CmdID

CmdID / Files

TeamViewer_Service.exe

TeamViewer file version info

Program on Windows 3 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real TeamViewer_Service.exe?

file version info and known copies
Installed inC:\Program Files (x86)\TeamViewer\
Signed byTeamViewer Germany GmbH
ProductTeamViewer, TeamViewer Germany GmbH
DescriptionTeamViewer

3 known copies

15.10.5.0 · C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe · signed by TeamViewer Germany GmbH

8a3a10811e82a119c25c05ec51f962259e6f0330ecae6da33d5c99da410b93e1

15.9.4.0 · C:\program files (x86)\TeamViewer\TeamViewer_Service.exe · signed by TeamViewer Germany GmbH

3657f08ac708ae64f2d5b4bff2eea37da26b437d6b8c4fe07235a34c4c860bc8

15.8.3.0 · C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe · signed by TeamViewer Germany GmbH

3eeb4c2d9b83598846ef36d684072362987e1a33fa693f8901d5c74015af646b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name TeamViewer_Service.exe
lowRemote Access Tool - Team Viewer Session Started On Windows HostJosh Nickels, Qi Nan