quasar | 773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd

Analysis

max time kernel
150s
max time network
159s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
Size

72.2MB
MD5

33c2adebfe2c3acedfb34ffff8151b7d
SHA1

8e93f7ecafa92017a7d528423574ab5cfeec754a
SHA256

773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd
SHA512

6f545b4da55412ec78de6d1c3bddbcc6bb857b7d13b15fe4bb832259dbe1842d44a02b46395233c23ca57abd34239226a60c9f7ee26fcf82ba383a836f8d61ad
SSDEEP

1572864:yIWs/6+mI5n17YTIytz8ATFiQiFGaaoE13gIFxXtzM/zMfCOA6Z:ssJmIBiTvR8UFiQYGvoq35FVEeCOr

Score

10^/10

quasar office04 discovery persistence privilege_escalation spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

167.71.56.116:22269

Mutex

3470ac31-30aa-4cf6-ab0a-1ed0dd64656f

Attributes

encryption_key
33E08519CDBEF59C54E93052681A76D1969C659E
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015fa6-1330.dat	family_quasar
behavioral1/memory/2836-1334-0x00000000008F0000-0x0000000000C14000-memory.dmp	family_quasar

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00050000000192a1-1657.dat	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 17 IoCs

pid	Process
2836	Client-built.exe
2992	TeamViewer_Setup_x64.exe
1756	TeamViewer_.exe
1736	TeamViewer_Service.exe
1876	TeamViewer.exe
2912	crashpad_handler.exe
2312	MicrosoftEdgeWebview2Setup.exe
2016	MicrosoftEdgeUpdate.exe
2896	MicrosoftEdgeUpdate.exe
1664	MicrosoftEdgeUpdate.exe
2976	MicrosoftEdgeUpdateComRegisterShell64.exe
2396	MicrosoftEdgeUpdateComRegisterShell64.exe
2936	MicrosoftEdgeUpdateComRegisterShell64.exe
1808	MicrosoftEdgeUpdate.exe
2696	MicrosoftEdgeUpdate.exe
1016	MicrosoftEdgeUpdate.exe
2584	MicrosoftEdgeUpdate.exe

Loads dropped DLL 64 IoCs

pid	Process
2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
2992	TeamViewer_Setup_x64.exe
2992	TeamViewer_Setup_x64.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1756-1658-0x0000000074EE0000-0x0000000074EEA000-memory.dmp	upx
behavioral1/files/0x00050000000192a1-1657.dat	upx
behavioral1/memory/1756-1770-0x0000000074EE0000-0x0000000074EEA000-memory.dmp	upx
behavioral1/memory/1756-2747-0x0000000074EE0000-0x0000000074EEA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	TeamViewer_.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\TeamViewerVPN.inf	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.ico	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	TeamViewer_.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.cat	TeamViewer_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_ca.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_tt.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd	TeamViewer_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_cs.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.inf	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml	TeamViewer_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_hr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	TeamViewer_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_ml.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_ro.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\tvmonitor.cat	TeamViewer_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.inf	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	TeamViewer_.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\Printer\	TeamViewer_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_am.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_vi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_sl.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewerVPN.inf	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf	TeamViewer_.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\outlook\	TeamViewer_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_hi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_is.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat	TeamViewer_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_uk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_eu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_sr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_bs.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\MicrosoftEdgeUpdateOnDemand.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_zh-CN.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_mk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_ne.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	TeamViewer_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_fi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_ka.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml	TeamViewer_.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\NOTICE.TXT	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_de.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_fr-CA.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_pt-PT.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\msedgeupdateres_lo.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	TeamViewer_.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	TeamViewer_.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	TeamViewer_.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	TeamViewer_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer_Setup_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1808	MicrosoftEdgeUpdate.exe
2584	MicrosoftEdgeUpdate.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\WpadDecision = "0"	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-ec-be-78-d7-0f\WpadDecisionTime = 704fdf0d634adb01	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\WpadDecisionTime = b09c6c11634adb01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\WpadDecisionTime = 704fdf0d634adb01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-ec-be-78-d7-0f\WpadDecisionReason = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-ec-be-78-d7-0f\WpadDecision = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\WpadNetworkName = "Network 3"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\9a-ec-be-78-d7-0f	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\WpadDecisionReason = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\WpadDecisionTime = 304a5807634adb01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-ec-be-78-d7-0f	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-ec-be-78-d7-0f\WpadDetectedUrl	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-ec-be-78-d7-0f\WpadDecisionTime = b09c6c11634adb01	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDAE441E-F0FD-4C2A-8BF7-1451FCDFAE16}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{877D726A-5456-4171-9CDB-0DAB3AFFE07F}\LocalServer32\ = "\"C:\\Program Files\\TeamViewer\\TeamViewer.exe\""	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tvcontrol1\shell\open\command\ = "\"C:\\Program Files\\TeamViewer\\TeamViewer.exe\" \"%1\""	TeamViewer_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{877D726A-5456-4171-9CDB-0DAB3AFFE07F}\TypeLib	TeamViewer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F274CC23-5456-42B2-AC7A-5C5EA0D6EFBC}	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F274CC23-5456-42B2-AC7A-5C5EA0D6EFBC}\ProxyStubClsid32	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tvvpn1\shell\open\command	TeamViewer_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tvvideocall1\URL Protocol = "\"\""	TeamViewer_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D399478A-5456-4112-B963-38E6C8AA1217}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B1BD342-5456-4F9F-A027-1BA0254C8C0A}\TypeLib\Version = "1.2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewer.Application\ = "TeamViewer Application Class"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2d702e20-b8a1-4c0b-a218-32223ce86ea1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{457E4C9C-5456-471C-8A3C-F3BFC8DF242C}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewer.Application.1\ = "TeamViewer Application Class v1"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewerSession\DefaultIcon\ = "\"C:\\Program Files\\TeamViewer\\TeamViewer.exe\",0"	TeamViewer_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tvvpn1\URL Protocol = "\"\""	TeamViewer_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.45\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95C0F21E-5456-4891-B9F6-014E98858D0B}\TypeLib\Version = "1.2"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDAE441E-F0FD-4C2A-8BF7-1451FCDFAE16}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.45\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95C0F21E-5456-4891-B9F6-014E98858D0B}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14B59F6C-4FF8-4AD9-BA71-D65FDF7AEC3B}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{550C2D70-5456-4990-A6B2-20E1EF1C8EBC}\TypeLib\Version = "1.2"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ = "Update3COMClass"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CurVer\ = "MicrosoftEdgeUpdate.CoreMachineClass.1"	MicrosoftEdgeUpdate.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	TeamViewer_Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	TeamViewer_Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	TeamViewer_Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	TeamViewer_Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	TeamViewer_Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	TeamViewer_Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	TeamViewer_Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	TeamViewer_Service.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
1756	TeamViewer_.exe
2016	MicrosoftEdgeUpdate.exe
2016	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
Token: SeDebugPrivilege	2836	Client-built.exe
Token: SeRestorePrivilege	1756	TeamViewer_.exe
Token: SeDebugPrivilege	2016	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	Client-built.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2836	Client-built.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2836	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe	31
PID 2100 wrote to memory of 2836	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe	31
PID 2100 wrote to memory of 2836	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe	31
PID 2100 wrote to memory of 2836	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe	31
PID 2100 wrote to memory of 2992	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe	32
PID 2100 wrote to memory of 2992	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe	32
PID 2100 wrote to memory of 2992	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe	32
PID 2100 wrote to memory of 2992	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe	32
PID 2100 wrote to memory of 2992	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe	32
PID 2100 wrote to memory of 2992	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe	32
PID 2100 wrote to memory of 2992	2100	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe	32
PID 2992 wrote to memory of 1756	2992	TeamViewer_Setup_x64.exe	33
PID 2992 wrote to memory of 1756	2992	TeamViewer_Setup_x64.exe	33
PID 2992 wrote to memory of 1756	2992	TeamViewer_Setup_x64.exe	33
PID 2992 wrote to memory of 1756	2992	TeamViewer_Setup_x64.exe	33
PID 2992 wrote to memory of 1756	2992	TeamViewer_Setup_x64.exe	33
PID 2992 wrote to memory of 1756	2992	TeamViewer_Setup_x64.exe	33
PID 2992 wrote to memory of 1756	2992	TeamViewer_Setup_x64.exe	33
PID 1756 wrote to memory of 3040	1756	TeamViewer_.exe	34
PID 1756 wrote to memory of 3040	1756	TeamViewer_.exe	34
PID 1756 wrote to memory of 3040	1756	TeamViewer_.exe	34
PID 1756 wrote to memory of 3040	1756	TeamViewer_.exe	34
PID 1756 wrote to memory of 1736	1756	TeamViewer_.exe	36
PID 1756 wrote to memory of 1736	1756	TeamViewer_.exe	36
PID 1756 wrote to memory of 1736	1756	TeamViewer_.exe	36
PID 1756 wrote to memory of 1736	1756	TeamViewer_.exe	36
PID 1756 wrote to memory of 1876	1756	TeamViewer_.exe	39
PID 1756 wrote to memory of 1876	1756	TeamViewer_.exe	39
PID 1756 wrote to memory of 1876	1756	TeamViewer_.exe	39
PID 1756 wrote to memory of 1876	1756	TeamViewer_.exe	39
PID 1876 wrote to memory of 2912	1876	TeamViewer.exe	40
PID 1876 wrote to memory of 2912	1876	TeamViewer.exe	40
PID 1876 wrote to memory of 2912	1876	TeamViewer.exe	40
PID 1756 wrote to memory of 1796	1756	TeamViewer_.exe	41
PID 1756 wrote to memory of 1796	1756	TeamViewer_.exe	41
PID 1756 wrote to memory of 1796	1756	TeamViewer_.exe	41
PID 1756 wrote to memory of 1796	1756	TeamViewer_.exe	41
PID 1756 wrote to memory of 1796	1756	TeamViewer_.exe	41
PID 1756 wrote to memory of 1796	1756	TeamViewer_.exe	41
PID 1756 wrote to memory of 1796	1756	TeamViewer_.exe	41
PID 1756 wrote to memory of 1048	1756	TeamViewer_.exe	42
PID 1756 wrote to memory of 1048	1756	TeamViewer_.exe	42
PID 1756 wrote to memory of 1048	1756	TeamViewer_.exe	42
PID 1756 wrote to memory of 1048	1756	TeamViewer_.exe	42
PID 1756 wrote to memory of 2312	1756	TeamViewer_.exe	44
PID 1756 wrote to memory of 2312	1756	TeamViewer_.exe	44
PID 1756 wrote to memory of 2312	1756	TeamViewer_.exe	44
PID 1756 wrote to memory of 2312	1756	TeamViewer_.exe	44
PID 1756 wrote to memory of 2312	1756	TeamViewer_.exe	44
PID 1756 wrote to memory of 2312	1756	TeamViewer_.exe	44
PID 1756 wrote to memory of 2312	1756	TeamViewer_.exe	44
PID 2312 wrote to memory of 2016	2312	MicrosoftEdgeWebview2Setup.exe	45
PID 2312 wrote to memory of 2016	2312	MicrosoftEdgeWebview2Setup.exe	45
PID 2312 wrote to memory of 2016	2312	MicrosoftEdgeWebview2Setup.exe	45
PID 2312 wrote to memory of 2016	2312	MicrosoftEdgeWebview2Setup.exe	45
PID 2312 wrote to memory of 2016	2312	MicrosoftEdgeWebview2Setup.exe	45
PID 2312 wrote to memory of 2016	2312	MicrosoftEdgeWebview2Setup.exe	45
PID 2312 wrote to memory of 2016	2312	MicrosoftEdgeWebview2Setup.exe	45
PID 2016 wrote to memory of 2896	2016	MicrosoftEdgeUpdate.exe	46
PID 2016 wrote to memory of 2896	2016	MicrosoftEdgeUpdate.exe	46
PID 2016 wrote to memory of 2896	2016	MicrosoftEdgeUpdate.exe	46
PID 2016 wrote to memory of 2896	2016	MicrosoftEdgeUpdate.exe	46
PID 2016 wrote to memory of 2896	2016	MicrosoftEdgeUpdate.exe	46
PID 2016 wrote to memory of 2896	2016	MicrosoftEdgeUpdate.exe	46

C:\Users\Admin\AppData\Local\Temp\33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
"C:\Users\Admin\AppData\Local\Temp\33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2836
- C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup_x64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\nse8B21.tmp\nse8B70\TeamViewer_.exe
    "C:\Users\Admin\AppData\Local\Temp\nse8B21.tmp\nse8B70\TeamViewer_.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\SysWOW64\schtasks.exe
      C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3040
  - - C:\Program Files\TeamViewer\TeamViewer_Service.exe
      "C:\Program Files\TeamViewer\TeamViewer_Service.exe" -install
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      PID:1736
  - - C:\Program Files\TeamViewer\TeamViewer.exe
      "C:\Program Files\TeamViewer\TeamViewer.exe" api --install
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1876
    - - C:\Program Files\TeamViewer\crashpad_handler.exe
        
        "C:\Program Files\TeamViewer\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\TeamViewer\Logs\ErrorReports --metrics-dir=C:\Users\Admin\AppData\Local\TeamViewer\Logs\ErrorReports --url=https://errorreporting.teamviewer.com:443/api/3/minidump/?sentry_client=sentry.native/0.4.17&sentry_key=ab2b65e79a501de39a5e47e7bc23e13b --attachment=C:\Users\Admin\AppData\Local\TeamViewer\Logs\ErrorReports\e2787600-e26f-4fd0-65b9-6130c864d62e.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\TeamViewer\Logs\ErrorReports\e2787600-e26f-4fd0-65b9-6130c864d62e.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\TeamViewer\Logs\ErrorReports\e2787600-e26f-4fd0-65b9-6130c864d62e.run\__sentry-breadcrumb2 --initial-client-data=0x1cc,0x1d0,0x1d4,0x1a0,0x1d8,0x1442bd8d8,0x1442bd8f0,0x1442bd908
        5⤵
        Executes dropped EXE
        
        PID:2912
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\TeamViewer\outlook\TeamViewerMeetingAddinShim.dll"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1796
  - - C:\Windows\SysWOW64\schtasks.exe
      C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1048
  - - C:\Program Files\TeamViewer\utils\MicrosoftEdgeWebview2Setup.exe
      "C:\Program Files\TeamViewer\utils\MicrosoftEdgeWebview2Setup.exe" /install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EUE437.tmp\MicrosoftEdgeUpdate.exe" /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Checks system information in the registry
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2016
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2896
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1664
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2976
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2396
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2936
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEZGRDM3OTEtNDg0My00ODBDLTg4MDktRjRFM0FENEVDNTg4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBNTYyMENCQi0zRTg3LTRDRjEtODg4OS0xQ0VCRDE4RjU3NTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE3My40NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMzE2NDg0MjAwMCIgaW5zdGFsbF90aW1lX21zPSI4MTEiLz48L2FwcD48L3JlcXVlc3Q-
        6⤵
        Executes dropped EXE
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1808
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{4FFD3791-4843-480C-8809-F4E3AD4EC588}"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2696

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
PID:1016
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEZGRDM3OTEtNDg0My00ODBDLTg4MDktRjRFM0FENEVDNTg4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszQ0VGNTlBMy1BMUMxLTRBODAtQUMzNi0wQzdERkQxRjRDRTV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjMxNjc2NTAwMDAiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
ae0bd70d0d7e467457b9e39b29f78410

SHA1
b4a549508cbc9f975a191434d4d20ad3c28d5028

SHA256
4d9f16b00bda1db65b68cb486f7ae1bf5b32aedf7fd335e4a8ef2fa087870986

SHA512
cbe2b5ffe647f5318edd9825ea6536d6d14dab66920def0323fb5b4dc03a4f8b6781b9209e5a557ab4d270b3f2b170797e6bd807195c93869367c0a245a3168e

Download Submit
C:\Program Files\TeamViewer\utils\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
b32d72daeee036e2b8f1c57e4a40e87a

SHA1
564caa330d077a3d26691338b3e38ee4879a929d

SHA256
65f6efdf6df4095971a95f4bf387590ae63109388344632a22458265ab7dd289

SHA512
b5d62ce1462d786c01d38e13d030ad6236ce63321819cf860cc6169f50f6309e627bc7709b305422851779e37dbae9fb358008aad8d6c124cd33cdec730288d5

Download Submit
C:\Program Files\TeamViewer\x64\teamviewervpn.sys

Filesize
34KB

MD5
f5520dbb47c60ee83024b38720abda24

SHA1
bc355c14a2b22712b91ff43cd4e046489a91cae5

SHA256
b8e555d92440bf93e3b55a66e27cef936477ef7528f870d3b78bd3b294a05cc0

SHA512
3c5bb212467d932f5eaa17a2346ef8f401a49760c9c6c89c6318a1313fcbabb1d43b1054692c01738ea6a3648cc57e06845b81becb3069f478d5b1a7cbcb0e66

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
0ad0bfb27b9a86eb7293aa63145eeb0e

SHA1
49bfac42a462228bb24b83110a497b4cefbee8fa

SHA256
9b7b1b14a17e92691b356beed4689e5336f624bd252bd342aaa74b61fce0f4b9

SHA512
6eafeb5288c404152e306278781bd18a89eb2eb3d8a41d3d0b43b4b0dda8c54ba8651c22d005eb3f808c1d21669fb284cbdf4eecc6b638f9c226a323a136907a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD329.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD399.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse8B21.tmp\nse8B70\TV15Install.log

Filesize
4KB

MD5
b702bd5fe3d60714b7a71669238d89cc

SHA1
bf8aadc284f9902312e03cf74d1ff7c7db4c417c

SHA256
977eb23b621bd5c48d04ab29395e425e510bc1d29ff5fe14d188965970671ae0

SHA512
fdb1306c689d3304f562fcc632b941b23973a9d9498c8fc2da31385b8ec03a7f6cc482654a33660076f8b6a43644ea67bde7904c17f2fd3e2ac0f5661819b01c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse8B21.tmp\nse8B70\install.ini

Filesize
78B

MD5
a3c26dd25fc88922e9297e2a9d04ac53

SHA1
807b0ca16c4080b6ce7ae8b09e7dcce7e52d5c19

SHA256
1c5231379c3025a42d51f956f649c445ebc550f9ad9b9f5cc4ae5e627ef456b3

SHA512
1d36ee7b43d82b72000520c0b0c37585576363fcd506aeab362c544000b0bf9702a357e118b2ae3499d8f8c9a7529f56169cc14e5281a5246ae9efd342c4fa59

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse8B21.tmp\nse8B70\tvinfo.ini

Filesize
50B

MD5
a48b05e8e36f7f4e9096ade8950b87e4

SHA1
c743c68fb5798389435927338d1c8ed1c59496a2

SHA256
72935bcb05a31b405a0e4a13eb0babd1640bbe03fad52ff85ffa91390d0e8eee

SHA512
7943a5c44c136347f199a1a3e1aa8af3f4ee9d5024d4588e3faa95f57dcd51292e606a057d567d45c8bc9d62ebfcfebd199654d1f1214b205124418c592f47f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse935C.tmp\advanced_unicode.ini

Filesize
1KB

MD5
f68824a4130ebaf6bc7ab0f62256d7d7

SHA1
40af19a0d92b3c9e1a8b1eaab7d12c69e5df436a

SHA256
cd8149a2e89373075ee6db800b7f2496bacbfe21b23e4a06a3453632503b3965

SHA512
6a173aaa183be0e5a516cad484802dae1fc53a414f870f93ea846a9ef9f9df35153766ef632eb5e8ced8f94c2ed09a9decdf3465d46b0dcc44a6918d88e242cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse935C.tmp\start_unicode.ini

Filesize
2KB

MD5
60294004e178148e6dae42d270f25b28

SHA1
5152057cedff1be8d6ff06cd1e3023a763247ca4

SHA256
a656cbd532650ded6b5017d5c54a125182f063f719f32128ea83e04c954cca34

SHA512
eda4567f2d17cdbc396e23bbc1b46c913a951a73afffc8e16d0b3a61cf7a9eae5ed8b7ffb331c045c8bc205299275a9d98dbb9c0097ffc6c85a6134f0a4d58c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse935C.tmp\start_unicode.ini

Filesize
2KB

MD5
9d09b46b3f408fd8ff0298102e0b972a

SHA1
ee1dae451617dc8fd9359b75a28fbf22d77982f2

SHA256
cce8aac99b927e1f59108bbdffdc3d2f1496b5e982f75c40e4ce4d72ea9e4598

SHA512
257c466c342387b20f8046e81afb94ac495ea474f93705f9b025398fe567f88ff96354c5324f98f9efef922c54574628c51f57d42a2f3e167eefac33a29ea068

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse935C.tmp\start_unicode.ini

Filesize
2KB

MD5
3e3cadc9987249f8fcf8747cc0e81d78

SHA1
cc8d0c99cbda86dc3c2c3eace89855f60ef55970

SHA256
dbf3e6b90983b9ce7750c944f2dc420abe003956afd6b5b4679a1e0b2ca416c3

SHA512
9ce106b6917535fa0e2bc39a4219814ee25cea5363d3d7932668bee5a5ee0bab2411b7f671e22ea952b3028dd8449ed205f4805e014e00f297d265b6b913eef5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7bb951b0a321a431218756efb4f79d76

SHA1
b0ed18f9d42d59d43062be6bf112e7d43c45d3e6

SHA256
f4e07306034db04ee62d635e03948cb3f8536d713f4ff8daaa9882091eee0a07

SHA512
6f2609bbf9f1e6069ff6692a065b83c5b3fe9b359b5d42b1bea660939b5904a7c788b6bd6222a166746dd5bafd74c87a6ced0995c03656c81db1bcaa54166760

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2495028eb6941bc498f35b7cc7990b63

SHA1
60e9bd7648a4cbe0103c83c99f8a04687efbaaa8

SHA256
2894a6b7c1fd321f32b897cfd80d7d3653e8767aa85e15e7e01754c291d0206f

SHA512
df794d80e2754a6b239ef8ab645de3733e1bdb451fd7df482cfb8b4baa0daf2571ab339fcea51ed58dd730e3f73331d900edfe639ddfcdb5496e4678405869b1

Download Submit
\Users\Admin\AppData\Local\Temp\Client-built.exe

Filesize
3.1MB

MD5
181719b653c83d0463d89a625a7f5c3e

SHA1
1173005be27979dc74779e60dc790299e4f2b0a4

SHA256
03a4b081b4966130cbe615ff249954e7e9a0d62a79faf8e56ac3830929748e43

SHA512
d05e6fc586a8731903df4cffe3bdcb92f99e2cdbe15e40706e87ecc038e4e9b1ef1fc9a39f8adeda4341e3507f2f8f81ae50d590ff9f4233cd7694b26fb3fa04

Download Submit
\Users\Admin\AppData\Local\Temp\nse8B21.tmp\TvGetVersion.dll

Filesize
686KB

MD5
878c644c12c3d96438c2909fbb7375cd

SHA1
4fb206e213bd088e28a1c10ab815d1bfd1b522f1

SHA256
75cf60d72a2cb6a748db6f69e2bfa065422df7bb6636d3c214f5435341574a66

SHA512
df0d1903901ffaf7ca1ee22cc5b8bac37cb554f78ed07a8ccaf84a2cd6fb7f9ac5599caad83d92079e170190701a9391468331ec8aa562bfdf32376703e05bd8

Download Submit
\Users\Admin\AppData\Local\Temp\nse935C.tmp\InstallOptions.dll

Filesize
27KB

MD5
e87068563fc18e67a78230067cc240e5

SHA1
37cd2cb5581fc575b8c46383d877926bda85883b

SHA256
822f75b69dd87332b5995528771923ec74dc5329c65094bf4e372eb8ef42bb8e

SHA512
dab6b330d73abadb63f6eb02a5bc87ce9b9d1bc64fcb9289581cfc2e04be0254893945b3bdb762b382bb491388e34bc018f098a489908dfbc9feca2a9ba13d5d

Download Submit
\Users\Admin\AppData\Local\Temp\nse935C.tmp\System.dll

Filesize
23KB

MD5
938c37b523d7fc08166e7a5810dd0f8e

SHA1
47b9663e5873669211655e0010e322f71b5a94be

SHA256
a91aa7c0ead677fc01b1c864e43e0cace110afb072b76ad47f4b3d1563f4dc20

SHA512
77afe83fb4e80a775dae0a54a2f0ff9710c135f9f1cf77396bc08a7fe46b016a8c079b4fa612e764eea5d258703f860688e38b443e33b1f980e04831739517c1

Download Submit
\Users\Admin\AppData\Local\Temp\nse935C.tmp\TvGetVersion.dll

Filesize
696KB

MD5
41c3a6594060581d3bf1a16ed4ae6a72

SHA1
62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47

SHA256
e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83

SHA512
3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd

Download Submit
\Users\Admin\AppData\Local\Temp\nse935C.tmp\UAC.dll

Filesize
29KB

MD5
488819f838abfcad73a2220c151292ee

SHA1
4a0cbd69300694f6dc393436e56a49e27546d0fe

SHA256
b5bb8d301173c4dd2969b1203d2c7d9400ba3f7f2e34ee102905bd2724162430

SHA512
b00d6cf712fe4cefce41479f6e6f4aa5ea006694d10f2837204de5bde1c5a4bef1368f2b0eb4b66d57a66e8ce6dc335fa91e9c8017e8e125c27eb1f5df4de9a0

Download Submit
\Users\Admin\AppData\Local\Temp\nse935C.tmp\UserInfo.dll

Filesize
15KB

MD5
77ff6a927940a0e4b8dc07bdde6ab5db

SHA1
8d0035242289504d050d237f7e3e548c1ddff077

SHA256
e1cb80a23786b02cb2c6a2f9e391b63cbf3ad911e42bbdc14cc6879c84b7404e

SHA512
6a3050dc8e3f4eaaa85a43cdf1ac4f69745c07efe48268103ee7d8927ec574b6866740f95e6b3aff154ba74cd05024223a3ea4957cb773dd065cfd797f8a07e3

Download Submit
\Users\Admin\AppData\Local\Temp\nse935C.tmp\linker.dll

Filesize
56KB

MD5
b05a97bb3f532b7cf57b8eedf198d7af

SHA1
83c13a90f4a3c1c62e132f5f3bc70c97c2ecfc80

SHA256
7817f79bcdf54ef8617f15b5c0b9b92053549d5a51fa280722ee7179311b69a1

SHA512
40706c5fc72198148962d24046722fc5e488c0cc4b3374a9f4b652175919e97a8712e882940db8c26479619a26ec4e2d41744627a9ca52ec7cb1ce4f91d7ee8c

Download Submit
\Users\Admin\AppData\Local\Temp\nse935C.tmp\nsArray.dll

Filesize
18KB

MD5
9761d708ea7c49662a21f6690d439e06

SHA1
b2e757e7eee5c788f16d666fb6cf9d41caccb04b

SHA256
8b8be21fa7bca491c93683c9f84bb49370ca7e1e864bd0658ff9e1d2809b67e4

SHA512
25990a993373009ccbd9e89cae3fc601928121775d0d5fe326c55a305ce8de51f35a2cb160e9dfbf3be82a53ddf7b9864116e7f5d3325afd7403cd3b7740c652

Download Submit
\Users\Admin\AppData\Local\Temp\nse935C.tmp\nsExec.dll

Filesize
18KB

MD5
9ea6ec7934495cc757639b5095362ca7

SHA1
ef2c14142b70689483576cc09083db4a2a363e02

SHA256
4d8c8353641bbb26bf9ea2ab2dbf126be6ef164b1ce80e3ef5030b873be166cd

SHA512
414b08f75bd7febb56784d8534cee028f6420776f07ce5797f66a78748c34b52f443aa35f72c8d7c81dd5366b34998b56d99a9d0d2b4b2b6bfc9775e4ff66531

Download Submit
\Users\Admin\AppData\Local\Temp\nse935C.tmp\nsis7z.dll

Filesize
187KB

MD5
7fe20cee9277556f4ef137e61d29d9f5

SHA1
d53c37dbf548914ed20c8ebb21186a95beef1ee3

SHA256
5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925

SHA512
a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7

Download Submit
memory/1016-3985-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/1016-3996-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/1016-3990-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/1016-3382-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/1016-3901-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/1756-1560-0x00000000003D0000-0x00000000003DE000-memory.dmp

Filesize
56KB

Download
memory/1756-2747-0x0000000074EE0000-0x0000000074EEA000-memory.dmp

Filesize
40KB

Download
memory/1756-1770-0x0000000074EE0000-0x0000000074EEA000-memory.dmp

Filesize
40KB

Download
memory/1756-1759-0x0000000007D50000-0x0000000007D82000-memory.dmp

Filesize
200KB

Download
memory/1756-1658-0x0000000074EE0000-0x0000000074EEA000-memory.dmp

Filesize
40KB

Download
memory/1808-3899-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/1808-3380-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/1876-2322-0x00000000030E0000-0x00000000036C8000-memory.dmp

Filesize
5.9MB

Download
memory/1876-2323-0x00000000030E0000-0x00000000036C8000-memory.dmp

Filesize
5.9MB

Download
memory/2016-3378-0x0000000000FA0000-0x0000000000FD5000-memory.dmp

Filesize
212KB

Download
memory/2016-3379-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/2100-1342-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-1326-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-0-0x00000000747E1000-0x00000000747E2000-memory.dmp

Filesize
4KB

Download
memory/2100-13-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-8-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-5-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-4-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-6-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-10-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-15-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-3-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-2-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-1-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-17-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-1328-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-12-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-1325-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-1324-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-30-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-23-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-124-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-133-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-22-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-19-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2100-43-0x0000000017020000-0x000000001B849000-memory.dmp

Filesize
72.2MB

Download
memory/2584-3902-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/2584-3383-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/2696-3381-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/2696-3989-0x00000000749B0000-0x0000000074BC1000-memory.dmp

Filesize
2.1MB

Download
memory/2836-1334-0x00000000008F0000-0x0000000000C14000-memory.dmp

Filesize
3.1MB

Download