Then, it modifies the Team Viewer registry settings. As we said, the Team Viewer components used in this campaign are not the original ones. They are slightly modified. The malware author replaced all the entries of “Teamviewer” strings in Team Viewer components. TeamViewer client registry settings are then HKLMSoftwareGoldstagerVersion5 and HKLMSoftwareCoinstagerVersion5 correspondingly. The launcher sets up several registry values that control how the remote access tool will work. This parameter represents a hash of the password with which a remote user has to connect to Team Viewer client. After that, the starter executes the very Team Viewer client netsvcs.exe