49d03705739faacb94c8025aaa432597d309fe96026c97ea4f0412bbf09f7a2e

Resubmissions

14-06-2023 15:31

230614-sye5jsah4z 7

13-06-2023 03:59

09-06-2023 03:51

09-06-2023 03:51

09-06-2023 03:33

Analysis

max time kernel
333s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2023 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cyber Security Support.exe
Size

22.0MB
MD5

8452fe515826ab6f43eff16918a40e32
SHA1

64859677fd830793f787fa87c7b29f75883da5cd
SHA256

49d03705739faacb94c8025aaa432597d309fe96026c97ea4f0412bbf09f7a2e
SHA512

6429fa27c63290a777ab6836e7e97b552afdf396a505876fef068929af3da40be01eb505809e4e5bcbb8421ee401439e14a345854b6a17b8ffa8f43375728994
SSDEEP

393216:KOTMIRuiduUzRK3oMS6smRo6SxIM/L/JUH6eBkpH1ed/cViEZs1e4Vj5NnExjuwM:Fg1Oo4WsmRorIMbJUHmpVPiE29XnExjg

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Cyber Security Support.exeTeamViewer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	Cyber Security Support.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	TeamViewer.exe

Executes dropped EXE 7 IoCs

Processes:

TeamViewer.exetv_w32.exetv_x64.exeTeamViewer_Desktop.exe

pid process

4688 TeamViewer.exe
3376 tv_w32.exe
1532 tv_x64.exe
4604 TeamViewer_Desktop.exe
732
2620
2356
Loads dropped DLL 6 IoCs

Processes:

TeamViewer.exetv_w32.exetv_x64.exeTeamViewer_Desktop.exerundll32.exe

pid process

4688 TeamViewer.exe
3376 tv_w32.exe
1532 tv_x64.exe
4604 TeamViewer_Desktop.exe
4544
5096 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

TeamViewer.exe

description ioc process

File opened (read-only) \??\D: TeamViewer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4560 1000 WerFault.exe

description	ioc	process
File opened (read-only)	\??\D:	TeamViewer.exe

pid	pid_target	process	target process
4560	1000	WerFault.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TeamViewer_Desktop.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TeamViewer_Desktop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TeamViewer_Desktop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TeamViewer_Desktop.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

TeamViewer_Desktop.exetv_x64.exetv_w32.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	TeamViewer_Desktop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	tv_w32.exe

Modifies registry class 3 IoCs

Processes:

TeamViewer.exeTeamViewer_Desktop.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2805025096-2326403612-4231045514-1000\{6DDB7EBF-799C-467D-BC1A-F033407D6DF9}	TeamViewer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-18\{C0A6E1C8-80C0-4864-8C16-1D09AB56A17D}	TeamViewer_Desktop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-18\{CC906CEF-813F-4C2D-A8E0-87D6A938192F}	TeamViewer_Desktop.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

TeamViewer.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	TeamViewer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	TeamViewer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	TeamViewer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	TeamViewer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	TeamViewer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	TeamViewer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

TeamViewer.exe

pid process

4688 TeamViewer.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

TeamViewer.exe

pid process

4688 TeamViewer.exe
4688 TeamViewer.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

TeamViewer_Desktop.exe

pid process

4604 TeamViewer_Desktop.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

TeamViewer_Desktop.exeAUDIODG.EXE

description pid process

Token: SeTcbPrivilege 4604 TeamViewer_Desktop.exe
Token: 33 2156 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 2156 AUDIODG.EXE

pid	process
4604	TeamViewer_Desktop.exe

description	pid	process
Token: SeTcbPrivilege	4604	TeamViewer_Desktop.exe
Token: 33	2156	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2156	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 16 IoCs

Processes:

TeamViewer.exeTeamViewer_Desktop.exe

pid	process
4688	TeamViewer.exe
4688	TeamViewer.exe
4688	TeamViewer.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4688	TeamViewer.exe

Suspicious use of SendNotifyMessage 15 IoCs

Processes:

TeamViewer.exeTeamViewer_Desktop.exe

pid	process
4688	TeamViewer.exe
4688	TeamViewer.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4688	TeamViewer.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

TeamViewer.exetv_x64.exetv_w32.exeTeamViewer_Desktop.exe

pid	process
4688	TeamViewer.exe
4688	TeamViewer.exe
1532	tv_x64.exe
3376	tv_w32.exe
1532	tv_x64.exe
1532	tv_x64.exe
3376	tv_w32.exe
3376	tv_w32.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe
4604	TeamViewer_Desktop.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Cyber Security Support.exe

description	pid	process	target process
PID 2064 wrote to memory of 1844	2064	Cyber Security Support.exe	reg.exe
PID 2064 wrote to memory of 1844	2064	Cyber Security Support.exe	reg.exe
PID 2064 wrote to memory of 1844	2064	Cyber Security Support.exe	reg.exe
PID 2064 wrote to memory of 560	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 560	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 560	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4972	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4972	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4972	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4920	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4920	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4920	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1128	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1128	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1128	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4872	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4872	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4872	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4560	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4560	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4560	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 488	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 488	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 488	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1712	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1712	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1712	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 2012	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 2012	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 2012	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1676	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1676	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1676	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 2748	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 2748	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 2748	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1740	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1740	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1740	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 212	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 212	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 212	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4452	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4452	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4452	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 3288	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 3288	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 3288	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1328	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1328	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1328	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 3304	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 3304	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 3304	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4856	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4856	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4856	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1160	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1160	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 1160	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 2608	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 2608	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 2608	2064	Cyber Security Support.exe	cmd.exe
PID 2064 wrote to memory of 4184	2064	Cyber Security Support.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Cyber Security Support.exe
"C:\Users\Admin\AppData\Local\Temp\Cyber Security Support.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" Add "HKCU\Software\TeamViewer" /v "TeamViewerTermsOfUseAcceptedQS" /t REG_DWORD /d "1" /f
2⤵
PID:1844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_ar.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_ar.dll"
2⤵
PID:560

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_bg.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_bg.dll"
2⤵
PID:4972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_cs.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_cs.dll"
2⤵
PID:4920

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_da.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_da.dll"
2⤵
PID:1128

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_de.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_de.dll"
2⤵
PID:4872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_el.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_el.dll"
2⤵
PID:4560

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_en.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_en.dll"
2⤵
PID:488

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_es.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_es.dll"
2⤵
PID:1712

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_fi.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_fi.dll"
2⤵
PID:2012

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_fr.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_fr.dll"
2⤵
PID:1676

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_he.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_he.dll"
2⤵
PID:2748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_hr.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_hr.dll"
2⤵
PID:1740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_hu.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_hu.dll"
2⤵
PID:212

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_id.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_id.dll"
2⤵
PID:4452

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_it.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_it.dll"
2⤵
PID:3288

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_ja.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_ja.dll"
2⤵
PID:1328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_ko.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_ko.dll"
2⤵
PID:3304

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_lt.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_lt.dll"
2⤵
PID:4856

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_nl.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_nl.dll"
2⤵
PID:1160

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_no.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_no.dll"
2⤵
PID:2608

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_pl.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_pl.dll"
2⤵
PID:4184

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_pt.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_pt.dll"
2⤵
PID:484

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_ro.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_ro.dll"
2⤵
PID:4476

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_ru.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_ru.dll"
2⤵
PID:4068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_sk.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_sk.dll"
2⤵
PID:4220

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_sr.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_sr.dll"
2⤵
PID:4516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_sv.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_sv.dll"
2⤵
PID:2808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_th.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_th.dll"
2⤵
PID:5060

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_tr.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_tr.dll"
2⤵
PID:4940

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_uk.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_uk.dll"
2⤵
PID:5064

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_vi.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_vi.dll"
2⤵
PID:1156

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_zhCN.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_zhCN.dll"
2⤵
PID:1576

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_zhTW.dll" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Resource_zhTW.dll"
2⤵
PID:4200

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c If Exist "C:\Users\Admin\AppData\Local\Temp\TV.ini" xcopy /y "C:\Users\Admin\AppData\Local\Temp\TV.ini"
2⤵
PID:5044

C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer.exe
"C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4688

C:\Users\Admin\AppData\Local\Temp\TVQS\tv_w32.exe
"C:\Users\Admin\AppData\Local\Temp\TVQS\tv_w32.exe" --action hooks --log
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3376

C:\Users\Admin\AppData\Local\Temp\TVQS\tv_x64.exe
"C:\Users\Admin\AppData\Local\Temp\TVQS\tv_x64.exe" --action hooks --log
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1532

C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer_Desktop.exe
"C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer_Desktop.exe" --IPCport 6039 --Module 2
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4604

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 1000 -ip 1000
1⤵
PID:1284

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1000 -s 2212
1⤵
- Program crash
PID:4560

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
- Loads dropped DLL
PID:5096

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\TeamViewer\Logs\TeamViewer15_Logfile.log
Filesize
391B

MD5
aded480e5f244b05d9b8d79072e09e04

SHA1
1fae75a275a821a705bcd002c21b720eb22c885e

SHA256
e2613c1baa794e7f07fff5963496a70748365fe4197cf58a3d15d1719f367480

SHA512
e4d296fd76fb44834063f3fc1679e2011415088c28387f12874d7f7dd5cff9ed0af1c38c7fd25e51235ab3b73dac72afd349148cab32d4778935f25c026c8cd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TV_w32.dll
Filesize
461KB

MD5
4db714b835887b461502b59d26ca5da4

SHA1
f10973946a0b71ca8172c98cb1ed90dfb68c73fa

SHA256
0ba8518fdf777106ecd95a5e1161c548eda18a60d4430839fd0eef81d64444b2

SHA512
ebca17879c08ee66936bfdc7a2f52cd7ba854338db5f34f1ceb7584e829bf45c1f5ff6ace233904ba72443be26a8c303da20f985a52a0dfa9afe9c416733b242

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TV_w32.exe
Filesize
344KB

MD5
99ea9d4f7d9140cbae1e283d66e290c3

SHA1
2750449dc7a64fa0db23af514cdd7a3f911f99e8

SHA256
017752a016adac8ea2b22d780dd1c47e63ece0e796144dd7a2bd92ddb0e2ae32

SHA512
42c5e72abf234afe15c09ade471fc839feafd4b7de656a49e73e83131245365a81aef5b9b04519221c1f07b5f5113a67d6e8c33b8e856f523e2ad72a445a28fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TV_x64.dll
Filesize
591KB

MD5
44a73603bb2215fb97a9f1dc39d331aa

SHA1
c71a32d6ef76603e1c2a5b700db1042cc7f68c55

SHA256
d85dfbd4ec0f7a354ac42aff78eacecb3b1145d9c833d42f5f4c51b357ccfe39

SHA512
fc7d936244638c6b5abc5a1ac6eba05e46ee6e78e7d4f72fdb096738abfc40a8a1798a341ccb8b85ab7779c4dd7c5842fe51a84105a2bfaab721cc3037c807de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TV_x64.exe
Filesize
406KB

MD5
7a9b48a0fb4a26707f3d395238e985b3

SHA1
b18a439ed9e92862b87a847c266904ebf63500f9

SHA256
8ce44458d394a7e5e644463a615009622788c8a9f2c8cadce0a0e3dc4199eafb

SHA512
6dab7156c822000a89afbb1daa23c4a270d32395772ee952715ec5bec1c356bb90a8b222cec048636077587d3ae44991e22fa709cdf338b01f9c89534bc0f9f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer.exe
Filesize
53.1MB

MD5
d0c78fb70e3101dbfccfa332616b4cd2

SHA1
fdeff80960bbc1d8379f2eb9bd731319facdaba9

SHA256
94999ca2ed2bb4539b40e9df558cd0a6e99cb4d1f7d7e5f49e718562a9549ff6

SHA512
fb8901c7d6e09dd6a64b2483698239e7c63c5fbf2e2ff6efacce3300fd291fa3b36e3362eaa613d0d656db21f6a5482143085e0b36c3185f5544ec111d537b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer.exe
Filesize
53.1MB

MD5
d0c78fb70e3101dbfccfa332616b4cd2

SHA1
fdeff80960bbc1d8379f2eb9bd731319facdaba9

SHA256
94999ca2ed2bb4539b40e9df558cd0a6e99cb4d1f7d7e5f49e718562a9549ff6

SHA512
fb8901c7d6e09dd6a64b2483698239e7c63c5fbf2e2ff6efacce3300fd291fa3b36e3362eaa613d0d656db21f6a5482143085e0b36c3185f5544ec111d537b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer.exe
Filesize
53.1MB

MD5
d0c78fb70e3101dbfccfa332616b4cd2

SHA1
fdeff80960bbc1d8379f2eb9bd731319facdaba9

SHA256
94999ca2ed2bb4539b40e9df558cd0a6e99cb4d1f7d7e5f49e718562a9549ff6

SHA512
fb8901c7d6e09dd6a64b2483698239e7c63c5fbf2e2ff6efacce3300fd291fa3b36e3362eaa613d0d656db21f6a5482143085e0b36c3185f5544ec111d537b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer_Desktop.exe
Filesize
12.8MB

MD5
6116d06a287fafa9af7fdc844ae5c037

SHA1
568edf7f3beaf01cd36094da79ca291bcc0ab2bd

SHA256
5aff2e9f62844ee25cbbd479573d137c4b4b5518ffb8c04295ecd7e1a0055bee

SHA512
7aa5b3c855162ffc3be49493e47341efadd60b9f3cfb5c2239d7b7231c38264d9656cb7fc72b75ea4d113b262b334b1e25a2701e78f781ab43072db159d30de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer_Desktop.exe
Filesize
12.8MB

MD5
6116d06a287fafa9af7fdc844ae5c037

SHA1
568edf7f3beaf01cd36094da79ca291bcc0ab2bd

SHA256
5aff2e9f62844ee25cbbd479573d137c4b4b5518ffb8c04295ecd7e1a0055bee

SHA512
7aa5b3c855162ffc3be49493e47341efadd60b9f3cfb5c2239d7b7231c38264d9656cb7fc72b75ea4d113b262b334b1e25a2701e78f781ab43072db159d30de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer_Resource_de.dll
Filesize
443KB

MD5
7a700e7efbb994a76d6bebb06e48f8d4

SHA1
6badd718c740eb93e721b565d1ff2f91c207e145

SHA256
8830b028956be3246f72d2867b0a75c3d911dce0d1948136b10d8dc56d419e0a

SHA512
89f2fad2db0ffbcd56e3696365cdac4e40eb12b89cf875666f2926ad2e11942da111d3487e954fda6c7ec289215654a31ad81728d5f0de88bbf6138fa537d2f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer_Resource_en.dll
Filesize
388KB

MD5
2fc876a38488193bf2e6856ee336307e

SHA1
22c1ea65bab6150530aa12b4156a4ec0e6514fb2

SHA256
d267f4e23374b83bc55cbdb136fec88aba2bb2bb38fc83349a7bf0e12a85abff

SHA512
5b078790b0126149da01516cd7359b9b9ebaf9aa19810626523133686e56268f3d79ec3a84221d4f74df719e110de91c8f4497b158213cc7a0ad324d4ce7fcdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\TeamViewer_StaticRes.dll
Filesize
7.8MB

MD5
c867fd0fc3fce9baf86aff1337575ca4

SHA1
77473731e5cfca510ef89dc9f3840f7d2847a12b

SHA256
5709f1dfe6d8e595b39fcad011908bba43b0c4fa4e4d4eac90900337fa77c55b

SHA512
40d72b568dbbcaaa3b140a169c8487ac622171a464a3510214d3d483502119e9ce4a17f4f06c3f8c22394dafca3fb3c8007123e4e1c4c3807a2897dc263c1c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\tv_w32.dll
Filesize
461KB

MD5
4db714b835887b461502b59d26ca5da4

SHA1
f10973946a0b71ca8172c98cb1ed90dfb68c73fa

SHA256
0ba8518fdf777106ecd95a5e1161c548eda18a60d4430839fd0eef81d64444b2

SHA512
ebca17879c08ee66936bfdc7a2f52cd7ba854338db5f34f1ceb7584e829bf45c1f5ff6ace233904ba72443be26a8c303da20f985a52a0dfa9afe9c416733b242

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\tv_w32.dll
Filesize
461KB

MD5
4db714b835887b461502b59d26ca5da4

SHA1
f10973946a0b71ca8172c98cb1ed90dfb68c73fa

SHA256
0ba8518fdf777106ecd95a5e1161c548eda18a60d4430839fd0eef81d64444b2

SHA512
ebca17879c08ee66936bfdc7a2f52cd7ba854338db5f34f1ceb7584e829bf45c1f5ff6ace233904ba72443be26a8c303da20f985a52a0dfa9afe9c416733b242

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\tv_w32.dll
Filesize
461KB

MD5
4db714b835887b461502b59d26ca5da4

SHA1
f10973946a0b71ca8172c98cb1ed90dfb68c73fa

SHA256
0ba8518fdf777106ecd95a5e1161c548eda18a60d4430839fd0eef81d64444b2

SHA512
ebca17879c08ee66936bfdc7a2f52cd7ba854338db5f34f1ceb7584e829bf45c1f5ff6ace233904ba72443be26a8c303da20f985a52a0dfa9afe9c416733b242

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\tv_w32.exe
Filesize
344KB

MD5
99ea9d4f7d9140cbae1e283d66e290c3

SHA1
2750449dc7a64fa0db23af514cdd7a3f911f99e8

SHA256
017752a016adac8ea2b22d780dd1c47e63ece0e796144dd7a2bd92ddb0e2ae32

SHA512
42c5e72abf234afe15c09ade471fc839feafd4b7de656a49e73e83131245365a81aef5b9b04519221c1f07b5f5113a67d6e8c33b8e856f523e2ad72a445a28fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\tv_x64.dll
Filesize
591KB

MD5
44a73603bb2215fb97a9f1dc39d331aa

SHA1
c71a32d6ef76603e1c2a5b700db1042cc7f68c55

SHA256
d85dfbd4ec0f7a354ac42aff78eacecb3b1145d9c833d42f5f4c51b357ccfe39

SHA512
fc7d936244638c6b5abc5a1ac6eba05e46ee6e78e7d4f72fdb096738abfc40a8a1798a341ccb8b85ab7779c4dd7c5842fe51a84105a2bfaab721cc3037c807de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\tv_x64.dll
Filesize
591KB

MD5
44a73603bb2215fb97a9f1dc39d331aa

SHA1
c71a32d6ef76603e1c2a5b700db1042cc7f68c55

SHA256
d85dfbd4ec0f7a354ac42aff78eacecb3b1145d9c833d42f5f4c51b357ccfe39

SHA512
fc7d936244638c6b5abc5a1ac6eba05e46ee6e78e7d4f72fdb096738abfc40a8a1798a341ccb8b85ab7779c4dd7c5842fe51a84105a2bfaab721cc3037c807de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\tv_x64.dll
Filesize
591KB

MD5
44a73603bb2215fb97a9f1dc39d331aa

SHA1
c71a32d6ef76603e1c2a5b700db1042cc7f68c55

SHA256
d85dfbd4ec0f7a354ac42aff78eacecb3b1145d9c833d42f5f4c51b357ccfe39

SHA512
fc7d936244638c6b5abc5a1ac6eba05e46ee6e78e7d4f72fdb096738abfc40a8a1798a341ccb8b85ab7779c4dd7c5842fe51a84105a2bfaab721cc3037c807de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\tv_x64.dll
Filesize
591KB

MD5
44a73603bb2215fb97a9f1dc39d331aa

SHA1
c71a32d6ef76603e1c2a5b700db1042cc7f68c55

SHA256
d85dfbd4ec0f7a354ac42aff78eacecb3b1145d9c833d42f5f4c51b357ccfe39

SHA512
fc7d936244638c6b5abc5a1ac6eba05e46ee6e78e7d4f72fdb096738abfc40a8a1798a341ccb8b85ab7779c4dd7c5842fe51a84105a2bfaab721cc3037c807de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\tv_x64.dll
Filesize
591KB

MD5
44a73603bb2215fb97a9f1dc39d331aa

SHA1
c71a32d6ef76603e1c2a5b700db1042cc7f68c55

SHA256
d85dfbd4ec0f7a354ac42aff78eacecb3b1145d9c833d42f5f4c51b357ccfe39

SHA512
fc7d936244638c6b5abc5a1ac6eba05e46ee6e78e7d4f72fdb096738abfc40a8a1798a341ccb8b85ab7779c4dd7c5842fe51a84105a2bfaab721cc3037c807de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\tv_x64.dll
Filesize
591KB

MD5
44a73603bb2215fb97a9f1dc39d331aa

SHA1
c71a32d6ef76603e1c2a5b700db1042cc7f68c55

SHA256
d85dfbd4ec0f7a354ac42aff78eacecb3b1145d9c833d42f5f4c51b357ccfe39

SHA512
fc7d936244638c6b5abc5a1ac6eba05e46ee6e78e7d4f72fdb096738abfc40a8a1798a341ccb8b85ab7779c4dd7c5842fe51a84105a2bfaab721cc3037c807de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVQS\tv_x64.exe
Filesize
406KB

MD5
7a9b48a0fb4a26707f3d395238e985b3

SHA1
b18a439ed9e92862b87a847c266904ebf63500f9

SHA256
8ce44458d394a7e5e644463a615009622788c8a9f2c8cadce0a0e3dc4199eafb

SHA512
6dab7156c822000a89afbb1daa23c4a270d32395772ee952715ec5bec1c356bb90a8b222cec048636077587d3ae44991e22fa709cdf338b01f9c89534bc0f9f1

Download Submit