05ffcb5b0ed25abc255377d121293b8e1765df9ec8
Instruction Fuzzy Hash: E8312627B0812A4AC324BABDF8958E87390DF9933F70886B7D599CF097D9286085C6D4

Function 00007FFD9BD3D6D4 Relevance: 1.4, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N%_H, xrefs: 00007FFD9BD3D764

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID: N%_H
API String ID: 0-556661792
Opcode ID: 831e0ee7d602d49ed4fd311ecb47a5f1d5143b556fe09bfc2149ef8273acd1b3
Instruction ID: b3803eabbc95f2b97b863c42888a27b5fb489258f0be170f9de62694b9329d86
Opcode Fuzzy Hash: 831e0ee7d602d49ed4fd311ecb47a5f1d5143b556fe09bfc2149ef8273acd1b3
Instruction Fuzzy Hash: 6D317D71B0D7890FE3289B2C58295B1BBD1EF96314B1941BFE05ECB297DE29AC438741

Function 00007FFD9BD32C10 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ea3130ae7550c09f97e9aaf84e2c429f9742e47012879c07feacd487daedab
Instruction ID: 7e54ce3d99665abf2fd587a6d0bf8b34b7794f1487097e7970b6713e7c5c3564
Opcode Fuzzy Hash: 42ea3130ae7550c09f97e9aaf84e2c429f9742e47012879c07feacd487daedab
Instruction Fuzzy Hash: 3ED16F22F0E98D4FE779EAA888665E477D0FF95394B0501B9D04ECB2A3DD2CAD068741

Function 00007FFD9BD39763 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d71d8e304d85c28395b0d4f145194426eecd331877577fb7c495b41ed27cef
Instruction ID: 1e10aec075e486b678b5a54f96184933690094846f66c512af7b71c53ea6567a
Opcode Fuzzy Hash: 33d71d8e304d85c28395b0d4f145194426eecd331877577fb7c495b41ed27cef
Instruction Fuzzy Hash: 99D14D3071990D4FDB98EB1CC469AB973E1EF59315B1211B9E44FCB2A7DE28EC428B41

Function 00007FFD9BD38BE3 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52dc9af5eb9c5324f0c8e8faa0d12a50ba4481d4a0f18c36dd6dd8718fad7aa
Instruction ID: 373b44745d900dc75330f81bbe82035a3db96352f0349239ca4be78d1ac97dff
Opcode Fuzzy Hash: a52dc9af5eb9c5324f0c8e8faa0d12a50ba4481d4a0f18c36dd6dd8718fad7aa
Instruction Fuzzy Hash: 97D10420B0EA4D4FE7A9AB6888697B877D1FF54314F0511B9D48FC71E3DE2DAA468300

Function 00007FFD9BD3A3D9 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca26fcb337cb0d1b5df9ce793f4def0c35165aa73d1d26bb7d2747fb437863fe
Instruction ID: 6f63453c8c2329bc816d7161968e5b46c25d9a878aa402d3edca2641171db8f3
Opcode Fuzzy Hash: ca26fcb337cb0d1b5df9ce793f4def0c35165aa73d1d26bb7d2747fb437863fe
Instruction Fuzzy Hash: 23D1B631B09A0D8FEBA8EB68C455BB977E1FF58314F0551BDD04EC72A2DE35A9818B40

Function 00007FFD9BD38C28 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9744381b7a322f3edd6e66e4a032d47c16b432d2b1b91e711bb94183c78265
Instruction ID: 6f8d8deaa7c137068bd5212be28afdbbe7ee65bd8af095d25619d18c8375ca9f
Opcode Fuzzy Hash: cb9744381b7a322f3edd6e66e4a032d47c16b432d2b1b91e711bb94183c78265
Instruction Fuzzy Hash: 83C11521B0EA0D4FEBA9AA6984697B877D1FF54304F1511BDD08FC71E3DE2DA9468300

Function 00007FFD9BD33140 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7b30b2a4c1a489ee6cefcc76173a2ec1f42333321b839f9ac54ade1a6ceda8
Instruction ID: 3322b42c0c954f2125c9018f2d16b315c1d7ed5bce92725294b805d73ce46113
Opcode Fuzzy Hash: 6e7b30b2a4c1a489ee6cefcc76173a2ec1f42333321b839f9ac54ade1a6ceda8
Instruction Fuzzy Hash: 33A19031B19A0E4FDBA8EB68D4616F973E1FF88324F115179E45ED3292DE35E9028B40

Function 00007FFD9BD38D3B Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e590d0d1a1fb9a8d22d48ea44eef3fda1d45d0dfad722fd94a893ee79aa694
Instruction ID: 780002333a108312082fdaab3d4c12024e6b1346cf7535476d6573989aaf9f64
Opcode Fuzzy Hash: e5e590d0d1a1fb9a8d22d48ea44eef3fda1d45d0dfad722fd94a893ee79aa694
Instruction Fuzzy Hash: B9A1A520B0990D4FEBA8EB6D84697B873D2FF58344F555079D44FC32E3DE29A9468740

Function 00007FFD9BD38D89 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63b8a8f9883c8f277ada7074af36a0a53d0a703ca9efd8ecd16c25d4bd30370
Instruction ID: fa62b6ca9a4cd05e0c21b939f9e072d7b19b6267eb84f16a12dd468ea4eab11c
Opcode Fuzzy Hash: d63b8a8f9883c8f277ada7074af36a0a53d0a703ca9efd8ecd16c25d4bd30370
Instruction Fuzzy Hash: F2918220B0990D4FEBA8EB6D84A97B873D2FF98344F515079D44FC32E3CE69A9468740

Function 00007FFD9BD38D01 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a1bd757baf26d108e93f88d340bb07d20fd4e9a48a1ba619c7f25da1801adf4
Instruction ID: dbbea366444e10c1ba832d605773b13b6001284dfc478384470e21a79ef3b517
Opcode Fuzzy Hash: 1a1bd757baf26d108e93f88d340bb07d20fd4e9a48a1ba619c7f25da1801adf4
Instruction Fuzzy Hash: 82919420B0990D4FEBA8EB6D84A97B873D2FF98344F515079D44FC32E3DE69A9468740

Function 00007FFD9BD38BC7 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99712313444e826ebc33cab510b7c348f45c038678c2ada48cbaeb86fdc6147e
Instruction ID: d56a7f49db437088c26d372614ad4e27ac23f975804c2278736623cdbec0e52b
Opcode Fuzzy Hash: 99712313444e826ebc33cab510b7c348f45c038678c2ada48cbaeb86fdc6147e
Instruction Fuzzy Hash: 8F918320B0990D4FEBA8EB6D84A97B873D2FF98344F515079D44FC32E3DE69A9468740

Function 00007FFD9BD38D27 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3aef52484b152f74200ec29ca35925bc80e2e99880a6aadab00ad8bd6b1ea4
Instruction ID: 3d33257af6553b9335a735a51f841278dbb3a8cd9653b667035829d4284a4d31
Opcode Fuzzy Hash: ed3aef52484b152f74200ec29ca35925bc80e2e99880a6aadab00ad8bd6b1ea4
Instruction Fuzzy Hash: BF918220B0990D4FEBA8EB6D84A97B873D2FF98344F515079D44FC32E3DE69A9468740

Function 00007FFD9BD36FC5 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1dec431c45e829993d889004050c61fd5ce5be8a9f7f8d6bf2daf95fbecff3
Instruction ID: 240c2c2e008bea444ef90223bde7261832a185d81c68bb83d30889c47f7211d3
Opcode Fuzzy Hash: 8b1dec431c45e829993d889004050c61fd5ce5be8a9f7f8d6bf2daf95fbecff3
Instruction Fuzzy Hash: 89713A3271DD4D0FE798EB6CD869AB537D1EF89324B0501BAE44EC72A7ED24AC424781

Function 00007FFD9BD3BD32 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb41bbac48daf037ae2dd1a8d9669200f4bd25ae252e4e1ef932cc3c2fb509f0
Instruction ID: 29a6130195512e7e1d94da55cbbc370ae22513d8e88f9cf309d574e6c214ec0e
Opcode Fuzzy Hash: fb41bbac48daf037ae2dd1a8d9669200f4bd25ae252e4e1ef932cc3c2fb509f0
Instruction Fuzzy Hash: 8B81D131B09A4D4FEBA5DF689864AF577E1EF49304F0A00BAE45EC71A3DA28ED41C701

Function 00007FFD9BD3D231 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44fd3d6877c324b2a705a7c9a3ecc1d85b44f5ce5a1302d43ca03f804c5eae2
Instruction ID: 98ccec5b6c6a8bd1a12e561c64e4fc87040d29c9130c455fdaf23268f29786ea
Opcode Fuzzy Hash: b44fd3d6877c324b2a705a7c9a3ecc1d85b44f5ce5a1302d43ca03f804c5eae2
Instruction Fuzzy Hash: FE71A271B1D94D4FDB98EF6CC4A5AA977E2FF98314B0501BAE04EC7297CA24EC018B41

Function 00007FFD9BD36C31 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db74bcf40fb71a4fe3679094c51a08a7126180751d44d596aebb6dd23f4ede27
Instruction ID: 77a5dbb76db6abe228002811ede937dc8be7f1005330ca71971ca781f48eac96
Opcode Fuzzy Hash: db74bcf40fb71a4fe3679094c51a08a7126180751d44d596aebb6dd23f4ede27
Instruction Fuzzy Hash: 46611662B1E94E4FE7ADAB6894656B523D2FF99354B4510BDD00FC72E7DE28BC028340

Function 00007FFD9BD3C15F Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a0a3ba930d4d8a74abe7b347b723fb5dafaa2aff377901ccc87606b62451de
Instruction ID: 6489c9ba6de1057c01a58d14fcfaaa02d948ca8de6934c327efc0b39b660f076
Opcode Fuzzy Hash: 52a0a3ba930d4d8a74abe7b347b723fb5dafaa2aff377901ccc87606b62451de
Instruction Fuzzy Hash: 2B519872B1DE494FF7A8AB684462AE473D2EF94388B54057ED41EC32DBDD29F8428700

Function 00007FFD9BD336F5 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c21c51b35624c15c977423525771c2c475cc8cb29a947690e1865bdcd35cf51
Instruction ID: de9873583b7654d6c8310e6a87d30fa38f0ec99c6c8244cdc0ac30c4f948b675
Opcode Fuzzy Hash: 9c21c51b35624c15c977423525771c2c475cc8cb29a947690e1865bdcd35cf51
Instruction Fuzzy Hash: 78511871A0E64E4FEB6DAB6898506B57BD0EF56328F1111BED48EC31E7DD18A8028381

Function 00007FFD9BD3D495 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8078331c18440494adb52be9a723fea1743f28d7dac75683f5d60084092c4bde
Instruction ID: f30b751810ba30bb85923f0c1b2d5df9d18dad05df21e745d12cfe0b9de3416a
Opcode Fuzzy Hash: 8078331c18440494adb52be9a723fea1743f28d7dac75683f5d60084092c4bde
Instruction Fuzzy Hash: 5251B371A09A4E8FDB99EF58C454AE97BE1FF59314F0541B6E05EC72A2CF34A901CB40

Function 00007FFD9BD3CAC9 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ecf502a29af431c458ebb5f07311476a97cb292171fb60c846ee7b3408a092c
Instruction ID: 6935f8cd0c5aeb5df3ee42eb3589da99954f1e7ffa85bc535913a19ef4dc0b5a
Opcode Fuzzy Hash: 9ecf502a29af431c458ebb5f07311476a97cb292171fb60c846ee7b3408a092c
Instruction Fuzzy Hash: E1514773B0EB890FE77DDB6848755E47BD0EF94358B0901BED08ACB1A7DD18A9858381

Function 00007FFD9BD3755C Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b646b63c062a090e60f6407758b7cb6814f0be1f7091aa98d4b4e05bb4c12f8b
Instruction ID: 073a4c5f24bc1876568a92a650fbb0c3c11afa69281ea5c7578d424da726d6c7
Opcode Fuzzy Hash: b646b63c062a090e60f6407758b7cb6814f0be1f7091aa98d4b4e05bb4c12f8b
Instruction Fuzzy Hash: A8412B22B1EE4E0FE7EC966C98A59F53BC1EF9936470501BAD05EC72D7ED18AC428341

Function 00007FFD9BD36E69 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82f681003f0c150b513c8c369023449da7ea22374df1fc04734ded8d5cd0668
Instruction ID: 70d8a7c860dcdabbd6ab7774053ce5d8ecfaca7a9638c0a3618e504dc102bd4e
Opcode Fuzzy Hash: b82f681003f0c150b513c8c369023449da7ea22374df1fc04734ded8d5cd0668
Instruction Fuzzy Hash: 5241F911B1FA890FE799A73C88746B07BE1DF56344F0944FAD489CB1B7D9199986C301

Function 00007FFD9BD3754E Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437af9dacbf76f450ce49243b8f46abaf56df01ea66315843773de629461dc7d
Instruction ID: 2f4bbb1a96b140bf2e5376d0a79fc6351754f2c15a705b591f2f8a4b57ada45a
Opcode Fuzzy Hash: 437af9dacbf76f450ce49243b8f46abaf56df01ea66315843773de629461dc7d
Instruction Fuzzy Hash: 81312B22B0EE4D0FD7A9966C88659B43BD1EF9926470501FAD05EC72A7ED18BC428341

Function 00007FFD9BD3CED9 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10a0c65c498697259e7d34a72006ebf7307c7580e7cca123fe6a53f760cc75b
Instruction ID: 4cf25a415f020b11ef2ebb597471072ec090b9c52332295542cdda9368a0bd14
Opcode Fuzzy Hash: f10a0c65c498697259e7d34a72006ebf7307c7580e7cca123fe6a53f760cc75b
Instruction Fuzzy Hash: E7413D3070AA4E8FDBA9EB58C461BB937A1FF55308F4510B9E40ECB1E2CB29E955C701

Function 00007FFD9BD32EC6 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07be489e25cdf325e392a38d11ea1e9b91c69bc118831f6de7320e20eb49b52
Instruction ID: 39d6d69ff9f2b11bb8367f17eb91fa9d5b977458350cd3653d461276d89f04af
Opcode Fuzzy Hash: f07be489e25cdf325e392a38d11ea1e9b91c69bc118831f6de7320e20eb49b52
Instruction Fuzzy Hash: 75316F62A1F58A0FD79E97B884615B13BE1EF8736470541FED049CB1A7DC2EA846C340

Function 00007FFD9BD328F2 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5e494e2c2432395c23e35eca857f60afd4a52919aea7cb7a3251ab59b96aa2
Instruction ID: e552813ff99302f0da463e9bb4b4882b2d51378dae6c45e59609e6677fa184a4
Opcode Fuzzy Hash: 0f5e494e2c2432395c23e35eca857f60afd4a52919aea7cb7a3251ab59b96aa2
Instruction Fuzzy Hash: 56312821B2EA4D4FE769A7A888B15F977A0EF59358F0101BBE04FCB1D7DC2869058351

Function 00007FFD9BD33730 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4452e6419c969d346177556066b50d0f65d6051d24b525da5201bbfc04ea91
Instruction ID: 453457461e3bd89a7ddf930f1038c0d3f849a1ddc0945f95424f6abd6b85e1e4
Opcode Fuzzy Hash: db4452e6419c969d346177556066b50d0f65d6051d24b525da5201bbfc04ea91
Instruction Fuzzy Hash: 45310831B0D90D5FFB9CFB689955AB933D1EF99328B011179D44EC32A7EE28E8024781

Function 00007FFD9BD3D155 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa7882474877c3d3ff86fe9ae4ae9d81785afe381dfcd16412098645a7428aa
Instruction ID: 5212ee02e5293c12cf9a2f0560f78803181970c2c704951be650bbaa2afbc6cb
Opcode Fuzzy Hash: 9fa7882474877c3d3ff86fe9ae4ae9d81785afe381dfcd16412098645a7428aa
Instruction Fuzzy Hash: 1D313231A0E98A5FE3BDA26898A56B476D0EF45354F1A10B9C44FC31B3DF18EA81CB41

Function 00007FFD9BD375F0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39aff03cbe60c30983de9bda3c904756c8c31c59c21407efeaa993be329da41f
Instruction ID: 906f006a17502a71b5808f82cb6bce5bed75f32682a146582ac4cba0b804e61e
Opcode Fuzzy Hash: 39aff03cbe60c30983de9bda3c904756c8c31c59c21407efeaa993be329da41f
Instruction Fuzzy Hash: 28110A23B1AD0D0BE7EC959D58669B573C1EF9837471612B9E05EC3297ED14BC828280

Function 00007FFD9BD3D0CD Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3efe01ddca95659526ff864a5c616d1cace0e509fced18235facad117beefb0
Instruction ID: 0e31f2142c4c26536dc31d396551d14e48abe8bfa8529424d5ee81b1e4dfaeeb
Opcode Fuzzy Hash: b3efe01ddca95659526ff864a5c616d1cace0e509fced18235facad117beefb0
Instruction Fuzzy Hash: CE21052158F6C91FC346A7B88C259D57FE4DF8B16430D42FAE089CB5A3C91C9947C761

Function 00007FFD9BD3C466 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e85b433688e1fc0f131ba06bd71e96bff3ed90bf8aad1812bea6720f120af4c
Instruction ID: 1b0fff247354a7470595bf02f106a44824f6129943d173136f4f03b9426d7c2d
Opcode Fuzzy Hash: 3e85b433688e1fc0f131ba06bd71e96bff3ed90bf8aad1812bea6720f120af4c
Instruction Fuzzy Hash: 18210893B2EE8A0FE79D976848626B567D1EF98348B0841BEA09FC71D7DD1CB5054300

Function 00007FFD9BD3798D Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe6e5772adf60f844ec40f4d3f074ffb8ca08da295c7ee28563df51687c55f9
Instruction ID: 9e3ab6d436cfcf7c40979ad4b9ce72e1f2d81d0dab0cf1bbefd2c735b876d67f
Opcode Fuzzy Hash: 4fe6e5772adf60f844ec40f4d3f074ffb8ca08da295c7ee28563df51687c55f9
Instruction Fuzzy Hash: 49217C3061CA0D8FDB98DF1CD4556B9B7E1FF98311F10113EE48AD3262DA35E8428B41

Function 00007FFD9BD3CCA5 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cebdbd2ebd56abfc34944598977706cdced272aca70c40c624d87847b13ee249
Instruction ID: 0b9ecce24476c3ad1ad47be92a2813e1c121d9dd5ad68342c8bb7c4395606169
Opcode Fuzzy Hash: cebdbd2ebd56abfc34944598977706cdced272aca70c40c624d87847b13ee249
Instruction Fuzzy Hash: 7011A21158FADA0FE35657B94C395E13FA49F8716430D42E7E086CB4F3D84C5A8A8361

Function 00007FFD9BD32943 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b455feb385eef30bb1c88c567ca4a1766372257877af551dd077663c79f50696
Instruction ID: 5c0a5d6941e72aaab4a0a1e318573c73672535a8519b8ef85598afdb284f4653
Opcode Fuzzy Hash: b455feb385eef30bb1c88c567ca4a1766372257877af551dd077663c79f50696
Instruction Fuzzy Hash: C521F222B3590D4BE768A79884B2AFA7291FF58358F40427AE04FC71C7DC68A9064380

Function 00007FFD9BD3C75F Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e5d2f00363b6469227e69a6bb6f61e11484e6bfd46426b4e8df9d8746a27eb
Instruction ID: 156dc4940b7cb1c5e46114bc7ef33abade9dc7449fac062634b3b5767f6be5dc
Opcode Fuzzy Hash: 76e5d2f00363b6469227e69a6bb6f61e11484e6bfd46426b4e8df9d8746a27eb
Instruction Fuzzy Hash: 1E01D462B1AE4E0FD7ACEA3804655B9A392FFD8248708457DE05AC7297CF29B9064300

Function 00007FFD9BD34C61 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347265ba2e8d799c3d1a470933ae82d1e722ccecda7e6c369a08a603447448d3
Instruction ID: c67179826867cb0834317b7813229b0652665889ac50d9c1bfa443529a2d2fcb
Opcode Fuzzy Hash: 347265ba2e8d799c3d1a470933ae82d1e722ccecda7e6c369a08a603447448d3
Instruction Fuzzy Hash: FC01F92150EB594FD756E32884652F57FD1DF85224F0D056ED089C70F3CD9846C58382

Function 00007FFD9BD3223A Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b5a70d703a291785676e70cf6ded119dbf9394ab7586d8d6474a6107da2d17
Instruction ID: babe0599b75047412944f6d218f8abfd75d2045bef6aa91f74b7db9a20a586f5
Opcode Fuzzy Hash: 93b5a70d703a291785676e70cf6ded119dbf9394ab7586d8d6474a6107da2d17
Instruction Fuzzy Hash: D5F04631A0EACC2FDB1597B898685EA7FF0EF86304F0641EBE44CCB1A3DD2466448341

Function 00007FFD9BD321D3 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661d4936121daadac5bd82c783e91257b57969dda92c66c892dcfa0e7e256f8f
Instruction ID: 5b93be114038da023f214084531b631ffa5a01a2b7c54187c9215cd6e2cff681
Opcode Fuzzy Hash: 661d4936121daadac5bd82c783e91257b57969dda92c66c892dcfa0e7e256f8f
Instruction Fuzzy Hash: CFF09E27B4ED0E1BD258B4CD6CD10F03380EB81374B45123AC61AC3052D88969520390

Function 00007FFD9BD33020 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36cc905ac16d20fd458bc507ad9e23ae9a8fb6e378e2848eb058c1594e6e29db
Instruction ID: 3a600fdf924c5b05881bf93485f823495336b8804cb91652373a5704020da44c
Opcode Fuzzy Hash: 36cc905ac16d20fd458bc507ad9e23ae9a8fb6e378e2848eb058c1594e6e29db
Instruction Fuzzy Hash: EAF02E21B29A4E07E768AF7C54152B573C1EF45319B460579D48EC71B2DE29DC424341

Function 00007FFD9BD322A9 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3095a292635230c5b41d2fa647cf163847f43a30e8f9ea0934ccea134eb05e15
Instruction ID: c924427682b9e6849970d4b7304edd4df48b72d11455920ec2f50922b06fd3fd
Opcode Fuzzy Hash: 3095a292635230c5b41d2fa647cf163847f43a30e8f9ea0934ccea134eb05e15
Instruction Fuzzy Hash: E9F0A471E1E6CC4FE7599BA488691E97FF0EF56214F4606E7E449C70A3EA2859458300

Function 00007FFD9BD3340D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cf21d9e70ce76508cf83898484feef363597d488487a1893d6b1d777935134
Instruction ID: fea82824fb36beb0032e75eb8efeb5191c16016ec155953803cf71105fed1b5a
Opcode Fuzzy Hash: 70cf21d9e70ce76508cf83898484feef363597d488487a1893d6b1d777935134
Instruction Fuzzy Hash: F4F0827150950D5FD628EB59EC565FA37A4FF85224F00013AF44D82152E6656962C750

Function 00007FFD9BD3C439 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7487fc331c25be0fdf61126d8ccc341b64504bd8b150b4e3fd776c75eb30a6df
Instruction ID: cad3d2eecfb971f8f4607b08e268f2e7c13abb03c0f2b29fbb67d3c92d1b16e0
Opcode Fuzzy Hash: 7487fc331c25be0fdf61126d8ccc341b64504bd8b150b4e3fd776c75eb30a6df
Instruction Fuzzy Hash: DED0A51375E74E06F9D066887CA11F163C5EB511797651373D449C3057DC1B57434101

Function 00007FFD9BD3CEB0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3713730974.00007FFD9BD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bd30000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc1c8425d5c8219fd63eab0b9ef2749b310c42d6fed62634394b275d1fba508
Instruction ID: 8b8377bed55aaa0633be5ca7c507932d5a32a613ed196e96a71e3c2185bcf273
Opcode Fuzzy Hash: 3cc1c8425d5c8219fd63eab0b9ef2749b310c42d6fed62634394b275d1fba508
Instruction Fuzzy Hash: 5BD0A77160B74D8FD75DB73C40151643690EF18744F1444BDD00ACB0E2D55255198200

Analysis Process: TeamViewer_Setup_x64.exePID: 7856, Parent PID: 7484COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.7%
Total number of Nodes:	1289
Total number of Limit Nodes:	24

Executed Functions

Function 004030D9 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004030FE
GetVersion.KERNEL32 ref: 00403104
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040312D
#17.COMCTL32(00000007,00000009), ref: 0040314F
OleInitialize.OLE32(00000000), ref: 00403156
SHGetFileInfoA.SHELL32(0041ECC8,00000000,?,00000160,00000000), ref: 00403172
GetCommandLineA.KERNEL32(00422F00,NSIS Error), ref: 00403187
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,00000000), ref: 0040319A
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,00000020), ref: 004031C5
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004032C2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032DF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032F3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004032FB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040330C
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403314
DeleteFileA.KERNELBASE(1033), ref: 00403328

Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF

ExitProcess.KERNEL32(?), ref: 004033D1
CoUninitialize.COMBASE(?), ref: 004033D6
ExitProcess.KERNEL32 ref: 004033F7
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403514
OpenProcessToken.ADVAPI32(00000000), ref: 0040351B
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403533
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403552
ExitWindowsEx.USER32(00000002,80040002), ref: 00403576
ExitProcess.KERNEL32 ref: 00403599

Part of subcall function 004054EF: MessageBoxIndirectA.USER32(00409218), ref: 0040554A

Strings

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD, xrefs: 004033B3
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 0040318D, 00403193, 0040334C
NSIS Error, xrefs: 00403178
.tmp, xrefs: 0040341E
~nsu, xrefs: 00403402
\Temp, xrefs: 004032D9
C:\Users\user\AppData\Local\Temp\, xrefs: 004032B7, 004032BC, 004032D2, 004032DE, 004032ED, 004032FA, 00403306, 0040330E, 00403407, 00403418, 00403423, 0040342F, 0040343C, 0040344B, 004034FA
", xrefs: 004031EA
C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe, xrefs: 004034B4
UXTHEME, xrefs: 00403121, 00403126, 0040312C
`Kt, xrefs: 00403300
SeShutdownPrivilege, xrefs: 0040352D
1033, xrefs: 00403323
C:\Users\user\AppData\Local\Temp, xrefs: 00403429, 0040342E, 0040345A
TEMP, xrefs: 00403307
TMP, xrefs: 0040330F
Low, xrefs: 004032F5
Error launching installer, xrefs: 0040338E

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe$C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`Kt$~nsu
API String ID: 3329125770-783158399
Opcode ID: 4f4e7a4209cacf2233f42e90a73ac4821f0654123dbc60adf3f7537713659d44
Instruction ID: e7c85c4fe1f62676e3f8a08d8ca43f8bf3783ba147aef7bb7f1979754dcbcc24
Opcode Fuzzy Hash: 4f4e7a4209cacf2233f42e90a73ac4821f0654123dbc60adf3f7537713659d44
Instruction Fuzzy Hash: B7C1E5706083417AE711AF71AD8DA2B7EA8EB85306F04457FF541B61D2C77C5A05CB2E

Function 00405D1B Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,0041F4E8,00000000,00404F4A,0041F4E8,00000000), ref: 00405DCC
GetSystemDirectoryA.KERNEL32(004226A0,00000400), ref: 00405E47
GetWindowsDirectoryA.KERNEL32(004226A0,00000400), ref: 00405E5A
SHGetSpecialFolderLocation.SHELL32(?,0040E8C0), ref: 00405E96
SHGetPathFromIDListA.SHELL32(0040E8C0,004226A0), ref: 00405EA4
CoTaskMemFree.OLE32(0040E8C0), ref: 00405EAF
lstrcatA.KERNEL32(004226A0,\Microsoft\Internet Explorer\Quick Launch), ref: 00405ED1
lstrlenA.KERNEL32(004226A0,?,0041F4E8,00000000,00404F4A,0041F4E8,00000000), ref: 00405F23

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E16
KAo, xrefs: 00405D28
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405ECB

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: KAo$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3339053753
Opcode ID: fb8208971b7bef3eab874112c295b4c22afd955e6dbc7abb81a1d2e78964ecc6
Instruction ID: 70d043a0125fa0970afc212ad974551980140434863585fcf13b89b4fbf53fe2
Opcode Fuzzy Hash: fb8208971b7bef3eab874112c295b4c22afd955e6dbc7abb81a1d2e78964ecc6
Instruction Fuzzy Hash: AD61F471A04A01ABDF205F64DC88B7F3BA8DB41305F50803BE941B62D0D27D4A82DF5E

Function 0040559B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004055C4
lstrcatA.KERNEL32(00420D10,\*.*,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040560C
lstrcatA.KERNEL32(?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040562D
lstrlenA.KERNEL32(?,?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405633
FindFirstFileA.KERNELBASE(00420D10,?,?,?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405644
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004056F1
FindClose.KERNEL32(00000000), ref: 00405702

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004055A8
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 0040559B
\*.*, xrefs: 00405606

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-2696634726
Opcode ID: f4a0432186cec9e524a36939f8e9c58fb2d449d925f7b508e3eb0abb68d19267
Instruction ID: 44541a5d5af4c0b2911f4644f2fa5328a4f1ed3919081d24b86541679c9c03d6
Opcode Fuzzy Hash: f4a0432186cec9e524a36939f8e9c58fb2d449d925f7b508e3eb0abb68d19267
Instruction Fuzzy Hash: 9F51CF30804A04BADF217A658C85BBF7AB8DF82318F54847BF445761D2C73D4982EE6E

Function 00406344 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28a8ad83f22bfe4c4d455a141f03dc38bf257c2203b46f6b1d5cba347f55b6d
Instruction ID: a8746b25a1c6b49bbeafbf020c2dfcaa04563a9eac1a8e827fb2969916571183
Opcode Fuzzy Hash: e28a8ad83f22bfe4c4d455a141f03dc38bf257c2203b46f6b1d5cba347f55b6d
Instruction Fuzzy Hash: 70F17670D00229CBCF18CFA8C8946ADBBB1FF44305F25816ED856BB281D7786A96CF44

Function 00405FFD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(74DF3410,00421558,C:\,0040589C,C:\,C:\,00000000,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 00406008
FindClose.KERNELBASE(00000000), ref: 00406014

Strings

C:\, xrefs: 00405FFD

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
Instruction ID: 1297c1e42099762feae64532f60583430090df1d404adb2e37743a0561846f6f
Opcode Fuzzy Hash: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
Instruction Fuzzy Hash: 8CD012319491206BC3105B38AD0C85B7A599F593317118A33F567F52F0C7788C7296E9

Function 00403679 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF

lstrcatA.KERNEL32(1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,00000000), ref: 004036F4
lstrlenA.KERNEL32(004226A0,?,?,?,004226A0,00000000,00429400,1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,74DF3410), ref: 00403769
lstrcmpiA.KERNEL32(?,.exe), ref: 0040377C
GetFileAttributesA.KERNEL32(004226A0), ref: 00403787
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00429400), ref: 004037D0

Part of subcall function 00405C57: wsprintfA.USER32 ref: 00405C64

RegisterClassA.USER32(00422EA0), ref: 0040380D
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403825
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 0040385A
ShowWindow.USER32(00000005,00000000), ref: 00403890
GetClassInfoA.USER32(00000000,RichEdit20A,00422EA0), ref: 004038BC
GetClassInfoA.USER32(00000000,RichEdit,00422EA0), ref: 004038C9
RegisterClassA.USER32(00422EA0), ref: 004038D2
DialogBoxParamA.USER32(?,00000000,00403A0B,00000000), ref: 004038F1

Strings

RichEdit, xrefs: 004038C3
C:\Users\user\AppData\Local\Temp\, xrefs: 0040367E
Control Panel\Desktop\ResourceLocale, xrefs: 004036AD
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 0040367D
RichEd32, xrefs: 004038A4
.exe, xrefs: 00403776
RichEd20, xrefs: 00403896
_Nb, xrefs: 004037EC, 00403854
RichEdit20A, xrefs: 004038B4, 004038BA
1033, xrefs: 00403699, 004036EF
.DEFAULT\Control Panel\International, xrefs: 004036DF

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-3157804261
Opcode ID: 5c13432dcba976acc153c6c4cb0ae4a4ceee92b52a3611d71cd5da1aeea12791
Instruction ID: cdcda0c5d6d895e27caec97b3fe99e3f57ebd92391a3aca4eab7d54baf018be6
Opcode Fuzzy Hash: 5c13432dcba976acc153c6c4cb0ae4a4ceee92b52a3611d71cd5da1aeea12791
Instruction Fuzzy Hash: FA61C8B16442007ED620BF669D45F373AACEB44759F40447FF941B22E2C77CAD029A2D

Function 00402C66 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C77
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,00000400), ref: 00402C93

Part of subcall function 0040596C: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 00405970
Part of subcall function 0040596C: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 00402CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00402C6D
Inst, xrefs: 00402D4B
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 00402C66
C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe, xrefs: 00402C7D, 00402C8C, 00402CA0, 00402CC0
C:\Users\user\AppData\Local\Temp, xrefs: 00402CC1, 00402CC6, 00402CCC
Null, xrefs: 00402D5D
soft, xrefs: 00402D54
Error launching installer, xrefs: 00402CB6

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-965790605
Opcode ID: 3f665217ac2245ad92c498c6fa1e551097c863ebe5e03bc44dd447b4a8322165
Instruction ID: 1839f4375b44da3097aca9d4a8c6c84b0463c2d100b7a2d698c12080187f488f
Opcode Fuzzy Hash: 3f665217ac2245ad92c498c6fa1e551097c863ebe5e03bc44dd447b4a8322165
Instruction Fuzzy Hash: BF51B6B1A41214ABDF109F65DE89B9E7AB4EF00355F14403BF904B62D1C7BC9E418B9D

Function 00401751 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,00000000,00000000,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405CF9: lstrcpynA.KERNEL32(?,?,00000400,00403187,00422F00,NSIS Error), ref: 00405D06

Part of subcall function 00404F12: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
Part of subcall function 00404F12: lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
Part of subcall function 00404F12: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE

Strings

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD, xrefs: 0040176D, 00401776, 00401783, 00401795, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF
C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\, xrefs: 0040181E, 0040183A
C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD, xrefs: 0040177E

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD$C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD$C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\
API String ID: 1941528284-3469538721
Opcode ID: 44ecab9e1ef5e24c1ff596ae454948ee53cb588ab7073804ea6e55edc91cb487
Instruction ID: dfa66b7161a0f16b13ad00a25904a83b243dedeb6ee7557d1be3b523159fd244
Opcode Fuzzy Hash: 44ecab9e1ef5e24c1ff596ae454948ee53cb588ab7073804ea6e55edc91cb487
Instruction Fuzzy Hash: 5641D572910515BACF107BB5CC85EAF3679EF45329B20823BF521F20E2D63C4A419B6D

Function 004053D8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541B
GetLastError.KERNEL32 ref: 0040542F
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405444
GetLastError.KERNEL32 ref: 0040544E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004053FE
ts@, xrefs: 004053DE
ds@, xrefs: 0040540D
C:\Users\user\AppData\Local\Temp, xrefs: 004053D8

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$ds@$ts@
API String ID: 3449924974-3456956737
Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction ID: 5d613d5f07efa900d759e60f8f8ec78c4c71b6ffd2fe208e339ff175f81ef67f
Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction Fuzzy Hash: F3010871D14259EADF119FA0D9487EFBFB8EB04315F00417AE904B6280D378A644CFAA

Function 00406024 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603B
wsprintfA.USER32 ref: 00406074
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406088

Strings

\, xrefs: 0040604C
UXTHEME, xrefs: 0040602D
%s%s.dll, xrefs: 0040606E

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction ID: 72752c577983536edbae7b7a4b2c1439e1101fa4b93fa8d0208d5a4e16dde88a
Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction Fuzzy Hash: E6F0FC30A40109AADB14E764DC0DFEB365CAB09305F140576A546E11D1D578E9258B69

Function 00402E9F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EFD
GetTickCount.KERNEL32 ref: 00402F7E
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402FAB
wsprintfA.USER32 ref: 00402FBB

Strings

... %d%%, xrefs: 00402FB5

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: fb8bdaecb8610db7079700bd5469a99c5e74861b297f6c97a10e9c8668abb65b
Instruction ID: 4ab2a5a1bcd3fb7fa9d72e81aa521510b391fe67da8672e6f00875cd24a8b3cf
Opcode Fuzzy Hash: fb8bdaecb8610db7079700bd5469a99c5e74861b297f6c97a10e9c8668abb65b
Instruction Fuzzy Hash: 7D518F729022199BDF10DF65DA08A9F7BB8AF40795F14413BF800B72C4C7789E51DBAA

Function 0040599B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004059AF
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 004059C9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040599E
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 0040599B
nsa, xrefs: 004059A6

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-337437966
Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction ID: 3a3981258a6ccd3f3c7180c2fb01dffc681fdc90015df490a153c8b64b3610b8
Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction Fuzzy Hash: 6DF08276708214ABEB108F55EC04B9B7B9CDF91760F10C03BFA48DA190D6B599548B99

Function 00405859 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405CF9: lstrcpynA.KERNEL32(?,?,00000400,00403187,00422F00,NSIS Error), ref: 00405D06

Part of subcall function 00405804: CharNextA.USER32(?,?,C:\,?,00405870,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 00405817
Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 0040582B

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058AC
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 004058BC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405859
C:\, xrefs: 0040585F, 00405864, 0040586A, 004058A5, 004058AB, 004058B3, 004058BB

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3049482934
Opcode ID: 2f5f7bd10b83e5c994280ddce28bb3e0edcf250d71028fabecdb2709bf5dd46b
Instruction ID: 1d2993da53655c0900dfa7f8eb6ffa86a16769ab8224128061af08a25d69d353
Opcode Fuzzy Hash: 2f5f7bd10b83e5c994280ddce28bb3e0edcf250d71028fabecdb2709bf5dd46b
Instruction Fuzzy Hash: 16F0F427105E5165DA22323B1C05B9F1A44CD86354718C53BFC51F22D2DA3CC8629DBE

Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401FBB

Part of subcall function 00404F12: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
Part of subcall function 00404F12: lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
Part of subcall function 00404F12: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FCB
GetProcAddress.KERNEL32(00000000,?), ref: 00401FDB
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402045

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: c9236aab3ecf390f27b0d2df40a3eeaa529cc51138fd025aa611fd94b365db02
Instruction ID: 033e4e5f5e4c037d50d2464c5542d6b5672e4837e9f8cb01fb8d89ff16108e1c
Opcode Fuzzy Hash: c9236aab3ecf390f27b0d2df40a3eeaa529cc51138fd025aa611fd94b365db02
Instruction Fuzzy Hash: 1A212B72904211FBDF217FA48E49AAE76B1AB45318F30423BF701B62D0C7BD49459A6E

Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405804: CharNextA.USER32(?,?,C:\,?,00405870,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 00405817
Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 0040582B

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 004053D8: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541B

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD, xrefs: 00401629

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD
API String ID: 1892508949-2353090577
Opcode ID: dc3f2b08dd0b23deb2200b8cff6eb9b6ab41173e829b03834ce904b4ad95c354
Instruction ID: 4fb2b9239308f527e4829455642bf5c86be9504270dcf99fcce102751257b2ff
Opcode Fuzzy Hash: dc3f2b08dd0b23deb2200b8cff6eb9b6ab41173e829b03834ce904b4ad95c354
Instruction Fuzzy Hash: 1611E736508141ABEF217F650D415BF27B0EA92325738467FE592B62E2C63C4942A63F

Function 0040548A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004054B3
CloseHandle.KERNEL32(?), ref: 004054C0

Strings

Error launching installer, xrefs: 0040549D

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 8c32d595c10ae78cfc35805ab98709760fd6cf99201592758dbf5461ff55bb51
Instruction ID: 90ee3f3d0c484d323fd0424032eb65db2415cafeee3384e03f1d9bc4b04e7a5d
Opcode Fuzzy Hash: 8c32d595c10ae78cfc35805ab98709760fd6cf99201592758dbf5461ff55bb51
Instruction Fuzzy Hash: FFE04FB4A002097FEB009B60EC05F7B7BBCEB00348F408561BD11F21A0E374A9508A78

Function 00406779 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4bbaf917c5b2b4b29eca7dd879fe0279583c9caa0a8680a3fb668f2eecfa979
Instruction ID: ac331763182a67db8ffe8b732b67c8974d54266b30473341b06133cd37c0d4bc
Opcode Fuzzy Hash: b4bbaf917c5b2b4b29eca7dd879fe0279583c9caa0a8680a3fb668f2eecfa979
Instruction Fuzzy Hash: ECA13171E00229CBDF28DFA8C8547ADBBB1FB44305F11816ED816BB281C7786A96CF44

Function 0040697A Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4b2f824491321a50731860d46817135270c8e97721ba662834ece50dc26027
Instruction ID: e89747aace1fce0fcb13a8d80e6f88749465aa03c559881c8099c8d07fdfb4d2
Opcode Fuzzy Hash: db4b2f824491321a50731860d46817135270c8e97721ba662834ece50dc26027
Instruction Fuzzy Hash: BE911070E04228CBDF28DF98C8547ADBBB1FB44305F15816ED816BB281C778AA96DF44

Function 00406690 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adca5b2b6989107afceee3a061708c38461c5fc9fc0daf484043dfdf7e09805a
Instruction ID: d456333056e0522eb9a81365918d8492ce98a85054e5b278218ea4b7938feab7
Opcode Fuzzy Hash: adca5b2b6989107afceee3a061708c38461c5fc9fc0daf484043dfdf7e09805a
Instruction Fuzzy Hash: E1814671D04228CFDF24CFA8C8847ADBBB1FB44305F25816AD416BB281C778AA96DF44

Function 00406195 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfff9db2859b877ca6a77ec9405565887134ef839be144d68b3806b8d7c08ac
Instruction ID: 4327eab70650ef0c96a691b493921a8ab8e5ba0d824f916f670fcb6a13d6a8f8
Opcode Fuzzy Hash: 5bfff9db2859b877ca6a77ec9405565887134ef839be144d68b3806b8d7c08ac
Instruction Fuzzy Hash: 11816671D04228DBDF24CFA8C8447ADBBB1FB44315F2181AED856BB281C7786A96DF44

Function 004065E3 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3dabd0af62f4e8bfcd4b659d73a5ba33a7939e144f292b7bb16ba2439e66e8
Instruction ID: 63ee65aff5d1ea53a99bb7455827a561e54e570c364fe5978cc4b9ff32097947
Opcode Fuzzy Hash: 2f3dabd0af62f4e8bfcd4b659d73a5ba33a7939e144f292b7bb16ba2439e66e8
Instruction Fuzzy Hash: E9711271D04228CBDF24CFA8C8547ADBBF1FB48305F15806AD856BB281D7786A96DF44

Function 00406701 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d4d9fa97144311a3e66a470cde7927608ab55fe6dc8c436fded4a10c430ead
Instruction ID: 2ec41c1936be718984cf19d05ce660ecedc56656b80368bbb2ce29215557a5c8
Opcode Fuzzy Hash: 83d4d9fa97144311a3e66a470cde7927608ab55fe6dc8c436fded4a10c430ead
Instruction Fuzzy Hash: 53712571E04228CBDF28CF98C854BADBBB1FB44305F15816ED856BB281C7785996DF44

Function 0040664D Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b21a4910564614c6641403ac362d6aa440f40f6368f9ee5d1983abbc3d5a3b8
Instruction ID: 94740bf10ed9628fc2a816943eb7322e71ed29eec5e37d1a6fe0f7c23d4f3e83
Opcode Fuzzy Hash: 1b21a4910564614c6641403ac362d6aa440f40f6368f9ee5d1983abbc3d5a3b8
Instruction Fuzzy Hash: 1D714571E04228CBDF28CF98C854BADBBB1FB44305F11806ED856BB281C7786A96DF44

Function 00401E44 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404F12: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
Part of subcall function 00404F12: lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
Part of subcall function 00404F12: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE

Part of subcall function 0040548A: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004054B3
Part of subcall function 0040548A: CloseHandle.KERNEL32(?), ref: 004054C0

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
GetExitCodeProcess.KERNELBASE(?,?), ref: 00401E8E
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EB3

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 7baa4545988b071bf1f27952e090968b1b6e0d745a44be253271fef70d106577
Instruction ID: 49f7d359c4d218189077cc8fb8a526ed56d4096950e75cb47e310611910bd6fc
Opcode Fuzzy Hash: 7baa4545988b071bf1f27952e090968b1b6e0d745a44be253271fef70d106577
Instruction Fuzzy Hash: C4016D31904104EBDF11AFA1C984A9E77B2EF00354F10817BFA01B52E1C7785A85AB9A

Function 00405553 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405947: GetFileAttributesA.KERNELBASE(?,?,0040555F,?,?,00000000,00405742,?,?,?,?), ref: 0040594C
Part of subcall function 00405947: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405960

RemoveDirectoryA.KERNELBASE(?,?,?,00000000,00405742), ref: 0040556E
DeleteFileA.KERNELBASE(?,?,?,00000000,00405742), ref: 00405576
SetFileAttributesA.KERNEL32(?,00000000), ref: 0040558E

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 17f562840c1773a82e66d36c699c3ba4858698b3520e1b3e97930180dfe60130
Instruction ID: 364b991763a9b947ff98ca2783b3bb2cd1a0068a6ee853e10d07d538a8c3989e
Opcode Fuzzy Hash: 17f562840c1773a82e66d36c699c3ba4858698b3520e1b3e97930180dfe60130
Instruction Fuzzy Hash: 6CE0E531519A91B6C61057309C08F5F2AD6EFCA338F040A36F891B21C4C33C88068E7E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
Instruction ID: da56ad7cfcb2a9fecb994a09e4a0bd113f750103611445cd7b28aada07ee45e3
Opcode Fuzzy Hash: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
Instruction Fuzzy Hash: 2E012831B24210ABE7294B389D04B6A369CE710328F11823BF811F72F1D6B8DC42DB4D

Function 00406092 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
GetProcAddress.KERNEL32(00000000,?), ref: 004060BF

Part of subcall function 00406024: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603B
Part of subcall function 00406024: wsprintfA.USER32 ref: 00406074
Part of subcall function 00406024: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406088

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction ID: f390ed2799c289b087c769a87f24dfac638062b8da6604b2acd18c4b1555f769
Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction Fuzzy Hash: B4E08632644111A6D320A7709D0493B72EC9E84710302483EF906F2191D738AC259669

Function 0040596C Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 00405970
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26

Function 00405947 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,0040555F,?,?,00000000,00405742,?,?,?,?), ref: 0040594C
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405960

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction ID: 96e5362f07f59601f7516fe8bcac2aa0a8151a45168581d09323fa3b8cc485cf
Opcode Fuzzy Hash: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction Fuzzy Hash: F7D01272908121AFC2102738ED0C89BBF65EB543717058B35FDB9F22F0D7304C568AA6

Function 0040359F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,004033D6,?), ref: 004035AA

Strings

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\, xrefs: 004035BE

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\
API String ID: 2962429428-367517261
Opcode ID: 596cad97df7a130adaf378ac47e28dabc4cf3a27c081830e49709f32aaba56d5
Instruction ID: f4b59f51dd056b556ace1dccfc0996fbca79989fe12c672f2328a55b3cb2227a
Opcode Fuzzy Hash: 596cad97df7a130adaf378ac47e28dabc4cf3a27c081830e49709f32aaba56d5
Instruction Fuzzy Hash: FBC08030504640B7D1247F79AD4B5193A145B40335FA04376F8B4F00F1C73C5B45555D

Function 00405455 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004030CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 0040545B
GetLastError.KERNEL32 ref: 00405469

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction ID: ace853db513f64caea17b5c73fb52fb3118c2a3fabff3065b7385b8b337d2f64
Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction Fuzzy Hash: 9DC08C30B18101EAC6100B30AE087073D50AB00742F1444356206E10E0C6309050CD2F

Function 00402283 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 004022BC

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
Instruction ID: ed5e863b5af70a22674a87f6432e4eb84017b1e79b4e81bbc09640d5f5368664
Opcode Fuzzy Hash: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
Instruction Fuzzy Hash: 8AE04F31B001746FDB217AF14E8EE7F11989B84348B64417EF601B62C3DDBC4D434AA9

Function 00405A13 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000020,?,0040305C,00000000,0040A8C0,00000020,0040A8C0,00000020,000000FF,00000004,00000000), ref: 00405A27

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: edb1125888c6416cb1e0b95ca9609c2ac4c4c792cbd4e8f88826aa2405e91300
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: D7E0EC3261425EEFDF109E659C40AEB7B6DEB053A4F048532FD25E2150E271E8219FB5

Function 004059E4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040308E,00000000,00000000,00402EEB,000000FF,00000004,00000000,00000000,00000000), ref: 004059F8

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction ID: 6c2e581bc83b2d89c4a498056592e8f52b2bea012b9e1656670f40d352b29975
Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction Fuzzy Hash: 4DE0EC3272429AABDF109E559C44EEF7BACEB05360F048932FD15E3190D235ED219FA9

Function 00405BB4 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

MoveFileExA.KERNEL32(?,?,00000005(MOVEFILE_REPLACE_EXISTING|MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00405BBE

Part of subcall function 00405A42: lstrcpyA.KERNEL32(00421A98,NUL,?,00000000,?,00000000,00405BD5,?,?), ref: 00405A51
Part of subcall function 00405A42: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405BD5,?,?), ref: 00405A75
Part of subcall function 00405A42: GetShortPathNameA.KERNEL32(?,00421A98,00000400), ref: 00405A7E
Part of subcall function 00405A42: GetShortPathNameA.KERNEL32(00421E98,00421E98,00000400), ref: 00405A9B
Part of subcall function 00405A42: wsprintfA.USER32 ref: 00405AB9
Part of subcall function 00405A42: GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405AF4
Part of subcall function 00405A42: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B03
Part of subcall function 00405A42: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B3B
Part of subcall function 00405A42: SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405B91

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: File$NamePathShortlstrcpy$AllocCloseGlobalHandleMovePointerSizewsprintf
String ID:
API String ID: 2305538632-0
Opcode ID: 200995f69a62734c116fa759da9e398c1731b90633fe871f8e3bc0a5ec9d069e
Instruction ID: 84c318f3e4a96c22bc0b86da1b6d9270b2a2b8de3931848374d89fd7c22897fb
Opcode Fuzzy Hash: 200995f69a62734c116fa759da9e398c1731b90633fe871f8e3bc0a5ec9d069e
Instruction Fuzzy Hash: 0DD09E35208601AEDA115B50DD05A5B7BB5EB90355F10C52AF289504B0E73594519F09

Function 00403091 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,?), ref: 0040309F

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Non-executed Functions

Function 0040488F Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004048A7
GetDlgItem.USER32(?,00000408), ref: 004048B2
GlobalAlloc.KERNEL32(00000040,?), ref: 004048FC
LoadBitmapA.USER32(0000006E), ref: 0040490F
SetWindowLongA.USER32(?,000000FC,00404E86), ref: 00404928
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040493C
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 0040494E
SendMessageA.USER32(?,00001109,00000002), ref: 00404964
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404970
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404982
DeleteObject.GDI32(00000000), ref: 00404985
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004049B0
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004049BC
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A51
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404A7C
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A90
GetWindowLongA.USER32(?,000000F0), ref: 00404ABF
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404ACD
ShowWindow.USER32(?,00000005), ref: 00404ADE
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404BDB
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C40
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C55
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C79
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C99
ImageList_Destroy.COMCTL32(?), ref: 00404CAE
GlobalFree.KERNEL32(?), ref: 00404CBE
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D37
SendMessageA.USER32(?,00001102,?,?), ref: 00404DE0
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404DEF
InvalidateRect.USER32(?,00000000,00000001), ref: 00404E0F
ShowWindow.USER32(?,00000000), ref: 00404E5D
GetDlgItem.USER32(?,000003FE), ref: 00404E68
ShowWindow.USER32(00000000), ref: 00404E6F

Strings

N, xrefs: 00404B19
M, xrefs: 00404A38
, xrefs: 00404E47
KAo, xrefs: 00404E15

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $KAo$M$N
API String ID: 1638840714-3073395132
Opcode ID: 8b0289ef19e9e7d4f6956f04046df2f7fedd754f5cc9c605ccbb11d5e9afe659
Instruction ID: e7c54df8ad39b376662a796d960b289492e5a6982c1727c2c37b81bede79f7f2
Opcode Fuzzy Hash: 8b0289ef19e9e7d4f6956f04046df2f7fedd754f5cc9c605ccbb11d5e9afe659
Instruction Fuzzy Hash: 43025EB0A00209AFEF109F54DC85AAE7BB5FB84315F10817AF611B62E1D7789E42DF58

Function 00405050 Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004050AF
GetDlgItem.USER32(?,000003EE), ref: 004050BE
GetClientRect.USER32(?,?), ref: 004050FB
GetSystemMetrics.USER32(00000002), ref: 00405102
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405123
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405134
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405147
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405155
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405168
ShowWindow.USER32(00000000,?,0000001B,?), ref: 0040518A
ShowWindow.USER32(?,00000008), ref: 0040519E
GetDlgItem.USER32(?,000003EC), ref: 004051BF
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004051CF
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004051E8
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004051F4
GetDlgItem.USER32(?,000003F8), ref: 004050CD

Part of subcall function 00403F13: SendMessageA.USER32(00000028,?,00000001,00403D44), ref: 00403F21

GetDlgItem.USER32(?,000003EC), ref: 00405210
CreateThread.KERNEL32(00000000,00000000,Function_00004FE4,00000000), ref: 0040521E
CloseHandle.KERNEL32(00000000), ref: 00405225
ShowWindow.USER32(00000000), ref: 00405248
ShowWindow.USER32(?,00000008), ref: 0040524F
ShowWindow.USER32(00000008), ref: 00405295
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052C9
CreatePopupMenu.USER32 ref: 004052DA
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004052EF
GetWindowRect.USER32(?,000000FF), ref: 0040530F
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405328
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405364
OpenClipboard.USER32(00000000), ref: 00405374
EmptyClipboard.USER32 ref: 0040537A
GlobalAlloc.KERNEL32(00000042,?), ref: 00405383
GlobalLock.KERNEL32(00000000), ref: 0040538D
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004053A1
GlobalUnlock.KERNEL32(00000000), ref: 004053BA
SetClipboardData.USER32(00000001,00000000), ref: 004053C5
CloseClipboard.USER32 ref: 004053CB

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: d6ecd7d14b8e00b748d1229dc10f545a94969e68e0fceeae392a714a00d68d17
Instruction ID: d5cc627e10ac9a037e5b70d1472d8d3a221fef050c439e23246209dc4a3cc6f1
Opcode Fuzzy Hash: d6ecd7d14b8e00b748d1229dc10f545a94969e68e0fceeae392a714a00d68d17
Instruction Fuzzy Hash: 53A159B1900208BFDB219FA0DD85AAE7F79FB48355F10407AFA01B61A0C7B55E41DF69

Function 0040431C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040436B
SetWindowTextA.USER32(00000000,?), ref: 00404395
SHBrowseForFolderA.SHELL32(?,0041F0E0,?), ref: 00404446
CoTaskMemFree.OLE32(00000000), ref: 00404451
lstrcmpiA.KERNEL32(004226A0,0041FD08), ref: 00404483
lstrcatA.KERNEL32(?,004226A0), ref: 0040448F
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044A1

Part of subcall function 004054D3: GetDlgItemTextA.USER32(?,?,00000400,004044D8), ref: 004054E6

Part of subcall function 00405F64: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FBC
Part of subcall function 00405F64: CharNextA.USER32(?,?,?,00000000), ref: 00405FC9
Part of subcall function 00405F64: CharNextA.USER32(?,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FCE
Part of subcall function 00405F64: CharPrevA.USER32(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FDE

GetDiskFreeSpaceA.KERNEL32(0041ECD8,?,?,0000040F,?,0041ECD8,0041ECD8,?,00000001,0041ECD8,?,?,000003FB,?), ref: 0040455F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040457A

Part of subcall function 004046D3: lstrlenA.KERNEL32(0041FD08,0041FD08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045EE,000000DF,00000000,00000400,?), ref: 00404771
Part of subcall function 004046D3: wsprintfA.USER32 ref: 00404779
Part of subcall function 004046D3: SetDlgItemTextA.USER32(?,0041FD08), ref: 0040478C

Strings

KAo, xrefs: 004045D6
A, xrefs: 0040443F

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$KAo
API String ID: 2624150263-3292651041
Opcode ID: 1558e11706ab6d26c01ec83b0c58713cad93a9e9ab837f02d5dc5529ec40a987
Instruction ID: 222947b4accbc62cc0073c5541b0f9589876626f1104fcc3d8441c992cea6716
Opcode Fuzzy Hash: 1558e11706ab6d26c01ec83b0c58713cad93a9e9ab837f02d5dc5529ec40a987
Instruction Fuzzy Hash: 71A17EB1900209ABDB11AFA5CC45BEFB6B8EF84315F14843BF711B62D1D77C8A418B69

Function 0040205E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407408,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020DD
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189

Strings

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD, xrefs: 0040211D

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD
API String ID: 123533781-2353090577
Opcode ID: 98c6856de954bf32f67bc9aae575288044ef0a57168b27d926b9bae310f30c25
Instruction ID: 15b8319daa3a69dadbe16bc3493db081a7dc62ee607a685d27ecc12527328b4b
Opcode Fuzzy Hash: 98c6856de954bf32f67bc9aae575288044ef0a57168b27d926b9bae310f30c25
Instruction Fuzzy Hash: 785138B1A00208BFCF10DFA4C988A9D7BB5FF48319F20856AF515EB2D1DB799941CB54

Function 00402688 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402697

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: a8d2051a0b43e45e0548476364d3f5ec7a3e7dc7c9238cb7b637b6be69fa9f30
Instruction ID: a95b2630499809d01a6e7b037cab792d100f7a465f9f887e4e98b5ff960ae470
Opcode Fuzzy Hash: a8d2051a0b43e45e0548476364d3f5ec7a3e7dc7c9238cb7b637b6be69fa9f30
Instruction Fuzzy Hash: 79F0A7726082009BE701E7A49949AEE7778DB61314F60057BE241A21C1D7B84985AB3A

Function 00403A0B Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A47
ShowWindow.USER32(?), ref: 00403A64
DestroyWindow.USER32 ref: 00403A78
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A94
GetDlgItem.USER32(?,?), ref: 00403AB5
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403AC9
IsWindowEnabled.USER32(00000000), ref: 00403AD0
GetDlgItem.USER32(?,00000001), ref: 00403B7E
GetDlgItem.USER32(?,00000002), ref: 00403B88
SetClassLongA.USER32(?,000000F2,?), ref: 00403BA2
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403BF3
GetDlgItem.USER32(?,00000003), ref: 00403C99
ShowWindow.USER32(00000000,?), ref: 00403CBA
EnableWindow.USER32(?,?), ref: 00403CCC
EnableWindow.USER32(?,?), ref: 00403CE7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403CFD
EnableMenuItem.USER32(00000000), ref: 00403D04
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403D1C
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D2F
lstrlenA.KERNEL32(0041FD08,?,0041FD08,00422F00), ref: 00403D58
SetWindowTextA.USER32(?,0041FD08), ref: 00403D67
ShowWindow.USER32(?,0000000A), ref: 00403E9B

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 3ac918ef0a42e48e667534ebe08b1c5e2c6f4e88b6f53ea8c8a8fe3e2e231469
Instruction ID: e8e4c14712e0ebd1bd3c96694815290efe84e81baa174b168cbdfcdac135d6c4
Opcode Fuzzy Hash: 3ac918ef0a42e48e667534ebe08b1c5e2c6f4e88b6f53ea8c8a8fe3e2e231469
Instruction Fuzzy Hash: 29C1DF71A04205BBDB20AF61EE45E2B3E7CFB45706B40453EF601B11E1C779A942AB6E

Function 00404027 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040B2
GetDlgItem.USER32(00000000,000003E8), ref: 004040C6
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004040E4
GetSysColor.USER32(?), ref: 004040F5
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404104
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404113
lstrlenA.KERNEL32(?), ref: 00404116
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404125
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040413A
GetDlgItem.USER32(?,0000040A), ref: 0040419C
SendMessageA.USER32(00000000), ref: 0040419F
GetDlgItem.USER32(?,000003E8), ref: 004041CA
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 0040420A
LoadCursorA.USER32(00000000,00007F02), ref: 00404219
SetCursor.USER32(00000000), ref: 00404222
ShellExecuteA.SHELL32(0000070B,open,004226A0,00000000,00000000,00000001), ref: 00404235
LoadCursorA.USER32(00000000,00007F00), ref: 00404242
SetCursor.USER32(00000000), ref: 00404245
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404271
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404285

Strings

N, xrefs: 004041B8
open, xrefs: 0040422D
KAo, xrefs: 00404047

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: KAo$N$open
API String ID: 3615053054-4196897437
Opcode ID: d6331d360d592cb1fcb1934a6ab791839a151b05b6f3426df7f2f496f579edd7
Instruction ID: f5dd8c80699fee66c1c508087d6ededbe7bbcdfb93c9c5870bdb982cd402330a
Opcode Fuzzy Hash: d6331d360d592cb1fcb1934a6ab791839a151b05b6f3426df7f2f496f579edd7
Instruction Fuzzy Hash: 1261C5B1A40209BFEB109F61DC45F6A7B79FB84741F10807AFB057A2D1C7B8A951CB98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: c0f94b8c962ee7b75acafc3cefd778743504d8a107dd351fe724bfdc705f9f00
Instruction ID: a0b7ce50fec83efafeb16569406a1c152c04985fcf8b97c7298fc3655e55bd79
Opcode Fuzzy Hash: c0f94b8c962ee7b75acafc3cefd778743504d8a107dd351fe724bfdc705f9f00
Instruction Fuzzy Hash: CD419B71804249AFCF058FA4CD459AFBFB9FF44310F00812AF961AA1A0C738EA50DFA5

Function 00405A42 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421A98,NUL,?,00000000,?,00000000,00405BD5,?,?), ref: 00405A51
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405BD5,?,?), ref: 00405A75
GetShortPathNameA.KERNEL32(?,00421A98,00000400), ref: 00405A7E

Part of subcall function 004058D1: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E1
Part of subcall function 004058D1: lstrlenA.KERNEL32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405913

GetShortPathNameA.KERNEL32(00421E98,00421E98,00000400), ref: 00405A9B
wsprintfA.USER32 ref: 00405AB9
GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405AF4
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B03
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B3B
SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405B91
GlobalFree.KERNEL32(00000000), ref: 00405BA2
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405BA9

Part of subcall function 0040596C: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 00405970
Part of subcall function 0040596C: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992

Strings

[Rename], xrefs: 00405B23, 00405B35
NUL, xrefs: 00405A4B
%s=%s, xrefs: 00405AAF

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 4c27ce9d423c33f638fbced1664b30ba87b14f005f57ce999c1b8a6a2e252c84
Instruction ID: 42b7cc2c3f2f4ef7c3412fd2f3d3cbe4eee66c4c235e50fd6e5efd85f9217fc4
Opcode Fuzzy Hash: 4c27ce9d423c33f638fbced1664b30ba87b14f005f57ce999c1b8a6a2e252c84
Instruction Fuzzy Hash: 9931E271A04B19ABD2206B619C89F6B3A6CDF45755F14003AFE05F62D2DA7CBC008E6D

Function 00405F64 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FBC
CharNextA.USER32(?,?,?,00000000), ref: 00405FC9
CharNextA.USER32(?,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FCE
CharPrevA.USER32(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FDE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F65
*?|<>/":, xrefs: 00405FAC
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 00405FA0

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1377249131
Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction ID: a0964663e3c08fb0288e5f4f4a0160773f2bbbf5a4d40b443b4f636863f092b1
Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction Fuzzy Hash: C611C451808F922EEB3216640C44BBB7F99CF5A760F18007BE9D4B22C2D67C5C429F6E

Function 00403F45 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F62
GetSysColor.USER32(00000000), ref: 00403F7E
SetTextColor.GDI32(?,00000000), ref: 00403F8A
SetBkMode.GDI32(?,?), ref: 00403F96
GetSysColor.USER32(?), ref: 00403FA9
SetBkColor.GDI32(?,?), ref: 00403FB9
DeleteObject.GDI32(?), ref: 00403FD3
CreateBrushIndirect.GDI32(?), ref: 00403FDD

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: 563dd17f99c902cd34f005863f03740a6a5938172a6e5e033378c94734032825
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: B4214271908705ABC7219F68DD48F4BBFF8AF01715B048A29E895E26E0D735EA04CB55

Function 00404F12 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 558402415f57fe0eb81db75807d2d057a66030d2c136bde9c432be6294094776
Instruction ID: 5a9a404093729f8c7a4ed64dcb73daf90ff889549f225b9df3951733f5861a8d
Opcode Fuzzy Hash: 558402415f57fe0eb81db75807d2d057a66030d2c136bde9c432be6294094776
Instruction Fuzzy Hash: EB219DB1A00119BADF119FA5DD84ADEBFB9EF44354F14807AF904B6290C7788E41DBA8

Function 004047DD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004047F8
GetMessagePos.USER32 ref: 00404800
ScreenToClient.USER32(?,?), ref: 0040481A
SendMessageA.USER32(?,00001111,00000000,?), ref: 0040482C
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404852

Strings

f, xrefs: 0040482E

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 206dc1e0429e6aa6b627cd25208fa2295557d59b2a7717453fa0c9894da25502
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: E6015276D00259BADB01DB94DC45FFEBBBCAF55711F10412BBA10B61C0C7B4A501CBA5

Function 00402B7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B9A
MulDiv.KERNEL32(044A887E,00000064,044AB7B8), ref: 00402BC5
wsprintfA.USER32 ref: 00402BD5
SetWindowTextA.USER32(?,?), ref: 00402BE5
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7

Strings

verifying installer: %d%%, xrefs: 00402BCF

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 649971ee7512e9da800057b1e5ac373431693e3f4f1e876899c067cd5a0faa84
Instruction ID: bd73235a5a2a729140de961e31d76a0e47d27260d0eaef7d75f80e35c4c54abd
Opcode Fuzzy Hash: 649971ee7512e9da800057b1e5ac373431693e3f4f1e876899c067cd5a0faa84
Instruction Fuzzy Hash: EF01F471540208BBEF109F60DD49EEE3B79EB04305F008039FA16B51D1D7B59955DF59

Function 004026C6 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
GlobalFree.KERNEL32(?), ref: 0040276F
GlobalFree.KERNEL32(00000000), ref: 00402782
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040279A
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 39fbd17f46fc9c371fd9deabdbb1a4d81bf886de883c9339f90e348bb50c0e41
Instruction ID: 55e8cf3ffad71cabca96213aa966ad8f6b0c6824c0bc9dabfeb9c0d6c9f08848
Opcode Fuzzy Hash: 39fbd17f46fc9c371fd9deabdbb1a4d81bf886de883c9339f90e348bb50c0e41
Instruction Fuzzy Hash: 03217C71800124BBCF216FA5DE89EAE7A79EF09324F14023AF950762D1C7795D418FA9

Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A9B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
RegCloseKey.ADVAPI32(?), ref: 00402AE0
RegCloseKey.ADVAPI32(?), ref: 00402B05
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 26d703e6b955c0b1753e13e50ef068aceb5afa025d50a3e8e2eadb28cc0acf60
Instruction ID: feb6aed171ad8b85e204e5b4e2feb4536d295dbd67c3687bd8867431d3a466b7
Opcode Fuzzy Hash: 26d703e6b955c0b1753e13e50ef068aceb5afa025d50a3e8e2eadb28cc0acf60
Instruction Fuzzy Hash: 53117F71A00108FFDF229F90DE89EAE3B7DEB54349B104076FA01B10A0D7749E51DB69

Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CE2
GetClientRect.USER32(00000000,?), ref: 00401CEF
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 17232caade98c5884c3b98c25dda3274542a73d841a3bd6b31c87e9b59191b88
Instruction ID: 14b9f5ff68e8b0ed0f2204d74c17d06140583eb6ed2bbf798243b331d3a4cd3b
Opcode Fuzzy Hash: 17232caade98c5884c3b98c25dda3274542a73d841a3bd6b31c87e9b59191b88
Instruction Fuzzy Hash: A9F0E7B2A04114AFEB01ABE4DE88DAFB7BDEB54305B10447AF602F6191C7789D018B79

Function 00401D38 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D3B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D57
ReleaseDC.USER32(?,00000000), ref: 00401D68
CreateFontIndirectA.GDI32(0040A7F0), ref: 00401DB3

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 54d11e4959632539d7c5822479490e62378c8afe9ef9106c9a33de1f24eaef6b
Instruction ID: 818c9bdddfe1b1fffd76dbb1b88acba4993fd419864b94457e62d7fc32e1ff32
Opcode Fuzzy Hash: 54d11e4959632539d7c5822479490e62378c8afe9ef9106c9a33de1f24eaef6b
Instruction Fuzzy Hash: FE016232948740AFE7416B70AE1AFAA3FB4A755305F108479F201B72E3C67811569B3F

Function 004046D3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0041FD08,0041FD08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045EE,000000DF,00000000,00000400,?), ref: 00404771
wsprintfA.USER32 ref: 00404779
SetDlgItemTextA.USER32(?,0041FD08), ref: 0040478C

Strings

%u.%u%s%s, xrefs: 0040475B

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: bbe280539c3cc3020c43bf789c637de2f8d0099704e891219e4d784778b6cf22
Instruction ID: 079308417c3a62341de1df324b483ce4e469374b9790fc4fe8de96a48b85a08e
Opcode Fuzzy Hash: bbe280539c3cc3020c43bf789c637de2f8d0099704e891219e4d784778b6cf22
Instruction Fuzzy Hash: F011A573A0412837EB0065699C45EAF3298DB86374F254637FA25F71D2EA788C5245A8

Function 0040393E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,00422F00), ref: 004039D6

Strings

"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 0040393F
KAo, xrefs: 004039B3
1033, xrefs: 00403942, 0040394C, 004039BD

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $1033$KAo
API String ID: 530164218-719868371
Opcode ID: 486f1793fc8ee117fab60480f2aa26aac85a5ca9132015367b3694c6ae5d67fc
Instruction ID: 79edc1b1becbb318b5d11430581b7fe373163fbdb48c995140def98ab9010f1e
Opcode Fuzzy Hash: 486f1793fc8ee117fab60480f2aa26aac85a5ca9132015367b3694c6ae5d67fc
Instruction Fuzzy Hash: B311F3F1B04611ABCB20DF14DD809737BADEBC4756328823FE941A73A0C67D9D029B98

Function 0040576B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030C6,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405771
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030C6,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 0040577A
lstrcatA.KERNEL32(?,00409014), ref: 0040578B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040576B

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 00e6a1abdfef3fccf4d12e3b382aa79108487555f8088e95eeaee7bf5793dfbe
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: 94D0A9B2A05A307AD3122715AC0DE8B2A08CF82300B094023F200B72A2CB3C1D418BFE

Function 00402364 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023A2
lstrlenA.KERNEL32(00409BE8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C2
RegSetValueExA.ADVAPI32(?,?,?,?,00409BE8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023FB
RegCloseKey.ADVAPI32(?,?,?,00409BE8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 1dca66d2d1093a5130de9b07e79a19b0c80f7b3ba9a11136c7381f0e18dd9290
Instruction ID: 26fcae0a7b2a502e926faea7c6e927eea7b3aae3134fdb689c9e3a18d41500d2
Opcode Fuzzy Hash: 1dca66d2d1093a5130de9b07e79a19b0c80f7b3ba9a11136c7381f0e18dd9290
Instruction Fuzzy Hash: 3E1145B1E00108BFEB10AFA5EE89EAF767DEB54358F10403AF505B71D1D6B85D419B28

Function 00405804 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,?,00405870,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
CharNextA.USER32(00000000), ref: 00405817
CharNextA.USER32(00000000), ref: 0040582B

Strings

C:\, xrefs: 00405805

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction ID: 4ca260c7e1a22d06af12069221c3406c2bee361732d71c1e98a9e22686a99acb
Opcode Fuzzy Hash: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction Fuzzy Hash: 71F0C253908F942BFB3276641C44B675F88DB55350F04C07BEA80B62C2C6788860CBEA

Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DE2,00000001), ref: 00402C15
GetTickCount.KERNEL32 ref: 00402C33
CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
ShowWindow.USER32(00000000,00000005), ref: 00402C5E

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: bb4189f2555980a5a403f1716edff6096ea92162ad211e01232e213a33bdd725
Instruction ID: 69bd14cd8f1a0d496662edafeb8c2727d8675a530a128bc1770b64b88ff4c26b
Opcode Fuzzy Hash: bb4189f2555980a5a403f1716edff6096ea92162ad211e01232e213a33bdd725
Instruction Fuzzy Hash: 2CF05E7090A220ABD6217F64FE0CDDF7BA4FB41B527018576F144B21E4C379988ACB9D

Function 00404E86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404EB5
CallWindowProcA.USER32(?,?,?,?), ref: 00404F06

Part of subcall function 00403F2A: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403F3C

Strings

, xrefs: 00404E96

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d7dba211b113031370aa0d375adf93c2d3682e4ecf800ebd227cab9ba7078c69
Instruction ID: f49a9e3fcece2dd6490d1841f3d0f5b5163df4d3f93a23d44cf999a9bd086e10
Opcode Fuzzy Hash: d7dba211b113031370aa0d375adf93c2d3682e4ecf800ebd227cab9ba7078c69
Instruction Fuzzy Hash: D10171B110020EABDF209F11DC84A9B3725FBC4754F208037FB11761D1DB799C61A7A9

Function 004035E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,74DF3410,00000000,C:\Users\user\AppData\Local\Temp\,004035BC,004033D6,?), ref: 004035FE
GlobalFree.KERNEL32(00000000), ref: 00403605

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004035E4

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: a52acb0b260d536fd7618f3e20de318eec4c6c539c6bb2def64801f0e67eaa78
Instruction ID: f6c6d059f9b75f5cc6a79e0049e3afa1176d7e4558308c53008dbe788c85df41
Opcode Fuzzy Hash: a52acb0b260d536fd7618f3e20de318eec4c6c539c6bb2def64801f0e67eaa78
Instruction Fuzzy Hash: 3EE0C2338100206BC7211F0AED04B5E77AC6F48B22F054066FC407B3A08B742C418BCC

Function 004057B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402CD2,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 004057B8
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402CD2,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 004057C6

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004057B2

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-47812868
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: 15550f116ff3ce815c4487a542d9ae56249738f0e4d38f85a76656e2d55d0e49
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: FAD0C7B2409D705EF31353149C08B9F6A58DF16700F195463E141EB591C6785D415BBD

Function 004058D1 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E1
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004058F9
CharNextA.USER32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040590A
lstrlenA.KERNEL32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405913

Memory Dump Source

Source File: 00000005.00000002.2380578346.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2380558195.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380601366.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380620951.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2380729620.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction ID: 481a9c588bbd1c68550dea5b76d7ebd72626077616c8f786d6c844a28ee3c139
Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction Fuzzy Hash: 9EF0F632504418FFCB02AFA5DC0099EBBA8EF46360B2540B9F800F7310D274EF01ABA9

Analysis Process: TeamViewer_.exePID: 7964, Parent PID: 7856COMMON

Execution Graph

Execution Coverage:	25.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1341
Total number of Limit Nodes:	42

Executed Functions

Function 004033B6 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033D9
GetVersion.KERNEL32 ref: 004033DF
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403408
#17.COMCTL32(00000007,00000009), ref: 0040342B
OleInitialize.OLE32(00000000), ref: 00403432
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 0040344E
GetCommandLineW.KERNEL32(00429240,NSIS Error), ref: 00403463
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00000000), ref: 00403476
CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00000020), ref: 0040349D

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004035D7
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004035E8
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004035F4
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403608
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403610
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403621
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403629
DeleteFileW.KERNELBASE(1033), ref: 0040363D

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

ExitProcess.KERNEL32(?), ref: 00403703
CoUninitialize.COMBASE(?), ref: 00403708
ExitProcess.KERNEL32 ref: 00403729
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00000000,?), ref: 0040373C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00000000,?), ref: 0040374B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00000000,?), ref: 00403756
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00000000,?), ref: 00403762
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040377E
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?), ref: 004037D8
CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe,00420EE8,00000001), ref: 004037EC
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000), ref: 00403819
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403848
OpenProcessToken.ADVAPI32(00000000), ref: 0040384F
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403864
AdjustTokenPrivileges.ADVAPI32 ref: 00403887
ExitWindowsEx.USER32(00000002,80040002), ref: 004038AC
ExitProcess.KERNEL32 ref: 004038CF

Strings

1033, xrefs: 00403638
Error launching installer, xrefs: 004036BF
TMP, xrefs: 00403624
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004033CD
~nsu, xrefs: 00403734
C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD, xrefs: 0040375B, 00403760, 0040378D
C:\Program Files\TeamViewer, xrefs: 004035BA, 004036DA, 00403784, 0040378E
C:\Program Files\TeamViewer\TVExtractTemp, xrefs: 004036E5
C:\Users\user\AppData\Local\Temp\, xrefs: 004035CC, 004035D1, 004035E7, 004035F3, 00403602, 0040360F, 0040361B, 00403623, 00403739, 0040374A, 00403755, 00403761, 0040376E, 0040377D, 0040382E
\Temp, xrefs: 004035EE
TEMP, xrefs: 0040361C
Low, xrefs: 0040360A
SeShutdownPrivilege, xrefs: 0040385E
.tmp, xrefs: 00403750
NSIS Error, xrefs: 00403454
C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe, xrefs: 004037E7
"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" , xrefs: 00403469, 0040346F, 00403665
UXTHEME, xrefs: 004033FC, 00403401, 00403407

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Handle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" $.tmp$1033$C:\Program Files\TeamViewer$C:\Program Files\TeamViewer\TVExtractTemp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD$C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 354199918-40274493
Opcode ID: e8a7877e60441a61d01466cbee3218a59cd968db92503058061a8fd593dce739
Instruction ID: be8551fa6605ebbbfda7487142ffb020be8bd547a3943651712312bea09c5587
Opcode Fuzzy Hash: e8a7877e60441a61d01466cbee3218a59cd968db92503058061a8fd593dce739
Instruction Fuzzy Hash: AED10571200300ABE7207F659D49A2B3AEDEB4074AF50443FF881B62D2DB7C8956876E

Function 0040596F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,74DF3420,74DF2EE0,00000000), ref: 00405998
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 004059E0
lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A03
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A09
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A19
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AB9
FindClose.KERNEL32(00000000), ref: 00405AC8

Strings

"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" , xrefs: 0040596F
\*.*, xrefs: 004059DA
C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\*.*, xrefs: 004059C8, 004059CE, 004059DF, 00405A18

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" $C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\*.*$\*.*
API String ID: 2035342205-678098784
Opcode ID: 3e74ea5c1780804c8595fdd51fd85a972d4f395f22791088baa2fc53644d391a
Instruction ID: 6c547db7f4d1248ed83a6ec2b2b7cf99957869ea0eb35c9edb1a86952611c1c3
Opcode Fuzzy Hash: 3e74ea5c1780804c8595fdd51fd85a972d4f395f22791088baa2fc53644d391a
Instruction Fuzzy Hash: 5A41B530A40914A6CB21AB659CC9AAF7678EF41724F20427FF801711D1D77C5986DE6E

Function 004064C1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(74DF3420,00426778,C:\,00405C83,C:\,C:\,00000000,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0), ref: 004064CC
FindClose.KERNEL32(00000000), ref: 004064D8

Strings

C:\, xrefs: 004064C1
xgB, xrefs: 004064C2

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\$xgB
API String ID: 2295610775-2001824454
Opcode ID: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction ID: 909a2899cbbcfc21b24ab628f9350e7a3c7b3772aa6d432f74911df6ac2d0bb5
Opcode Fuzzy Hash: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction Fuzzy Hash: 8BD0C9315045209BC2111778AE4C85B7A98AF553317628A36B466F12A0C674CC22869C

Function 00406846 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction ID: 84f5b91c3f937eb173619b21672ae23043901769df73ed9f159891f0fc81c8d0
Opcode Fuzzy Hash: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction Fuzzy Hash: 72F18671D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7385A8ACF45

Function 0040541C Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040547A
GetDlgItem.USER32(?,000003EE), ref: 00405489
GetClientRect.USER32(?,?), ref: 004054C6
GetSystemMetrics.USER32(00000002), ref: 004054CD
SendMessageW.USER32(?,00001061,00000000,?), ref: 004054EE
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004054FF
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405512
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405520
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405533
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405555
ShowWindow.USER32(?,00000008), ref: 00405569
GetDlgItem.USER32(?,000003EC), ref: 0040558A
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040559A
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055B3
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055BF
GetDlgItem.USER32(?,000003F8), ref: 00405498

Part of subcall function 00404277: SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285

GetDlgItem.USER32(?,000003EC), ref: 004055DC
CreateThread.KERNELBASE(00000000,00000000,Function_000053B0,00000000), ref: 004055EA
CloseHandle.KERNEL32(00000000), ref: 004055F1
ShowWindow.USER32(00000000), ref: 00405615
ShowWindow.USER32(?,00000008), ref: 0040561A
ShowWindow.USER32(00000008), ref: 00405664
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405698
CreatePopupMenu.USER32 ref: 004056A9
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056BD
GetWindowRect.USER32(?,?), ref: 004056DD
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056F6
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040572E
OpenClipboard.USER32(00000000), ref: 0040573E
EmptyClipboard.USER32 ref: 00405744
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405750
GlobalLock.KERNEL32(00000000), ref: 0040575A
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040576E
GlobalUnlock.KERNEL32(00000000), ref: 0040578E
SetClipboardData.USER32(0000000D,00000000), ref: 00405799
CloseClipboard.USER32 ref: 0040579F

Strings

{, xrefs: 00405682
(7B, xrefs: 0040570A

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 3356856100fded7762ccce4ebf21ef6244253d3db3b1b0b4e2cb175bf3461c6d
Instruction ID: 3349dadf3efb3a8fdffdb79f187be012afacb07b5928e089a4a7fd9dccbac2fd
Opcode Fuzzy Hash: 3356856100fded7762ccce4ebf21ef6244253d3db3b1b0b4e2cb175bf3461c6d
Instruction Fuzzy Hash: 60B15670900608FFDB119FA0DD89EAE3B79FB48354F40847AFA45A61A0CB754E52DF68

Function 00403D6A Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403DA6
ShowWindow.USER32(?), ref: 00403DC3
DestroyWindow.USER32 ref: 00403DD7
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DF3
GetDlgItem.USER32(?,?), ref: 00403E14
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E28
IsWindowEnabled.USER32(00000000), ref: 00403E2F
GetDlgItem.USER32(?,00000001), ref: 00403EDD
GetDlgItem.USER32(?,00000002), ref: 00403EE7
SetClassLongW.USER32(?,000000F2,?), ref: 00403F01
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F52
GetDlgItem.USER32(?,00000003), ref: 00403FF8
ShowWindow.USER32(00000000,?), ref: 00404019
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040402B
EnableWindow.USER32(?,?), ref: 00404046
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040405C
EnableMenuItem.USER32(00000000), ref: 00404063
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040407B
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040408E
lstrlenW.KERNEL32(00423728,?,00423728,00429240), ref: 004040B7
SetWindowTextW.USER32(?,00423728), ref: 004040CB
ShowWindow.USER32(?,0000000A), ref: 004041FF

Strings

(7B, xrefs: 004040A3

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: f1306570f035e21c4f068449413519e45d51919a909de34d05465df8e21c2881
Instruction ID: 4530f9416eb169af0d44378ddba5762a1eee688012323a74912104aead4a3b33
Opcode Fuzzy Hash: f1306570f035e21c4f068449413519e45d51919a909de34d05465df8e21c2881
Instruction Fuzzy Hash: A5C1FFB1640200FFCB206F61EE84E2B3AA8EB95745F40057EF641B21F1CB7999529B6D

Function 004039C7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00000000), ref: 00403A48
lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files\TeamViewer,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,74DF3420), ref: 00403AC8
lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files\TeamViewer,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403ADB
GetFileAttributesW.KERNEL32(Remove folder: ), ref: 00403AE6
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files\TeamViewer), ref: 00403B2F

Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2

RegisterClassW.USER32(004291E0), ref: 00403B6C
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B84
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403BB9
ShowWindow.USER32(00000005,00000000), ref: 00403BEF
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403C1B
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403C28
RegisterClassW.USER32(004291E0), ref: 00403C31
DialogBoxParamW.USER32(?,00000000,00403D6A,00000000), ref: 00403C50

Strings

RichEd32, xrefs: 00403C03
RichEdit, xrefs: 00403C22
.exe, xrefs: 00403AD5
1033, xrefs: 004039E7, 00403A43
Control Panel\Desktop\ResourceLocale, xrefs: 004039FB
C:\Program Files\TeamViewer, xrefs: 00403A57, 00403A5F, 00403B02, 00403B08, 00403B18
C:\Users\user\AppData\Local\Temp\, xrefs: 004039CC
RichEdit20W, xrefs: 00403C13, 00403C19
Remove folder: , xrefs: 00403A8F, 00403A98, 00403AA6, 00403AF5, 00403AFB
.DEFAULT\Control Panel\International, xrefs: 00403A33
_Nb, xrefs: 00403B4B, 00403BB3
(7B, xrefs: 004039F3
"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" , xrefs: 004039CB
RichEd20, xrefs: 00403BF5

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" $(7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Program Files\TeamViewer$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-3187729388
Opcode ID: e4b79f2775376875fb57570f8962d2b7733680286c700de63aaa8ea03b262410
Instruction ID: e7f44595d902892b35b801f2f0c3734befc0b18a393fec54347386a87508d522
Opcode Fuzzy Hash: e4b79f2775376875fb57570f8962d2b7733680286c700de63aaa8ea03b262410
Instruction Fuzzy Hash: 8661C570244200BAD730AF669D49E2B3A7CEB84B49F40453FF981B62E2DB7D5912C63D

Function 00402E41 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402E55
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe,00000400), ref: 00402E71

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe,80000000,00000003), ref: 00402EBA
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403001

Strings

soft, xrefs: 00402F31
Error launching installer, xrefs: 00402E91
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040304A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403098
Null, xrefs: 00402F3A
Inst, xrefs: 00402F28
C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe, xrefs: 00402E5B, 00402E6A, 00402E7E, 00402E9B
C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD, xrefs: 00402E9C, 00402EA1, 00402EA7
"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" , xrefs: 00402E41
C:\Users\user\AppData\Local\Temp\, xrefs: 00402E4B, 00403019

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD$C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1373743479
Opcode ID: a88f7b64cf2f84ce6159e852375487555ed60e3ec4e5ecaf9a54fe269baa00ef
Instruction ID: e866f1dd798e5fb15c0a347603bcfded6ce2f229c2e481af73dd86df93422dd6
Opcode Fuzzy Hash: a88f7b64cf2f84ce6159e852375487555ed60e3ec4e5ecaf9a54fe269baa00ef
Instruction Fuzzy Hash: 9761C431A00215ABDB209F75DD49B9E7BB8EB00359F20817FF500F62D1DABD9A448B5D

Function 004061A0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,?,00405314,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000), ref: 00406263
GetSystemDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 004062E1
GetWindowsDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 004062F4
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406330
SHGetPathFromIDListW.SHELL32(?,Remove folder: ), ref: 0040633E
CoTaskMemFree.OLE32(?), ref: 00406349
lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040636D
lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,?,00405314,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000), ref: 004063C7

Strings

Remove folder: , xrefs: 004061CA, 004062AA, 004062CB, 004062E0, 004062F3, 0040630F, 0040633A, 0040636C, 00406372, 0040638C, 004063A0, 004063C0, 004063C6, 004063D2, 00406405
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406367
Software\Microsoft\Windows\CurrentVersion, xrefs: 004062AF
Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\, xrefs: 004061C5

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3439563036
Opcode ID: ad7f9d25d5d15659371a18125183daf3d831ef86bf1ddb5fded95f80f67ed536
Instruction ID: 57c77dc533264c97ace6329bd87f7d674c2bea75a5b3d90d15d675b8bae5a73d
Opcode Fuzzy Hash: ad7f9d25d5d15659371a18125183daf3d831ef86bf1ddb5fded95f80f67ed536
Instruction Fuzzy Hash: 1E611571A00104EBDF209F24CC40AAE37A5AF15314F56817FED56BA2D0D73D8AA2CB9D

Function 004052DD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00402E19,00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000), ref: 00405338
SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\), ref: 0040534A
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\, xrefs: 004052FE, 0040530E, 00405314, 00405337, 00405343

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\
API String ID: 2531174081-2889978620
Opcode ID: 972aac7018336843b0c890e7bd87d5dddbcc3b404b63b40d4461520666951a00
Instruction ID: d14990956ab1253184f877e9e8298894284f42a30aea32824f5004b5108fa95f
Opcode Fuzzy Hash: 972aac7018336843b0c890e7bd87d5dddbcc3b404b63b40d4461520666951a00
Instruction Fuzzy Hash: 62217F71900518BACF119FA6DD44ACFBFB8EF85354F10807AF904B62A1C7B94A51DFA8

Function 00401767 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!,C:\Program Files\TeamViewer\TVExtractTemp,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!,InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!,00000000,00000000,InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!,C:\Program Files\TeamViewer\TVExtractTemp,?,?,00000031), ref: 004017CD

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00402E19,00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Strings

InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE
C:\Program Files\TeamViewer\TVExtractTemp, xrefs: 00401796

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Program Files\TeamViewer\TVExtractTemp$InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!
API String ID: 1941528284-2970256656
Opcode ID: 1862fb3b77c31d46c0470bd97efe8d86f4df64904e2d1f4c121f71988b6a393e
Instruction ID: b64174440326d41e90dd14f1ad6608c73badddfa8ee8632f400ec40acf256ac3
Opcode Fuzzy Hash: 1862fb3b77c31d46c0470bd97efe8d86f4df64904e2d1f4c121f71988b6a393e
Instruction Fuzzy Hash: 0C41C431900515BACF117FB5CC46DAE3679EF05329B20827BF422F51E2DA3C86629A6D

Function 00402D9F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402DBA
GetTickCount.KERNEL32 ref: 00402DD8
wsprintfW.USER32 ref: 00402E06

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00402E19,00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402E2A
ShowWindow.USER32(00000000,00000005), ref: 00402E38

Part of subcall function 00402D83: MulDiv.KERNEL32(00056D1C,00000064,0005863F), ref: 00402D98

Strings

... %d%%, xrefs: 00402E00

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: fea16c4b337e24937a113fc6e035eb6b9d553e5e7cb87782fe297e9c5fc018cb
Instruction ID: 67f39cb704aca6262626a7976268bb3bb8a333bdab68892006d91dd8afb4411f
Opcode Fuzzy Hash: fea16c4b337e24937a113fc6e035eb6b9d553e5e7cb87782fe297e9c5fc018cb
Instruction Fuzzy Hash: 96016D70541614EBC721AB60EF4DA9B7A68AF00706B14417FF885F12E0CBF85865CBEE

Function 004057AC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004057EF
GetLastError.KERNEL32 ref: 00405803
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405818
GetLastError.KERNEL32 ref: 00405822

Strings

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD, xrefs: 004057AC
C:\Users\user\AppData\Local\Temp\, xrefs: 004057D2

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD
API String ID: 3449924974-3423635631
Opcode ID: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction ID: b278f7ea68de5888e34302da86fdb06c438f4ef9b03e74a9ab654546e4f81ce2
Opcode Fuzzy Hash: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction Fuzzy Hash: 89010871D00619DADF10DBA0D9447EFBFB8EB04304F00803ADA44B6190E7789618DFA9

Function 004064E8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
wsprintfW.USER32 ref: 0040653A
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040654E

Strings

%s%S.dll, xrefs: 00406534
\, xrefs: 00406510
UXTHEME, xrefs: 004064F1

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction ID: c6b4a3c42f63eea3762d57d51081eb848d485012b63e63803453d9912f42ff06
Opcode Fuzzy Hash: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction Fuzzy Hash: 3AF0FC70500219BADB10AB64ED0DF9B366CAB00304F10403AA646F10D0EB7CD725CBA8

Function 00405D82 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DA0
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,004033B4,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405DBB

Strings

"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" , xrefs: 00405D82
C:\Users\user\AppData\Local\Temp\, xrefs: 00405D87
nsa, xrefs: 00405D8F

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-867520439
Opcode ID: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction ID: a69a53d4b23f3d63feeda802a3e8a765614c71270742c911b33c62312df6cecc
Opcode Fuzzy Hash: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction Fuzzy Hash: 32F06D76600608BBDB008B59DD09AABBBB8EF91710F10803BEE01F7190E6B09A548B64

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 58c60bd3f3897121054778c1da70f1d8408b3ab71b88223ff436e3f080a0af7a
Instruction ID: b9f5b7c8593eadded22e2ca3cbb8d83d08b5e31647f9888e60cfbaa55d101d4e
Opcode Fuzzy Hash: 58c60bd3f3897121054778c1da70f1d8408b3ab71b88223ff436e3f080a0af7a
Instruction Fuzzy Hash: 66116A71504119FFEF10AF90DF8CEAE3B79FB14384B10007AF905E11A0D7B58E55AA69

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction ID: 9ab6cbc1baff8286944736a18d7265b6422843b7a732a624d4201333bc7942cf
Opcode Fuzzy Hash: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction Fuzzy Hash: F2219071940209BEEF01AFB5CE4AABE7B75EF44744F10403EFA01B61D1D6B88A409B69

Function 0040604B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Remove folder: ,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 00406075
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 00406096
RegCloseKey.KERNELBASE(?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 004060B9

Strings

Remove folder: , xrefs: 0040604E

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Remove folder:
API String ID: 3677997916-1958208860
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 0186f18981595c0b19feb364ea02d5f95392918b8fa258a18f8687652683a575
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 4501483115020AEADF21CF66ED08E9B3BA8EF84390B01402AF845D2220D735D964DBA5

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction ID: d84b147cfae213de6894e87518a1957a70c03431d85ade02b305fde94438308f
Opcode Fuzzy Hash: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction Fuzzy Hash: E511C071E00108BFEB10AFA4DE89DAE777DEB14358F11403AF904B71D1DBB85E409668

Function 004038D5 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 004038E7
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 004038FB

Strings

C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\, xrefs: 0040390B
C:\Users\user\AppData\Local\Temp\, xrefs: 004038DA

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\
API String ID: 2962429428-775491263
Opcode ID: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction ID: 23b98c188a40640ee87c89e263e7d2a3484f90a0975adae1b2ea6fd77d705eba
Opcode Fuzzy Hash: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction Fuzzy Hash: 78E086B14407149AC124AF7CAD495853A185F453357248726F178F20F0C778996B5E9D

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405BDD: CharNextW.USER32(?,?,C:\,?,00405C51,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 004057AC: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004057EF

SetCurrentDirectoryW.KERNEL32(?,C:\Program Files\TeamViewer\TVExtractTemp,?,00000000,000000F0), ref: 00401645

Strings

C:\Program Files\TeamViewer\TVExtractTemp, xrefs: 00401638

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Program Files\TeamViewer\TVExtractTemp
API String ID: 1892508949-2667424760
Opcode ID: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction ID: 18abe7de9e9977a76830232601504265d2e6edcedfe07fce7f69d5744a4425eb
Opcode Fuzzy Hash: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction Fuzzy Hash: F911E631500504EBCF207FA0CD0199E3AB2EF44364B25453BF906B61F2DA3D4A819E5E

Function 00405C3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 00405BDD: CharNextW.USER32(?,?,C:\,?,00405C51,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405C93
GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0), ref: 00405CA3

Strings

C:\, xrefs: 00405C40, 00405C45, 00405C4B, 00405C8C, 00405C92, 00405C9A, 00405CA2

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction ID: 790be11e20efdccda9c73cacd4945748764c6204d4d0b11914a12a4c94a1ccfd
Opcode Fuzzy Hash: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction Fuzzy Hash: 41F0F925108F6515F62233790D05EAF2554CF82394755067FF891B12D1DB3C9D938C7D

Function 00406C7B Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction ID: 95c87b37ce546c92696c349aad8761a6baa0f42cb897a758cf539d426e2a5a70
Opcode Fuzzy Hash: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction Fuzzy Hash: 65A13471D00229CBDF28CFA8C844AADBBB1FF44305F15816AD956BB281D7785A86DF44

Function 00406E7C Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction ID: dd225a6952a4a1885b566de7f95e3528e0c965b1b64db9b9769652e5c735704b
Opcode Fuzzy Hash: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction Fuzzy Hash: 3D913370D04229CBDF28CFA8C844BADBBB1FF44305F15816AD856BB291C7789A86DF45

Function 00406B92 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction ID: c728d5504c89e28601c55753f21d2f559f3974f1a6ce44cf054f885a45476dee
Opcode Fuzzy Hash: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction Fuzzy Hash: 06813471D04228CFDF24CFA8C844BADBBB1FB44305F25816AD856BB291C7789A86DF45

Function 00406697 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction ID: 5389f57cfb4a3ea8b0a271fe5c21418892ef356aef38e154ca47b5156c43700c
Opcode Fuzzy Hash: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction Fuzzy Hash: 37816831D04229CBDF24CFA8C844BADBBB0FF44305F11816AD956BB281D7785986DF45

Function 00406AE5 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction ID: 7cecadd07089ef5f508d2048bcf4206a214b5fe31ba49bd0cdf53ec9cfb3ce0b
Opcode Fuzzy Hash: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction Fuzzy Hash: 35712175D04228CBDF28CFA8C844BADBBB1FB44305F15816AD806BB281D7789A96DF44

Function 00406C03 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction ID: f96eec566abe8136b7696836c8602221009d3abbc3cba5cf828ad5cd02611e0d
Opcode Fuzzy Hash: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction Fuzzy Hash: 56713371D04228CBEF28CFA8C844BADBBB1FF44305F15816AD856BB281C7789996DF45

Function 00406B4F Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction ID: 17f295adf0ba2181094cfffbed918b39bb4908eb68d6975640ddb9889f0749db
Opcode Fuzzy Hash: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction Fuzzy Hash: F2714531D04229CBEF28CF98C844BADBBB1FF44305F11816AD816BB291C7785A96DF44

Function 004031EF Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403203

Part of subcall function 0040336E: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 00403236
SetFilePointer.KERNELBASE(04609CEA,00000000,00000000,00414ED0,00004000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000), ref: 00403331

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 60a078b62880e419fd8869ad6c2e376d7a0a18806c11cc7e2be6b3a6e40e2614
Instruction ID: 2fd669d0756999c0d63da40b5d988076205959dac08f3783f289fe1fafb1afdd
Opcode Fuzzy Hash: 60a078b62880e419fd8869ad6c2e376d7a0a18806c11cc7e2be6b3a6e40e2614
Instruction Fuzzy Hash: 19314B72500204DBD710DF69EEC49663FA9F74075A718423FE900F22E0CBB55D458B9D

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00402E19,00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 24cdcc8e17645b09c8dba356bdc9c6051ea27a3cc416b1f1b75791a7a23ceb8f
Instruction ID: 135227bab5bbd0cb957ad13063370cb04025123e1843093ab7a3381522db9c00
Opcode Fuzzy Hash: 24cdcc8e17645b09c8dba356bdc9c6051ea27a3cc416b1f1b75791a7a23ceb8f
Instruction Fuzzy Hash: 7D21A731900219EBCF20AFA5CE48A9E7E71BF00354F20427BF511B51E1DBBD8A81DA5D

Function 00401B37 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401BA7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BB9

Strings

InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!, xrefs: 00401B5E, 00401B64, 00401B7E

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Global$AllocFree
String ID: InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!
API String ID: 3394109436-3224948528
Opcode ID: e295b54685931270dff86f202c2fdefb044b2b91f5e4e3df0bc5e06abf08786f
Instruction ID: 7cdfc3cbb2e69f4264c6c6693aec6085e55c642d7687a467de19211c04d07d9e
Opcode Fuzzy Hash: e295b54685931270dff86f202c2fdefb044b2b91f5e4e3df0bc5e06abf08786f
Instruction Fuzzy Hash: 67219672A00100EBDB20EB94CD85D5E77B6AF84314B21453BF502F72E1DA7898618F5D

Function 00402537 Relevance: 4.6, APIs: 3, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(0040ADD8,?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 0040258E

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID:
API String ID: 3109718747-0
Opcode ID: 850b0114aee89c8d8b14894d23efcefd65d0faa324c372d2657d007c57cf9cb9
Instruction ID: 4789cac02ba757069cd1743e95fa376523a080456913a55bd7acca95e4ec0b97
Opcode Fuzzy Hash: 850b0114aee89c8d8b14894d23efcefd65d0faa324c372d2657d007c57cf9cb9
Instruction Fuzzy Hash: CA11E772A01204BADB10AFB18F4EE9E32659F54355F20403BF502F65C1DAFC8E51576E

Function 004021EA Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004064C1: FindFirstFileW.KERNELBASE(74DF3420,00426778,C:\,00405C83,C:\,C:\,00000000,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0), ref: 004064CC
Part of subcall function 004064C1: FindClose.KERNEL32(00000000), ref: 004064D8

lstrlenW.KERNEL32 ref: 0040222A
lstrlenW.KERNEL32(00000000), ref: 00402235
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 0040225E

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: f9a99ba4a91a9f4c9246cf651f25ea3f75fba1548a7733be5ccfd7ea764f24a6
Instruction ID: 9c43d8eab5e28b8efadc9e1ada5fd511aa80cab417b32b1cb638ddde26c09318
Opcode Fuzzy Hash: f9a99ba4a91a9f4c9246cf651f25ea3f75fba1548a7733be5ccfd7ea764f24a6
Instruction Fuzzy Hash: 4711707190021896CB10EFF98D4999EB7F8AF04314F10807FA905FB2DAE6B8D9018B69

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
Instruction ID: c7ec42ec2a5b8cbcf97019b844e04a4f9c539befeef3331d530b96059407f5ff
Opcode Fuzzy Hash: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
Instruction Fuzzy Hash: FCF03171A14204EBEB209F65DE8CABF767DEF80354B10843FF505B61D0DAB84D419B69

Function 00405927 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D2E: GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
Part of subcall function 00405D2E: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B09), ref: 00405942
DeleteFileW.KERNELBASE(?,?,?,00000000,00405B09), ref: 0040594A
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405962

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction ID: ecea3d8082f0941e5ee01c5501cf82e541f4c7e763f85e657b920a2cf98d934c
Opcode Fuzzy Hash: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction Fuzzy Hash: 6EE09B72105A91D6D21067349E0CB5F2AD8DF96335F09493EF595F11D0C778880ACA7D

Function 0040421B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000408,?,00000000,00403E78), ref: 00404239

Strings

x, xrefs: 0040421B

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend
String ID: x
API String ID: 3850602802-2363233923
Opcode ID: 3e871ac91d012b6cae2f90b6371e3effc72337ca5df1d59cb8fc0e815e15e1ac
Instruction ID: 9e34857be529cc3efc5f0a7cea2a0d9e3d50e3e0a723924f26ebfb3191f04208
Opcode Fuzzy Hash: 3e871ac91d012b6cae2f90b6371e3effc72337ca5df1d59cb8fc0e815e15e1ac
Instruction Fuzzy Hash: 78C012B1240200FBCA209B00EE00B167A20F7A8702F2089BDF380200B086718822DB2D

Function 004030E7 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 0040310C

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5362526f818bdb809ad5cab08ae3c06d9fff902eb4395bb37ab99caf6aafdfc9
Instruction ID: 040f2acbe5348ef8c996952313d322865bd2faa87b76d8d9ba7109e69b0e4b3d
Opcode Fuzzy Hash: 5362526f818bdb809ad5cab08ae3c06d9fff902eb4395bb37ab99caf6aafdfc9
Instruction Fuzzy Hash: 22316B30200219EBDB108F55ED84ADA3F68EB08359F20813AF905EA1D0DB79DF50DBA9

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
Instruction ID: a4ed2935f8c713a64b441f8b02302a8faa8aa65f3841d01997d269d515fb9b23
Opcode Fuzzy Hash: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
Instruction Fuzzy Hash: 9D119131911205EBDB10CFA0CA489AEB7B4EF44354B20843FE446B72D0D6B85A41DB19

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction ID: d65e0694727b7210e6f7bc09f77efd2c0147e56cffd904cd4a2c980f2ed28b93
Opcode Fuzzy Hash: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction Fuzzy Hash: 3D01D131724210EBEB195B789D04B2A3698E714314F1089BAF855F62F1DA788C128B5D

Function 0040231F Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040233E
RegCloseKey.ADVAPI32(00000000), ref: 00402347

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
Instruction ID: b5033fe3495a5d5fbf66e52db86fe43622c16bf705f2fe0f4142c4154f9543e6
Opcode Fuzzy Hash: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
Instruction Fuzzy Hash: 45F04F32A04110ABEB11BFB59B4EABE726A9B40314F15807BF501B71D5D9FC99025629

Function 004053B0 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004053C0

Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

CoUninitialize.COMBASE(00000404,00000000), ref: 0040540C

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: 3868b5a52622b10a1177551b7cc78a5ffd836502efb30cae45cbc154cdcfe80d
Instruction ID: fd15c1a48ffcd0bde852b119af7687a848e5b357f1d71b2c4b4b2b4c4c2fcb19
Opcode Fuzzy Hash: 3868b5a52622b10a1177551b7cc78a5ffd836502efb30cae45cbc154cdcfe80d
Instruction Fuzzy Hash: 55F0F076645601CBD3101B54AD05B5B7268EF80781F56407EEE44A23F1CABA48428B2E

Function 00406558 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
GetProcAddress.KERNEL32(00000000,?), ref: 00406585

Part of subcall function 004064E8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
Part of subcall function 004064E8: wsprintfW.USER32 ref: 0040653A
Part of subcall function 004064E8: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040654E

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 45558713834216164227cc70c45b1d33d53decf29647882cb75fd2fc812b7039
Instruction ID: 8c1a5bb66f910ccc430fc34c4425cef617f316e2833151c7c1ff8c8a0ee84b40
Opcode Fuzzy Hash: 45558713834216164227cc70c45b1d33d53decf29647882cb75fd2fc812b7039
Instruction Fuzzy Hash: C3E086326042206BD6105B706E0893762BC9ED8740302483EF946F2084D778DC329A6D

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CallbackDispatcherShowUserWindow
String ID:
API String ID: 82835404-0
Opcode ID: f95c109804867172db61b1135defe61bd419d678e2b077b04fc1289a75674494
Instruction ID: 21ddd3577add1129786b8edf5e015a7aca6159172531db4ba1f8ff50d12c07f3
Opcode Fuzzy Hash: f95c109804867172db61b1135defe61bd419d678e2b077b04fc1289a75674494
Instruction Fuzzy Hash: D3E08C326005009BCB20AFB5AA4999D3375EF50369710017BE402F10E1CABC9C408A2D

Function 00403932 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,74DF3420,00000000,74DF2EE0,00403909,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 0040394C
GlobalFree.KERNEL32(?), ref: 00403953

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
Instruction ID: 420717e04dc644aaadfe3aeddcd4797dc829437e29e913c3c6529364dabb0ba4
Opcode Fuzzy Hash: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
Instruction Fuzzy Hash: 41E012739011309BC6225F95ED44B5E7B6D6F95B32F0A423AE9807B26087B45D838FD8

Function 00405D53 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe,80000000,00000003), ref: 00405D57
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction ID: e98dd403a5e5432679a9d4e257ef455d3d6759c2e5ed6cf280caa05d5291d686
Opcode Fuzzy Hash: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction Fuzzy Hash: B3D09E71654601EFEF098F20DF16F2E7AA2EB84B00F11562CB682940E0DA7158199B19

Function 00405D2E Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction ID: 62c1218995ad43f24aa052634507c0d83541fa9dca801c4eab67991220ff17ac
Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction Fuzzy Hash: 40D01272504520AFC2513738EF0C89BBF95EB543B17028B35FAF9A22F0DB304C568A98

Function 00405829 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004033A9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040582F
GetLastError.KERNEL32 ref: 0040583D

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction ID: d963a2520b22da8993c1f0374a54a6368e12bf2bf52e26206a68f99a8800bbf8
Opcode Fuzzy Hash: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction Fuzzy Hash: 1DC04C31204B029AD7506B609F097177954AB50781F11C8396946E00A0DE348465DE2D

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
Instruction ID: 0f14848d4f24c16631b00b750435c060a764b4453362ef8260df6bafad2d34e7
Opcode Fuzzy Hash: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
Instruction Fuzzy Hash: 7FE01A71601114ABDB11EBA59E4ACAE766AAB40328B10443BF501F14E1CAB988619A2E

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 014b14aad264ab3d9278ecb8b720997d0a3792ab61640f4b6d401bffeacc1512
Instruction ID: a822d11f1d05533bca3208a69e79300e3559a9020bae074bf72d5f6ed1f8f9d7
Opcode Fuzzy Hash: 014b14aad264ab3d9278ecb8b720997d0a3792ab61640f4b6d401bffeacc1512
Instruction Fuzzy Hash: BCE04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Function 00405E05 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00410E7F,0040CED0,004032EF,0040CED0,00410E7F,00414ED0,00004000,?,00000000,00403119,00000004), ref: 00405E19

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: dac0b8971ba2920abb5474f128329a0fa477ab7403896bbfc0984bb8014ca22f
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 4AE08632100119ABCF105F50DC00EEB376CEB00350F004832FA65E2040E230EA219BE4

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction ID: ef45ff86538a2d51f1b0222ec8c1b297abd10be8bd22699319dc95f068cee933
Opcode Fuzzy Hash: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction Fuzzy Hash: CCE08676244108BFDB00DFA8DE47FD537ECAB14700F004031BA08D70D1C674E5508768

Function 00405DD6 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040336B,0040A230,0040A230,0040326F,00414ED0,00004000,?,00000000,00403119), ref: 00405DEA

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction ID: f39de87387fc754cac4ceee649b5e38243fe2bf9183d254406dbd5143e25ae03
Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction Fuzzy Hash: 57E0EC3221125AABDF509F65DC08AEB7B6DEF05360F008837F955E6160D631E9219BE8

Function 004058C3 Relevance: 1.5, APIs: 1, Instructions: 21windowCOMMON

Download Yara Rule

APIs

MessageBoxIndirectW.USER32(0040A3E8), ref: 0040591E

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: IndirectMessage
String ID:
API String ID: 1874166685-0
Opcode ID: ad30b8c57171d568f185787def9c3cb3c84c161905c8a48c9e8b193500a59949
Instruction ID: 321c8730501e623a228f699c15320e1e2f592dc12f854a1532b6ac915461554a
Opcode Fuzzy Hash: ad30b8c57171d568f185787def9c3cb3c84c161905c8a48c9e8b193500a59949
Instruction Fuzzy Hash: CCF0F272A10701CBC768CF18EA44B1A3BE0E704304F50817AE854A23B0D77998E2DF1E

Function 004022DF Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402310

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
Instruction ID: 815fd251d1ef055c124add3867079dbd89389a2e6f50d5753089410e689aa70c
Opcode Fuzzy Hash: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
Instruction Fuzzy Hash: 91E04F30800208BBDF01AFA4CE49DBD3B79AF00344F14043AF940AB0D5E7F89A819749

Function 00404242 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,00000000), ref: 0040425C

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 7233622df6a7a8fb633e185686b3ac587ee5e59de1f4571593d5d0ba3e8b76bd
Instruction ID: 65f8c73b99d4ee7bdc81e4beaf37a5475fca5134ded6dd21b3b8f91a9c360ad6
Opcode Fuzzy Hash: 7233622df6a7a8fb633e185686b3ac587ee5e59de1f4571593d5d0ba3e8b76bd
Instruction Fuzzy Hash: F2C04C76148200BFE641A755CC42F1FB799EF9431AF40C52EB59CE51D2C63994309A2A

Function 0040428E Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
Instruction ID: 8584b4a80e8197aea4c9dd325401cbfcfbe68695eba590e205f4256e4e85e437
Opcode Fuzzy Hash: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
Instruction Fuzzy Hash: 67C04C71740600BBDA20CB649D45F1677546754740F1448697640A60E0C674D420D62C

Function 0040336E Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction ID: 64c0fffafe8abe290eaf2022e63b776f1a4a3bd25e2fde741040b5855636c72c
Opcode Fuzzy Hash: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction Fuzzy Hash: 70B01231140300BFDA214F00DF09F057B21AB90700F10C034B344780F086711075EB0D

Function 00404277 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
Instruction ID: 3e0bacd84e958153637e663f6e0df00a268db6e73930f78988907d41dcf2010e
Opcode Fuzzy Hash: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
Instruction Fuzzy Hash: 32B01235290A00FBDE214B00EE09F457E62F76C701F008478B340240F0CAB300B1DB19

Function 00404264 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040403C), ref: 0040426E

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
Instruction ID: ea629541fdd2228df96855dc4de4e407fdbb002a66502a1a5a86269346c048a7
Opcode Fuzzy Hash: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
Instruction Fuzzy Hash: C0A001B6644500ABCE129F90EF49D0ABBB2EBE8742B518579A285900348A364961EB59

Non-executed Functions

Function 00404C59 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C71
GetDlgItem.USER32(?,00000408), ref: 00404C7C
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CC6
LoadBitmapW.USER32(0000006E), ref: 00404CD9
SetWindowLongW.USER32(?,000000FC,00405251), ref: 00404CF2
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D06
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D18
SendMessageW.USER32(?,00001109,00000002), ref: 00404D2E
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D3A
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D4C
DeleteObject.GDI32(00000000), ref: 00404D4F
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D7A
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D86
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E1C
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E47
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E5B
GetWindowLongW.USER32(?,000000F0), ref: 00404E8A
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404E98
ShowWindow.USER32(?,00000005), ref: 00404EA9
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FA6
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040500B
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405020
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405044
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405064
ImageList_Destroy.COMCTL32(?), ref: 00405079
GlobalFree.KERNEL32(?), ref: 00405089
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405102
SendMessageW.USER32(?,00001102,?,?), ref: 004051AB
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051BA
InvalidateRect.USER32(?,00000000,00000001), ref: 004051DA
ShowWindow.USER32(?,00000000), ref: 00405228
GetDlgItem.USER32(?,000003FE), ref: 00405233
ShowWindow.USER32(00000000), ref: 0040523A

Strings

M, xrefs: 00404E03
, xrefs: 00405212
N, xrefs: 00404EE4

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: c57cb45ce89cd192e0511e30eec95623b06f81766ebd804847a276e94d887aeb
Instruction ID: ce840dee0c3a5b827351c7f25dbf2e3605d0905f5c54158640504e6bfb71dde6
Opcode Fuzzy Hash: c57cb45ce89cd192e0511e30eec95623b06f81766ebd804847a276e94d887aeb
Instruction Fuzzy Hash: 4C023EB0A00209EFDF209F64CD45AAE7BB5FB84355F10817AE610BA2E1C7799D52CF58

Function 004043DF Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040447D
GetDlgItem.USER32(?,000003E8), ref: 00404491
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044AE
GetSysColor.USER32(?), ref: 004044BF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044CD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044DB
lstrlenW.KERNEL32(?), ref: 004044E0
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044ED
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404502
GetDlgItem.USER32(?,0000040A), ref: 0040455B
SendMessageW.USER32(00000000), ref: 00404562
GetDlgItem.USER32(?,000003E8), ref: 0040458D
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045D0
LoadCursorW.USER32(00000000,00007F02), ref: 004045DE
SetCursor.USER32(00000000), ref: 004045E1
ShellExecuteW.SHELL32(0000070B,open,004281E0,00000000,00000000,00000001), ref: 004045F6
LoadCursorW.USER32(00000000,00007F00), ref: 00404602
SetCursor.USER32(00000000), ref: 00404605
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404634
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404646

Strings

open, xrefs: 004045EE
Remove folder: , xrefs: 004045BC
VC@, xrefs: 004045EB
N, xrefs: 0040457B

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$Remove folder: $VC@$open
API String ID: 3615053054-2721566001
Opcode ID: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction ID: ef28e404984a924d02769b335405a58d84a4f5c10dd13b46e9d300bde90bb2c1
Opcode Fuzzy Hash: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction Fuzzy Hash: 717191B1A00209BFDB10AF60DD45E6A7B69FB94344F00843AFB05B62E0D779AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction ID: fbc3582f0be17511ef24b6208279bd62f68a22b1f89f17edcf88e24f0ff4dafb
Opcode Fuzzy Hash: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction Fuzzy Hash: 8E418A71800209AFCF058F95DE459AFBBB9FF44310F00842EF991AA1A0C738EA55DFA4

Function 004046DD Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040472C
SetWindowTextW.USER32(00000000,?), ref: 00404756
SHBrowseForFolderW.SHELL32(?), ref: 00404807
CoTaskMemFree.OLE32(00000000), ref: 00404812
lstrcmpiW.KERNEL32(Remove folder: ,00423728,00000000,?,?), ref: 00404844
lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404850
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404862

Part of subcall function 004058A7: GetDlgItemTextW.USER32(?,?,00000400,00404899), ref: 004058BA

Part of subcall function 00406412: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406475
Part of subcall function 00406412: CharNextW.USER32(?,?,?,00000000), ref: 00406484
Part of subcall function 00406412: CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406489
Part of subcall function 00406412: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040649C

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404925
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404940

Part of subcall function 00404A99: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
Part of subcall function 00404A99: wsprintfW.USER32 ref: 00404B43
Part of subcall function 00404A99: SetDlgItemTextW.USER32(?,00423728), ref: 00404B56

Strings

Remove folder: , xrefs: 0040483E, 00404843, 0040484E
(7B, xrefs: 004047DA
C:\Program Files\TeamViewer, xrefs: 0040482D
A, xrefs: 00404800

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$C:\Program Files\TeamViewer$Remove folder:
API String ID: 2624150263-2772811393
Opcode ID: c0b61ef350f3b11f3d6e2819161bdb8859453bf742527bbdd3f0f7a625ed1280
Instruction ID: d5aaf60bd55b21875b9c8b9a8d0b3d7e01f34e6f89f3adcbdcc63617e1d21faf
Opcode Fuzzy Hash: c0b61ef350f3b11f3d6e2819161bdb8859453bf742527bbdd3f0f7a625ed1280
Instruction Fuzzy Hash: B7A191F1A00209ABDB11AFA5CC45AAF77B8EF84354F10847BF601B62D1D77C99418B6D

Function 00405EAD Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00426DC8,NUL,?,00000000,?,?,00406040,?,?), ref: 00405EBC
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405EE9

Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F06
wsprintfA.USER32 ref: 00405F24
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC
GlobalFree.KERNEL32(00000000), ref: 0040600D
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406014

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Strings

NUL, xrefs: 00405EB6
[Rename], xrefs: 00405F8E, 00405FA0
%ls=%ls, xrefs: 00405F1A

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: 30f1ad71034d6c445b7df81822845e1e30d199c7f1bc078365d62d19a968fdd2
Instruction ID: 52ae09e4e2a5e81e4d5588e003ad531eff1fe7f7ae6e2de5146a23cae23f7ad9
Opcode Fuzzy Hash: 30f1ad71034d6c445b7df81822845e1e30d199c7f1bc078365d62d19a968fdd2
Instruction Fuzzy Hash: EB315330241B19BBD2206B209D08F2B3A5CEF85758F15043BF942F62C2EA7CC9118EBD

Function 00406412 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406475
CharNextW.USER32(?,?,?,00000000), ref: 00406484
CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406489
CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040649C

Strings

*?|<>/":, xrefs: 00406464
"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" , xrefs: 00406412
C:\Users\user\AppData\Local\Temp\, xrefs: 00406413

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1635410149
Opcode ID: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction ID: c1b46f2de1f90aebbf911330ce555e940da56993e608f70b6a8db31027969b8c
Opcode Fuzzy Hash: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction Fuzzy Hash: 5311C85680121299DB307B588C40AB7A2B8EF55754F52803FEDCA732C1E77C5C9286BD

Function 004042A9 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042C6
GetSysColor.USER32(00000000), ref: 004042E2
SetTextColor.GDI32(?,00000000), ref: 004042EE
SetBkMode.GDI32(?,?), ref: 004042FA
GetSysColor.USER32(?), ref: 0040430D
SetBkColor.GDI32(?,?), ref: 0040431D
DeleteObject.GDI32(?), ref: 00404337
CreateBrushIndirect.GDI32(?), ref: 00404341

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction ID: 2a82f640caf94e13ad52f77eccc7f6a005bf570db5d4005cc44859485eb84fad
Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction Fuzzy Hash: 9F215171600704ABCB219F68DE08B4BBBF8AF81714F04892DED95E26A0D738E904CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405E34: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405E4A

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction ID: fbd7f9394f7a40dbbdef10ea3a20ac1ae57b35180e29dd1ddeb30b88b5afce05
Opcode Fuzzy Hash: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction Fuzzy Hash: 19510774D00219ABDF209F94CA88AAEB779FF04344F50447BE501B72E0D7B99982DB69

Function 00404BA7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BC2
GetMessagePos.USER32 ref: 00404BCA
ScreenToClient.USER32(?,?), ref: 00404BE4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BF6
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C1C

Strings

f, xrefs: 00404BF8

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction ID: 45e0f6331f39cfe7836e80c9775163861a3897288b26a0b158bc224782e9bc0b
Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction Fuzzy Hash: C9015271901218BAEB00DB94DD45FFEBBBCAF54711F10012BBA51B61D0C7B495018B54

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDE0), ref: 00401DD1

Strings

Tahoma, xrefs: 00401DB7

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 5a25ca78bc8c32752d7f72089744ea34f9941ea911f474610dde7174e3f6db02
Instruction ID: 9e8fd183d3d9d3ef172346538d4b27734d94fdc92d2c471f4f64b2fa811a60c8
Opcode Fuzzy Hash: 5a25ca78bc8c32752d7f72089744ea34f9941ea911f474610dde7174e3f6db02
Instruction Fuzzy Hash: F601A271544641EFEB016BB0AF4AF9A3F75BB65301F104579F152B61E2CA7C0006AB2D

Function 00402D04 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
wsprintfW.USER32 ref: 00402D56
SetWindowTextW.USER32(?,?), ref: 00402D66
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D78

Strings

unpacking data: %d%%, xrefs: 00402D44
verifying installer: %d%%, xrefs: 00402D4B, 00402D54

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 3598370c3c9dfc29f84c7b8ed24a957720a686991d5537ef1c6dff233380f4e6
Instruction ID: 006a23aec332b8a1771af90dfa9c1e08c84c5b856183a3bf167901723993fe13
Opcode Fuzzy Hash: 3598370c3c9dfc29f84c7b8ed24a957720a686991d5537ef1c6dff233380f4e6
Instruction Fuzzy Hash: 2FF0367050020CABEF206F50DD49BEA3B69FF44305F00803AFA55B51D0DBF959558F59

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e8b18edfeea79fa09e45a72486dc9901f693ae42d48326bb65f86fff18046ac9
Instruction ID: 9003099e8900d80eaa65f9bf21adae6f43ee9946aaa6f9d478ae9c17af360c06
Opcode Fuzzy Hash: e8b18edfeea79fa09e45a72486dc9901f693ae42d48326bb65f86fff18046ac9
Instruction Fuzzy Hash: D6216F72801118BBCF216FA5CE49D9E7F79EF09364F24423AF550762E0CB794E419B98

Function 00404A99 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
wsprintfW.USER32 ref: 00404B43
SetDlgItemTextW.USER32(?,00423728), ref: 00404B56

Strings

(7B, xrefs: 00404B2C
%u.%u%s%s, xrefs: 00404B24

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 81ae9ae8dc439d9931515dbc50321e52771afc0a6870d61e722dcea37f1a3983
Instruction ID: 8555a1dc09e6b234f76c08cd80d60a8511de1cbf1cdbca66d7a603e4fd23a7b2
Opcode Fuzzy Hash: 81ae9ae8dc439d9931515dbc50321e52771afc0a6870d61e722dcea37f1a3983
Instruction Fuzzy Hash: E911EB736441283BDB0095AD9C45F9E3298DB85378F150237FA26F71D1DA79D82286EC

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction ID: c287ee2e14a47dfcdc45124cadc9b4dd0eb33b5564dd8f2f51e592e83ba53e14
Opcode Fuzzy Hash: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction Fuzzy Hash: 33F0E172600504AFD701DBE4DE88CEEBBBDEB48311B104476F541F51A1CA749D018B38

Function 00405BDD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,00405C51,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405BEB
CharNextW.USER32(00000000), ref: 00405BF0
CharNextW.USER32(00000000), ref: 00405C08

Strings

C:\, xrefs: 00405BDE

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 97bda6209b414f3be7afdaeea7f60dfeaed0a7be6e9491b65ace1fa1eacd3bf0
Instruction ID: 6e78a38a92844ebddfb5a00e32717de03c0cdfda6ab0f65e84db47d2e3257ff5
Opcode Fuzzy Hash: 97bda6209b414f3be7afdaeea7f60dfeaed0a7be6e9491b65ace1fa1eacd3bf0
Instruction Fuzzy Hash: 83F0B411949F1D95FF3177584C45A7BA7BCEB55360B00803BEA41B72C1D7B84C818EEA

Function 00405B32 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405B38
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405B42
lstrcatW.KERNEL32(?,0040A014), ref: 00405B54

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B32

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction ID: 1c34604f245f66d13fb295c2dca74b2082213948d97efa3850964b8affffb698
Opcode Fuzzy Hash: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction Fuzzy Hash: 57D05E31101934AAC2116B448C04DDB73AC9E46304341442AF201B70A6C778695286FD

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00402E19,00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsy5D72.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Part of subcall function 0040585E: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
Part of subcall function 0040585E: CloseHandle.KERNEL32(?), ref: 00405894

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: bb4ed085c638bd443c710e2d7f0342cbaf51ccc2adafb456e5dd98b29d2a060b
Instruction ID: 5702df78c33f9bd13decba52644e1012fe72a42f767711efff684f6f7274af03
Opcode Fuzzy Hash: bb4ed085c638bd443c710e2d7f0342cbaf51ccc2adafb456e5dd98b29d2a060b
Instruction Fuzzy Hash: FF11A131900508EBCF21AF91CD4499E7AB6AF40314F21407BFA05B61F1D7798A92DB99

Function 00403C9D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(00000000,00429240), ref: 00403D35

Strings

1033, xrefs: 00403CA1, 00403CAB, 00403D1C
"C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" , xrefs: 00403C9E

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe" $1033
API String ID: 530164218-809957822
Opcode ID: 9d022d01f112da27556ef407cc074c94f0222ef42f22569fe4f3b5c0e17e7ae8
Instruction ID: 4786a0dcc4ba2f930af81554b1ec9cb86176e7a1d2ad565e9f211a7c6dcc4e6b
Opcode Fuzzy Hash: 9d022d01f112da27556ef407cc074c94f0222ef42f22569fe4f3b5c0e17e7ae8
Instruction Fuzzy Hash: 7111C331B44210ABD7359F15EC40A337B6CEF85715B28427BE801AB3A1C63A9D1296A9

Function 00405251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405280
CallWindowProcW.USER32(?,?,?,?), ref: 004052D1

Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

Strings

, xrefs: 00405261

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction ID: 35360b72f4910b777185a6264b25dc7760dbd7dc789205491e41d57b326ac1ec
Opcode Fuzzy Hash: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction Fuzzy Hash: 6B019E71210708ABDF208F11DD84E9B3A35EF94321F60443AFA00761D1C77A8D529E6A

Function 0040585E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
CloseHandle.KERNEL32(?), ref: 00405894

Strings

Error launching installer, xrefs: 00405871

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction ID: 0fb7bd0647ee639374dbc29985885c8cd5f4694ddcbbc5ba66c50ad851a9a680
Opcode Fuzzy Hash: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction Fuzzy Hash: 22E04FB0A002097FEB009B64ED45F7B77ACEB04208F408431BD00F2150D77498248A78

Function 00405B7E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,00402EAD,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe,80000000,00000003), ref: 00405B84
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,00402EAD,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe,C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD\TeamViewer_.exe,80000000,00000003), ref: 00405B94

Strings

C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD, xrefs: 00405B7E

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsc4E1F.tmp\nsn4EAD
API String ID: 2709904686-2353090577
Opcode ID: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction ID: 87bbc210c64b19a6b78a00595756172ded5dec919d443e3f73ce50da7c0279be
Opcode Fuzzy Hash: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction Fuzzy Hash: D4D05EB24009209AD312AB04DD00DAF77ACEF163007464426E841AB166D778BC8186BC

Function 00405CB8 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405CE0
CharNextA.USER32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF1
lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

Memory Dump Source

Source File: 00000006.00000002.2371266651.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2371247525.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371371269.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371401685.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2371670655.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction ID: b09c91cad7c2282b041c35ea214dbdd3f15ee75aa50bf55fe933874c09a5e2ef
Opcode Fuzzy Hash: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction Fuzzy Hash: BFF0F631104954FFD702DFA5DD04E9FBBA8EF06350B2180BAE841F7210D674DE01ABA8

Analysis Process: TeamViewer_.exePID: 8092, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	20.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1343
Total number of Limit Nodes:	40

Executed Functions

Function 004033B6 Relevance: 84.4, APIs: 34, Strings: 14, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033D9
GetVersion.KERNEL32 ref: 004033DF
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403408
#17.COMCTL32(00000007,00000009), ref: 0040342B
OleInitialize.OLE32(00000000), ref: 00403432
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 0040344E
GetCommandLineW.KERNEL32(00429240,NSIS Error), ref: 00403463
GetModuleHandleW.KERNEL32(00000000,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000), ref: 00403476
CharNextW.USER32(00000000,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000020), ref: 0040349D

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

GetTempPathW.KERNEL32(00000400,00437800), ref: 004035D7
GetWindowsDirectoryW.KERNEL32(00437800,000003FB), ref: 004035E8
lstrcatW.KERNEL32(00437800,\Temp), ref: 004035F4
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp), ref: 00403608
lstrcatW.KERNEL32(00437800,Low), ref: 00403610
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low), ref: 00403621
SetEnvironmentVariableW.KERNEL32(TMP,00437800), ref: 00403629
DeleteFileW.KERNELBASE(00437000), ref: 0040363D

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

ExitProcess.KERNEL32(?), ref: 00403703
CoUninitialize.COMBASE(?), ref: 00403708
ExitProcess.KERNEL32 ref: 00403729
lstrcatW.KERNEL32(00437800,~nsu,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000,?), ref: 0040373C
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000,?), ref: 0040374B
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000,?), ref: 00403756
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000,?), ref: 00403762
SetCurrentDirectoryW.KERNEL32(00437800,00437800), ref: 0040377E
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?), ref: 004037D8
CopyFileW.KERNEL32(C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,00420EE8,00000001), ref: 004037EC
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000), ref: 00403819
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403848
OpenProcessToken.ADVAPI32(00000000), ref: 0040384F
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403864
AdjustTokenPrivileges.ADVAPI32 ref: 00403887
ExitWindowsEx.USER32(00000002,80040002), ref: 004038AC
ExitProcess.KERNEL32 ref: 004038CF

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 004033CD
.tmp, xrefs: 00403750
SeShutdownPrivilege, xrefs: 0040385E
C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe, xrefs: 004037E7
NSIS Error, xrefs: 00403454
"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 00403469, 0040346F, 00403665
TEMP, xrefs: 0040361C
~nsu, xrefs: 00403734
C:\Program Files\TeamViewer, xrefs: 004035BA, 004036DA, 00403784, 0040378E
UXTHEME, xrefs: 004033FC, 00403401, 00403407
TMP, xrefs: 00403624
Error launching installer, xrefs: 004036BF
Low, xrefs: 0040360A
\Temp, xrefs: 004035EE

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Handle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$.tmp$C:\Program Files\TeamViewer$C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 354199918-3051870712
Opcode ID: adc4d748d9836f5a15988fa3e2f94b2f0245c9efab62edd68d6b1bb0daacd0ec
Instruction ID: be8551fa6605ebbbfda7487142ffb020be8bd547a3943651712312bea09c5587
Opcode Fuzzy Hash: adc4d748d9836f5a15988fa3e2f94b2f0245c9efab62edd68d6b1bb0daacd0ec
Instruction Fuzzy Hash: AED10571200300ABE7207F659D49A2B3AEDEB4074AF50443FF881B62D2DB7C8956876E

Function 0040596F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,74DF3420,74DF2EE0,00000000), ref: 00405998
lstrcatW.KERNEL32(C:\Windows\TEMP\nseC5E0.tmp\*.*,\*.*,C:\Windows\TEMP\nseC5E0.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 004059E0
lstrcatW.KERNEL32(?,0040A014,?,C:\Windows\TEMP\nseC5E0.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A03
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Windows\TEMP\nseC5E0.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A09
FindFirstFileW.KERNELBASE(C:\Windows\TEMP\nseC5E0.tmp\*.*,?,?,?,0040A014,?,C:\Windows\TEMP\nseC5E0.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A19
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AB9
FindClose.KERNEL32(00000000), ref: 00405AC8

Strings

"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 0040596F
\*.*, xrefs: 004059DA
C:\Windows\TEMP\nseC5E0.tmp\*.*, xrefs: 004059C8, 004059CE, 004059DF, 00405A18

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$C:\Windows\TEMP\nseC5E0.tmp\*.*$\*.*
API String ID: 2035342205-1628145164
Opcode ID: caf8ebbf86a4c95ad3815d748c14af6cf0a222b2c55ec9266b14322c72a8a4f6
Instruction ID: 6c547db7f4d1248ed83a6ec2b2b7cf99957869ea0eb35c9edb1a86952611c1c3
Opcode Fuzzy Hash: caf8ebbf86a4c95ad3815d748c14af6cf0a222b2c55ec9266b14322c72a8a4f6
Instruction Fuzzy Hash: 5A41B530A40914A6CB21AB659CC9AAF7678EF41724F20427FF801711D1D77C5986DE6E

Function 00406846 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction ID: 84f5b91c3f937eb173619b21672ae23043901769df73ed9f159891f0fc81c8d0
Opcode Fuzzy Hash: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction Fuzzy Hash: 72F18671D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7385A8ACF45

Function 004064C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(74DF3420,00426778,00425F30,00405C83,00425F30,00425F30,00000000,00425F30,00425F30,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0), ref: 004064CC
FindClose.KERNELBASE(00000000), ref: 004064D8

Strings

xgB, xrefs: 004064C2

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction ID: 909a2899cbbcfc21b24ab628f9350e7a3c7b3772aa6d432f74911df6ac2d0bb5
Opcode Fuzzy Hash: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction Fuzzy Hash: 8BD0C9315045209BC2111778AE4C85B7A98AF553317628A36B466F12A0C674CC22869C

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 760ba12aea5bac669ea06a92ce868f6cfbbc58d79179603cd607c726fd559e33
Instruction ID: ca82d2f7608ddbe9a9db451b4e667c54ef54e9945bbc135f2cbc761c4928cd6d
Opcode Fuzzy Hash: 760ba12aea5bac669ea06a92ce868f6cfbbc58d79179603cd607c726fd559e33
Instruction Fuzzy Hash: 3CF08275600114DBC711EBE4DD49AAEB374FF00324F2045BBE105F31E1D7B499559B2A

Function 004039C7 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000), ref: 00403A48
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,C:\Program Files\TeamViewer,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,74DF3420), ref: 00403AC8
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,C:\Program Files\TeamViewer,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403ADB
GetFileAttributesW.KERNEL32(004281E0), ref: 00403AE6
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files\TeamViewer), ref: 00403B2F

Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2

RegisterClassW.USER32(004291E0), ref: 00403B6C
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B84
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403BB9
ShowWindow.USER32(00000005,00000000), ref: 00403BEF
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403C1B
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403C28
RegisterClassW.USER32(004291E0), ref: 00403C31
DialogBoxParamW.USER32(?,00000000,00403D6A,00000000), ref: 00403C50

Strings

"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 004039CB
RichEd32, xrefs: 00403C03
.exe, xrefs: 00403AD5
RichEdit20W, xrefs: 00403C13, 00403C19
(7B, xrefs: 004039F3
C:\Program Files\TeamViewer, xrefs: 00403A57, 00403A5F, 00403B02, 00403B08, 00403B18
.DEFAULT\Control Panel\International, xrefs: 00403A33
Control Panel\Desktop\ResourceLocale, xrefs: 004039FB
RichEdit, xrefs: 00403C22
_Nb, xrefs: 00403B4B, 00403BB3
RichEd20, xrefs: 00403BF5

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$(7B$.DEFAULT\Control Panel\International$.exe$C:\Program Files\TeamViewer$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-3034445695
Opcode ID: d6eb97ecc45ceecdb0e2d203f76fda1198e4e833a1627c35b81ac0c75580ce77
Instruction ID: e7f44595d902892b35b801f2f0c3734befc0b18a393fec54347386a87508d522
Opcode Fuzzy Hash: d6eb97ecc45ceecdb0e2d203f76fda1198e4e833a1627c35b81ac0c75580ce77
Instruction Fuzzy Hash: 8661C570244200BAD730AF669D49E2B3A7CEB84B49F40453FF981B62E2DB7D5912C63D

Function 00402E41 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402E55
GetModuleFileNameW.KERNEL32(00000000,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,00000400), ref: 00402E71

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00402EBA
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403001

Strings

"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 00402E41
soft, xrefs: 00402F31
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040304A
Inst, xrefs: 00402F28
dVA, xrefs: 004030C6
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403098
C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe, xrefs: 00402E5B, 00402E6A, 00402E7E, 00402E9B
Null, xrefs: 00402F3A
Error launching installer, xrefs: 00402E91

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$dVA$soft
API String ID: 2803837635-3649123712
Opcode ID: cc8dbefb85167051c5f544e5004306f35bb35ae70e2c75d84afc589ab8111160
Instruction ID: e866f1dd798e5fb15c0a347603bcfded6ce2f229c2e481af73dd86df93422dd6
Opcode Fuzzy Hash: cc8dbefb85167051c5f544e5004306f35bb35ae70e2c75d84afc589ab8111160
Instruction Fuzzy Hash: 9761C431A00215ABDB209F75DD49B9E7BB8EB00359F20817FF500F62D1DABD9A448B5D

Function 004061A0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,00422708,?,00405314,00422708,00000000,00000000,00000000), ref: 00406263
GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 004062E1
GetWindowsDirectoryW.KERNEL32(004281E0,00000400), ref: 004062F4
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406330
SHGetPathFromIDListW.SHELL32(?,004281E0), ref: 0040633E
CoTaskMemFree.OLE32(?), ref: 00406349
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040636D
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405314,00422708,00000000,00000000,00000000), ref: 004063C7

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004062AF
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406367

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: 978d560dfc87019ac3657ebba0841bd774ce65c1ae89d16051c02eb976f42344
Instruction ID: 57c77dc533264c97ace6329bd87f7d674c2bea75a5b3d90d15d675b8bae5a73d
Opcode Fuzzy Hash: 978d560dfc87019ac3657ebba0841bd774ce65c1ae89d16051c02eb976f42344
Instruction Fuzzy Hash: 1E611571A00104EBDF209F24CC40AAE37A5AF15314F56817FED56BA2D0D73D8AA2CB9D

Function 00402D9F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402DBA
GetTickCount.KERNEL32 ref: 00402DD8
wsprintfW.USER32 ref: 00402E06

Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19,00402E19,00422708,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402E2A
ShowWindow.USER32(00000000,00000005), ref: 00402E38

Part of subcall function 00402D83: MulDiv.KERNEL32(00000000,00000064,00001796), ref: 00402D98

Strings

... %d%%, xrefs: 00402E00

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 55d24c5390b907b95f49b66e4ea6ad5927533a63874c6edf844c1ebc3ef3af3f
Instruction ID: 67f39cb704aca6262626a7976268bb3bb8a333bdab68892006d91dd8afb4411f
Opcode Fuzzy Hash: 55d24c5390b907b95f49b66e4ea6ad5927533a63874c6edf844c1ebc3ef3af3f
Instruction Fuzzy Hash: 96016D70541614EBC721AB60EF4DA9B7A68AF00706B14417FF885F12E0CBF85865CBEE

Function 00402D04 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
wsprintfW.USER32 ref: 00402D56
SetWindowTextW.USER32(?,?), ref: 00402D66
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D78

Strings

unpacking data: %d%%, xrefs: 00402D44
verifying installer: %d%%, xrefs: 00402D4B, 00402D54

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
Instruction ID: 006a23aec332b8a1771af90dfa9c1e08c84c5b856183a3bf167901723993fe13
Opcode Fuzzy Hash: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
Instruction Fuzzy Hash: 2FF0367050020CABEF206F50DD49BEA3B69FF44305F00803AFA55B51D0DBF959558F59

Function 004064E8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
wsprintfW.USER32 ref: 0040653A
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040654E

Strings

\, xrefs: 00406510
UXTHEME, xrefs: 004064F1
%s%S.dll, xrefs: 00406534

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction ID: c6b4a3c42f63eea3762d57d51081eb848d485012b63e63803453d9912f42ff06
Opcode Fuzzy Hash: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction Fuzzy Hash: 3AF0FC70500219BADB10AB64ED0DF9B366CAB00304F10403AA646F10D0EB7CD725CBA8

Function 00402BFF Relevance: 9.1, APIs: 6, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.KERNELBASE(?), ref: 00402C65
RegDeleteKeyExW.KERNELBASE(?,?,00000000,00000003), ref: 00402C83
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseDelete$EnumOpen
String ID:
API String ID: 345360480-0
Opcode ID: 4ec6df6a7822e6832b209296c93603dddbd7b2fdc8aeab19611781db4307b28d
Instruction ID: b9f5b7c8593eadded22e2ca3cbb8d83d08b5e31647f9888e60cfbaa55d101d4e
Opcode Fuzzy Hash: 4ec6df6a7822e6832b209296c93603dddbd7b2fdc8aeab19611781db4307b28d
Instruction Fuzzy Hash: 66116A71504119FFEF10AF90DF8CEAE3B79FB14384B10007AF905E11A0D7B58E55AA69

Function 004031EF Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403203

Part of subcall function 0040336E: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 00403236
SetFilePointer.KERNELBASE(00415664,00000000,00000000,00414ED0,00004000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000), ref: 00403331

Strings

@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@, xrefs: 00403248, 004032E3
dVA, xrefs: 004031F2, 0040330F

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: @@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@$dVA
API String ID: 1092082344-3936939755
Opcode ID: 7f87ec3f3126c4afc5deb31522855fdbb853a78037bb661dde8e94ffc6001a55
Instruction ID: 2fd669d0756999c0d63da40b5d988076205959dac08f3783f289fe1fafb1afdd
Opcode Fuzzy Hash: 7f87ec3f3126c4afc5deb31522855fdbb853a78037bb661dde8e94ffc6001a55
Instruction Fuzzy Hash: 19314B72500204DBD710DF69EEC49663FA9F74075A718423FE900F22E0CBB55D458B9D

Function 00406697 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@, xrefs: 00406697

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID: @@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@
API String ID: 0-2705140028
Opcode ID: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction ID: 5389f57cfb4a3ea8b0a271fe5c21418892ef356aef38e154ca47b5156c43700c
Opcode Fuzzy Hash: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction Fuzzy Hash: 37816831D04229CBDF24CFA8C844BADBBB0FF44305F11816AD956BB281D7785986DF45

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017CD

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19,00402E19,00422708,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 691a1510b89acce80dd3805f8ce29c63c215ef208285089eafd6533280d8da0c
Instruction ID: b64174440326d41e90dd14f1ad6608c73badddfa8ee8632f400ec40acf256ac3
Opcode Fuzzy Hash: 691a1510b89acce80dd3805f8ce29c63c215ef208285089eafd6533280d8da0c
Instruction Fuzzy Hash: 0C41C431900515BACF117FB5CC46DAE3679EF05329B20827BF422F51E2DA3C86629A6D

Function 00405D82 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DA0
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,004033B4,00437000,00437800,00437800,00437800,00437800,00437800,00437800,004035DE), ref: 00405DBB

Strings

"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 00405D82
nsa, xrefs: 00405D8F

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$nsa
API String ID: 1716503409-1472656423
Opcode ID: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction ID: a69a53d4b23f3d63feeda802a3e8a765614c71270742c911b33c62312df6cecc
Opcode Fuzzy Hash: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction Fuzzy Hash: 32F06D76600608BBDB008B59DD09AABBBB8EF91710F10803BEE01F7190E6B09A548B64

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction ID: d84b147cfae213de6894e87518a1957a70c03431d85ade02b305fde94438308f
Opcode Fuzzy Hash: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction Fuzzy Hash: E511C071E00108BFEB10AFA4DE89DAE777DEB14358F11403AF904B71D1DBB85E409668

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19,00402E19,00422708,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Part of subcall function 0040585E: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
Part of subcall function 0040585E: CloseHandle.KERNEL32(?), ref: 00405894

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNELBASE(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: a78f467d102d634b70d0cd300a6522cd21a94210720227bbe75178bdad148be0
Instruction ID: 5702df78c33f9bd13decba52644e1012fe72a42f767711efff684f6f7274af03
Opcode Fuzzy Hash: a78f467d102d634b70d0cd300a6522cd21a94210720227bbe75178bdad148be0
Instruction Fuzzy Hash: FF11A131900508EBCF21AF91CD4499E7AB6AF40314F21407BFA05B61F1D7798A92DB99

Function 004057AC Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,00437800), ref: 004057EF
GetLastError.KERNEL32 ref: 00405803
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405818
GetLastError.KERNEL32 ref: 00405822

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction ID: b278f7ea68de5888e34302da86fdb06c438f4ef9b03e74a9ab654546e4f81ce2
Opcode Fuzzy Hash: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction Fuzzy Hash: 89010871D00619DADF10DBA0D9447EFBFB8EB04304F00803ADA44B6190E7789618DFA9

Function 004030E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 0040310C

Strings

dVA, xrefs: 00403101, 004031A1, 004031E1

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer
String ID: dVA
API String ID: 973152223-1571107130
Opcode ID: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
Instruction ID: 040f2acbe5348ef8c996952313d322865bd2faa87b76d8d9ba7109e69b0e4b3d
Opcode Fuzzy Hash: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
Instruction Fuzzy Hash: 22316B30200219EBDB108F55ED84ADA3F68EB08359F20813AF905EA1D0DB79DF50DBA9

Function 00405C3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 00405BDD: CharNextW.USER32(?,?,00425F30,?,00405C51,00425F30,00425F30,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405C93
GetFileAttributesW.KERNELBASE(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0), ref: 00405CA3

Strings

0_B, xrefs: 00405C40

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction ID: 790be11e20efdccda9c73cacd4945748764c6204d4d0b11914a12a4c94a1ccfd
Opcode Fuzzy Hash: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction Fuzzy Hash: 41F0F925108F6515F62233790D05EAF2554CF82394755067FF891B12D1DB3C9D938C7D

Function 00406C7B Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction ID: 95c87b37ce546c92696c349aad8761a6baa0f42cb897a758cf539d426e2a5a70
Opcode Fuzzy Hash: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction Fuzzy Hash: 65A13471D00229CBDF28CFA8C844AADBBB1FF44305F15816AD956BB281D7785A86DF44

Function 00406E7C Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction ID: dd225a6952a4a1885b566de7f95e3528e0c965b1b64db9b9769652e5c735704b
Opcode Fuzzy Hash: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction Fuzzy Hash: 3D913370D04229CBDF28CFA8C844BADBBB1FF44305F15816AD856BB291C7789A86DF45

Function 00406B92 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction ID: c728d5504c89e28601c55753f21d2f559f3974f1a6ce44cf054f885a45476dee
Opcode Fuzzy Hash: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction Fuzzy Hash: 06813471D04228CFDF24CFA8C844BADBBB1FB44305F25816AD856BB291C7789A86DF45

Function 00406AE5 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction ID: 7cecadd07089ef5f508d2048bcf4206a214b5fe31ba49bd0cdf53ec9cfb3ce0b
Opcode Fuzzy Hash: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction Fuzzy Hash: 35712175D04228CBDF28CFA8C844BADBBB1FB44305F15816AD806BB281D7789A96DF44

Function 00406C03 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction ID: f96eec566abe8136b7696836c8602221009d3abbc3cba5cf828ad5cd02611e0d
Opcode Fuzzy Hash: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction Fuzzy Hash: 56713371D04228CBEF28CFA8C844BADBBB1FF44305F15816AD856BB281C7789996DF45

Function 00406B4F Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction ID: 17f295adf0ba2181094cfffbed918b39bb4908eb68d6975640ddb9889f0749db
Opcode Fuzzy Hash: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction Fuzzy Hash: F2714531D04229CBEF28CF98C844BADBBB1FF44305F11816AD816BB291C7785A96DF44

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19,00402E19,00422708,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 3af2946ff99008b209debd4f1eb8d373454f26c3ddb3991e3b063650c9d6d31f
Instruction ID: 135227bab5bbd0cb957ad13063370cb04025123e1843093ab7a3381522db9c00
Opcode Fuzzy Hash: 3af2946ff99008b209debd4f1eb8d373454f26c3ddb3991e3b063650c9d6d31f
Instruction Fuzzy Hash: 7D21A731900219EBCF20AFA5CE48A9E7E71BF00354F20427BF511B51E1DBBD8A81DA5D

Function 00402537 Relevance: 4.6, APIs: 3, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(0040ADD8,?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 0040258E

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID:
API String ID: 3109718747-0
Opcode ID: e7f3211d175e5301a81dcf8418a50b190afa44f623bbf1836edc17c3b72aee6a
Instruction ID: 4789cac02ba757069cd1743e95fa376523a080456913a55bd7acca95e4ec0b97
Opcode Fuzzy Hash: e7f3211d175e5301a81dcf8418a50b190afa44f623bbf1836edc17c3b72aee6a
Instruction Fuzzy Hash: CA11E772A01204BADB10AFB18F4EE9E32659F54355F20403BF502F65C1DAFC8E51576E

Function 0040604B Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,004281E0,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,004281E0,?), ref: 00406075
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,004281E0,?), ref: 00406096
RegCloseKey.KERNELBASE(?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,004281E0,?), ref: 004060B9

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 0186f18981595c0b19feb364ea02d5f95392918b8fa258a18f8687652683a575
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 4501483115020AEADF21CF66ED08E9B3BA8EF84390B01402AF845D2220D735D964DBA5

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
Instruction ID: c7ec42ec2a5b8cbcf97019b844e04a4f9c539befeef3331d530b96059407f5ff
Opcode Fuzzy Hash: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
Instruction Fuzzy Hash: FCF03171A14204EBEB209F65DE8CABF767DEF80354B10843FF505B61D0DAB84D419B69

Function 00405927 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D2E: GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
Part of subcall function 00405D2E: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B09), ref: 00405942
DeleteFileW.KERNELBASE(?,?,?,00000000,00405B09), ref: 0040594A
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405962

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction ID: ecea3d8082f0941e5ee01c5501cf82e541f4c7e763f85e657b920a2cf98d934c
Opcode Fuzzy Hash: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction Fuzzy Hash: 6EE09B72105A91D6D21067349E0CB5F2AD8DF96335F09493EF595F11D0C778880ACA7D

Function 004038D5 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00437800,00403708,?), ref: 004038E7
CloseHandle.KERNEL32(FFFFFFFF,00437800,00403708,?), ref: 004038FB

Strings

C:\Windows\TEMP\nseC5E0.tmp\, xrefs: 0040390B

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Windows\TEMP\nseC5E0.tmp\
API String ID: 2962429428-3537077208
Opcode ID: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction ID: 23b98c188a40640ee87c89e263e7d2a3484f90a0975adae1b2ea6fd77d705eba
Opcode Fuzzy Hash: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction Fuzzy Hash: 78E086B14407149AC124AF7CAD495853A185F453357248726F178F20F0C778996B5E9D

Function 00405E05 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414BCB,@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@,004032EF,@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@,00414BCB,00414ED0,00004000,?,00000000,00403119,00000004), ref: 00405E19

Strings

@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@, xrefs: 00405E05

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileWrite
String ID: @@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@
API String ID: 3934441357-2705140028
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: dac0b8971ba2920abb5474f128329a0fa477ab7403896bbfc0984bb8014ca22f
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 4AE08632100119ABCF105F50DC00EEB376CEB00350F004832FA65E2040E230EA219BE4

Function 00405DD6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@,0040336B,0040A230,0040A230,0040326F,00414ED0,00004000,?,00000000,00403119), ref: 00405DEA

Strings

@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@, xrefs: 00405DD6

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileRead
String ID: @@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@
API String ID: 2738559852-2705140028
Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction ID: f39de87387fc754cac4ceee649b5e38243fe2bf9183d254406dbd5143e25ae03
Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction Fuzzy Hash: 57E0EC3221125AABDF509F65DC08AEB7B6DEF05360F008837F955E6160D631E9219BE8

Function 004015B9 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405BDD: CharNextW.USER32(?,?,00425F30,?,00405C51,00425F30,00425F30,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 004057AC: CreateDirectoryW.KERNELBASE(?,?,00437800), ref: 004057EF

SetCurrentDirectoryW.KERNEL32(?,00436000,?,00000000,000000F0), ref: 00401645

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction ID: 18abe7de9e9977a76830232601504265d2e6edcedfe07fce7f69d5744a4425eb
Opcode Fuzzy Hash: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction Fuzzy Hash: F911E631500504EBCF207FA0CD0199E3AB2EF44364B25453BF906B61F2DA3D4A819E5E

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
Instruction ID: a4ed2935f8c713a64b441f8b02302a8faa8aa65f3841d01997d269d515fb9b23
Opcode Fuzzy Hash: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
Instruction Fuzzy Hash: 9D119131911205EBDB10CFA0CA489AEB7B4EF44354B20843FE446B72D0D6B85A41DB19

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction ID: d65e0694727b7210e6f7bc09f77efd2c0147e56cffd904cd4a2c980f2ed28b93
Opcode Fuzzy Hash: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction Fuzzy Hash: 3D01D131724210EBEB195B789D04B2A3698E714314F1089BAF855F62F1DA788C128B5D

Function 0040231F Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040233E
RegCloseKey.ADVAPI32(00000000), ref: 00402347

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
Instruction ID: b5033fe3495a5d5fbf66e52db86fe43622c16bf705f2fe0f4142c4154f9543e6
Opcode Fuzzy Hash: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
Instruction Fuzzy Hash: 45F04F32A04110ABEB11BFB59B4EABE726A9B40314F15807BF501B71D5D9FC99025629

Function 00406594 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?), ref: 004065AB
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004065BB

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Message$DispatchPeek
String ID:
API String ID: 1770753511-0
Opcode ID: ef2e4593c0240a07502a9f68f436a2f199b7ff7db9f8b56736ff16cb35fdca16
Instruction ID: 3df2e48da143b1230ddfac55cbc283c178fe6404b28bee855849021750633643
Opcode Fuzzy Hash: ef2e4593c0240a07502a9f68f436a2f199b7ff7db9f8b56736ff16cb35fdca16
Instruction Fuzzy Hash: EBE086B790111876CA10A799AD05ECB776C9B95750F014036F611F3085D678E5118AB4

Function 00406558 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
GetProcAddress.KERNEL32(00000000,?), ref: 00406585

Part of subcall function 004064E8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
Part of subcall function 004064E8: wsprintfW.USER32 ref: 0040653A
Part of subcall function 004064E8: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040654E

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 31197a09b32f9822319ed056a1c078f96e3f7aaf520cdba8edd4f010bc886546
Instruction ID: 8c1a5bb66f910ccc430fc34c4425cef617f316e2833151c7c1ff8c8a0ee84b40
Opcode Fuzzy Hash: 31197a09b32f9822319ed056a1c078f96e3f7aaf520cdba8edd4f010bc886546
Instruction Fuzzy Hash: C3E086326042206BD6105B706E0893762BC9ED8740302483EF946F2084D778DC329A6D

Function 00403932 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,74DF3420,00000000,74DF2EE0,00403909,00437800,00403708,?), ref: 0040394C
GlobalFree.KERNEL32(?), ref: 00403953

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
Instruction ID: 420717e04dc644aaadfe3aeddcd4797dc829437e29e913c3c6529364dabb0ba4
Opcode Fuzzy Hash: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
Instruction Fuzzy Hash: 41E012739011309BC6225F95ED44B5E7B6D6F95B32F0A423AE9807B26087B45D838FD8

Function 00405D53 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00405D57
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction ID: e98dd403a5e5432679a9d4e257ef455d3d6759c2e5ed6cf280caa05d5291d686
Opcode Fuzzy Hash: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction Fuzzy Hash: B3D09E71654601EFEF098F20DF16F2E7AA2EB84B00F11562CB682940E0DA7158199B19

Function 00405D2E Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction ID: 62c1218995ad43f24aa052634507c0d83541fa9dca801c4eab67991220ff17ac
Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction Fuzzy Hash: 40D01272504520AFC2513738EF0C89BBF95EB543B17028B35FAF9A22F0DB304C568A98

Function 00405829 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004033A9,00437800,00437800,00437800,00437800,00437800,004035DE), ref: 0040582F
GetLastError.KERNEL32 ref: 0040583D

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction ID: d963a2520b22da8993c1f0374a54a6368e12bf2bf52e26206a68f99a8800bbf8
Opcode Fuzzy Hash: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction Fuzzy Hash: 1DC04C31204B029AD7506B609F097177954AB50781F11C8396946E00A0DE348465DE2D

Function 00401B37 Relevance: 2.6, APIs: 2, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401BA7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BB9

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: 554d17eb3c6d1829cbb52a784c7af5d6f88ef092a67b5b7707c292645e37930e
Instruction ID: 7cdfc3cbb2e69f4264c6c6693aec6085e55c642d7687a467de19211c04d07d9e
Opcode Fuzzy Hash: 554d17eb3c6d1829cbb52a784c7af5d6f88ef092a67b5b7707c292645e37930e
Instruction Fuzzy Hash: 67219672A00100EBDB20EB94CD85D5E77B6AF84314B21453BF502F72E1DA7898618F5D

Function 00401673 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 0040168E

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: a51ebfd131b5ce1ad24a1fd58dead1362408043bc730019d15f3e82182553067
Instruction ID: f96437beda5fd31dd1875ddb5f908f1f3267c620ccf54a3d4895ce3c899c2c08
Opcode Fuzzy Hash: a51ebfd131b5ce1ad24a1fd58dead1362408043bc730019d15f3e82182553067
Instruction Fuzzy Hash: 50F0B431604114D7CB20BF7A4F0DD5E32A59F82338B25437BF912B62E6DAFC8A41956E

Function 004027CE Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?,?), ref: 004027E2

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: cc0804f4c103f793c784cf4c7483c4fcd77a3d298a483efa9ec2adbee381f28d
Instruction ID: 03c77e44a5bd49d5adcbbbc7357f2d618ce2ff781a2b40b59b4f28f65829b406
Opcode Fuzzy Hash: cc0804f4c103f793c784cf4c7483c4fcd77a3d298a483efa9ec2adbee381f28d
Instruction Fuzzy Hash: D9E06576600115DBCB50DFD0DE48AAEB3B4AF04314F10447BD101F61D1E6F889519B6D

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
Instruction ID: 0f14848d4f24c16631b00b750435c060a764b4453362ef8260df6bafad2d34e7
Opcode Fuzzy Hash: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
Instruction Fuzzy Hash: 7FE01A71601114ABDB11EBA59E4ACAE766AAB40328B10443BF501F14E1CAB988619A2E

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction ID: ef45ff86538a2d51f1b0222ec8c1b297abd10be8bd22699319dc95f068cee933
Opcode Fuzzy Hash: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction Fuzzy Hash: CCE08676244108BFDB00DFA8DE47FD537ECAB14700F004031BA08D70D1C674E5508768

Function 004022DF Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402310

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
Instruction ID: 815fd251d1ef055c124add3867079dbd89389a2e6f50d5753089410e689aa70c
Opcode Fuzzy Hash: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
Instruction Fuzzy Hash: 91E04F30800208BBDF01AFA4CE49DBD3B79AF00344F14043AF940AB0D5E7F89A819749

Function 0040601F Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

MoveFileExW.KERNELBASE(?,?,00000005,00405B21,?,00000000,000000F1,?,?,?,?,?), ref: 00406029

Part of subcall function 00405EAD: lstrcpyW.KERNEL32(00426DC8,NUL,?,00000000,?,?,00406040,?,?), ref: 00405EBC
Part of subcall function 00405EAD: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
Part of subcall function 00405EAD: GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405EE9
Part of subcall function 00405EAD: GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F06
Part of subcall function 00405EAD: wsprintfA.USER32 ref: 00405F24
Part of subcall function 00405EAD: GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
Part of subcall function 00405EAD: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
Part of subcall function 00405EAD: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
Part of subcall function 00405EAD: SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$NamePathShortlstrcpy$AllocCloseGlobalHandleMovePointerSizewsprintf
String ID:
API String ID: 2305538632-0
Opcode ID: c3375b46b30391636c211c7ba3bb6b5856b401a82baf414915ce8378752f4d8e
Instruction ID: 18bddb7de20ac1970eb55a3559b5efcfaddd6cd83010f6772ef5631c43e5a1b0
Opcode Fuzzy Hash: c3375b46b30391636c211c7ba3bb6b5856b401a82baf414915ce8378752f4d8e
Instruction Fuzzy Hash: CBD0C73124C601BFDB255B10DD0591B7BA5FB90355F11C43EF595900B2E7368461EF0D

Function 0040336E Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction ID: 64c0fffafe8abe290eaf2022e63b776f1a4a3bd25e2fde741040b5855636c72c
Opcode Fuzzy Hash: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction Fuzzy Hash: 70B01231140300BFDA214F00DF09F057B21AB90700F10C034B344780F086711075EB0D

Non-executed Functions

Function 00404C59 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C71
GetDlgItem.USER32(?,00000408), ref: 00404C7C
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CC6
LoadBitmapW.USER32(0000006E), ref: 00404CD9
SetWindowLongW.USER32(?,000000FC,00405251), ref: 00404CF2
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D06
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D18
SendMessageW.USER32(?,00001109,00000002), ref: 00404D2E
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D3A
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D4C
DeleteObject.GDI32(00000000), ref: 00404D4F
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D7A
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D86
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E1C
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E47
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E5B
GetWindowLongW.USER32(?,000000F0), ref: 00404E8A
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404E98
ShowWindow.USER32(?,00000005), ref: 00404EA9
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FA6
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040500B
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405020
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405044
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405064
ImageList_Destroy.COMCTL32(?), ref: 00405079
GlobalFree.KERNEL32(?), ref: 00405089
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405102
SendMessageW.USER32(?,00001102,?,?), ref: 004051AB
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051BA
InvalidateRect.USER32(?,00000000,00000001), ref: 004051DA
ShowWindow.USER32(?,00000000), ref: 00405228
GetDlgItem.USER32(?,000003FE), ref: 00405233
ShowWindow.USER32(00000000), ref: 0040523A

Strings

M, xrefs: 00404E03
, xrefs: 00405212
N, xrefs: 00404EE4

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 2479b366cad44d8d2a02fbd124e29c277f71441e1411fda8dea8c44bba4244d6
Instruction ID: ce840dee0c3a5b827351c7f25dbf2e3605d0905f5c54158640504e6bfb71dde6
Opcode Fuzzy Hash: 2479b366cad44d8d2a02fbd124e29c277f71441e1411fda8dea8c44bba4244d6
Instruction Fuzzy Hash: 4C023EB0A00209EFDF209F64CD45AAE7BB5FB84355F10817AE610BA2E1C7799D52CF58

Function 0040541C Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040547A
GetDlgItem.USER32(?,000003EE), ref: 00405489
GetClientRect.USER32(?,?), ref: 004054C6
GetSystemMetrics.USER32(00000002), ref: 004054CD
SendMessageW.USER32(?,00001061,00000000,?), ref: 004054EE
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004054FF
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405512
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405520
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405533
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405555
ShowWindow.USER32(?,00000008), ref: 00405569
GetDlgItem.USER32(?,000003EC), ref: 0040558A
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040559A
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055B3
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055BF
GetDlgItem.USER32(?,000003F8), ref: 00405498

Part of subcall function 00404277: SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285

GetDlgItem.USER32(?,000003EC), ref: 004055DC
CreateThread.KERNEL32(00000000,00000000,Function_000053B0,00000000), ref: 004055EA
CloseHandle.KERNEL32(00000000), ref: 004055F1
ShowWindow.USER32(00000000), ref: 00405615
ShowWindow.USER32(?,00000008), ref: 0040561A
ShowWindow.USER32(00000008), ref: 00405664
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405698
CreatePopupMenu.USER32 ref: 004056A9
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056BD
GetWindowRect.USER32(?,?), ref: 004056DD
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056F6
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040572E
OpenClipboard.USER32(00000000), ref: 0040573E
EmptyClipboard.USER32 ref: 00405744
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405750
GlobalLock.KERNEL32(00000000), ref: 0040575A
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040576E
GlobalUnlock.KERNEL32(00000000), ref: 0040578E
SetClipboardData.USER32(0000000D,00000000), ref: 00405799
CloseClipboard.USER32 ref: 0040579F

Strings

(7B, xrefs: 0040570A
{, xrefs: 00405682

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 7d3ad4f7b905998d9e0ff1ed48f107a225979fc90d670cd13e2faa1d61a6de43
Instruction ID: 3349dadf3efb3a8fdffdb79f187be012afacb07b5928e089a4a7fd9dccbac2fd
Opcode Fuzzy Hash: 7d3ad4f7b905998d9e0ff1ed48f107a225979fc90d670cd13e2faa1d61a6de43
Instruction Fuzzy Hash: 60B15670900608FFDB119FA0DD89EAE3B79FB48354F40847AFA45A61A0CB754E52DF68

Function 00403D6A Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403DA6
ShowWindow.USER32(?), ref: 00403DC3
DestroyWindow.USER32 ref: 00403DD7
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DF3
GetDlgItem.USER32(?,?), ref: 00403E14
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E28
IsWindowEnabled.USER32(00000000), ref: 00403E2F
GetDlgItem.USER32(?,00000001), ref: 00403EDD
GetDlgItem.USER32(?,00000002), ref: 00403EE7
SetClassLongW.USER32(?,000000F2,?), ref: 00403F01
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F52
GetDlgItem.USER32(?,00000003), ref: 00403FF8
ShowWindow.USER32(00000000,?), ref: 00404019
EnableWindow.USER32(?,?), ref: 0040402B
EnableWindow.USER32(?,?), ref: 00404046
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040405C
EnableMenuItem.USER32(00000000), ref: 00404063
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040407B
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040408E
lstrlenW.KERNEL32(00423728,?,00423728,00429240), ref: 004040B7
SetWindowTextW.USER32(?,00423728), ref: 004040CB
ShowWindow.USER32(?,0000000A), ref: 004041FF

Strings

(7B, xrefs: 004040A3

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: dd9405652fbbb87ab488d8a14d0aeb81f33be68f6094b2cdc8f2b1d388c01c08
Instruction ID: 4530f9416eb169af0d44378ddba5762a1eee688012323a74912104aead4a3b33
Opcode Fuzzy Hash: dd9405652fbbb87ab488d8a14d0aeb81f33be68f6094b2cdc8f2b1d388c01c08
Instruction Fuzzy Hash: A5C1FFB1640200FFCB206F61EE84E2B3AA8EB95745F40057EF641B21F1CB7999529B6D

Function 004043DF Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040447D
GetDlgItem.USER32(?,000003E8), ref: 00404491
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044AE
GetSysColor.USER32(?), ref: 004044BF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044CD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044DB
lstrlenW.KERNEL32(?), ref: 004044E0
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044ED
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404502
GetDlgItem.USER32(?,0000040A), ref: 0040455B
SendMessageW.USER32(00000000), ref: 00404562
GetDlgItem.USER32(?,000003E8), ref: 0040458D
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045D0
LoadCursorW.USER32(00000000,00007F02), ref: 004045DE
SetCursor.USER32(00000000), ref: 004045E1
ShellExecuteW.SHELL32(0000070B,open,004281E0,00000000,00000000,00000001), ref: 004045F6
LoadCursorW.USER32(00000000,00007F00), ref: 00404602
SetCursor.USER32(00000000), ref: 00404605
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404634
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404646

Strings

open, xrefs: 004045EE
N, xrefs: 0040457B
VC@, xrefs: 004045EB

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$VC@$open
API String ID: 3615053054-3831744127
Opcode ID: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction ID: ef28e404984a924d02769b335405a58d84a4f5c10dd13b46e9d300bde90bb2c1
Opcode Fuzzy Hash: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction Fuzzy Hash: 717191B1A00209BFDB10AF60DD45E6A7B69FB94344F00843AFB05B62E0D779AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction ID: fbc3582f0be17511ef24b6208279bd62f68a22b1f89f17edcf88e24f0ff4dafb
Opcode Fuzzy Hash: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction Fuzzy Hash: 8E418A71800209AFCF058F95DE459AFBBB9FF44310F00842EF991AA1A0C738EA55DFA4

Function 00405EAD Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00426DC8,NUL,?,00000000,?,?,00406040,?,?), ref: 00405EBC
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405EE9

Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F06
wsprintfA.USER32 ref: 00405F24
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC
GlobalFree.KERNEL32(00000000), ref: 0040600D
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406014

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Strings

%ls=%ls, xrefs: 00405F1A
NUL, xrefs: 00405EB6
[Rename], xrefs: 00405F8E, 00405FA0

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b79c81f05b1b833d126071e3cf8f1dbc038624686787cc5f02dad872694d8803
Instruction ID: 52ae09e4e2a5e81e4d5588e003ad531eff1fe7f7ae6e2de5146a23cae23f7ad9
Opcode Fuzzy Hash: b79c81f05b1b833d126071e3cf8f1dbc038624686787cc5f02dad872694d8803
Instruction Fuzzy Hash: EB315330241B19BBD2206B209D08F2B3A5CEF85758F15043BF942F62C2EA7CC9118EBD

Function 004046DD Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040472C
SetWindowTextW.USER32(00000000,?), ref: 00404756
SHBrowseForFolderW.SHELL32(?), ref: 00404807
CoTaskMemFree.OLE32(00000000), ref: 00404812
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 00404844
lstrcatW.KERNEL32(?,004281E0), ref: 00404850
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404862

Part of subcall function 004058A7: GetDlgItemTextW.USER32(?,?,00000400,00404899), ref: 004058BA

Part of subcall function 00406412: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406475
Part of subcall function 00406412: CharNextW.USER32(?,?,?,00000000), ref: 00406484
Part of subcall function 00406412: CharNextW.USER32(?,00000000,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406489
Part of subcall function 00406412: CharPrevW.USER32(?,?,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 0040649C

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404925
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404940

Part of subcall function 00404A99: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
Part of subcall function 00404A99: wsprintfW.USER32 ref: 00404B43
Part of subcall function 00404A99: SetDlgItemTextW.USER32(?,00423728), ref: 00404B56

Strings

C:\Program Files\TeamViewer, xrefs: 0040482D
A, xrefs: 00404800
(7B, xrefs: 004047DA

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$C:\Program Files\TeamViewer
API String ID: 2624150263-460036527
Opcode ID: b1c988a2c75076f1e590c134e256cc95cfc43452e7a67f3061b6eea54995cb3a
Instruction ID: d5aaf60bd55b21875b9c8b9a8d0b3d7e01f34e6f89f3adcbdcc63617e1d21faf
Opcode Fuzzy Hash: b1c988a2c75076f1e590c134e256cc95cfc43452e7a67f3061b6eea54995cb3a
Instruction Fuzzy Hash: B7A191F1A00209ABDB11AFA5CC45AAF77B8EF84354F10847BF601B62D1D77C99418B6D

Function 004042A9 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042C6
GetSysColor.USER32(00000000), ref: 004042E2
SetTextColor.GDI32(?,00000000), ref: 004042EE
SetBkMode.GDI32(?,?), ref: 004042FA
GetSysColor.USER32(?), ref: 0040430D
SetBkColor.GDI32(?,?), ref: 0040431D
DeleteObject.GDI32(?), ref: 00404337
CreateBrushIndirect.GDI32(?), ref: 00404341

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction ID: 2a82f640caf94e13ad52f77eccc7f6a005bf570db5d4005cc44859485eb84fad
Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction Fuzzy Hash: 9F215171600704ABCB219F68DE08B4BBBF8AF81714F04892DED95E26A0D738E904CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405E34: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405E4A

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction ID: fbd7f9394f7a40dbbdef10ea3a20ac1ae57b35180e29dd1ddeb30b88b5afce05
Opcode Fuzzy Hash: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction Fuzzy Hash: 19510774D00219ABDF209F94CA88AAEB779FF04344F50447BE501B72E0D7B99982DB69

Function 004052DD Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
lstrcatW.KERNEL32(00422708,00402E19,00402E19,00422708,00000000,00000000,00000000), ref: 00405338
SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: e0d278b4f454602652d1392a5fb3045d02927be56822f9b38c604404e895085a
Instruction ID: d14990956ab1253184f877e9e8298894284f42a30aea32824f5004b5108fa95f
Opcode Fuzzy Hash: e0d278b4f454602652d1392a5fb3045d02927be56822f9b38c604404e895085a
Instruction Fuzzy Hash: 62217F71900518BACF119FA6DD44ACFBFB8EF85354F10807AF904B62A1C7B94A51DFA8

Function 00406412 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406475
CharNextW.USER32(?,?,?,00000000), ref: 00406484
CharNextW.USER32(?,00000000,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406489
CharPrevW.USER32(?,?,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 0040649C

Strings

"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 00406412
*?|<>/":, xrefs: 00406464

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$*?|<>/":
API String ID: 589700163-1805722269
Opcode ID: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction ID: c1b46f2de1f90aebbf911330ce555e940da56993e608f70b6a8db31027969b8c
Opcode Fuzzy Hash: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction Fuzzy Hash: 5311C85680121299DB307B588C40AB7A2B8EF55754F52803FEDCA732C1E77C5C9286BD

Function 00404BA7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BC2
GetMessagePos.USER32 ref: 00404BCA
ScreenToClient.USER32(?,?), ref: 00404BE4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BF6
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C1C

Strings

f, xrefs: 00404BF8

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction ID: 45e0f6331f39cfe7836e80c9775163861a3897288b26a0b158bc224782e9bc0b
Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction Fuzzy Hash: C9015271901218BAEB00DB94DD45FFEBBBCAF54711F10012BBA51B61D0C7B495018B54

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 268536b817805fd7c6aa0ddf0c0313c96854f1d95891718e15f9d7c13f840f6f
Instruction ID: 9003099e8900d80eaa65f9bf21adae6f43ee9946aaa6f9d478ae9c17af360c06
Opcode Fuzzy Hash: 268536b817805fd7c6aa0ddf0c0313c96854f1d95891718e15f9d7c13f840f6f
Instruction Fuzzy Hash: D6216F72801118BBCF216FA5CE49D9E7F79EF09364F24423AF550762E0CB794E419B98

Function 00404A99 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
wsprintfW.USER32 ref: 00404B43
SetDlgItemTextW.USER32(?,00423728), ref: 00404B56

Strings

%u.%u%s%s, xrefs: 00404B24
(7B, xrefs: 00404B2C

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 97f8edb7a0e5a20212aa5a449d05d7effc420c8931a1b74a790ae22a69f051c3
Instruction ID: 8555a1dc09e6b234f76c08cd80d60a8511de1cbf1cdbca66d7a603e4fd23a7b2
Opcode Fuzzy Hash: 97f8edb7a0e5a20212aa5a449d05d7effc420c8931a1b74a790ae22a69f051c3
Instruction Fuzzy Hash: E911EB736441283BDB0095AD9C45F9E3298DB85378F150237FA26F71D1DA79D82286EC

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction ID: c287ee2e14a47dfcdc45124cadc9b4dd0eb33b5564dd8f2f51e592e83ba53e14
Opcode Fuzzy Hash: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction Fuzzy Hash: 33F0E172600504AFD701DBE4DE88CEEBBBDEB48311B104476F541F51A1CA749D018B38

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDE0), ref: 00401DD1

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 020d429652f6eb968a81cc61bdee73d82fb2a6d644655b906a561d6cebbfb8f5
Instruction ID: 9e8fd183d3d9d3ef172346538d4b27734d94fdc92d2c471f4f64b2fa811a60c8
Opcode Fuzzy Hash: 020d429652f6eb968a81cc61bdee73d82fb2a6d644655b906a561d6cebbfb8f5
Instruction Fuzzy Hash: F601A271544641EFEB016BB0AF4AF9A3F75BB65301F104579F152B61E2CA7C0006AB2D

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction ID: 9ab6cbc1baff8286944736a18d7265b6422843b7a732a624d4201333bc7942cf
Opcode Fuzzy Hash: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction Fuzzy Hash: F2219071940209BEEF01AFB5CE4AABE7B75EF44744F10403EFA01B61D1D6B88A409B69

Function 00405251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405280
CallWindowProcW.USER32(?,?,?,?), ref: 004052D1

Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

Strings

, xrefs: 00405261

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction ID: 35360b72f4910b777185a6264b25dc7760dbd7dc789205491e41d57b326ac1ec
Opcode Fuzzy Hash: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction Fuzzy Hash: 6B019E71210708ABDF208F11DD84E9B3A35EF94321F60443AFA00761D1C77A8D529E6A

Function 0040585E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
CloseHandle.KERNEL32(?), ref: 00405894

Strings

Error launching installer, xrefs: 00405871

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction ID: 0fb7bd0647ee639374dbc29985885c8cd5f4694ddcbbc5ba66c50ad851a9a680
Opcode Fuzzy Hash: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction Fuzzy Hash: 22E04FB0A002097FEB009B64ED45F7B77ACEB04208F408431BD00F2150D77498248A78

Function 00405CB8 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405CE0
CharNextA.USER32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF1
lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

Memory Dump Source

Source File: 00000009.00000002.2254845796.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2254791967.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254890679.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2254908183.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2255062187.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction ID: b09c91cad7c2282b041c35ea214dbdd3f15ee75aa50bf55fe933874c09a5e2ef
Opcode Fuzzy Hash: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction Fuzzy Hash: BFF0F631104954FFD702DFA5DD04E9FBBA8EF06350B2180BAE841F7210D674DE01ABA8

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lz3EbiqoK4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log

C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe

C:\Program Files\TeamViewer\TVExtractTemp\CopyrightFULL.txt

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf

C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat

C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll

C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe

Windows Analysis Report
lz3EbiqoK4.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre