b47c896d78a61fb5bd0f0d2b1b9db6ed2c63a30a78565d234deda49e3f23826a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ING-Antifraude-Windows.exe
Size 41.1MB
Sample260828-aky2dssamh
SHA256 b47c896d78a61fb5bd0f0d2b1b9db6ed2c63a30a78565d234deda49e3f23826a
MD5 ff016f8bb78e6e0e2689b1108f168531
SHA1 3be6b71b77d22d7589c2d20b4a3013b3e9e1cf57
SHA512 49b989cce6d944a87693a296b4bdc510cef146e4e5f088f28dc31d2b9c567e3e85fc60571f25fc95f234dfe8d43e3e4dc2f028092a8c03d35b9e409438d3735a
SSDEEP 786432:kIxgC/eoZBb36qcdH51FB2BuMDbNtBGvtHrk/v0BSYCNT0SGv70m5xo:kIeZWV3Rcdv76DDbDcvNrP8Z4PYYi
TLSH
T10097337C1E305AC7F411A9342872E2CB79235D61A0A9091F6AF139FC2670F94DC9BB76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000700000002470b-186.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	TeamViewer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{5b342390-6d3c-fb4a-882f-ffd35feebbe5}\SETC58D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5b342390-6d3c-fb4a-882f-ffd35feebbe5}\TVVirtualMonitorDriver.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5b342390-6d3c-fb4a-882f-ffd35feebbe5}\SETC58E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5b342390-6d3c-fb4a-882f-ffd35feebbe5}\SETC59F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa\TVVirtualMonitorDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D	TeamViewer_Service.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5b342390-6d3c-fb4a-882f-ffd35feebbe5}\TVVirtualMonitorDriver.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5b342390-6d3c-fb4a-882f-ffd35feebbe5}\SETC59F.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	TeamViewer_Service.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\TeamViewer\DataUploader\tvdatauploader.db-journal	TeamViewer_Service.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5b342390-6d3c-fb4a-882f-ffd35feebbe5}\SETC58E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa\TVVirtualMonitorDriver.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5b342390-6d3c-fb4a-882f-ffd35feebbe5}	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	TeamViewer_Service.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5b342390-6d3c-fb4a-882f-ffd35feebbe5}\TVVirtualMonitorDriver.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa\TVVirtualMonitorDriver.dll	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_CF6A9DE045ED90861ED288C9E06DB80A	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_CF6A9DE045ED90861ED288C9E06DB80A	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A	TeamViewer_Service.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\TeamViewer\DataUploader\tvdatauploader.db	TeamViewer_Service.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5b342390-6d3c-fb4a-882f-ffd35feebbe5}\SETC58D.tmp	DrvInst.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002470b-186.dat	upx
behavioral1/memory/2696-189-0x0000000073D40000-0x0000000073D4A000-memory.dmp	upx
behavioral1/memory/1716-428-0x0000000073D10000-0x0000000073D1A000-memory.dmp	upx
behavioral1/memory/2696-901-0x0000000073D40000-0x0000000073D4A000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\TeamViewerVPN.inf	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\tvfiles_printer_WithPDFSupport_x64.7z	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVHVersion15.txt	TeamViewer_Service.exe
File created	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\CopyrightHOST.txt	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.cat	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\tvfilesx64.7z	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\tvfilesx64.7z	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x86\TVVirtualCamera_x86.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TeamViewer15_Logfile.log	TeamViewer_Service.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.inf	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TeamViewer15_Logfile.log	TeamViewer.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\TV_Audio.cat	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TeamViewer15_Logfile.log	tv_x64.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.inf	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\Printer\	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\tvfiles.7z	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\Printer	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\ErrorReports\Service\d4c0241c-4b76-403c-1345-70d1c7d15f44.run.lock	TeamViewer_Service.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\rolloutfile.tv13	TeamViewer_Service.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\	TeamViewer_.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	ING-Antifraude-Windows.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tv_x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tv_x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe

Executes dropped EXE 10 IoCs

pid	Process
1716	TeamViewer_.exe
4296	TeamViewer_Service.exe
6140	TeamViewer.exe
1020	TeamViewer_Service.exe
3856	tv_x64.exe
5212	tv_x64.exe
1688	TeamViewer_Service.exe
5032	TeamViewer.exe
1500	tv_w32.exe
1620	tv_x64.exe

Loads dropped DLL 64 IoCs

pid	Process
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_w32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ING-Antifraude-Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	tv_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	tv_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tv_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tv_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	tv_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	tv_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tv_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	tv_x64.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A20E949F-5456-4A49-BE51-88077E13F793}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D399478A-5456-4112-B963-38E6C8AA1217}\ = "ITvAddress"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDBA72AF-5456-49B0-875B-F9122A78D9FB}	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewer.Application\CurVer	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A20E949F-5456-4A49-BE51-88077E13F793}\ = "ITvMachineSettings"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{457E4C9C-5456-471C-8A3C-F3BFC8DF242C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{95C0F21E-5456-4891-B9F6-014E98858D0B}\TypeLib\Version = "1.2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC73DAE1-5456-440C-B6EE-0D4A235B71B5}\ = "ITvService"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D399478A-5456-4112-B963-38E6C8AA1217}\ProxyStubClsid32	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F274CC23-5456-42B2-AC7A-5C5EA0D6EFBC}\ProxyStubClsid32	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F274CC23-5456-42B2-AC7A-5C5EA0D6EFBC}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F274CC23-5456-42B2-AC7A-5C5EA0D6EFBC}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14B59F6C-4FF8-4AD9-BA71-D65FDF7AEC3B}\ = "ITvConverter2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DB86189D-5456-4B7B-B5AB-419653E156DD}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EB079FD-5456-432D-BDAB-9B38DF8DD0EE}\ = "ITvMeetingSession"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD9D431B-3B37-4F4A-B676-D43D8AEAD6E2}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDBA72AF-5456-49B0-875B-F9122A78D9FB}\TypeLib\Version = "1.2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{877D726A-5456-4171-9CDB-0DAB3AFFE07F}\VersionIndependentProgID\ = "TeamViewer.Application"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\teamviewer8\shell	ING-Antifraude-Windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tvassign1\URL Protocol = "\"\""	ING-Antifraude-Windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A20E949F-5456-4A49-BE51-88077E13F793}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DB86189D-5456-4B7B-B5AB-419653E156DD}	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DB86189D-5456-4B7B-B5AB-419653E156DD}\TypeLib	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F274CC23-5456-42B2-AC7A-5C5EA0D6EFBC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EB079FD-5456-432D-BDAB-9B38DF8DD0EE}\ProxyStubClsid32	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD9D431B-3B37-4F4A-B676-D43D8AEAD6E2}\ProxyStubClsid32	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewer.Application\ = "TeamViewer Application Class"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tvassign1	ING-Antifraude-Windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A20E949F-5456-4A49-BE51-88077E13F793}\TypeLib\Version = "1.2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EB079FD-5456-432D-BDAB-9B38DF8DD0EE}\ = "ITvMeetingSession"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14B59F6C-4FF8-4AD9-BA71-D65FDF7AEC3B}\TypeLib	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{550C2D70-5456-4990-A6B2-20E1EF1C8EBC}\ = "ITvScheduledMeeting"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDBA72AF-5456-49B0-875B-F9122A78D9FB}\TypeLib	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF93CDAB-5456-4611-AE2C-6F50A41564C1}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{95C0F21E-5456-4891-B9F6-014E98858D0B}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD9D431B-3B37-4F4A-B676-D43D8AEAD6E2}\ = "ITvScheduledMeeting2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\TeamViewer.exe\AppID = "{850A928D-5456-4865-BBE5-42635F1EBCA1}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\teamviewer8\shell\open	ING-Antifraude-Windows.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EB079FD-5456-432D-BDAB-9B38DF8DD0EE}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14B59F6C-4FF8-4AD9-BA71-D65FDF7AEC3B}\TypeLib\Version = "1.2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09183D47-5456-4B6E-BA7E-F170D9F4ABEE}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F5E4D7D-7181-44DC-8407-CAF525D85345}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{877D726A-5456-4171-9CDB-0DAB3AFFE07F}\ProgID\ = "TeamViewer.Application.1"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D399478A-5456-4112-B963-38E6C8AA1217}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14B59F6C-4FF8-4AD9-BA71-D65FDF7AEC3B}	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A20E949F-5456-4A49-BE51-88077E13F793}\ProxyStubClsid32	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F274CC23-5456-42B2-AC7A-5C5EA0D6EFBC}\ProxyStubClsid32	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{95C0F21E-5456-4891-B9F6-014E98858D0B}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewer.Service	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A20E949F-5456-4A49-BE51-88077E13F793}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D399478A-5456-4112-B963-38E6C8AA1217}\TypeLib\Version = "1.2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF93CDAB-5456-4611-AE2C-6F50A41564C1}\ = "ITvVersion"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{457E4C9C-5456-471C-8A3C-F3BFC8DF242C}\ProxyStubClsid32	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B1BD342-5456-4F9F-A027-1BA0254C8C0A}\TypeLib\Version = "1.2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{877D726A-5456-4171-9CDB-0DAB3AFFE07F}\AppID = "{850A928D-5456-4865-BBE5-42635F1EBCA1}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CFDFB010-5456-4D0B-8A07-B55C0B963627}\ProgID	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CFDFB010-5456-4D0B-8A07-B55C0B963627}\ProgID\ = "TeamViewer.Service.1"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F274CC23-5456-42B2-AC7A-5C5EA0D6EFBC}\TypeLib	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{457E4C9C-5456-471C-8A3C-F3BFC8DF242C}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC73DAE1-5456-440C-B6EE-0D4A235B71B5}\ = "ITvService"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A20E949F-5456-4A49-BE51-88077E13F793}\TypeLib	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D399478A-5456-4112-B963-38E6C8AA1217}\TypeLib	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F274CC23-5456-42B2-AC7A-5C5EA0D6EFBC}\ = "ITvSession"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{457E4C9C-5456-471C-8A3C-F3BFC8DF242C}\TypeLib	TeamViewer.exe

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	TeamViewer_Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	TeamViewer_Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	TeamViewer_Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	TeamViewer_Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	TeamViewer_Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	TeamViewer_Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	TeamViewer_Service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	TeamViewer_Service.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1620	schtasks.exe
5100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
1716	TeamViewer_.exe
1716	TeamViewer_.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe
2696	ING-Antifraude-Windows.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeAuditPrivilege	5744	svchost.exe
Token: SeSecurityPrivilege	5744	svchost.exe
Token: SeTcbPrivilege	1688	TeamViewer_Service.exe
Token: SeBackupPrivilege	1688	TeamViewer_Service.exe
Token: SeRestorePrivilege	1688	TeamViewer_Service.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5032	TeamViewer.exe
5032	TeamViewer.exe
5032	TeamViewer.exe
5032	TeamViewer.exe
5032	TeamViewer.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5032	TeamViewer.exe
5032	TeamViewer.exe
5032	TeamViewer.exe
5032	TeamViewer.exe
5032	TeamViewer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5032	TeamViewer.exe
5032	TeamViewer.exe
5032	TeamViewer.exe
5032	TeamViewer.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1620	2696	ING-Antifraude-Windows.exe	88
PID 1716 wrote to memory of 5100	1716	TeamViewer_.exe	94
PID 2696 wrote to memory of 4296	2696	ING-Antifraude-Windows.exe	96
PID 2696 wrote to memory of 6140	2696	ING-Antifraude-Windows.exe	99
PID 2696 wrote to memory of 3856	2696	ING-Antifraude-Windows.exe	104
PID 2696 wrote to memory of 5212	2696	ING-Antifraude-Windows.exe	106
PID 5744 wrote to memory of 3004	5744	svchost.exe	108
PID 2696 wrote to memory of 5408	2696	ING-Antifraude-Windows.exe	109
PID 1688 wrote to memory of 5032	1688	TeamViewer_Service.exe	114
PID 1688 wrote to memory of 1500	1688	TeamViewer_Service.exe	115
PID 1688 wrote to memory of 1620	1688	TeamViewer_Service.exe	116

C:\Users\Admin\AppData\Local\Temp\ING-Antifraude-Windows.exe
"C:\Users\Admin\AppData\Local\Temp\ING-Antifraude-Windows.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1620
- C:\Program Files\TeamViewer\TeamViewer_Service.exe
  "C:\Program Files\TeamViewer\TeamViewer_Service.exe" -install
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:4296
- C:\Program Files\TeamViewer\TeamViewer.exe
  "C:\Program Files\TeamViewer\TeamViewer.exe" api --install
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:6140
- C:\Program Files\TeamViewer\tv_x64.exe
  "C:\Program Files\TeamViewer\tv_x64.exe" --action uninstallpnpdriver --inf "C:\Program Files\TeamViewer\x64\TVVirtualMonitorDriver.inf" --log "C:\Program Files\TeamViewer\TeamViewer15_Hooks.log"
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  PID:3856
- C:\Program Files\TeamViewer\tv_x64.exe
  "C:\Program Files\TeamViewer\tv_x64.exe" --action installpnpdriver --inf "C:\Program Files\TeamViewer\x64\TVVirtualMonitorDriver.inf" --log "C:\Program Files\TeamViewer\TeamViewer15_Hooks.log"
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:5212
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5408

C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5100

C:\Program Files\TeamViewer\TeamViewer_Service.exe
"C:\Program Files\TeamViewer\TeamViewer_Service.exe"
1⤵
- Executes dropped EXE
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{21112c14-c3ff-ac40-8b10-e28d1452ba9c}\TVVirtualMonitorDriver.inf" "9" "4e60e5847" "0000000000000160" "WinSta0\Default" "0000000000000104" "208" "C:\Program Files\TeamViewer\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3004

C:\Program Files\TeamViewer\TeamViewer_Service.exe
"C:\Program Files\TeamViewer\TeamViewer_Service.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files\TeamViewer\TeamViewer.exe
  "C:\Program Files\TeamViewer\TeamViewer.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5032
- C:\Program Files\TeamViewer\tv_w32.exe
  "C:\Program Files\TeamViewer\tv_w32.exe" --log C:\Program Files\TeamViewer\TeamViewer15_Logfile.log --action hooks
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:1500
- C:\Program Files\TeamViewer\tv_x64.exe
  "C:\Program Files\TeamViewer\tv_x64.exe" --log C:\Program Files\TeamViewer\TeamViewer15_Logfile.log --action hooks
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TeamViewer_.exe

Path C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
Size 41.1MB
SHA256 b47c896d78a61fb5bd0f0d2b1b9db6ed2c63a30a78565d234deda49e3f23826a
MD5 ff016f8bb78e6e0e2689b1108f168531
SHA1 3be6b71b77d22d7589c2d20b4a3013b3e9e1cf57
SHA512 49b989cce6d944a87693a296b4bdc510cef146e4e5f088f28dc31d2b9c567e3e85fc60571f25fc95f234dfe8d43e3e4dc2f028092a8c03d35b9e409438d3735a
SSDEEP 786432:kIxgC/eoZBb36qcdH51FB2BuMDbNtBGvtHrk/v0BSYCNT0SGv70m5xo:kIeZWV3Rcdv76DDbDcvNrP8Z4PYYi
TLSH
T10097337C1E305AC7F411A9342872E2CB79235D61A0A9091F6AF139FC2670F94DC9BB76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_Service.exe

Path C:\Program Files\TeamViewer\TeamViewer_Service.exe
Size 26.1MB
SHA256 ef07838762db23a42df77d0ee273c825070849a1fe9ea45d48a4f9000d565e04
MD5 36cb9942f42280f7f7f9437b8f6314fc
SHA1 f50d0f9194a74b5f94c33b830de2d9a9889eebde
SHA512 20a03bce9b4cbcfbbeb3d407caa63c7fedff009c1b95b1d4d3ffbd66cd97fb5a2fe394d67aa8b1dbe202a72606e066cd20256074f894799d5c9eec9519ae5ccc
SSDEEP 393216:1b9h6xo1Dii80A/VGhojliDjQ0uJdngwPUY:1bh+V3gcf
TLSH
T133578E17B2E801ECE0BAD179CA9B8907EBB2B819037157DF059085AA1F67EF04E7D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewerVPN.sy_

Path C:\Program Files\TeamViewer\x64\TeamViewerVPN.sy_
Size 45KB
SHA256 3a09c3a24ec480ba4ad466760996e0f3ced30c1499abda32da6ead9de5d08836
MD5 6317a1890582d5abb3e3e3ee6b217411
SHA1 78f44d94212467fc61b98efbda91f2bc701e1a39
SHA512 6241dc81ef29736972d2e8ce3fe0c52371445cf80e5ebf22630d9f29b1953470a0f2c15a57262e400f90773eb74428af4521c744acfe7d202f19ebf9b7ae3e03
SSDEEP 768:XD0lMrZrZwFu/xdw9/oxBwNNyElQWmjI11YiWJ1hP4n2u41z2:6MT1ZyFoElQWAI11772H2
TLSH
T197239EE256B80892D86B947096DBCA17FFB4B2831351D6EF1358D2651F63BC1273E328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TV15Install.log

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV15Install.log
Size 2KB
SHA256 d7500fe2c752b797c84b05a54263934b7ef10a358aac2701149f02c348598cff
MD5 49220d3d83f82368d1ed3afb51c95115
SHA1 1d33710796d92cac227feee5881125769e8cfcd8
SHA512 ed8b67dd8df68cea910c1dd09410e21c8d5c1cb8c4469d3329c9fc03bfa5afd521872b6a344941181e55f7071d5a017ff364c26a6f836b00f0410e937054f1e6
TLSH
T19441F3189DF09A3C6D53C24DC67D3F88E1A63C537C9A211BF3AB10412E019E9EBCE216
MD5 SHA1 SHA512 TLSH

Submit Download

TV15Install.log

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV15Install.log
Size 2KB
SHA256 dcce0320fa7bb4c1f94dfe545873109d88f61128ad241530c6a37512f751367d
MD5 aa6fb1f2845d995e3f99699d00d49573
SHA1 d602cae0134f74bf1daec2919d0a9a7d8ca33229
SHA512 1e1ffbd66c0ba76756a8a34d84c13b4b0260f851257d716d95790ef2c2f81b7837bc01e1defdab0379389dc380089ffc7f9d33db45c4f3c30a4de2572d1e79d1
TLSH
T1BD41E4189DF09A3C6D53C24DC67D3F88E1A67C537C9A211BF3AB10412E019E9EBCE216
MD5 SHA1 SHA512 TLSH

Submit Download

TV15Install.log

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV15Install.log
Size 4KB
SHA256 aea175b9368ce24ce96a81e130c4f53e0e501306139ef819941798d76f2b1dd1
MD5 95e9dbb3bbfd57bc47ae76b35eb43b48
SHA1 a9c34478f7ddb45a017c8ec78c8977255cad0da6
SHA512 ec21515e47138e1bba091aa62462e6a218e71b2be448b68b4eabfe0549d40ab0fcaad211e04eb78c030ad6b8c0018c24e9a7426cc30980a97f874e0856b21cbc
SSDEEP 48:KGX6rQvRxFGTxluXhb7F9FDaFXz3syI5X2qnEHYotTGazG9wYeh/CI+vCICi4C6h:KqpxhQdzyfETID6UpxlF6BegEpLd+v
TLSH
T18D9105189DF05A7CAD53C25DC57D7E8CE1A6BC477C9A211BF3AB10412A019E8FBCE116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

environment_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsp7721.tmp\environment_unicode.ini
Size 1KB
SHA256 97e2a4fa507b7feff85fa48e57d0a617ed70260023bcd621b93647cf7219be88
MD5 cffd1f2b43128b216bf394bff58cd5c6
SHA1 046dd688c00e2366c5a719b228da568eb769c3e9
SHA512 112fa169bb20cb9333007cbae082ad6577c6d6946348151c683c4a8ec9751c64eaa6844a49f0d9eecb809eb6c4607917864a224ab67647b32b7cdeb48c76d7c9
TLSH
T1B32163533BF80144E5BBF61DFBF64436A7393946183DC90E80D10B0E49E5A80426BBDB
MD5 SHA1 SHA512 TLSH

Submit Download

environment_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsp7721.tmp\environment_unicode.ini
Size 1KB
SHA256 0412a1be7aef49060bbaf0cd8620c09c8035cd198fae5220c670b980a2979b17
MD5 231839edd338a5d1a2786a724f3ac537
SHA1 6c1c3455df3347042dba9c85728e5a8761e69036
SHA512 e8cf431127a5f6ee1094391d2e6b518887f693e95c8b449a91cca8fa7015317384ba7cee4954faa97f60b352e226eead3e4461683e348bfcbd5363f0a767a091
TLSH
T1622151533BF80144E5BBF619EBF68036A7393906183DC91E80D10B0E49E5680426BBDB
MD5 SHA1 SHA512 TLSH

Submit Download

finish_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsp7721.tmp\finish_unicode.ini
Size 1KB
SHA256 51b57cf2c70006646a76797cadaa5d014c9ff707da8a4b4e17bcdfccc3c00fd8
MD5 db0713808219e4d7334171f9e1e6c2bc
SHA1 8d8c463837cfce60b6f501dd75b398e3c7ed8a06
SHA512 ef0f8ff01e4f6419bc64af3a0fadada15f0c1f23f95a544460dd4fac83c1dde3758537fd5f93cc8e3b39a45b310261b3f6511a286d95ee5edf615ec40aac08af
TLSH
T1172160632BF80055F6BBFA08EBB594319B353D454C3DC55D80D00A0E09F66A086ABBDB
MD5 SHA1 SHA512 TLSH

Submit Download

hoststart_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsp7721.tmp\hoststart_unicode.ini
Size 1KB
SHA256 ba5e57215a569efb0cb8468504118ad7312e389b1db6362a6b0eb1c475ae4add
MD5 178a2259dd0de6da4cf66055db097336
SHA1 d60046033264aebca74110cc8e663ff7a8575aca
SHA512 98b6edbb5b54d3498661a73f1c29568214e5ef8acfa5c580e6ac82a77d01c6ac3f7728c2e2d9e95d3e270dc9fa7ec683d00f86209d96013225d5616b70099f07
TLSH
T1E821634267F80118F6F76F69EAF100718B76BC5A6C3CD98C41C10A0E45F8D80E872BAB
MD5 SHA1 SHA512 TLSH

Submit Download

hoststart_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsp7721.tmp\hoststart_unicode.ini
Size 1KB
SHA256 67fecb6ddb5f602af71a4fa2cb8546853b4bc542641c2c61b3e5c984091d28e7
MD5 e53f4cf10483c5e72c27c6792451439f
SHA1 2fb52d16b280de44b08e4c27f048525c8ec84ee4
SHA512 29a44ede2e7ff87687f251e63a6c553e4c7cf75dc70690c030dfa4e0152825e90e8082fbf77b7e2c2e2d6a6e5875593e2e89e033e568039f7a71043af8fe40b6
TLSH
T1482175422BE80118F2F76F69EAB101718B757C56AC3DD98D41C10A0E44F9D80E872BAB
MD5 SHA1 SHA512 TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\InstallOptions.dll
Size 15KB
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TvGetVersion.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\TvGetVersion.dll
Size 696KB
SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
MD5 41c3a6594060581d3bf1a16ed4ae6a72
SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
TLSH
T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\UAC.dll
Size 29KB
SHA256 b5bb8d301173c4dd2969b1203d2c7d9400ba3f7f2e34ee102905bd2724162430
MD5 488819f838abfcad73a2220c151292ee
SHA1 4a0cbd69300694f6dc393436e56a49e27546d0fe
SHA512 b00d6cf712fe4cefce41479f6e6f4aa5ea006694d10f2837204de5bde1c5a4bef1368f2b0eb4b66d57a66e8ce6dc335fa91e9c8017e8e125c27eb1f5df4de9a0
SSDEEP 384:QqVibvTh4qnFP+OPEzinclP+RZSf+VIYiWLglLoPxh8E9VF0NyH5TV:QqVavVfPkzhlmg/YiWLPxWEFX
TLSH
T156D28D6617E4492BD9231E3036E665325FBAB871097180EF1527D6C53AB0B83BE7C31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\UserInfo.dll
Size 4KB
SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
MD5 e6f30908abfc6f53b7c3c36daec4586d
SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
TLSH
T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
MD5 SHA1 SHA512 TLSH

Submit Download

hoststart_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\hoststart_unicode.ini
Size 1KB
SHA256 4eca80ba535bcba5377c9bd7645b956a97246f248354a8cf142d2afe15824e18
MD5 b0e5d4098564b78af317d128a59ee091
SHA1 ea11aa895fc8606a79d75ef9f7338b5186b32c02
SHA512 934000c3fc01e13cfb3200036aae5d7b3e4fff7500e7f63cecfd679099cbbaded46b5760006bde599caebda6afee1db0b5d2a62cc3ec641de8af517e2df70b35
TLSH
T1232157522BF84128F6F76F69EAF100718B757C56AC3CD58D41C10A0E45F5D80E972BAB
MD5 SHA1 SHA512 TLSH

Submit Download

hoststart_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\hoststart_unicode.ini
Size 1KB
SHA256 ae5cc27e84d632471a406cf014eb8c06fc60c364243d536af7987c7a86623d98
MD5 6402781a5c7a25170c67d6c2c392a80a
SHA1 b31a1352923e402e02d2daa3990b4de9a52c1d7d
SHA512 73e27f8f5d2644e420cf1330402b869177256a6c80da4e66505b7a8e896531f73b883a4c17c58c0476bdbf2419673709bc4d1ffde936aae864496e7d546e0d5b
TLSH
T11121634227F84118F6F76F69EAF100718B76BC56AC3CD98C41C10A0E45F8D80E872BAB
MD5 SHA1 SHA512 TLSH

Submit Download

nsArray.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\nsArray.dll
Size 18KB
SHA256 8b8be21fa7bca491c93683c9f84bb49370ca7e1e864bd0658ff9e1d2809b67e4
MD5 9761d708ea7c49662a21f6690d439e06
SHA1 b2e757e7eee5c788f16d666fb6cf9d41caccb04b
SHA512 25990a993373009ccbd9e89cae3fc601928121775d0d5fe326c55a305ce8de51f35a2cb160e9dfbf3be82a53ddf7b9864116e7f5d3325afd7403cd3b7740c652
SSDEEP 384:nqqedh6EHFRksp7KpFX1ZSf+VIYiWLALiqPxh8E9VF0NymgEy:Ted/FR9mXc/YiWMPxWEspy
TLSH
T1BC827C638A682C05DE634F7071D8863AAE75BBA1DDE1C1C22309C1215B91781BBEC6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\nsis7z.dll
Size 187KB
SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
MD5 7fe20cee9277556f4ef137e61d29d9f5
SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
TLSH
T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpn_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\vpn_unicode.ini
Size 1KB
SHA256 84c0a40e87638c5500a0c404d450ade94c5b9d414b63c7093b95291d9d77da4d
MD5 c95f424de04034f1122c2e37d930eaa2
SHA1 22a3ca28ce3b65722e055ca1b911b42c093373b7
SHA512 b10a2baafe0039c08dd17fb59e7c14e77d9d59c2a09a10453a798330974ba439ea7cbac2f5c544f96c0ce623ea6d173449167b908386307b80b593ad6097bea9
TLSH
T19E31CC036BF94118F4FBBB04EAB541358B3A3C85A93CC54E44E1094E05F5E8099B77E7
MD5 SHA1 SHA512 TLSH

Submit Download

vpn_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nst4D81.tmp\vpn_unicode.ini
Size 1KB
SHA256 a92335f6eb3442cdd84f7bad772db6a2f5d1f73633c307743bc88ec472dc0444
MD5 9edf5f809e12e0be466cceccfc95a6f9
SHA1 b65e00c5f2e2392fa79431792cbdee802189ff04
SHA512 016b21000489a61f90860655a20e0e7a10cd4d65d61c304b8a6fe80eb50d3c9454c89d50c7b0303840e55f900b0e02694fc196478139025043313f6f61ddcd95
TLSH
T15B31A9036BF94108F4FBBB54EAF541358B7A3C95AA3CC18E40E1094E01F5A8099A77EB
MD5 SHA1 SHA512 TLSH

Submit Download

SETC510.tmp

Path C:\Users\Admin\AppData\Local\Temp\{21112c14-c3ff-ac40-8b10-e28d1452ba9c}\SETC510.tmp
Size 11KB
SHA256 2c714a3687424c798b565128c0720322a7ea0fb779d91963048394ea471707aa
MD5 746441b276b24b7a5b487a429f60d214
SHA1 657258cbaf47d6faa2ec58c77b948c6398828f96
SHA512 f734829ec6d6ad84848fa5cd2b866337360481b596a383a49ae3ba5176ffd74850c8dfa345f1dd3bc4644da6fa905ad91644e450da02c413d39849ea3c35753c
SSDEEP 192:qtxI5sxyQJCxSFBkyKuqwFWQFH5JUoowcLK+X01k9z3A4ZdMXrWp:80GFRdfUo6R9zrvMu
TLSH
T14C32F9E6972C45C2EDE76DB0539CE5973C3E6BCB1810946A2297F7680CA27D8E70442F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETC521.tmp

Path C:\Users\Admin\AppData\Local\Temp\{21112c14-c3ff-ac40-8b10-e28d1452ba9c}\SETC521.tmp
Size 70KB
SHA256 cd858c1a37d9599181285ce55e38bbd7cef8637f8df1d3ba425b78c2670e345e
MD5 5da3dd0a7761d1c1678d65f22005175a
SHA1 13edda1695d1080379adf30596f149cfe09e865d
SHA512 54c14b06f3cf373dd4a6d77030d7908fc6cb42bf151760877ef2ea0c5662b56f2dd09a334bb55602a4f1920cdf91fba140aaea14113da369cd25b89ab8b3ca3a
SSDEEP 768:Mdq9xYKLIHVgKqnS/OLlGkQctwE/uf95v13d6YHU3/Yic5Hf+AMxkEBsF9zmGW:MUYK7xxacKYS5vBHU3/7IHkxuXznW
TLSH
T1A1637C5A92A884A6D56B8678C0D39F27FAB5F841075092CF03B4C35A1F637D0AB3D3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETC522.tmp

Path C:\Users\Admin\AppData\Local\Temp\{21112c14-c3ff-ac40-8b10-e28d1452ba9c}\SETC522.tmp
Size 4KB
SHA256 f35e1bed01d9efdd2566f6a07560d263ce6cd9494aed03cd3564a7788f6ffa41
MD5 6ccc14f0f72bb4398f0a15cc96bbbb86
SHA1 891a0a4069c8ccec4540387a213a445e7a65982f
SHA512 1ef640fec7f68587e938646ab2771f5bfa8384542e401b097cfce3a0d0b67a3f5a6f756fc9f66c77d7d8ac6daa87d227864e7b44fc81a64bebc42254dee906ee
SSDEEP 96:Kw/Pg6KAXlFHmk9/BabDIWebYNnitU42S42Lx:s1E
TLSH
T14EA19F03A7ED4218F1F7ABD0EAF951664A733C95593CDA8D01D4568E2AF0E4098E37B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-428-0x0000000073D10000-0x0000000073D1A000-memory.dmp

Download

memory/2696-189-0x0000000073D40000-0x0000000073D4A000-memory.dmp

Download

memory/2696-901-0x0000000073D40000-0x0000000073D4A000-memory.dmp

Download