LOLRMMTHE REMOTE ACCESS CATALOG
GitHub
Catalog / TeamViewer
RMM

TeamViewer

TeamViewer is a remote monitoring and management (RMM) tool.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category
RMM
Research authors
Nasreddine Bencherchali, Michael Haag
Created
2024-08-02
Last modified
2025-12-14
Privileges
user
Free / availability
Yes
Verification required
No
Supported platforms
AndroidChromeOSLinuxWindowsiOSmacOS

Known vulnerabilities

Executables & installation paths

Filename
TeamViewer.exe
OriginalFileName
Not recorded
Description
Not recorded
Product
TeamViewer

Installation paths

C:\Program Files\TeamViewer\
teamviewer_desktop.exe
teamviewer_service.exe
teamviewerhost

Code signing

signer name
TeamViewer GmbH
certificate thumbprint
N/A
tbs sha256
Not recorded
tbs sha1
8A32858C446E0F681927B02BECA029F854B98D31
signer name
TeamViewer Germany GmbH
certificate thumbprint
777A41024CF413CCB49B3434565545C0D78D80E9
tbs sha256
290C3846B4E52E99DD2B7E5FA600BDB51972D7A3CFD37BA67AC1ED362CC1CA93
tbs sha1
Not recorded
signer name
TeamViewer Germany GmbH
certificate thumbprint
N/A
tbs sha256
Not recorded
tbs sha1
EA00EEBFABBB1D7DB243AFE1349D536A812B0EBF
signer name
TeamViewer Germany GmbH
issuer
CN=DigiCert Assured ID Code Signing CA-1
certificate thumbprint
05CDF79B0EFFFF361DAC0363ADAA75B066C49DE0
tbs sha256
DFD5337289D8F9FC748CCC9A7DC597EEEFEA7ABEA5AF736AFFD09CAC8145AADB
tbs sha1
EA00EEBFABBB1D7DB243AFE1349D536A812B0EBF
valid from
2019-12-19T00:00:00+00:00
valid to
2020-12-23T12:00:00+00:00
signer name
TeamViewer GmbH
issuer
CN=DigiCert Assured ID Code Signing CA-1
certificate thumbprint
7709C8FE112562666C7AC973E43831BA9FADBB54
tbs sha256
454E97CEB89961E5C52E60CC9D4E231DE06BF61747113B90850819EE1EBE19E0
tbs sha1
8A32858C446E0F681927B02BECA029F854B98D31
valid from
2019-02-11T00:00:00+00:00
valid to
2019-12-31T12:00:00+00:00

search names

teamviewer_desktop.exe
teamviewer_service.exe

company names

signer names

TeamViewer Germany GmbH
TeamViewer GmbH

FORENSIC EVIDENCE

Disk artifacts

File
C:\Users\<username>\AppData\Local\Temp\TeamViewer\TV15Install.log
Description
N/A
OS
Windows
File
TeamViewer\d\d_Logfile\.log
Description
N/A
OS
Windows
Type
Regex
File
C:\Program Files\TeamViewer\Connections_incoming.txt
Description
N/A
OS
Windows
File
C:\Program Files\TeamViewer\TVNetwork.log
Description
N/A
OS
Windows
File
%LOCALAPPDATA%\Temp\TeamViewer\TV15Install.log
Description
N/A
OS
Windows
File
%APPDATA%\\TeamViewer\\TeamViewer\d\d_Logfile\.log
Description
N/A
OS
Windows
Type
Regex
File
teamviewerqs.exe
Description
N/A
OS
Windows
File
tv_w32.exe
Description
N/A
OS
Windows
File
tv_w64.exe
Description
N/A
OS
Windows
File
tv_x64.exe
Description
N/A
OS
Windows
File
teamviewer.exe
Description
N/A
OS
Windows
File
teamviewer_service.exe
Description
N/A
OS
Windows
File
%LOCALAPPDATA%\TeamViewer\Database\tvchatfilecache.db
Description
SQlite 3 database storing cache about TeamViewer chat
OS
Windows
File
%LOCALAPPDATA%\TeamViewer\RemotePrinting\tvprint.db
Description
SQlite 3 database storing TeamViewer print jobs
OS
Windows
File
%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\TeamViewer.lnk
Description
N/A
OS
Windows
File
C:\Program Files*\TeamViewer\connections*.txt
Description
N/A
OS
Windows
File
C:\Users\*\AppData\Roaming\TeamViewer\MRU\RemoteSupport\*tvc
Description
N/A
OS
Windows

FORENSIC EVIDENCE

Event log artifacts

EventID
7045
ProviderName
Service Control Manager
LogFile
System.evtx
ServiceName
TeamViewer
ImagePath
"C:\\Program Files\\TeamViewer\\TeamViewer_Service.exe"
Description
Service installation event as result of TeamViewer installation.

FORENSIC EVIDENCE

Registry artifacts

Path
HKLM\SOFTWARE\TeamViewer\*
Description
N/A
Path
HKU\<SID>\SOFTWARE\TeamViewer\*
Description
N/A
Path
HKLM\SYSTEM\CurrentControlSet\Services\TeamViewer\*
Description
N/A
Path
HKLM\SOFTWARE\TeamViewer\ConnectionHistory
Description
N/A
Path
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TeamViewer\*
Description
N/A
Path
HKU\SID\SOFTWARE\TeamViewer\MainWindowHandle
Description
N/A
Path
HKU\SID\SOFTWARE\TeamViewer\DesktopWallpaperSingleImage
Description
N/A
Path
HKU\SID\SOFTWARE\TeamViewer\DesktopWallpaperSingleImagePath
Description
N/A
Path
HKU\SID\SOFTWARE\TeamViewer\DesktopWallpaperSingleImagePosition
Description
N/A
Path
HKU\SID\SOFTWARE\TeamViewer\MinimizeToTray
Description
N/A
Path
HKU\SID\SOFTWARE\TeamViewer\MultiMedia\AudioUserSelectedCapturingEndpoint
Description
N/A
Path
HKU\SID\SOFTWARE\TeamViewer\MultiMedia\AudioSendingVolumeV2
Description
N/A
Path
HKU\SID\SOFTWARE\TeamViewer\MultiMedia\AudioUserSelectedRenderingEndpoint
Description
N/A
Path
HKLM\SOFTWARE\TeamViewer\ConnectionHistory
Description
N/A
Path
HKU\SID\SOFTWARE\TeamViewer\ClientWindow_Mode
Description
N/A
Path
HKU\SID\SOFTWARE\TeamViewer\ClientWindowPositions
Description
N/A

FORENSIC EVIDENCE

Network artifacts

Description
Known remote domains
Domains
  • *.teamviewer.com
Ports
Not recorded
Description
N/A
Domains
  • router15.teamviewer.com
Ports
  • 443
Description
N/A
Domains
  • client.teamviewer.com
Ports
  • 443
Description
N/A
Domains
  • taf.teamviewer.com
Ports
  • 443

FORENSIC EVIDENCE

Other artifacts

Type
Mutex
Value
TeamViewer_LogMutex
Type
Mutex
Value
TeamViewerHooks_DynamicMemMutex
Type
Mutex
Value
TeamViewer3_Win32_Instance_Mutex

Detections

Sigma
https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/teamviewer_registry_sigma.yml
Description
Detects potential registry activity of TeamViewer RMM tool
Sigma
https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/teamviewer_network_sigma.yml
Description
Detects potential network activity of TeamViewer RMM tool
Sigma
https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/teamviewer_files_sigma.yml
Description
Detects potential files activity of TeamViewer RMM tool
Sigma
https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/teamviewer_processes_sigma.yml
Description
Detects potential processes activity of TeamViewer RMM tool

References

Acknowledgements

Person
Théo Letailleur
Handle
in/theosyn