b47c896d78a61fb5bd0f0d2b1b9db6ed2c63a30a78565d234deda49e3f23826a

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ING-Antifraude-Windows.exe
Size 41.1MB
Sample260828-aky2dssamh
SHA256 b47c896d78a61fb5bd0f0d2b1b9db6ed2c63a30a78565d234deda49e3f23826a
MD5 ff016f8bb78e6e0e2689b1108f168531
SHA1 3be6b71b77d22d7589c2d20b4a3013b3e9e1cf57
SHA512 49b989cce6d944a87693a296b4bdc510cef146e4e5f088f28dc31d2b9c567e3e85fc60571f25fc95f234dfe8d43e3e4dc2f028092a8c03d35b9e409438d3735a
SSDEEP 786432:kIxgC/eoZBb36qcdH51FB2BuMDbNtBGvtHrk/v0BSYCNT0SGv70m5xo:kIeZWV3Rcdv76DDbDcvNrP8Z4PYYi
TLSH
T10097337C1E305AC7F411A9342872E2CB79235D61A0A9091F6AF139FC2670F94DC9BB76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c00000001c5d1-184.dat	acprotect

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D	TeamViewer_Service.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2b3d1ebb-8458-d54d-9705-7763dbf68d91}\SET9E59.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2b3d1ebb-8458-d54d-9705-7763dbf68d91}	DrvInst.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\TeamViewer\DataUploader\tvdatauploader.db	TeamViewer_Service.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2b3d1ebb-8458-d54d-9705-7763dbf68d91}\SET9E5A.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A	TeamViewer_Service.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2b3d1ebb-8458-d54d-9705-7763dbf68d91}\TVVirtualMonitorDriver.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2b3d1ebb-8458-d54d-9705-7763dbf68d91}\SET9E5A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2b3d1ebb-8458-d54d-9705-7763dbf68d91}\TVVirtualMonitorDriver.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2b3d1ebb-8458-d54d-9705-7763dbf68d91}\SET9E5B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa\TVVirtualMonitorDriver.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_CF6A9DE045ED90861ED288C9E06DB80A	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_CF6A9DE045ED90861ED288C9E06DB80A	TeamViewer_Service.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa\TVVirtualMonitorDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	TeamViewer_Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D	TeamViewer_Service.exe
File created	C:\Windows\System32\DriverStore\Temp\{2b3d1ebb-8458-d54d-9705-7763dbf68d91}\SET9E59.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2b3d1ebb-8458-d54d-9705-7763dbf68d91}\SET9E5B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2b3d1ebb-8458-d54d-9705-7763dbf68d91}\TVVirtualMonitorDriver.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa\TVVirtualMonitorDriver.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	TeamViewer_Service.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\TeamViewer\DataUploader\tvdatauploader.db-journal	TeamViewer_Service.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5d1-184.dat	upx
behavioral2/memory/4388-186-0x0000000074800000-0x000000007480A000-memory.dmp	upx
behavioral2/memory/4588-425-0x00000000742B0000-0x00000000742BA000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewerAutomation.DataBridge.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x86\	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TeamViewer15_Logfile.log	TeamViewer.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TeamViewer15_Hooks.log	tv_x64.exe
File opened for modification	C:\Program Files\TeamViewer\TeamViewer15_Logfile.log	TeamViewer_Service.exe
File opened for modification	C:\Program Files\TeamViewer\TeamViewer15_Logfile.log	tv_w32.exe
File opened for modification	C:\Program Files\TeamViewer\TVHVersion15.txt	TeamViewer_Service.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewerAutomation.DataBridge.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\Printer	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.cat	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\TeamViewerVPN.inf	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.inf	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TV_Audio.sy_	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\tvfiles.7z	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\TV_Audio.inf	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\ErrorReports\Service\91268954-6c4a-48cc-c784-edf8fc427601.run.lock	TeamViewer_Service.exe
File created	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\rolloutfile.tv13	TeamViewer_Service.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\CopyrightHOST.txt	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\TV_Audio.cat	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\x64\TV_Audio.inf	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	ING-Antifraude-Windows.exe
File created	C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	ING-Antifraude-Windows.exe
File opened for modification	C:\Program Files\TeamViewer\TVExtractTemp\x64	ING-Antifraude-Windows.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	tv_x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tv_x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe

Executes dropped EXE 10 IoCs

pid	Process
4588	TeamViewer_.exe
1224	TeamViewer_Service.exe
5484	TeamViewer_Service.exe
924	TeamViewer.exe
3244	tv_x64.exe
3656	tv_x64.exe
2520	TeamViewer_Service.exe
2964	TeamViewer.exe
964	tv_w32.exe
3376	tv_x64.exe

Loads dropped DLL 64 IoCs

pid	Process
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ING-Antifraude-Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_w32.exe

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tv_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	tv_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tv_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tv_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	tv_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tv_x64.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	tv_w32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	tv_x64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	TeamViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	tv_w32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14B59F6C-4FF8-4AD9-BA71-D65FDF7AEC3B}	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B1BD342-5456-4F9F-A027-1BA0254C8C0A}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tvassign1\shell\open\command\ = "\"C:\\Program Files\\TeamViewer\\TeamViewer.exe\" \"%1\""	ING-Antifraude-Windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A20E949F-5456-4A49-BE51-88077E13F793}\TypeLib\Version = "1.2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DB86189D-5456-4B7B-B5AB-419653E156DD}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09183D47-5456-4B6E-BA7E-F170D9F4ABEE}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F274CC23-5456-42B2-AC7A-5C5EA0D6EFBC}	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{550C2D70-5456-4990-A6B2-20E1EF1C8EBC}\ProxyStubClsid32	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{850A928D-5456-4865-BBE5-42635F1EBCA1}\ = "TeamViewer Application"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tvassign1\shell	ING-Antifraude-Windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D399478A-5456-4112-B963-38E6C8AA1217}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DB86189D-5456-4B7B-B5AB-419653E156DD}\ = "ITvUserSettings"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D399478A-5456-4112-B963-38E6C8AA1217}	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EB079FD-5456-432D-BDAB-9B38DF8DD0EE}\ProxyStubClsid32	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD9D431B-3B37-4F4A-B676-D43D8AEAD6E2}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B1BD342-5456-4F9F-A027-1BA0254C8C0A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F5E4D7D-7181-44DC-8407-CAF525D85345}\ = "ITvApplication2"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC73DAE1-5456-440C-B6EE-0D4A235B71B5}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D399478A-5456-4112-B963-38E6C8AA1217}\TypeLib\Version = "1.2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{550C2D70-5456-4990-A6B2-20E1EF1C8EBC}\TypeLib\Version = "1.2"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD9D431B-3B37-4F4A-B676-D43D8AEAD6E2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F5E4D7D-7181-44DC-8407-CAF525D85345}\TypeLib	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CFDFB010-5456-4D0B-8A07-B55C0B963627}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A20E949F-5456-4A49-BE51-88077E13F793}\TypeLib	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A20E949F-5456-4A49-BE51-88077E13F793}\TypeLib\Version = "1.2"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB86189D-5456-4B7B-B5AB-419653E156DD}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{850A928D-5456-4865-BBE5-42635F1EBCA1}\RunAs = "Interactive User"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\teamviewer8\URL Protocol = "\"\""	ING-Antifraude-Windows.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14B59F6C-4FF8-4AD9-BA71-D65FDF7AEC3B}\ProxyStubClsid32	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD9D431B-3B37-4F4A-B676-D43D8AEAD6E2}\TypeLib	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F5E4D7D-7181-44DC-8407-CAF525D85345}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC73DAE1-5456-440C-B6EE-0D4A235B71B5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewer.Service.1\ = "TeamViewer Service Class v1"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF93CDAB-5456-4611-AE2C-6F50A41564C1}\TypeLib	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{550C2D70-5456-4990-A6B2-20E1EF1C8EBC}\TypeLib	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09183D47-5456-4B6E-BA7E-F170D9F4ABEE}\TypeLib	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F5E4D7D-7181-44DC-8407-CAF525D85345}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC73DAE1-5456-440C-B6EE-0D4A235B71B5}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{877D726A-5456-4171-9CDB-0DAB3AFFE07F}\ProgID\ = "TeamViewer.Application.1"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}\1.2\0\win64\ = "C:\\Program Files\\TeamViewer\\TeamViewer.exe"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D399478A-5456-4112-B963-38E6C8AA1217}\ = "ITvAddress"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95C0F21E-5456-4891-B9F6-014E98858D0B}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95C0F21E-5456-4891-B9F6-014E98858D0B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09183D47-5456-4B6E-BA7E-F170D9F4ABEE}\TypeLib\Version = "1.2"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewer.Application	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{877D726A-5456-4171-9CDB-0DAB3AFFE07F}\VersionIndependentProgID	TeamViewer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2B433F44-5456-42FF-8CBD-54E8176ECD01}\AccessPermission = 010004803000000040000000000000001400000002001c0001000000000014000300000001010000000000050b0000000102000000000005200000002002000001020000000000052000000020020000	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF93CDAB-5456-4611-AE2C-6F50A41564C1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EB079FD-5456-432D-BDAB-9B38DF8DD0EE}	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD9D431B-3B37-4F4A-B676-D43D8AEAD6E2}\ProxyStubClsid32	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC73DAE1-5456-440C-B6EE-0D4A235B71B5}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\TeamViewer_Service.exe\AppID = "{2B433F44-5456-42FF-8CBD-54E8176ECD01}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{877D726A-5456-4171-9CDB-0DAB3AFFE07F}	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{457E4C9C-5456-471C-8A3C-F3BFC8DF242C}\TypeLib	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD9D431B-3B37-4F4A-B676-D43D8AEAD6E2}	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewer.Service\ = "TeamViewer Service Class"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D399478A-5456-4112-B963-38E6C8AA1217}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\teamviewer8\shell	ING-Antifraude-Windows.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}\1.2\0	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14B59F6C-4FF8-4AD9-BA71-D65FDF7AEC3B}\TypeLib\ = "{D5883D5C-5456-4BF9-844A-3F8C5E61AF9F}"	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD9D431B-3B37-4F4A-B676-D43D8AEAD6E2}	TeamViewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09183D47-5456-4B6E-BA7E-F170D9F4ABEE}\ProxyStubClsid32	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{877D726A-5456-4171-9CDB-0DAB3AFFE07F}\VersionIndependentProgID\ = "TeamViewer.Application"	TeamViewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A20E949F-5456-4A49-BE51-88077E13F793}\ = "ITvMachineSettings"	TeamViewer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5580	schtasks.exe
2544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4588	TeamViewer_.exe
4588	TeamViewer_.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe
4388	ING-Antifraude-Windows.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTcbPrivilege	2520	TeamViewer_Service.exe
Token: SeBackupPrivilege	2520	TeamViewer_Service.exe
Token: SeRestorePrivilege	2520	TeamViewer_Service.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2964	TeamViewer.exe
2964	TeamViewer.exe
2964	TeamViewer.exe
2964	TeamViewer.exe
2964	TeamViewer.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2964	TeamViewer.exe
2964	TeamViewer.exe
2964	TeamViewer.exe
2964	TeamViewer.exe
2964	TeamViewer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2964	TeamViewer.exe
2964	TeamViewer.exe
2964	TeamViewer.exe
2964	TeamViewer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 5580	4388	ING-Antifraude-Windows.exe	89
PID 4588 wrote to memory of 2544	4588	TeamViewer_.exe	93
PID 4388 wrote to memory of 1224	4388	ING-Antifraude-Windows.exe	95
PID 4388 wrote to memory of 924	4388	ING-Antifraude-Windows.exe	100
PID 4388 wrote to memory of 3244	4388	ING-Antifraude-Windows.exe	101
PID 4388 wrote to memory of 3656	4388	ING-Antifraude-Windows.exe	102
PID 4388 wrote to memory of 5892	4388	ING-Antifraude-Windows.exe	104
PID 2520 wrote to memory of 2964	2520	TeamViewer_Service.exe	108
PID 2520 wrote to memory of 964	2520	TeamViewer_Service.exe	110
PID 2520 wrote to memory of 3376	2520	TeamViewer_Service.exe	111

C:\Users\Admin\AppData\Local\Temp\ING-Antifraude-Windows.exe
"C:\Users\Admin\AppData\Local\Temp\ING-Antifraude-Windows.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5580
- C:\Program Files\TeamViewer\TeamViewer_Service.exe
  "C:\Program Files\TeamViewer\TeamViewer_Service.exe" -install
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Program Files\TeamViewer\TeamViewer.exe
  "C:\Program Files\TeamViewer\TeamViewer.exe" api --install
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:924
- C:\Program Files\TeamViewer\tv_x64.exe
  "C:\Program Files\TeamViewer\tv_x64.exe" --action uninstallpnpdriver --inf "C:\Program Files\TeamViewer\x64\TVVirtualMonitorDriver.inf" --log "C:\Program Files\TeamViewer\TeamViewer15_Hooks.log"
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Executes dropped EXE
  PID:3244
- C:\Program Files\TeamViewer\tv_x64.exe
  "C:\Program Files\TeamViewer\tv_x64.exe" --action installpnpdriver --inf "C:\Program Files\TeamViewer\x64\TVVirtualMonitorDriver.inf" --log "C:\Program Files\TeamViewer\TeamViewer15_Hooks.log"
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:3656
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5892

C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2544

C:\Program Files\TeamViewer\TeamViewer_Service.exe
"C:\Program Files\TeamViewer\TeamViewer_Service.exe"
1⤵
- Executes dropped EXE
PID:5484

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{27ca9a79-89b6-cf4e-b166-46a1a8412f55}\TVVirtualMonitorDriver.inf" "9" "4e60e5847" "000000000000017C" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\TeamViewer\x64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2620

C:\Program Files\TeamViewer\TeamViewer_Service.exe
"C:\Program Files\TeamViewer\TeamViewer_Service.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files\TeamViewer\TeamViewer.exe
  "C:\Program Files\TeamViewer\TeamViewer.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2964
- C:\Program Files\TeamViewer\tv_w32.exe
  "C:\Program Files\TeamViewer\tv_w32.exe" --log C:\Program Files\TeamViewer\TeamViewer15_Logfile.log --action hooks
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:964
- C:\Program Files\TeamViewer\tv_x64.exe
  "C:\Program Files\TeamViewer\tv_x64.exe" --log C:\Program Files\TeamViewer\TeamViewer15_Logfile.log --action hooks
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:3376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TeamViewer_.exe

Path C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
Size 41.1MB
SHA256 b47c896d78a61fb5bd0f0d2b1b9db6ed2c63a30a78565d234deda49e3f23826a
MD5 ff016f8bb78e6e0e2689b1108f168531
SHA1 3be6b71b77d22d7589c2d20b4a3013b3e9e1cf57
SHA512 49b989cce6d944a87693a296b4bdc510cef146e4e5f088f28dc31d2b9c567e3e85fc60571f25fc95f234dfe8d43e3e4dc2f028092a8c03d35b9e409438d3735a
SSDEEP 786432:kIxgC/eoZBb36qcdH51FB2BuMDbNtBGvtHrk/v0BSYCNT0SGv70m5xo:kIeZWV3Rcdv76DDbDcvNrP8Z4PYYi
TLSH
T10097337C1E305AC7F411A9342872E2CB79235D61A0A9091F6AF139FC2670F94DC9BB76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_Service.exe

Path C:\Program Files\TeamViewer\TeamViewer_Service.exe
Size 26.1MB
SHA256 ef07838762db23a42df77d0ee273c825070849a1fe9ea45d48a4f9000d565e04
MD5 36cb9942f42280f7f7f9437b8f6314fc
SHA1 f50d0f9194a74b5f94c33b830de2d9a9889eebde
SHA512 20a03bce9b4cbcfbbeb3d407caa63c7fedff009c1b95b1d4d3ffbd66cd97fb5a2fe394d67aa8b1dbe202a72606e066cd20256074f894799d5c9eec9519ae5ccc
SSDEEP 393216:1b9h6xo1Dii80A/VGhojliDjQ0uJdngwPUY:1bh+V3gcf
TLSH
T133578E17B2E801ECE0BAD179CA9B8907EBB2B819037157DF059085AA1F67EF04E7D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv_x64.exe

Path C:\Program Files\TeamViewer\tv_x64.exe
Size 440KB
SHA256 5386fece64b07651e4874309c4c179e75799d6672efc0c0ac81038d9ba0946cc
MD5 25c009c71c4150c4accc280f8d4fbb3b
SHA1 a72189b697e030e776011c86c7c0fdb857bef057
SHA512 30dacd9196ca7053167d7d7f7a722afe197ad5914a857f8b89d75091cdbe93fca4a71618cf7872e274c9914cb46108dc277f63d0840e74c0694df005d7e4a74e
SSDEEP 6144:yOVWXk6ZrBfc0G/Ct1Dw6wM9o6motyJLyrOp1lnkwNW99lOpOq6YlBMb6G4zcpas:yTluwWJ6wgdsOclHAa1q
TLSH
T15BA48D16E7A800F9E177D17CCA934802E7727C1A43A1D6DF039495AA5F376E09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewerVPN.sy_

Path C:\Program Files\TeamViewer\x64\TeamViewerVPN.sy_
Size 45KB
SHA256 3a09c3a24ec480ba4ad466760996e0f3ced30c1499abda32da6ead9de5d08836
MD5 6317a1890582d5abb3e3e3ee6b217411
SHA1 78f44d94212467fc61b98efbda91f2bc701e1a39
SHA512 6241dc81ef29736972d2e8ce3fe0c52371445cf80e5ebf22630d9f29b1953470a0f2c15a57262e400f90773eb74428af4521c744acfe7d202f19ebf9b7ae3e03
SSDEEP 768:XD0lMrZrZwFu/xdw9/oxBwNNyElQWmjI11YiWJ1hP4n2u41z2:6MT1ZyFoElQWAI11772H2
TLSH
T197239EE256B80892D86B947096DBCA17FFB4B2831351D6EF1358D2651F63BC1273E328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TV15Install.log

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV15Install.log
Size 2KB
SHA256 5cb5eb6b21b9837f4876046d5d3502405a8ea43bfa95a07fc4d6a8737bf3e504
MD5 dea065637a82644530a31cdff43f8ca2
SHA1 f19f829db7151e1513381ec9531bc844c3bd052f
SHA512 aa3c2892c2b46eff1d1b3e0badcd29e0a306c07fd247c787be1fd288d6e7e685e2ac61fd0ed4b7fbe9be153b7d17db0b0ab06dee3cb62293ca7ea65724031902
TLSH
T1EC41A6084EF15A3C6D67C24DC5797F88F1B67C477CAA611AF3AB21412A018E8E7CE251
MD5 SHA1 SHA512 TLSH

Submit Download

TV15Install.log

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV15Install.log
Size 2KB
SHA256 af3b69b503461a81a84d533cb325a5bb2c04d5b3b783f0bba8f09030bca084c6
MD5 7d18db732ed73404e107d7f2f63c846e
SHA1 ed1eb20e6d3ef3e09efc7c8a4917c6a3e8ecced7
SHA512 8dcba9e304adfacef2e6ffd2f801aa15e3093572d8dc2476ff6e77afe45f55a10b1d6080859463194810fce7b6a847439ee94ceacb87d4e7e1e6f991ae9467a2
TLSH
T13651A4088EF1593C6D67C24DC5797F88F1B67C4778AA611AF3AB21412E018E8EBCE255
MD5 SHA1 SHA512 TLSH

Submit Download

TV15Install.log

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV15Install.log
Size 4KB
SHA256 dcad2b95005e605c6b83f7ca96540e915a7f0bf9d3f8cfacc4cdbeded7954e4a
MD5 b4b78f42b5633e22858268081d894049
SHA1 38cbe5d63f96e60f3437d2df7a957d06ea8f8dd2
SHA512 0e865970e48d757516678c86943ab744744d14aff51e8310ac732044f280c9bbef46274244ff0105808c160d82499c654bc67cdafb21f1b9204a48938112bd13
SSDEEP 48:KGUTrzvRxF5TyluEhwSFAc9wNBFUYeIsX2q6EHYdSTE2G9wSUhVCh+cChCF4CNCU:KbpxSi16RiE1Y3gZpxhiOdJzfET9IAH
TLSH
T1C1A1F6089DF19A3C6D97C24DC5793F88F1A67C477C9A611BF3AB11412E018E9EBCE212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\InstallOptions.dll
Size 15KB
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TvGetVersion.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\TvGetVersion.dll
Size 696KB
SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
MD5 41c3a6594060581d3bf1a16ed4ae6a72
SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
TLSH
T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\UAC.dll
Size 29KB
SHA256 b5bb8d301173c4dd2969b1203d2c7d9400ba3f7f2e34ee102905bd2724162430
MD5 488819f838abfcad73a2220c151292ee
SHA1 4a0cbd69300694f6dc393436e56a49e27546d0fe
SHA512 b00d6cf712fe4cefce41479f6e6f4aa5ea006694d10f2837204de5bde1c5a4bef1368f2b0eb4b66d57a66e8ce6dc335fa91e9c8017e8e125c27eb1f5df4de9a0
SSDEEP 384:QqVibvTh4qnFP+OPEzinclP+RZSf+VIYiWLglLoPxh8E9VF0NyH5TV:QqVavVfPkzhlmg/YiWLPxWEFX
TLSH
T156D28D6617E4492BD9231E3036E665325FBAB871097180EF1527D6C53AB0B83BE7C31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\UserInfo.dll
Size 4KB
SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
MD5 e6f30908abfc6f53b7c3c36daec4586d
SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
TLSH
T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
MD5 SHA1 SHA512 TLSH

Submit Download

hoststart_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\hoststart_unicode.ini
Size 1KB
SHA256 4c776e60e6a9ce4abbb547bdf5ef5b43a7055895766b83ec7b253761f136f30e
MD5 4cf01a90bb7de0833f7f56f136623490
SHA1 cab3a7cd430357e57c9d729e81616406cf0d7a3b
SHA512 2bd938827b3a170c080e18bdf2c5b00b528d765bd5c3dcc8891db3d79d9ad766a8200c07a71e1042789c53852a750cb23b651e47747a89df5361cd786a038cb8
TLSH
T1182187422BF84118F2F76F69EAF101718B35BC16AC3CD58D41C10A0E45F4D80E972BAB
MD5 SHA1 SHA512 TLSH

Submit Download

hoststart_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\hoststart_unicode.ini
Size 1KB
SHA256 028006184bb632c7d99d4843ed5d5dd0e81b619e851e137804208c58664ab404
MD5 643a0047df9da36868b852da74af1830
SHA1 7dd8eb44a22e72c96b68ab96467a4af0d0d0e77b
SHA512 c1f144db2034c1d3a6c0b790956937ac5d5685efd27ddbea8ce37dfe8faca88d0f21c1e360c58407652e0d10671f9e0981037ff99edda250bf5827b4a143fb3e
TLSH
T1A921435227F84118F6F76F69EAB101718B76BC56AC3CD98D41C10A0E45F4D80E8B2BAB
MD5 SHA1 SHA512 TLSH

Submit Download

hoststart_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\hoststart_unicode.ini
Size 1KB
SHA256 73259ee2784cb856f6d480a91bc9f1dcaadfe2a5aa18bafd7af9aacf79be10e2
MD5 7b3bfa7fbc192e4a7d4ef847602913c4
SHA1 4e6348fdcb0ddf67bfebb2d5bd005305b9178484
SHA512 064f72477d0f6fd33d6cdd0897db472f953415180c7b5fa099f5d772142fe9c0b8fed09d740da5983bbf3b50ec934eb3b1e9078b47e4bd7aaac60604932f31bc
TLSH
T1A621874227F84118F2F76F69EAF101718B35BC16AC3CD58D41C10A0E45F4D80E972BAB
MD5 SHA1 SHA512 TLSH

Submit Download

nsArray.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\nsArray.dll
Size 18KB
SHA256 8b8be21fa7bca491c93683c9f84bb49370ca7e1e864bd0658ff9e1d2809b67e4
MD5 9761d708ea7c49662a21f6690d439e06
SHA1 b2e757e7eee5c788f16d666fb6cf9d41caccb04b
SHA512 25990a993373009ccbd9e89cae3fc601928121775d0d5fe326c55a305ce8de51f35a2cb160e9dfbf3be82a53ddf7b9864116e7f5d3325afd7403cd3b7740c652
SSDEEP 384:nqqedh6EHFRksp7KpFX1ZSf+VIYiWLALiqPxh8E9VF0NymgEy:Ted/FR9mXc/YiWMPxWEspy
TLSH
T1BC827C638A682C05DE634F7071D8863AAE75BBA1DDE1C1C22309C1215B91781BBEC6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\nsis7z.dll
Size 187KB
SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
MD5 7fe20cee9277556f4ef137e61d29d9f5
SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
TLSH
T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpn_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsr3A23.tmp\vpn_unicode.ini
Size 1KB
SHA256 84c0a40e87638c5500a0c404d450ade94c5b9d414b63c7093b95291d9d77da4d
MD5 c95f424de04034f1122c2e37d930eaa2
SHA1 22a3ca28ce3b65722e055ca1b911b42c093373b7
SHA512 b10a2baafe0039c08dd17fb59e7c14e77d9d59c2a09a10453a798330974ba439ea7cbac2f5c544f96c0ce623ea6d173449167b908386307b80b593ad6097bea9
TLSH
T19E31CC036BF94118F4FBBB04EAB541358B3A3C85A93CC54E44E1094E05F5E8099B77E7
MD5 SHA1 SHA512 TLSH

Submit Download

environment_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsr6171.tmp\environment_unicode.ini
Size 1KB
SHA256 0412a1be7aef49060bbaf0cd8620c09c8035cd198fae5220c670b980a2979b17
MD5 231839edd338a5d1a2786a724f3ac537
SHA1 6c1c3455df3347042dba9c85728e5a8761e69036
SHA512 e8cf431127a5f6ee1094391d2e6b518887f693e95c8b449a91cca8fa7015317384ba7cee4954faa97f60b352e226eead3e4461683e348bfcbd5363f0a767a091
TLSH
T1622151533BF80144E5BBF619EBF68036A7393906183DC91E80D10B0E49E5680426BBDB
MD5 SHA1 SHA512 TLSH

Submit Download

finish_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsr6171.tmp\finish_unicode.ini
Size 1KB
SHA256 51b57cf2c70006646a76797cadaa5d014c9ff707da8a4b4e17bcdfccc3c00fd8
MD5 db0713808219e4d7334171f9e1e6c2bc
SHA1 8d8c463837cfce60b6f501dd75b398e3c7ed8a06
SHA512 ef0f8ff01e4f6419bc64af3a0fadada15f0c1f23f95a544460dd4fac83c1dde3758537fd5f93cc8e3b39a45b310261b3f6511a286d95ee5edf615ec40aac08af
TLSH
T1172160632BF80055F6BBFA08EBB594319B353D454C3DC55D80D00A0E09F66A086ABBDB
MD5 SHA1 SHA512 TLSH

Submit Download

hoststart_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsr6171.tmp\hoststart_unicode.ini
Size 1KB
SHA256 99d0a2f3358ec721947a406deadd3e0bc491779cc9b320bc82b68e5712f8bb15
MD5 fe0bfbf0dcd96860b32d7eff6f7e692b
SHA1 ff9669648511bafb87f50a3fee1160138a76c9d9
SHA512 0aba53dbf66966e089cd1e515227757c20cdb231d852ea7f635aab1646badf1ea544cb90f1866b5bf1ee154cdf59b92a649127b3b965a69f04753f03d46eca6a
TLSH
T15B21754227E80118F2F7AB69EAF101718B357C569C3DD58D41C10A0E45F8D80E872BAB
MD5 SHA1 SHA512 TLSH

Submit Download

hoststart_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsr6171.tmp\hoststart_unicode.ini
Size 1KB
SHA256 90f9d23eb9259989715ba7bab9d012c8d45bd3180f9c8b27e0eca1a4974fbdc3
MD5 c02a1a2976f795f79ab821c5caff8b0d
SHA1 a51390ad6322329a7ca6e00f62dc6c297909e496
SHA512 75d32143ae3dcb1ef2dc558b4e91e3698dfeb44d83e84452b15f85aa8195d84c0aa00d092955cd7dbf7621e0f3e25c117b97aa3aa21f2d815bc9453c17c8f2c8
TLSH
T1C12175422BE80118F2F7AF69EAF101718B357C569C3DD58D41C10A0E45F9D80E872BAB
MD5 SHA1 SHA512 TLSH

Submit Download

vpn_unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsr6171.tmp\vpn_unicode.ini
Size 1KB
SHA256 a92335f6eb3442cdd84f7bad772db6a2f5d1f73633c307743bc88ec472dc0444
MD5 9edf5f809e12e0be466cceccfc95a6f9
SHA1 b65e00c5f2e2392fa79431792cbdee802189ff04
SHA512 016b21000489a61f90860655a20e0e7a10cd4d65d61c304b8a6fe80eb50d3c9454c89d50c7b0303840e55f900b0e02694fc196478139025043313f6f61ddcd95
TLSH
T15B31A9036BF94108F4FBBB54EAF541358B7A3C95AA3CC18E40E1094E01F5A8099A77EB
MD5 SHA1 SHA512 TLSH

Submit Download

tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa.ini

Path C:\Windows\System32\DriverStore\FileRepository\tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa.ini
Size 476B
SHA256 5ece2741f505f4a03d2913593d2bb944541ebe2f6284a379647c0fa7aac5468e
MD5 989d2ce8a518d1f918d5f87b7327d0c5
SHA1 745653e89d9b2b48ce9dec12cac4148f8effd0a9
SHA512 880be78461112f98f6d6be6d92be0a697f5e14f076dd5014f6674d6a96f2d94022c9d3750d37a6df5137070c843d41f9202aa6fd25ad6c635f69969d194edd12
TLSH
T143F0A73BB9F84D8E1C4B60AAD2299F74FD09320329771056B2E4C6A11A4B68C6FD1B52
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2964-1151-0x0000023A37130000-0x0000023A382A5000-memory.dmp

Download

memory/2964-1155-0x0000023A37130000-0x0000023A382A5000-memory.dmp

Download

memory/4388-186-0x0000000074800000-0x000000007480A000-memory.dmp

Download

memory/4588-425-0x00000000742B0000-0x00000000742BA000-memory.dmp

Download