Let's use the mmls utility from Brian Carrier's Sleuth Kit: Let's see what we have here. Let's take a closer look at apg.exe and use PPEE: This looks like TeamViewer and is signed as TeamViewer, so does this mean it indeed is TeamViewer. Judging by the file's size, it has nothing to do with the original msi.dll, so it is clearly DLL Search Order Hijacking. Another interesting file is TeamViewer.ini: Here is anti-forensics: according to the configuration file, our "TeamViewer" did not keep any logs, and was apparently used as a RAT (Remote Access Trojan). Well, not bad. To extract data from it, you can use RegRipper again. Let's take a look, at WinPrintSvc.exe, for instance: Remote Utilities is another remote management tool. Apparently, this is the source of Remote Utilities. If you continue scrolling through the timeline, you will see traces of a rather suspicious directory and file being created: Despite the strange extension, fnbfdnja.hej has a familiar header: What will a checksum search on VirusTotal show us. We already know that it is RTM, and since it is RTM, the most likely vector of infection is a phishing email. In this case, the victim used Microsoft Outlook, so we found the .ost file with mail data in its usual location, and in it — the exact phishing email we have been looking for: On a final note, let us check one more interesting artifact