CmdID

CmdID / Files

TeamViewer_Desktop.exe

TeamViewer file version info

Program on Windows 3 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real TeamViewer_Desktop.exe?

file version info and known copies
Installed inC:\Program Files (x86)\TeamViewer\
Signed byTeamViewer Germany GmbH
ProductTeamViewer, TeamViewer Germany GmbH
DescriptionTeamViewer

3 known copies

15.10.5.0 · C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe · signed by TeamViewer Germany GmbH

e2d3c2c379a50a3b9121eba1d1e5a465b30f6f3819d844dd884585ef6122c7ec

15.9.4.0 · C:\program files (x86)\TeamViewer\TeamViewer_Desktop.exe · signed by TeamViewer Germany GmbH

c8dc943db46326906b95c3a072ebbd43c32cec41494a263720304a422a3af14c

15.8.3.0 · C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe · signed by TeamViewer Germany GmbH

b36b92f47d98f793c6ebaabdd56c9c17a6c57bf2e233419c48799a0c05bc6fdf

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name TeamViewer_Desktop.exe
lowRemote Access Tool - Team Viewer Session Started On Windows HostJosh Nickels, Qi Nan

Sigma names TeamViewer_Desktop.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.