dialog
initDialog
show
Overview
overview
7Static
static
32ed504c107...18.exe
windows7-x64
32ed504c107...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ta.dll
windows7-x64
3$PLUGINSDI...ta.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3TeamViewer.exe
windows7-x64
7TeamViewer.exe
windows10-2004-x64
7TeamViewer...op.exe
windows7-x64
3TeamViewer...op.exe
windows10-2004-x64
3TeamViewer...en.dll
windows7-x64
1TeamViewer...en.dll
windows10-2004-x64
1TeamViewer...ce.exe
windows7-x64
1TeamViewer...ce.exe
windows10-2004-x64
1TeamViewer...es.dll
windows7-x64
1TeamViewer...es.dll
windows10-2004-x64
1tv_w32.dll
windows7-x64
1tv_w32.dll
windows10-2004-x64
1tv_w32.exe
windows7-x64
1tv_w32.exe
windows10-2004-x64
1tv_x64.dll
windows7-x64
1tv_x64.dll
windows10-2004-x64
1tv_x64.exe
windows7-x64
1tv_x64.exe
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2ed504c1074d19681e8b7ace1d7c8819_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2ed504c1074d19681e8b7ace1d7c8819_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ReadCustomerData.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ReadCustomerData.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
TeamViewer.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
TeamViewer.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
TeamViewer_Desktop.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
TeamViewer_Desktop.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
TeamViewer_Resource_en.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
TeamViewer_Resource_en.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
TeamViewer_Service.exe
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
TeamViewer_Service.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
TeamViewer_StaticRes.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
TeamViewer_StaticRes.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
tv_w32.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
tv_w32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
tv_w32.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
tv_w32.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
tv_x64.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
tv_x64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
tv_x64.exe
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
tv_x64.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
2ed504c1074d19681e8b7ace1d7c8819_JaffaCakes118
-
Size
3.0MB
-
MD5
2ed504c1074d19681e8b7ace1d7c8819
-
SHA1
5b21ed3c7eba273abe62862057a9e386cf7e2097
-
SHA256
552b1d5034fdc75a990bd7942ac7f2d3c8a915bb18bb92933c4a93c1812a573c
-
SHA512
5e5bd8908ad51c4e1dd001d4af51bf04c5b93fa5895e1b648c5e4b00553d01760b0a608f0cc7527f3ab06c3e2d3634a3a6943892b7f9430ffd3d65e36409d625
-
SSDEEP
49152:soPgXl99q0F1qwGdYZmzZYp4NNk6xXxtGd8Wgd9fpABRgphcsODsuXW/wbv:s/Xljq0F1udYqYFW+9yx+vsyWYb
Score
3/10
Malware Config
Signatures
-
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource 2ed504c1074d19681e8b7ace1d7c8819_JaffaCakes118 unpack001/$PLUGINSDIR/InstallOptions.dll unpack001/$PLUGINSDIR/ReadCustomerData.dll unpack001/$PLUGINSDIR/System.dll unpack001/$PLUGINSDIR/TvGetVersion.dll unpack001/$PLUGINSDIR/nsis7z.dll -
NSIS installer 2 IoCs
resource yara_rule sample nsis_installer_1 sample nsis_installer_2
Files
-
2ed504c1074d19681e8b7ace1d7c8819_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 44KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/InstallOptions.dll.dll windows:4 windows x86 arch:x86
b1cd0d78f652ce5fc63f0879371af012
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc
user32
MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect
gdi32
SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject
shell32
SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Exports
Exports
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/ReadCustomerData.dll.dll windows:4 windows x86 arch:x86
d29e408dd9048e10d5936c6f2bfca832
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
MultiByteToWideChar
GetLastError
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
CloseHandle
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
RtlUnwind
RaiseException
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers
VirtualAlloc
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
InitializeCriticalSection
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetEndOfFile
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GlobalFree
lstrcpyA
Exports
Exports
ReadCustomerData
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/System.dll.dll windows:4 windows x86 arch:x86
2017f2acbdaa42ab3e4adeb8b4c37e7b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Exports
Exports
Alloc
Call
Copy
Free
Get
Int64Op
Store
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/TvGetVersion.dll.dll windows:4 windows x86 arch:x86
88d67657017b9d8004b8a2d8a16f30a6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shlwapi
SHDeleteKeyA
SHCopyKeyA
kernel32
LocalFree
InterlockedDecrement
GetModuleFileNameA
RtlUnwind
CreateDirectoryA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
MoveFileA
DeleteFileA
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetFullPathNameA
GetCurrentDirectoryA
ExitProcess
GetVersionExA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
Sleep
GetLocaleInfoA
HeapSize
VirtualAlloc
HeapReAlloc
WriteFile
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSection
SetFilePointer
GetTimeZoneInformation
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
lstrcpynA
lstrcpyA
lstrlenA
lstrcatA
GetDriveTypeA
CreateFileA
GetFileSize
GlobalAlloc
ReadFile
CloseHandle
GlobalFree
GetLastError
GetCurrentProcessId
GetModuleHandleA
GetProcAddress
lstrcmpiA
FreeEnvironmentStringsA
GetStringTypeW
user32
GetSystemMetrics
wsprintfA
SendMessageA
winspool.drv
EnumPrintProcessorsA
EnumPrinterDriversA
advapi32
RegEnumValueA
RegCreateKeyExA
RegDeleteValueA
LookupAccountNameA
ConvertSidToStringSidA
DeleteService
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegFlushKey
RegSetValueExA
RegQueryValueExA
GetUserNameA
shell32
ShellExecuteA
SHFileOperationA
ole32
CoUninitialize
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun
CoInitialize
oleaut32
VariantClear
SysAllocString
GetErrorInfo
SysFreeString
Exports
Exports
AddAuthorizedApplication
CopyRegKeyWithRollback
CopyRegValueWithRollback
CreateDirWithRollback
DeleteRegKeyWithRollback
DeleteRegValueWithRollback
GetCurrentSessionId
GetServiceStatus
GetUserSID
IsNetPath
IsPrintProcessorInstalled
IsPrinterDriverInstalled
IsServiceInstalled
IsTvPasswordSet
LoadFile
RegCopyKey
RegCopyValue
RemoveAuthorizedApplication
RemoveService
RemoveServiceWait
RollbackFileChanges
RollbackRegChanges
RunService
RunServiceWait
StopService
StopServiceWait
TvIsHomeServer
TvIsServer
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsVersion
WindowsVersionMajor
WindowsVersionMinor
WriteRegValueWithRollback
Sections
.text Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/nsis7z.dll.dll windows:4 windows x86 arch:x86
b22ed27c346f001ed1b4410c1073cfa9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
LoadLibraryA
GetModuleFileNameA
RemoveDirectoryW
MoveFileA
MoveFileW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
GetFullPathNameA
GetFullPathNameW
GetCurrentThreadId
GetCurrentProcessId
SetLastError
CreateFileW
SetFileTime
CloseHandle
SetFileAttributesA
SetFileAttributesW
RemoveDirectoryA
FindClose
FindFirstFileA
FindFirstFileW
CreateFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetProcAddress
GetCurrentProcess
GetSystemInfo
GetModuleHandleA
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
DeleteCriticalSection
AreFileApisANSI
VirtualFree
VirtualAlloc
GetVersionExA
ResetEvent
WaitForSingleObject
SetEvent
InitializeCriticalSection
CreateEventA
SetFileApisToOEM
SetFileApisToANSI
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapAlloc
HeapFree
HeapReAlloc
ExitThread
CreateThread
GetCommandLineA
GetProcessHeap
HeapDestroy
HeapCreate
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
Sleep
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
VirtualQuery
user32
CharUpperW
CharUpperA
GetDlgItem
FindWindowExA
SetWindowTextA
wsprintfA
SendMessageA
oleaut32
VariantCopy
VariantClear
SysAllocString
Exports
Exports
Extract
ExtractWithCallback
ExtractWithDetails
Sections
.text Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/wincheck.ini
-
$_2_/tvqsfiles.7z.7z
-
TeamViewer.exe.exe windows:5 windows x86 arch:x86
06ff1b63b833db0a9e6fcdb280057163
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
fb:d0:e1:c6:cf:e6:ea:c3:5b:06:dc:e2:e4:45:f9:49:b5:c1:c6:1aSigner
Actual PE Digestfb:d0:e1:c6:cf:e6:ea:c3:5b:06:dc:e2:e4:45:f9:49:b5:c1:c6:1aDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer.pdb
Imports
avicap32
capGetDriverDescriptionW
msvfw32
DrawDibOpen
DrawDibDraw
DrawDibClose
winmm
waveOutGetNumDevs
waveOutUnprepareHeader
waveInClose
waveInReset
waveInStart
waveOutOpen
waveOutPrepareHeader
waveOutWrite
waveInUnprepareHeader
waveInAddBuffer
waveInPrepareHeader
waveInOpen
timeEndPeriod
timeBeginPeriod
mixerSetControlDetails
mixerGetControlDetailsW
mixerClose
mixerGetLineControlsW
mixerGetLineInfoW
mixerGetID
waveOutGetDevCapsW
waveInGetDevCapsW
mixerGetDevCapsW
mixerOpen
waveInGetNumDevs
waveOutClose
waveOutReset
waveOutRestart
waveOutPause
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
kernel32
CompareFileTime
CompareStringW
GetVolumeInformationW
GetDriveTypeW
lstrcpyW
FindFirstFileW
GetFullPathNameW
GetThreadTimes
GetSystemDirectoryA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStringTypeA
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
HeapCreate
GetModuleFileNameA
GetStdHandle
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetDateFormatA
GetTimeFormatA
ExitProcess
GetStartupInfoA
GetCommandLineA
ExitThread
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
CreateWaitableTimerA
CreateFileMappingA
MapViewOfFileEx
CreateFileA
UnmapViewOfFile
FindClose
GetModuleHandleA
GetFileTime
GetFileInformationByHandle
RaiseException
FormatMessageA
GetLocaleInfoA
HeapSize
HeapReAlloc
HeapDestroy
IsProcessorFeaturePresent
LoadLibraryA
lstrlenA
GetComputerNameW
SetFileAttributesW
SetEndOfFile
ReadFileEx
GetOverlappedResult
CancelIo
WaitForMultipleObjectsEx
GetFileAttributesExW
SetFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetFileAttributesW
GlobalSize
GetSystemTime
WaitForSingleObjectEx
GetLogicalDriveStringsW
DeviceIoControl
GetDateFormatW
SystemTimeToTzSpecificLocalTime
GetTempPathW
SystemTimeToFileTime
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
MoveFileExW
CreateProcessW
TerminateProcess
WaitNamedPipeW
ProcessIdToSessionId
GetPrivateProfileIntW
InterlockedCompareExchange
GetQueuedCompletionStatus
TerminateThread
QueueUserAPC
CreateIoCompletionPort
OpenEventA
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
OpenProcess
ExpandEnvironmentStringsW
FormatMessageW
LocalFree
SetThreadAffinityMask
QueryPerformanceCounter
QueryPerformanceFrequency
MoveFileW
SetFilePointer
GetSystemDirectoryW
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileW
GetCurrentThread
ResetEvent
SetThreadPriority
GetPriorityClass
EnterCriticalSection
GetCurrentDirectoryA
PeekNamedPipe
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
RemoveDirectoryW
LocalAlloc
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
CloseHandle
HeapFree
GetProcessHeap
GetCurrentThreadId
SetLastError
CreateEventA
HeapAlloc
SetPriorityClass
TryEnterCriticalSection
VirtualAlloc
VirtualFree
GetLocaleInfoW
DuplicateHandle
GetLocalTime
GetTimeFormatW
DeleteFileW
GetCurrentProcessId
CopyFileW
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
GetModuleHandleW
CreateMutexW
ReleaseMutex
TlsAlloc
TlsFree
GlobalHandle
lstrcmpW
MulDiv
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateThread
ResumeThread
GetExitCodeThread
InterlockedDecrement
WaitForMultipleObjects
ReleaseSemaphore
CreateSemaphoreA
GetModuleFileNameW
CreateDirectoryW
SetErrorMode
SetProcessShutdownParameters
lstrcpynW
GetVersionExW
WritePrivateProfileStringW
GetFileSize
ReadFile
GetPrivateProfileStringW
CreateWaitableTimerW
CreateEventW
InterlockedExchangeAdd
InterlockedExchange
PostQueuedCompletionStatus
SetWaitableTimer
GetSystemTimeAsFileTime
InterlockedIncrement
SleepEx
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GetProcAddress
GlobalAlloc
GlobalLock
CreateFileW
WriteFile
GlobalUnlock
GlobalFree
Sleep
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
GetLastError
GetTickCount
SetEvent
AreFileApisANSI
WaitForSingleObject
user32
BringWindowToTop
GetWindowRect
GetDC
ShowWindow
SetFocus
IsWindow
DestroyWindow
ReleaseDC
GetAsyncKeyState
CreateDialogParamW
SetClassLongW
LoadCursorW
GetSystemMenu
GetMessagePos
DrawEdge
LoadAcceleratorsW
GetActiveWindow
CreatePopupMenu
AppendMenuW
InsertMenuW
InsertMenuItemW
IsMenu
CreateMenu
DestroyMenu
PostMessageW
InvalidateRect
IsWindowVisible
PtInRect
GetCursorPos
GetWindowLongW
UnregisterClassA
BlockInput
GetClassInfoW
RegisterClassW
RegisterClipboardFormatW
EnumDisplayMonitors
SendMessageW
EnumDisplayDevicesW
AttachThreadInput
EnumChildWindows
GetUpdateRgn
LoadBitmapW
SwitchToThisWindow
SetWindowsHookExW
CallNextHookEx
ActivateKeyboardLayout
GetKeyboardLayout
SendInput
GetKeyboardState
ExitWindowsEx
UnhookWindowsHookEx
MapVirtualKeyW
ToUnicode
OpenDesktopW
SetThreadDesktop
CloseDesktop
GetNextDlgTabItem
SetWindowPlacement
GetWindowPlacement
TranslateAcceleratorW
GetMessageW
GetKeyState
GetCursorInfo
GetDlgItemTextW
DrawIcon
DrawIconEx
GetCapture
FrameRect
DrawFocusRect
DrawStateW
MonitorFromWindow
GetSysColorBrush
EnumDisplaySettingsW
SendNotifyMessageW
LoadStringW
CallWindowProcW
DefWindowProcW
MoveWindow
GetClientRect
ScreenToClient
InvalidateRgn
SetTimer
KillTimer
SetCapture
ScrollWindowEx
SetParent
SetScrollInfo
GetClassInfoExW
CopyRect
IsRectEmpty
InflateRect
SendDlgItemMessageW
GetClassLongW
GetWindowThreadProcessId
WindowFromPoint
CopyIcon
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
OffsetRect
DestroyIcon
SetWindowPos
MapWindowPoints
VkKeyScanExW
GetForegroundWindow
ChildWindowFromPointEx
SetForegroundWindow
SetRect
SetMenuInfo
GetLastInputInfo
GetWindow
RegisterClassExW
CreateWindowExW
SystemParametersInfoW
UpdateWindow
SetScrollPos
GetScrollInfo
BeginPaint
EndPaint
SetCursorPos
SetCursor
CreateIconIndirect
ReleaseCapture
MessageBoxA
SetWindowContextHelpId
MapDialogRect
CreateDialogIndirectParamW
RegisterWindowMessageW
CreateAcceleratorTableW
GetFocus
DestroyAcceleratorTable
IsChild
CharNextW
GetSysColor
GetCursor
UnionRect
DestroyCursor
SetActiveWindow
UpdateLayeredWindow
MonitorFromPoint
GetMenuItemCount
IntersectRect
SetLayeredWindowAttributes
RedrawWindow
MsgWaitForMultipleObjects
PostQuitMessage
TrackPopupMenuEx
AdjustWindowRectEx
IsIconic
GetMenu
DrawTextExW
DialogBoxParamW
MessageBoxW
MessageBeep
SetDlgItemTextW
IsWindowEnabled
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
OpenClipboard
GetClipboardViewer
SetClipboardViewer
ChangeClipboardChain
FindWindowW
CheckMenuItem
PeekMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageW
PostThreadMessageW
GetClassNameW
DrawTextW
GetWindowDC
EndDialog
LoadImageW
LoadIconW
MonitorFromRect
GetMonitorInfoW
AdjustWindowRect
GetSystemMetrics
FillRect
SetRectEmpty
ShowScrollBar
ClientToScreen
GetMenuState
IsDialogMessageW
GetDesktopWindow
GetDlgItem
EnableWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetDlgCtrlID
GetSubMenu
LoadMenuW
CheckMenuRadioItem
GetMenuStringW
DeleteMenu
RemoveMenu
TrackMouseEvent
EqualRect
SetWindowRgn
GetParent
SetMenuItemInfoW
GetMenuItemInfoW
EnableMenuItem
SetWindowLongW
gdi32
MoveToEx
GetTextExtentPoint32W
GetTextMetricsW
GetStockObject
SetBkMode
SelectClipRgn
CreatePolygonRgn
SetLayout
ExtTextOutW
GetObjectType
SetBkColor
SetTextColor
SetPixel
SetViewportOrgEx
SetBrushOrgEx
CreateCompatibleBitmap
BitBlt
SelectObject
CreateCompatibleDC
LineTo
CreateFontIndirectW
CombineRgn
CreateRectRgn
StretchBlt
SetStretchBltMode
CreateDIBSection
RealizePalette
SelectPalette
DeleteDC
GetDeviceCaps
DeleteObject
Ellipse
Polygon
Rectangle
SetDIBColorTable
GetClipBox
GetViewportOrgEx
PatBlt
CreatePen
GetPixel
CreatePatternBrush
SetRectRgn
OffsetRgn
GetObjectW
CreateSolidBrush
RoundRect
GetLayout
GetBitmapBits
GetBkMode
GetTextColor
GetRgnBox
CreateFontW
SetWindowOrgEx
CreateBitmap
GetCurrentObject
TextOutW
BeginPath
EndPath
StrokeAndFillPath
CreateRectRgnIndirect
CreatePalette
CreateRoundRectRgn
comdlg32
GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW
advapi32
InitiateSystemShutdownW
GetSidIdentifierAuthority
CryptGenRandom
CryptReleaseContext
RegOpenKeyExW
CryptAcquireContextA
LsaLookupNames
LsaFreeMemory
LsaClose
ConvertSidToStringSidW
LsaOpenPolicy
RegFlushKey
GetUserNameW
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetSecurityInfo
SetSecurityInfo
CreateProcessAsUserW
LogonUserW
LookupAccountSidW
LookupAccountNameW
EqualSid
FreeSid
RegCreateKeyW
RegOpenCurrentUser
StartServiceW
CloseServiceHandle
SetEntriesInAclW
GetNamedSecurityInfoW
GetAce
DeleteAce
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RevertToSelf
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
shell32
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
SHBrowseForFolderW
DragAcceptFiles
SHGetSpecialFolderPathW
ord680
SHGetFileInfoW
SHGetSpecialFolderLocation
ord155
ExtractIconExW
DragQueryFileW
ExtractIconW
SHAppBarMessage
ShellExecuteExW
Shell_NotifyIconW
DragFinish
ole32
OleDuplicateData
CoGetInterfaceAndReleaseStream
PropVariantClear
CLSIDFromString
CoCreateInstance
DoDragDrop
ReleaseStgMedium
CoMarshalInterThreadInterfaceInStream
CoCreateGuid
RegisterDragDrop
RevokeDragDrop
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoInitializeSecurity
CoTaskMemAlloc
oleaut32
LoadTypeLi
VarUI4FromStr
OleCreatePropertyFrame
SysFreeString
SysStringLen
VariantInit
VariantClear
SysAllocStringLen
SysAllocString
LoadRegTypeLi
OleCreateFontIndirect
shlwapi
PathCompactPathW
comctl32
ImageList_GetIconSize
InitCommonControlsEx
ImageList_SetBkColor
ImageList_Create
ImageList_Destroy
ImageList_Remove
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragMove
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Draw
ws2_32
socket
select
getsockname
__WSAFDIsSet
ntohl
htonl
inet_addr
ioctlsocket
shutdown
setsockopt
recv
closesocket
ntohs
WSACreateEvent
htons
connect
sendto
WSAResetEvent
WSACloseEvent
WSAWaitForMultipleEvents
WSAEventSelect
WSASetEvent
bind
recvfrom
accept
listen
WSASetLastError
WSARecv
WSARecvFrom
WSASend
WSASocketW
WSADuplicateSocketW
gethostbyname
WSAGetLastError
inet_ntoa
send
getpeername
WSACleanup
WSAStartup
getservbyname
gethostbyaddr
getservbyport
WSAAddressToStringA
getsockopt
msimg32
AlphaBlend
mpr
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW
netapi32
NetApiBufferFree
NetUserModalsGet
NetServerEnum
NetWkstaGetInfo
NetUserGetInfo
setupapi
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
sensapi
IsNetworkAlive
wininet
InternetSetOptionW
InternetCloseHandle
HttpEndRequestA
InternetOpenW
HttpQueryInfoW
InternetReadFile
InternetQueryDataAvailable
InternetWriteFile
InternetConnectW
HttpSendRequestA
InternetErrorDlg
InternetQueryOptionW
InternetGoOnlineA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
iphlpapi
GetIpAddrTable
GetBestInterface
GetAdaptersInfo
GetAdapterIndex
DeleteIPAddress
FlushIpNetTable
IpRenewAddress
SendARP
GetIfEntry
imagehlp
ImageGetCertificateData
ImageGetCertificateHeader
ImageEnumerateCertificates
secur32
GetUserNameExW
crypt32
CryptHashCertificate
CertFreeCertificateContext
CertGetNameStringW
CryptVerifyMessageSignature
wintrust
WinVerifyTrust
userenv
CreateEnvironmentBlock
UnloadUserProfile
DestroyEnvironmentBlock
LoadUserProfileW
wtsapi32
WTSQuerySessionInformationW
WTSCloseServer
WTSEnumerateSessionsW
WTSFreeMemory
WTSEnumerateProcessesW
mswsock
AcceptEx
GetAcceptExSockaddrs
Sections
.text Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 221KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 503KB - Virtual size: 503KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
TeamViewer_Desktop.exe.exe windows:5 windows x86 arch:x86
a8a7799a0300a0e639e26eb9d35b7df2
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
87:32:3e:18:82:bd:ab:e3:7d:f4:87:9f:6f:b2:10:5f:4f:1f:7f:d1Signer
Actual PE Digest87:32:3e:18:82:bd:ab:e3:7d:f4:87:9f:6f:b2:10:5f:4f:1f:7f:d1Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer_Desktop.pdb
Imports
wtsapi32
WTSEnumerateProcessesW
WTSEnumerateSessionsW
WTSFreeMemory
kernel32
GetCurrentProcess
lstrlenW
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetModuleHandleW
lstrcmpiW
FreeLibrary
GetThreadTimes
SetEnvironmentVariableA
CreateFileA
SetStdHandle
MultiByteToWideChar
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
FlushInstructionCache
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
GetModuleFileNameA
GetStdHandle
ExitProcess
CompareStringW
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
SizeofResource
LoadResource
FindResourceW
LockResource
LoadLibraryExW
GetModuleFileNameW
SetProcessShutdownParameters
GetProcessShutdownParameters
GetCurrentProcessId
GetCommandLineW
SleepEx
GetExitCodeThread
SetWaitableTimer
PostQueuedCompletionStatus
InterlockedExchangeAdd
QueueUserAPC
CreateEventW
CreateWaitableTimerW
lstrcpyW
DeviceIoControl
CreateFileW
Sleep
LocalFree
LocalAlloc
LoadLibraryW
GetCurrentThread
CreateMutexA
TlsAlloc
TlsFree
DuplicateHandle
FindResourceExW
WriteConsoleW
RaiseException
InterlockedExchange
WaitForMultipleObjects
GetLastError
SetLastError
ReleaseSemaphore
CreateSemaphoreA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
SetEvent
GetDateFormatA
GetTimeFormatA
GetStartupInfoA
GetCommandLineA
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
CreateWaitableTimerA
GetSystemInfo
AreFileApisANSI
GetModuleHandleA
WaitForSingleObject
HeapAlloc
CreateEventA
FormatMessageA
GetLocaleInfoA
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
SetEndOfFile
ReadFileEx
GetOverlappedResult
CancelIo
WaitForMultipleObjectsEx
GetSystemTime
CreateThread
GetProcessHeap
HeapFree
CloseHandle
GetTickCount
FlushFileBuffers
ResumeThread
GetFileAttributesW
SetFileAttributesW
GlobalLock
GlobalUnlock
FileTimeToSystemTime
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
GetSystemDirectoryW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
GetFileSize
WriteFile
SetFilePointer
ReleaseMutex
CreateMutexW
CreateDirectoryW
QueryPerformanceFrequency
QueryPerformanceCounter
SetThreadAffinityMask
GetVersionExW
WideCharToMultiByte
FormatMessageW
GetLocalTime
OpenProcess
TerminateProcess
ProcessIdToSessionId
ReadFile
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
OpenEventA
ResetEvent
CreateIoCompletionPort
TerminateThread
GetQueuedCompletionStatus
InterlockedCompareExchange
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SystemTimeToFileTime
user32
DestroyWindow
GetClassNameW
GetWindowInfo
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
IsZoomed
ShowWindow
SetWindowPos
GetForegroundWindow
SystemParametersInfoW
EqualRect
IntersectRect
OffsetRect
IsRectEmpty
PtInRect
SetRectEmpty
CopyRect
InflateRect
InvalidateRect
IsWindow
GetCursorPos
SendMessageW
LockWorkStation
EnumWindows
MapWindowPoints
FindWindowW
FindWindowExW
SetWindowsHookExW
UnhookWindowsHookEx
GetCursorInfo
GetIconInfo
DrawTextW
GetSystemMetrics
GetWindowRgn
IsWindowEnabled
WindowFromPoint
GetDesktopWindow
CallNextHookEx
GetWindow
GetWindowDC
UnionRect
RedrawWindow
GetWindowThreadProcessId
GetGUIThreadInfo
GetParent
GetDC
ReleaseDC
FillRect
GetWindowLongW
CallWindowProcW
DefWindowProcW
GetClientRect
SetLayeredWindowAttributes
MsgWaitForMultipleObjectsEx
GetUserObjectInformationW
LoadStringW
OpenInputDesktop
SetThreadDesktop
ExitWindowsEx
EnumDisplayDevicesW
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayMonitors
ScreenToClient
SetWindowLongW
GetDlgItem
LoadBitmapW
GetAsyncKeyState
LoadImageW
ToUnicode
MapVirtualKeyW
VkKeyScanExW
GetKeyboardState
GetKeyState
GetKeyboardLayout
ActivateKeyboardLayout
RegisterClipboardFormatW
UnregisterClassA
GetThreadDesktop
BlockInput
KillTimer
SetTimer
OpenDesktopW
EnumDesktopWindows
CloseDesktop
PostThreadMessageW
IsWindowVisible
PostMessageW
SendInput
SendNotifyMessageW
MessageBoxA
PostQuitMessage
MessageBoxW
CreateDialogParamW
CreateWindowExW
RegisterClassExW
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
GetClassInfoExW
gdi32
DeleteObject
SetBkMode
GetSystemPaletteEntries
GetDIBits
GetDeviceCaps
StretchBlt
CreateCompatibleDC
GetObjectW
RectInRegion
CreateRectRgnIndirect
CreateDIBSection
SetPixel
CreateDCW
GetTextExtentPoint32W
SetBkColor
CreatePen
DeleteDC
CreateSolidBrush
TextOutW
RoundRect
GetDCOrgEx
BitBlt
PtInRegion
GetRgnBox
OffsetRgn
SetRectRgn
Rectangle
SelectClipRgn
SelectObject
GetRegionData
CombineRgn
CreateRectRgn
CreateCompatibleBitmap
GetStockObject
CreatePatternBrush
CreateFontIndirectW
ExtCreateRegion
GdiFlush
advapi32
GetSidIdentifierAuthority
StartServiceW
CloseServiceHandle
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
GetUserNameW
RegFlushKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenCurrentUser
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
InitiateSystemShutdownW
RevertToSelf
FreeSid
EqualSid
LookupAccountNameW
LookupAccountSidW
LogonUserW
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
AllocateAndInitializeSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
ImpersonateLoggedOnUser
RegCreateKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
SHGetMalloc
ole32
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitializeSecurity
OleUninitialize
OleInitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
ReleaseStgMedium
oleaut32
SafeArrayGetElement
VariantClear
SafeArrayGetDim
VarUI4FromStr
SysAllocString
SysFreeString
VariantInit
VariantCopy
VariantChangeType
comctl32
ImageList_Draw
InitCommonControlsEx
msimg32
AlphaBlend
ws2_32
ioctlsocket
htonl
shutdown
gethostbyname
getsockname
getsockopt
closesocket
listen
WSAGetLastError
inet_ntoa
inet_addr
WSAAddressToStringA
select
WSASocketW
WSASend
WSARecv
WSACleanup
WSAStartup
setsockopt
WSASetLastError
ntohl
htons
__WSAFDIsSet
accept
bind
connect
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
imagehlp
ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData
crypt32
CryptHashCertificate
CertFreeCertificateContext
CertGetNameStringW
CryptVerifyMessageSignature
wintrust
WinVerifyTrust
netapi32
NetApiBufferFree
NetUserModalsGet
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 409KB - Virtual size: 408KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 203KB - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
TeamViewer_Resource_en.dll.dll windows:5 windows x86 arch:x86
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
07:78:85:b8:69:67:21:b8:5a:d1:8f:c6:6b:56:37:c5:3a:27:2e:f9Signer
Actual PE Digest07:78:85:b8:69:67:21:b8:5a:d1:8f:c6:6b:56:37:c5:3a:27:2e:f9Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.rsrc Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
TeamViewer_Service.exe.exe windows:5 windows x86 arch:x86
16390213abc6fd8bbe87e56bd0a98b21
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
9b:4b:4d:94:22:18:46:6d:1d:a3:ac:03:d6:d0:d8:3c:86:02:3e:d8Signer
Actual PE Digest9b:4b:4d:94:22:18:46:6d:1d:a3:ac:03:d6:d0:d8:3c:86:02:3e:d8Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer_Service.pdb
Imports
kernel32
TlsAlloc
InterlockedExchangeAdd
PostQueuedCompletionStatus
TlsFree
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
GetModuleFileNameW
lstrcmpiW
SetConsoleCtrlHandler
SetLastError
GetLastError
Sleep
GetThreadTimes
GetSystemDirectoryA
ExpandEnvironmentStringsA
lstrlenA
SetEnvironmentVariableA
CreateFileA
SetStdHandle
WriteConsoleW
WriteConsoleA
LoadLibraryA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentDirectoryA
PeekNamedPipe
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
GetExitCodeThread
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetConsoleOutputCP
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
CompareStringW
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
GetDateFormatA
GetTimeFormatA
ExitThread
FileTimeToSystemTime
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
GetSystemDirectoryW
FreeLibrary
CloseHandle
CreateFileW
GetProcAddress
LoadLibraryW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentProcess
GetCurrentProcessId
GetSystemTimeAsFileTime
ReleaseSemaphore
WaitForSingleObject
CreateEventA
CreateSemaphoreA
DuplicateHandle
SetEvent
GetTickCount
GetFileSize
SleepEx
InitializeCriticalSection
DeleteCriticalSection
SetWaitableTimer
WriteFile
SetFilePointer
ReleaseMutex
CreateMutexW
CreateDirectoryW
MoveFileW
CreateEventW
CreateWaitableTimerW
LocalFree
OpenProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThread
SetThreadAffinityMask
GetVersionExW
WideCharToMultiByte
FormatMessageW
MultiByteToWideChar
GetLocalTime
ProcessIdToSessionId
WaitNamedPipeW
TerminateProcess
ReadFile
CreateProcessW
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
HeapFree
GetProcessHeap
TlsGetValue
TlsSetValue
OpenEventA
ResetEvent
HeapAlloc
CreateIoCompletionPort
QueueUserAPC
TerminateThread
GetQueuedCompletionStatus
InterlockedCompareExchange
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SystemTimeToFileTime
DeviceIoControl
GetVolumeInformationW
RaiseException
lstrlenW
GetModuleHandleW
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
ResumeThread
CreateThread
SetThreadPriority
GetOverlappedResult
GetComputerNameW
GetLocaleInfoA
FormatMessageA
SetEndOfFile
GetFileAttributesW
GetFileInformationByHandle
SetFileAttributesW
GetModuleHandleA
AreFileApisANSI
CreateWaitableTimerA
RtlUnwind
UnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
user32
MsgWaitForMultipleObjectsEx
MessageBoxA
FindWindowW
SendMessageW
PostThreadMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
ExitWindowsEx
MessageBoxW
CharNextW
DestroyWindow
advapi32
InitiateSystemShutdownW
RevertToSelf
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetNamedSecurityInfoW
DeleteAce
GetAce
GetNamedSecurityInfoW
SetEntriesInAclW
CloseServiceHandle
StartServiceW
QueryServiceStatus
ControlService
DeleteService
FreeSid
EqualSid
LookupAccountSidW
LogonUserW
RegCloseKey
RegOpenCurrentUser
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RegQueryValueExW
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
CreateProcessAsUserW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LsaLookupNames
LsaFreeMemory
LsaClose
ConvertSidToStringSidW
LsaOpenPolicy
GetUserNameW
RegFlushKey
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetSecurityInfo
SetSecurityInfo
ole32
CoInitializeSecurity
OleInitialize
StringFromGUID2
OleUninitialize
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
oleaut32
VarUI4FromStr
SysAllocString
VariantClear
SysFreeString
ws2_32
connect
htons
WSACreateEvent
ntohs
getpeername
WSAResetEvent
socket
send
getsockname
__WSAFDIsSet
ntohl
inet_addr
ioctlsocket
getsockopt
setsockopt
recv
closesocket
gethostbyname
WSAGetLastError
WSACloseEvent
WSAWaitForMultipleEvents
WSAEventSelect
WSASetEvent
bind
htonl
recvfrom
shutdown
WSAStartup
WSACleanup
inet_ntoa
accept
listen
WSASetLastError
WSARecv
WSASend
WSASocketW
WSADuplicateSocketW
sendto
select
WSARecvFrom
getservbyname
gethostbyaddr
getservbyport
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
setupapi
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
sensapi
IsNetworkAlive
wininet
HttpEndRequestA
InternetQueryDataAvailable
InternetReadFile
HttpSendRequestExA
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetWriteFile
InternetConnectW
HttpSendRequestA
InternetErrorDlg
InternetQueryOptionW
InternetGoOnlineA
HttpOpenRequestA
HttpAddRequestHeadersA
InternetCloseHandle
iphlpapi
GetBestInterface
GetIfEntry
SendARP
IpRenewAddress
FlushIpNetTable
DeleteIPAddress
GetAdapterIndex
GetAdaptersInfo
GetIpAddrTable
imagehlp
ImageGetCertificateData
ImageGetCertificateHeader
ImageEnumerateCertificates
secur32
GetUserNameExW
crypt32
CryptHashCertificate
CertFreeCertificateContext
CryptVerifyMessageSignature
CertGetNameStringW
wintrust
WinVerifyTrust
userenv
UnloadUserProfile
LoadUserProfileW
CreateEnvironmentBlock
DestroyEnvironmentBlock
wtsapi32
WTSQuerySessionInformationW
WTSCloseServer
WTSEnumerateProcessesW
WTSFreeMemory
WTSEnumerateSessionsW
shell32
ShellExecuteExW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
mswsock
GetAcceptExSockaddrs
AcceptEx
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 533KB - Virtual size: 532KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 53KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 213KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
TeamViewer_StaticRes.dll.dll windows:5 windows x86 arch:x86
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
33:c1:26:d5:ae:65:6e:42:62:b2:2c:88:98:e9:ea:96:0a:4b:26:c1Signer
Actual PE Digest33:c1:26:d5:ae:65:6e:42:62:b2:2c:88:98:e9:ea:96:0a:4b:26:c1Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.rsrc Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
tv_w32.dll.dll windows:5 windows x86 arch:x86
714e5bc40dee78cd885497d6a83a0771
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0c:2e:1f:58:4a:e7:aa:43:c9:e7:cd:72:c5:32:f3:35:1c:25:24:4bSigner
Actual PE Digest0c:2e:1f:58:4a:e7:aa:43:c9:e7:cd:72:c5:32:f3:35:1c:25:24:4bDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_w32dll.pdb
Imports
crtdll
strncat
strncpy
_vsnprintf
_snprintf
_strlwr
strrchr
memmove
memcpy
wcsstr
_wcslwr
_global_unwind2
_local_unwind2
_initterm
malloc
__dllonexit
strncmp
memset
comctl32
InitCommonControlsEx
kernel32
GetFileAttributesExW
HeapAlloc
GlobalLock
DeleteCriticalSection
GetProcAddress
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetLocalTime
InterlockedCompareExchange
GlobalUnlock
DisableThreadLibraryCalls
OpenMutexW
GetModuleFileNameA
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
CreateThread
LocalFree
CreateMutexW
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
SetEvent
GetTickCount
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
LocalAlloc
SetLastError
GlobalFree
GlobalAlloc
GetVersion
QueryPerformanceCounter
GetVersionExW
VirtualProtect
ResumeThread
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
Thread32Next
CloseHandle
GetProcessHeap
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSection
FileTimeToSystemTime
InterlockedExchange
user32
ShowWindow
GetWindow
GetWindowLongW
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
SendMessageW
GetClientRect
IsZoomed
GetWindowInfo
IsRectEmpty
CallWindowProcW
RedrawWindow
MoveWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
EndPaint
BeginPaint
GetActiveWindow
SetWindowLongW
FindWindowExW
FindWindowW
GetClassNameA
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
GetWindowRect
ReleaseDC
IsWindow
IsWindowVisible
SetWindowPos
GetClassInfoExW
LoadCursorW
RegisterClassExW
CallNextHookEx
DestroyWindow
DefWindowProcW
KillTimer
SetTimer
RegisterClipboardFormatW
CreateWindowExW
UnregisterClassW
SendMessageTimeoutW
UnhookWindowsHookEx
SendNotifyMessageW
SetWindowsHookExW
RegisterWindowMessageW
MapWindowPoints
GetWindowDC
gdi32
DeleteObject
GdiFlush
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
Rectangle
GetStockObject
CreatePen
Polyline
ExtCreatePen
LineTo
MoveToEx
CreateSolidBrush
CreateCompatibleBitmap
GetObjectW
SetPixel
GetPixel
RectVisible
DeleteDC
shell32
DragQueryFileW
ole32
ReleaseStgMedium
CoCreateInstance
Exports
Exports
GetLoaderInterface
GetTeamViewerInterface
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
tv_w32.exe.exe windows:5 windows x86 arch:x86
50a1bd551f06f6cf63b0687e32d02be5
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
8f:61:b8:a1:22:f8:65:0f:05:4f:24:9c:84:f8:3e:60:6c:5e:7f:34Signer
Actual PE Digest8f:61:b8:a1:22:f8:65:0f:05:4f:24:9c:84:f8:3e:60:6c:5e:7f:34Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_w32exe.pdb
Imports
kernel32
SetEvent
GetVersionExW
GetLastError
CreateEventW
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
CreateMutexW
SetFilePointer
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringW
HeapFree
HeapAlloc
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
WriteConsoleA
VirtualQuery
user32
PeekMessageW
DispatchMessageW
SendInput
BlockInput
MsgWaitForMultipleObjectsEx
TranslateMessage
shell32
ShellExecuteExW
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
tv_x64.dll.dll windows:5 windows x64 arch:x64
2b7e8ea5f94b83a0c345d3ae26628b16
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
c9:12:6f:1d:8a:de:d1:9b:51:a1:1d:16:fe:45:85:ad:dd:79:48:4cSigner
Actual PE Digestc9:12:6f:1d:8a:de:d1:9b:51:a1:1d:16:fe:45:85:ad:dd:79:48:4cDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_x64dll.pdb
Imports
msvcrt
_onexit
__dllonexit
realloc
calloc
malloc
free
_initterm
_wcslwr
wcsstr
strncmp
memmove
__C_specific_handler
strrchr
_strlwr
_snprintf
_vsnprintf
strncpy
strncat
memcpy
memset
comctl32
InitCommonControlsEx
kernel32
FileTimeToSystemTime
InitializeCriticalSection
GetLastError
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetProcessHeap
CloseHandle
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
ResumeThread
VirtualProtect
GetVersionExW
QueryPerformanceCounter
GlobalUnlock
GetFileAttributesExW
HeapAlloc
GlobalLock
DeleteCriticalSection
GetProcAddress
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetLocalTime
DisableThreadLibraryCalls
OpenMutexW
GetModuleFileNameA
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
CreateThread
LocalFree
CreateMutexW
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
SetEvent
GetTickCount
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
LocalAlloc
SetLastError
user32
SendNotifyMessageW
UnhookWindowsHookEx
SendMessageTimeoutW
UnregisterClassW
CreateWindowExW
RegisterClipboardFormatW
SetTimer
KillTimer
DefWindowProcW
DestroyWindow
CallNextHookEx
RegisterClassExW
LoadCursorW
GetClassInfoExW
SetWindowPos
IsWindowVisible
IsWindow
ReleaseDC
GetWindowRect
GetWindowDC
GetClassNameA
ShowWindow
GetWindow
GetWindowLongPtrW
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
SendMessageW
GetClientRect
IsZoomed
GetWindowInfo
IsRectEmpty
CallWindowProcW
RedrawWindow
MoveWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
GetActiveWindow
SetWindowLongPtrW
EndPaint
BeginPaint
FindWindowExW
FindWindowW
MapWindowPoints
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
RegisterWindowMessageW
SetWindowsHookExW
gdi32
RectVisible
GetPixel
SetPixel
GetObjectW
CreateCompatibleBitmap
CreateSolidBrush
MoveToEx
LineTo
DeleteObject
Polyline
CreatePen
GetStockObject
Rectangle
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
GdiFlush
ExtCreatePen
DeleteDC
shell32
DragQueryFileW
ole32
ReleaseStgMedium
CoCreateInstance
Exports
Exports
GetLoaderInterface
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.shared Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
tv_x64.exe.exe windows:5 windows x64 arch:x64
2c5c62562658e3dcbc628c79afc9f4a7
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
e7:09:b5:d9:b0:a4:0a:8e:8c:ba:71:8d:4b:88:6d:ab:27:f6:ba:c5Signer
Actual PE Digeste7:09:b5:d9:b0:a4:0a:8e:8c:ba:71:8d:4b:88:6d:ab:27:f6:ba:c5Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_x64exe.pdb
Imports
kernel32
SetEvent
GetVersionExW
GetLastError
CreateEventW
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
CreateMutexW
SetFilePointer
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
FlsAlloc
LCMapStringW
HeapFree
HeapAlloc
GetModuleHandleW
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
InitializeCriticalSectionAndSpinCount
HeapReAlloc
user32
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
shell32
ShellExecuteExW
Sections
.text Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$_2_/tvqsfilesx64.7z.7z
-
x64/TVMonitor.inf
-
x64/TVMonitor.sy_.sys windows:6 windows x64 arch:x64
f24b69173de020aa0ac1739d7b40e04c
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before16/07/2004, 00:00Not After15/07/2014, 23:59SubjectCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USNot Before16/01/2008, 00:00Not After22/02/2011, 23:59SubjectCN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
61:0c:12:06:00:00:00:00:00:1bCertificate
IssuerCN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before23/05/2006, 17:01Not After23/05/2016, 17:11SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3bSigner
Actual PE Digest28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3bDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
j:\teamviewer6.0\monitordriver\objfre_wlh_amd64\amd64\TVMonitor.pdb
Imports
ntoskrnl.exe
IoAcquireRemoveLockEx
KeClearEvent
IoDeleteSymbolicLink
_snwprintf
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoReleaseRemoveLockEx
IoDetachDevice
PoRequestPowerIrp
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
IoReleaseRemoveLockAndWaitEx
ObReferenceObjectByHandle
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
KeInitializeTimerEx
KeCancelTimer
KeWaitForMultipleObjects
IofCallDriver
KeBugCheckEx
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
x64/tvmonitor.cat
-
$_2_/tvqsfilesx86.7z.7z
-
x86/TVMonitor.inf
-
x86/TVMonitor.sy_.sys windows:6 windows x86 arch:x86
bc06eb1dad5e8285411e580cdee99e10
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before16/07/2004, 00:00Not After15/07/2014, 23:59SubjectCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USNot Before16/01/2008, 00:00Not After22/02/2011, 23:59SubjectCN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
61:0c:12:06:00:00:00:00:00:1bCertificate
IssuerCN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before23/05/2006, 17:01Not After23/05/2016, 17:11SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83Signer
Actual PE Digesta9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
j:\teamviewer6.0\monitordriver\objfre_wxp_x86\i386\TVMonitor.pdb
Imports
ntoskrnl.exe
RtlInitUnicodeString
_snwprintf
IofCompleteRequest
IoReleaseRemoveLockEx
PoCallDriver
IoAcquireRemoveLockEx
PoStartNextPowerIrp
IofCallDriver
ObfDereferenceObject
IoGetAttachedDeviceReference
IoDeleteDevice
IoDetachDevice
KeWaitForSingleObject
KeSetEvent
PoRequestPowerIrp
IoAttachDeviceToDeviceStack
IoDeleteSymbolicLink
IoInitializeRemoveLockEx
IoCreateSymbolicLink
IoCreateDevice
InterlockedIncrement
IoReleaseRemoveLockAndWaitEx
PsTerminateSystemThread
KeCancelTimer
KeWaitForMultipleObjects
KeSetTimerEx
KeClearEvent
KeInitializeTimerEx
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeTickCount
KeBugCheckEx
KeInitializeEvent
KeGetCurrentThread
hal
KeGetCurrentIrql
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 277B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 384B - Virtual size: 274B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
x86/tvmonitor.cat