Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\getsysinfo.exe
- %TEMP%\teamviewer\version9\teamviewer_resource_lt.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_nl.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_no.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_pl.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_pt.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_ro.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_ru.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_sk.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_sr.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_sv.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_th.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_tr.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_uk.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_vi.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_zhcn.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_zhtw.dll
- %TEMP%\teamviewer\version9\teamviewer_staticres.dll
- %TEMP%\teamviewer\version9\tv_w32.dll
- %TEMP%\teamviewer\version9\tv_x64.dll
- %TEMP%\teamviewer\version9\tvqsfilesx64.7z
- %TEMP%\teamviewer\version9\x64\tvmonitor.cat
- %TEMP%\teamviewer\version9\x64\tvmonitor.inf
- %TEMP%\teamviewer\version9\x64\tvmonitor.sy_
- %TEMP%\teamviewer\version9\tvinfo.ini
- %APPDATA%\teamviewer\teamviewer9_logfile.log
- %TEMP%\teamviewer\version9\teamviewer_resource_ko.dll
- %WINDIR%\temp\cabbfe5.tmp
- %TEMP%\teamviewer\version9\teamviewer_resource_ja.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_id.dll
- %TEMP%\teamviewerqs.exe
- %TEMP%\smarttinyscan.exe
- %TEMP%\nsx29ee.tmp
- %TEMP%\nsc2a5c.tmp\tvgetversion.dll
- %TEMP%\nsc2a5c.tmp\system.dll
- %TEMP%\teamviewer\version9\tvqsfiles.7z
- %TEMP%\nsc2a5c.tmp\nsis7z.dll
- %TEMP%\teamviewer\version9\teamviewer.exe
- %TEMP%\teamviewer\version9\teamviewer_desktop.exe
- %TEMP%\teamviewer\version9\teamviewer_service.exe
- %TEMP%\teamviewer\version9\tv_w32.exe
- %TEMP%\teamviewer\version9\tv_x64.exe
- %TEMP%\teamviewer\version9\teamviewer_resource_ar.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_bg.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_cs.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_da.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_de.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_el.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_en.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_es.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_fi.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_fr.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_he.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_hr.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_hu.dll
- %TEMP%\teamviewer\version9\teamviewer_resource_it.dll
- %WINDIR%\temp\tarbfe6.tmp
Удаляет следующие файлы
- %TEMP%\teamviewer\version9\tvqsfiles.7z
- %TEMP%\teamviewer\version9\tvqsfilesx64.7z
- %TEMP%\nsc2a5c.tmp\nsis7z.dll
- %TEMP%\nsc2a5c.tmp\system.dll
- %TEMP%\nsc2a5c.tmp\tvgetversion.dll
- %WINDIR%\temp\cabbfe5.tmp
- %WINDIR%\temp\tarbfe6.tmp
Сетевая активность
TCP
Запросы HTTP GET
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK da##.net
- DNS ASK pi###.#eamviewer.com
- DNS ASK ma#####2.teamviewer.com
- DNS ASK cl####.teamviewer.com
- DNS ASK microsoft.com
Другое
Ищет следующие окна
- ClassName: '#32770' WindowName: 'TeamViewer'
- ClassName: '#32770' WindowName: ''
- ClassName: '' WindowName: 'TeamViewer Manager'
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\getsysinfo.exe'
- '%TEMP%\teamviewerqs.exe'
- '%TEMP%\teamviewer\version9\teamviewer.exe'
- '%TEMP%\teamviewer\version9\tv_w32.exe' --action hooks --log %APPDATA%\TeamViewer\TeamViewer9_Logfile.log
- '%TEMP%\teamviewer\version9\tv_x64.exe' --action hooks --log %APPDATA%\TeamViewer\TeamViewer9_Logfile.log
- '%TEMP%\getsysinfo.exe' ' (со скрытым окном)
