Support[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Support.exe
Size

2.9MB
MD5

0ff024b6c48602b3131c9efdc529370c
SHA1

7388ed697a688a1205e7c175a704b016a5703cb0
SHA256

e5c09b3be5db9107e3a4c24c3aa38d52e54637371c39029d6167b344b777054c
SHA512

29ae861505cd88ad2b6ab7d6a537de4a29a2367f81f082a77c564caf7716b05fe2b77a9a61e8ec06cfe3a216fe42e891d80b074ecbb99789c34f52ceea01dea0
SSDEEP

49152:SS6BVgiZEG0Vi14U9goEZG7KnIy1aXsa1Ew41JH/3RLAXbnqkbkxGCCn0UUo6/gd:SSkbW9UmoEcK51crET19/hEnsxzUV64d

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/ReadCustomerData.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/TvGetVersion.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack001/out.upx

NSIS installer 1 IoCs

installer

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

Files

Support.exe
.exe windows:4 windows x86 arch:x86

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:80:5f:99:db:4b:23:34:4d:b2:2e:77:25:d7:12:24:90:89:32:22
Signer

Actual PE Digest

02:80:5f:99:db:4b:23:34:4d:b2:2e:77:25:d7:12:24:90:89:32:22

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 200KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ReadCustomerData.dll
.dll windows:4 windows x86 arch:x86

d29e408dd9048e10d5936c6f2bfca832

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
MultiByteToWideChar
GetLastError
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
CloseHandle
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
RtlUnwind
RaiseException
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers
VirtualAlloc
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
InitializeCriticalSection
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetEndOfFile
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GlobalFree
lstrcpyA

Exports

Exports

ReadCustomerData

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/TvGetVersion.dll
.dll windows:4 windows x86 arch:x86

3e6973f711ba3e93140a87f28c26c445

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GetVersionExA
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
lstrcpynA
GetTickCount
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
WriteFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSection
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
lstrcpyA
lstrlenA
lstrcatA
GetDriveTypeA
CreateFileA
GetFileSize
GlobalAlloc
ReadFile
CloseHandle
GlobalFree
GetLastError
GetCurrentProcessId
GetModuleHandleA
GetProcAddress
QueryPerformanceCounter
lstrcmpiA

user32

GetSystemMetrics
wsprintfA
SendMessageA

winspool.drv

EnumPrinterDriversA
EnumPrintProcessorsA

advapi32

DeleteService
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA

Exports

Exports

GetCurrentSessionId
GetServiceStatus
IsNetPath
IsPrintProcessorInstalled
IsPrinterDriverInstalled
IsServiceInstalled
IsTvPasswordSet
LoadFile
RegCopyKey
RegCopyValue
RemoveService
RemoveServiceWait
RunService
RunServiceWait
StopService
StopServiceWait
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsVersion
WindowsVersionMajor
WindowsVersionMinor

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsis7z.dll
.dll windows:4 windows x86 arch:x86

b22ed27c346f001ed1b4410c1073cfa9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
LoadLibraryA
GetModuleFileNameA
RemoveDirectoryW
MoveFileA
MoveFileW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
GetFullPathNameA
GetFullPathNameW
GetCurrentThreadId
GetCurrentProcessId
SetLastError
CreateFileW
SetFileTime
CloseHandle
SetFileAttributesA
SetFileAttributesW
RemoveDirectoryA
FindClose
FindFirstFileA
FindFirstFileW
CreateFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetProcAddress
GetCurrentProcess
GetSystemInfo
GetModuleHandleA
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
DeleteCriticalSection
AreFileApisANSI
VirtualFree
VirtualAlloc
GetVersionExA
ResetEvent
WaitForSingleObject
SetEvent
InitializeCriticalSection
CreateEventA
SetFileApisToOEM
SetFileApisToANSI
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapAlloc
HeapFree
HeapReAlloc
ExitThread
CreateThread
GetCommandLineA
GetProcessHeap
HeapDestroy
HeapCreate
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
Sleep
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
VirtualQuery

user32

CharUpperW
CharUpperA
GetDlgItem
FindWindowExA
SetWindowTextA
wsprintfA
SendMessageA

oleaut32

VariantCopy
VariantClear
SysAllocString

Exports

Exports

Extract
ExtractWithCallback
ExtractWithDetails

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/wincheck.ini
$_2_/tvqsfiles.7z
.7z
TeamViewer.exe
.exe windows:5 windows x86 arch:x86

b45134ed88a7b2c4d79f4b45ea04aa2e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e1:da:5e:04:9d:3a:d4:ee:05:ac:b8:1f:e4:24:5c:ba:eb:68:a9:7a
Signer

Actual PE Digest

e1:da:5e:04:9d:3a:d4:ee:05:ac:b8:1f:e4:24:5c:ba:eb:68:a9:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer.pdb

Imports

avicap32

capGetDriverDescriptionW

msvfw32

DrawDibOpen
DrawDibClose
DrawDibDraw

winmm

waveInReset
waveInStart
waveOutReset
waveOutOpen
waveOutPrepareHeader
waveOutPause
waveOutWrite
waveOutClose
waveInClose
waveInUnprepareHeader
waveInAddBuffer
waveInPrepareHeader
waveInOpen
timeEndPeriod
timeBeginPeriod
mixerSetControlDetails
mixerGetControlDetailsW
mixerClose
mixerGetLineControlsW
mixerGetLineInfoW
mixerGetID
waveOutGetDevCapsW
waveInGetDevCapsW
mixerGetDevCapsW
mixerOpen
waveOutGetNumDevs
waveOutRestart
waveInGetNumDevs
waveOutUnprepareHeader

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo
GetAdapterIndex
DeleteIPAddress
FlushIpNetTable
IpRenewAddress
SendARP

kernel32

GetThreadTimes
GetSystemDirectoryA
GetVersionExA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStringTypeA
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
HeapCreate
GetModuleFileNameA
GetStdHandle
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetDateFormatA
GetTimeFormatA
ExitProcess
GetStartupInfoA
GetCommandLineA
ExitThread
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
CreateWaitableTimerA
CreateFileMappingA
MapViewOfFileEx
CreateFileA
UnmapViewOfFile
AreFileApisANSI
GetModuleHandleA
GetFileTime
GetFileInformationByHandle
GetVolumeInformationW
RemoveDirectoryW
FormatMessageA
GetLocaleInfoA
HeapSize
HeapReAlloc
HeapDestroy
IsProcessorFeaturePresent
LoadLibraryA
lstrlenA
SetFileAttributesW
SetEndOfFile
ReadFileEx
CompareStringW
CancelIo
GlobalSize
WaitForMultipleObjectsEx
GetFileAttributesExW
GetSystemTime
SetFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetFileAttributesW
WaitForSingleObjectEx
GetLogicalDriveStringsW
DeviceIoControl
GetDateFormatW
SystemTimeToTzSpecificLocalTime
GetTempPathW
SystemTimeToFileTime
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
MoveFileExW
CreateProcessW
TerminateProcess
WaitNamedPipeW
ProcessIdToSessionId
GetPrivateProfileIntW
InterlockedCompareExchange
GetQueuedCompletionStatus
TerminateThread
QueueUserAPC
CreateIoCompletionPort
OpenEventA
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
OpenProcess
ExpandEnvironmentStringsW
FormatMessageW
LocalFree
SetThreadAffinityMask
QueryPerformanceCounter
QueryPerformanceFrequency
MoveFileW
SetFilePointer
GetSystemDirectoryW
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDriveTypeW
lstrcpyW
FindFirstFileW
GetFullPathNameW
FindClose
CompareFileTime
GetCurrentDirectoryA
PeekNamedPipe
GetFullPathNameA
FindNextFileW
GetCurrentThread
ResetEvent
SetThreadPriority
GetPriorityClass
SetPriorityClass
TryEnterCriticalSection
VirtualAlloc
VirtualFree
GetLocaleInfoW
DuplicateHandle
GetLocalTime
GetTimeFormatW
GetComputerNameW
DeleteFileW
GetCurrentProcessId
CopyFileW
GetCommandLineW
HeapFree
FindFirstFileA
GetDriveTypeA
GetOverlappedResult
LocalAlloc
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
CloseHandle
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
GetModuleHandleW
CreateMutexW
ReleaseMutex
TlsAlloc
TlsFree
GlobalHandle
lstrcmpW
MulDiv
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateThread
ResumeThread
GetExitCodeThread
InterlockedDecrement
WaitForMultipleObjects
ReleaseSemaphore
CreateSemaphoreA
GetModuleFileNameW
CreateDirectoryW
SetErrorMode
SetProcessShutdownParameters
lstrcpynW
GetVersionExW
WritePrivateProfileStringW
GetFileSize
ReadFile
GetPrivateProfileStringW
CreateWaitableTimerW
CreateEventW
InterlockedExchangeAdd
InterlockedExchange
PostQueuedCompletionStatus
SetWaitableTimer
GetSystemTimeAsFileTime
InterlockedIncrement
SleepEx
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GetProcAddress
GlobalAlloc
GlobalLock
CreateFileW
WriteFile
GlobalUnlock
GlobalFree
Sleep
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
GetLastError
GetTickCount
SetEvent
WaitForSingleObject
HeapAlloc
CreateEventA
SetLastError
GetCurrentThreadId
GetProcessHeap

user32

GetWindowRect
GetSysColorBrush
SendDlgItemMessageW
GetClassLongW
GetWindowThreadProcessId
WindowFromPoint
CopyIcon
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
ChildWindowFromPointEx
SetForegroundWindow
DrawTextW
SetRect
SetMenuInfo
GetLastInputInfo
MessageBoxA
BringWindowToTop
DrawStateW
SendNotifyMessageW
SendMessageW
SetWindowLongW
ExitWindowsEx
SetFocus
DrawFocusRect
IsWindow
DestroyWindow
ReleaseDC
GetAsyncKeyState
CreateDialogParamW
SetClassLongW
LoadCursorW
GetActiveWindow
CreatePopupMenu
UnregisterClassA
BlockInput
GetDC
GetClassInfoW
RegisterClassW
EnumDisplayMonitors
EnumDisplaySettingsW
EnumDisplayDevicesW
AttachThreadInput
EnumChildWindows
GetUpdateRgn
LoadBitmapW
SwitchToThisWindow
SetWindowsHookExW
CallNextHookEx
ActivateKeyboardLayout
GetKeyboardLayout
SendInput
GetKeyboardState
VkKeyScanExW
UnhookWindowsHookEx
MapVirtualKeyW
ToUnicode
OpenDesktopW
FrameRect
GetCapture
DrawIconEx
DrawIcon
GetDlgItemTextW
GetCursorInfo
GetKeyState
GetMessageW
TranslateAcceleratorW
GetWindowPlacement
SetWindowPlacement
GetNextDlgTabItem
LoadAcceleratorsW
DrawEdge
GetMessagePos
GetSystemMenu
RegisterClipboardFormatW
ShowWindow
SetThreadDesktop
CloseDesktop
LoadStringW
AppendMenuW
InsertMenuW
InsertMenuItemW
IsMenu
CreateMenu
DestroyMenu
PostMessageW
InvalidateRect
IsWindowVisible
PtInRect
GetCursorPos
GetWindowLongW
CallWindowProcW
SetWindowContextHelpId
MapDialogRect
CreateDialogIndirectParamW
RegisterWindowMessageW
CreateAcceleratorTableW
GetFocus
DefWindowProcW
MoveWindow
GetClientRect
ScreenToClient
DestroyAcceleratorTable
IsChild
CharNextW
GetSysColor
GetCursor
InvalidateRgn
SetTimer
KillTimer
SetCapture
ScrollWindowEx
SetParent
SetScrollInfo
GetClassInfoExW
CopyRect
IsRectEmpty
InflateRect
OffsetRect
DestroyIcon
UnionRect
DestroyCursor
SetActiveWindow
UpdateLayeredWindow
MonitorFromPoint
GetMenuItemCount
GetClassNameW
IntersectRect
SetLayeredWindowAttributes
RedrawWindow
MsgWaitForMultipleObjects
PostQuitMessage
TrackPopupMenuEx
AdjustWindowRectEx
IsIconic
GetMenu
DrawTextExW
DialogBoxParamW
MessageBoxW
MessageBeep
SetDlgItemTextW
IsWindowEnabled
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
OpenClipboard
GetClipboardViewer
SetClipboardViewer
ChangeClipboardChain
FindWindowW
GetForegroundWindow
PeekMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageW
PostThreadMessageW
GetWindowDC
EndDialog
LoadImageW
LoadIconW
MonitorFromRect
MonitorFromWindow
GetMonitorInfoW
AdjustWindowRect
GetSystemMetrics
FillRect
SetRectEmpty
ShowScrollBar
ClientToScreen
GetMenuState
IsDialogMessageW
GetDesktopWindow
GetDlgItem
EnableWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetDlgCtrlID
GetSubMenu
LoadMenuW
CheckMenuRadioItem
GetMenuStringW
DeleteMenu
RemoveMenu
TrackMouseEvent
EqualRect
SetWindowRgn
GetParent
SetMenuItemInfoW
GetMenuItemInfoW
EnableMenuItem
CheckMenuItem
ReleaseCapture
CreateIconIndirect
SetCursor
SetCursorPos
EndPaint
BeginPaint
GetScrollInfo
SetScrollPos
UpdateWindow
SystemParametersInfoW
CreateWindowExW
RegisterClassExW
GetWindow
MapWindowPoints
SetWindowPos

gdi32

SetBkMode
SelectClipRgn
CreatePolygonRgn
SetLayout
ExtTextOutW
GetObjectType
SetBkColor
SetTextColor
SetPixel
SetViewportOrgEx
SetBrushOrgEx
CreateCompatibleBitmap
BitBlt
SelectObject
CreateCompatibleDC
GetObjectW
GetStockObject
CombineRgn
CreateRectRgn
StretchBlt
SetStretchBltMode
EndPath
RealizePalette
SelectPalette
DeleteDC
GetDeviceCaps
DeleteObject
CreateRectRgnIndirect
RoundRect
CreateRoundRectRgn
PatBlt
GetTextExtentPoint32W
MoveToEx
LineTo
CreatePen
GetPixel
CreatePatternBrush
SetRectRgn
OffsetRgn
CreateSolidBrush
CreateFontIndirectW
Ellipse
Polygon
Rectangle
SetDIBColorTable
GetClipBox
GetViewportOrgEx
CreateFontW
SetWindowOrgEx
CreateBitmap
GetCurrentObject
TextOutW
CreatePalette
BeginPath
StrokeAndFillPath
GetLayout
GetBitmapBits
GetBkMode
GetTextColor
GetRgnBox
GetTextMetricsW
CreateDIBSection

comdlg32

CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW

advapi32

RegQueryInfoKeyW
InitiateSystemShutdownW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LsaLookupNames
LsaFreeMemory
LsaClose
ConvertSidToStringSidW
LsaOpenPolicy
RegFlushKey
GetUserNameW
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetSecurityInfo
SetSecurityInfo
CreateProcessAsUserW
LogonUserW
LookupAccountSidW
LookupAccountNameW
EqualSid
FreeSid
RegCreateKeyW
RegOpenCurrentUser
StartServiceW
CloseServiceHandle
SetEntriesInAclW
GetNamedSecurityInfoW
GetAce
DeleteAce
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RevertToSelf
RegEnumKeyExW
GetSidIdentifierAuthority
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

ShellExecuteExW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderPathW
DragQueryFileW
ExtractIconW
SHBrowseForFolderW
DragAcceptFiles
Shell_NotifyIconW
ord680
SHGetFileInfoW
SHGetSpecialFolderLocation
ord155
ExtractIconExW
ShellExecuteW
SHAppBarMessage
DragFinish

ole32

RevokeDragDrop
CoMarshalInterThreadInterfaceInStream
CoCreateGuid
ReleaseStgMedium
CoGetInterfaceAndReleaseStream
RegisterDragDrop
OleDuplicateData
DoDragDrop
CoInitializeSecurity
CoTaskMemFree
CoTaskMemRealloc
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CLSIDFromProgID
OleLockRunning
StringFromGUID2
CoCreateInstance
CLSIDFromString
PropVariantClear
CoGetClassObject

oleaut32

LoadRegTypeLi
VariantClear
VariantInit
SysStringLen
SysFreeString
OleCreateFontIndirect
SysAllocString
SysAllocStringLen
LoadTypeLi
VarUI4FromStr
OleCreatePropertyFrame

shlwapi

PathCompactPathW

comctl32

InitCommonControlsEx
ImageList_Draw
ImageList_GetIconSize
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragMove
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetIcon
ImageList_SetBkColor
ImageList_Remove
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon

ws2_32

socket
select
getsockname
__WSAFDIsSet
ntohl
htonl
ioctlsocket
shutdown
setsockopt
recv
ntohs
WSACreateEvent
htons
connect
sendto
send
WSAResetEvent
WSAWaitForMultipleEvents
WSAEventSelect
WSASetEvent
bind
recvfrom
accept
listen
WSASetLastError
WSARecv
WSARecvFrom
WSASend
WSASocketW
WSADuplicateSocketW
gethostbyaddr
getservbyname
getservbyport
WSAAddressToStringA
WSACloseEvent
getpeername
gethostbyname
WSAGetLastError
inet_ntoa
WSAStartup
WSACleanup
getsockopt
closesocket
inet_addr

msimg32

AlphaBlend

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

netapi32

NetWkstaGetInfo
NetApiBufferFree
NetServerEnum
NetUserGetInfo
NetUserModalsGet

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW

sensapi

IsNetworkAlive

wininet

InternetSetOptionW
InternetCloseHandle
InternetQueryDataAvailable
InternetOpenW
HttpQueryInfoW
InternetReadFile
HttpEndRequestA
InternetWriteFile
InternetConnectW
HttpSendRequestA
InternetErrorDlg
InternetQueryOptionW
InternetGoOnlineA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA

imagehlp

ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates

secur32

GetUserNameExW

crypt32

CertFreeCertificateContext
CertGetNameStringW
CryptHashCertificate
CryptVerifyMessageSignature

wintrust

WinVerifyTrust

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile
LoadUserProfileW

wtsapi32

WTSEnumerateProcessesW
WTSCloseServer
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSFreeMemory

mswsock

AcceptEx
GetAcceptExSockaddrs

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 232KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 501KB - Virtual size: 501KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_Desktop.exe
.exe windows:5 windows x86 arch:x86

9d1ac328d1c8fde0b8d69c52da21aca6

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:6e:c4:16:7b:dc:8f:bf:8c:47:01:ab:21:5b:2f:9f:24:06:d2:37
Signer

Actual PE Digest

0a:6e:c4:16:7b:dc:8f:bf:8c:47:01:ab:21:5b:2f:9f:24:06:d2:37

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer_Desktop.pdb

Imports

wtsapi32

WTSEnumerateProcessesW
WTSEnumerateSessionsW
WTSFreeMemory

kernel32

GetCurrentProcess
lstrlenW
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetModuleHandleW
lstrcmpiW
FreeLibrary
MultiByteToWideChar
SizeofResource
FlushInstructionCache
SetEnvironmentVariableA
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LoadResource
GetOEMCP
FindResourceW
LoadLibraryExW
GetModuleFileNameW
SetProcessShutdownParameters
DuplicateHandle
GetProcessShutdownParameters
GetCurrentProcessId
GetCommandLineW
SleepEx
GetExitCodeThread
SetWaitableTimer
PostQueuedCompletionStatus
InterlockedExchangeAdd
QueueUserAPC
CreateEventW
CreateWaitableTimerW
lstrcpyW
DeviceIoControl
CreateFileW
Sleep
LocalFree
LocalAlloc
LoadLibraryW
GetCurrentThread
CreateMutexA
TlsAlloc
RaiseException
InterlockedExchange
WaitForMultipleObjects
GetLastError
SetLastError
ReleaseSemaphore
CreateSemaphoreA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
GetTickCount
GetCurrentThreadId
GetACP
HeapCreate
GetModuleFileNameA
GetStdHandle
ExitProcess
CompareStringW
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
GetDateFormatA
GetTimeFormatA
GetStartupInfoA
GetCommandLineA
ExitThread
SetEvent
WaitForSingleObject
HeapAlloc
RtlUnwind
IsDebuggerPresent
UnhandledExceptionFilter
CreateWaitableTimerA
GetSystemInfo
AreFileApisANSI
GetModuleHandleA
FormatMessageA
GetLocaleInfoA
TlsFree
IsValidCodePage
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
CreateEventA
GetProcessHeap
HeapFree
CloseHandle
GetThreadTimes
LoadLibraryA
SetEndOfFile
ReadFileEx
GetOverlappedResult
CancelIo
WaitForMultipleObjectsEx
FileTimeToSystemTime
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
GetSystemDirectoryW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
QueryPerformanceFrequency
QueryPerformanceCounter
SetThreadAffinityMask
GetVersionExW
WideCharToMultiByte
FormatMessageW
GetLocalTime
GetFileSize
WriteFile
SetFilePointer
ReleaseMutex
CreateMutexW
CreateDirectoryW
OpenProcess
TerminateProcess
ProcessIdToSessionId
ReadFile
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
OpenEventA
ResetEvent
CreateIoCompletionPort
TerminateThread
GetQueuedCompletionStatus
InterlockedCompareExchange
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SystemTimeToFileTime
GlobalUnlock
GlobalLock
SetFileAttributesW
GetFileAttributesW
ResumeThread
CreateThread
LockResource
FindResourceExW
GetSystemTime

user32

GetMessageW
GetClassInfoExW
DestroyWindow
GetWindowRect
GetForegroundWindow
IsWindow
TranslateMessage
SystemParametersInfoW
EqualRect
IntersectRect
OffsetRect
InflateRect
IsRectEmpty
CopyRect
GetClassNameW
PtInRect
SetRectEmpty
DispatchMessageW
LoadCursorW
SetWindowLongW
MonitorFromWindow
SendMessageW
LockWorkStation
EnumWindows
SetWindowPos
FindWindowW
FindWindowExW
SetWindowsHookExW
UnhookWindowsHookEx
GetCursorInfo
GetIconInfo
DrawTextW
GetDC
GetSystemMetrics
GetWindowRgn
IsWindowEnabled
WindowFromPoint
GetDesktopWindow
CallNextHookEx
GetWindow
ReleaseDC
GetWindowDC
LoadStringW
OpenInputDesktop
SetThreadDesktop
ExitWindowsEx
GetMonitorInfoW
EnumDisplayDevicesW
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayMonitors
ScreenToClient
FillRect
GetDlgItem
LoadBitmapW
GetAsyncKeyState
PeekMessageW
LoadImageW
ToUnicode
MapVirtualKeyW
VkKeyScanExW
GetKeyboardState
GetKeyState
GetKeyboardLayout
ActivateKeyboardLayout
RegisterClipboardFormatW
UnregisterClassA
MapWindowPoints
UnionRect
RedrawWindow
GetCursorPos
GetWindowThreadProcessId
GetGUIThreadInfo
GetParent
GetWindowLongW
CallWindowProcW
DefWindowProcW
GetClientRect
SetLayeredWindowAttributes
MsgWaitForMultipleObjectsEx
GetUserObjectInformationW
GetThreadDesktop
BlockInput
KillTimer
SetTimer
OpenDesktopW
EnumDesktopWindows
CloseDesktop
PostThreadMessageW
IsWindowVisible
PostMessageW
SendInput
SendNotifyMessageW
MessageBoxA
PostQuitMessage
MessageBoxW
CreateDialogParamW
CreateWindowExW
RegisterClassExW
CharNextW

gdi32

SelectObject
SetBkMode
GetSystemPaletteEntries
GetDIBits
GetDeviceCaps
StretchBlt
CreateCompatibleDC
GetObjectW
RectInRegion
CreateRectRgnIndirect
CreateDIBSection
SetPixel
CreateDCW
DeleteDC
GetDCOrgEx
BitBlt
PtInRegion
GetRgnBox
OffsetRgn
SetRectRgn
Rectangle
SelectClipRgn
DeleteObject
GetRegionData
CombineRgn
CreateRectRgn
CreateCompatibleBitmap
GetStockObject
RoundRect
CreatePatternBrush
CreateFontIndirectW
CreatePen
GetTextExtentPoint32W
GdiFlush
SetBkColor
CreateSolidBrush
TextOutW
ExtCreateRegion

advapi32

GetSidIdentifierAuthority
StartServiceW
CloseServiceHandle
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
GetUserNameW
RegFlushKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenCurrentUser
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
InitiateSystemShutdownW
RevertToSelf
FreeSid
EqualSid
LookupAccountNameW
LookupAccountSidW
LogonUserW
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
AllocateAndInitializeSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
ImpersonateLoggedOnUser
RegCreateKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitializeSecurity
OleUninitialize
OleInitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
ReleaseStgMedium

oleaut32

VarUI4FromStr
SafeArrayGetDim
SafeArrayGetElement
SysAllocString
VariantClear
SysFreeString
VariantInit
VariantCopy
VariantChangeType

comctl32

ImageList_Draw
InitCommonControlsEx

msimg32

AlphaBlend

ws2_32

ioctlsocket
htonl
shutdown
gethostbyname
getsockname
getsockopt
closesocket
listen
WSAGetLastError
inet_ntoa
inet_addr
WSAAddressToStringA
select
WSASocketW
WSASend
WSARecv
WSACleanup
WSAStartup
setsockopt
WSASetLastError
ntohl
htons
__WSAFDIsSet
accept
bind
connect

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

crypt32

CryptHashCertificate
CertFreeCertificateContext
CertGetNameStringW
CryptVerifyMessageSignature

wintrust

WinVerifyTrust

shell32

SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
ShellExecuteW

netapi32

NetUserModalsGet
NetApiBufferFree

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 407KB - Virtual size: 407KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_Resource_de.dll
.dll windows:5 windows x86 arch:x86

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:a3:d8:6c:4e:bc:a5:69:01:ca:e5:e1:56:58:00:5d:72:6b:31:88
Signer

Actual PE Digest

34:a3:d8:6c:4e:bc:a5:69:01:ca:e5:e1:56:58:00:5d:72:6b:31:88

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TeamViewer_Service.exe
.exe windows:5 windows x86 arch:x86

6215f753fb0fd015dcbd3067d8587144

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:fc:dd:1c:c9:90:12:ea:58:59:83:2c:46:68:6e:5f:d7:cd:ed:c9
Signer

Actual PE Digest

34:fc:dd:1c:c9:90:12:ea:58:59:83:2c:46:68:6e:5f:d7:cd:ed:c9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer_Service.pdb

Imports

kernel32

TlsAlloc
InterlockedExchangeAdd
PostQueuedCompletionStatus
TlsFree
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
GetModuleFileNameW
lstrcmpiW
SetConsoleCtrlHandler
SetLastError
GetLastError
Sleep
GetThreadTimes
GetSystemDirectoryA
GetVersionExA
ExpandEnvironmentStringsA
lstrlenA
SetEnvironmentVariableA
CreateFileA
SetStdHandle
WriteConsoleW
WriteConsoleA
LoadLibraryA
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
HeapSize
HeapReAlloc
VirtualAlloc
GetCurrentDirectoryA
PeekNamedPipe
GetFullPathNameA
FindFirstFileA
GetConsoleOutputCP
GetDriveTypeA
VirtualFree
HeapCreate
GetModuleFileNameA
GetStdHandle
CompareStringW
GetExitCodeThread
GetPrivateProfileStringW
WritePrivateProfileStringW
IsValidLocale
GetPrivateProfileIntW
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
GetDateFormatA
GetTimeFormatA
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
CreateWaitableTimerA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
GetSystemDirectoryW
FreeLibrary
CloseHandle
CreateFileW
GetProcAddress
LoadLibraryW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentProcess
GetCurrentProcessId
GetSystemTimeAsFileTime
ReleaseSemaphore
WaitForSingleObject
CreateEventA
CreateSemaphoreA
DuplicateHandle
SetEvent
GetTickCount
GetFileSize
SleepEx
InitializeCriticalSection
DeleteCriticalSection
SetWaitableTimer
WriteFile
SetFilePointer
ReleaseMutex
CreateMutexW
CreateDirectoryW
MoveFileW
CreateEventW
CreateWaitableTimerW
LocalFree
OpenProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThread
SetThreadAffinityMask
GetVersionExW
WideCharToMultiByte
FormatMessageW
MultiByteToWideChar
GetLocalTime
GetVolumeInformationW
ProcessIdToSessionId
WaitNamedPipeW
TerminateProcess
ReadFile
CreateProcessW
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
HeapFree
GetProcessHeap
TlsGetValue
TlsSetValue
OpenEventA
ResetEvent
HeapAlloc
CreateIoCompletionPort
QueueUserAPC
TerminateThread
GetQueuedCompletionStatus
InterlockedCompareExchange
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SystemTimeToFileTime
DeviceIoControl
RaiseException
lstrlenW
GetModuleHandleW
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
ResumeThread
CreateThread
SetThreadPriority
GetOverlappedResult
GetComputerNameW
GetLocaleInfoA
FormatMessageA
SetEndOfFile
GetFileAttributesW
GetFileInformationByHandle
SetFileAttributesW
GetModuleHandleA
AreFileApisANSI
GetCurrentThreadId

user32

SendMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
DestroyWindow
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
ExitWindowsEx
CharNextW
MessageBoxW
MessageBoxA
FindWindowW

advapi32

InitiateSystemShutdownW
RevertToSelf
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetNamedSecurityInfoW
DeleteAce
GetAce
GetNamedSecurityInfoW
SetEntriesInAclW
CloseServiceHandle
StartServiceW
QueryServiceStatus
ControlService
DeleteService
FreeSid
EqualSid
LookupAccountSidW
LogonUserW
RegCloseKey
RegOpenCurrentUser
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RegQueryValueExW
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LsaLookupNames
LsaFreeMemory
LsaClose
ConvertSidToStringSidW
LsaOpenPolicy
GetUserNameW
RegFlushKey
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetSecurityInfo
SetSecurityInfo
CreateProcessAsUserW
RegQueryInfoKeyW
RegEnumKeyExW

ole32

CoInitializeSecurity
CoCreateGuid
OleUninitialize
StringFromGUID2
OleInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree

oleaut32

VariantClear
SysAllocString
SysFreeString
VarUI4FromStr

ws2_32

htons
WSACreateEvent
ntohs
getpeername
WSAResetEvent
socket
htonl
select
getsockname
__WSAFDIsSet
ntohl
inet_addr
sendto
shutdown
connect
recv
closesocket
gethostbyname
WSAGetLastError
inet_ntoa
WSACleanup
WSAStartup
send
WSACloseEvent
WSAWaitForMultipleEvents
WSAEventSelect
WSASetEvent
bind
recvfrom
setsockopt
accept
listen
getsockopt
getservbyport
getservbyname
gethostbyaddr
WSARecv
WSARecvFrom
WSASend
WSASocketW
WSADuplicateSocketW
ioctlsocket
WSASetLastError

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

netapi32

NetApiBufferFree
NetWkstaGetInfo

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

sensapi

IsNetworkAlive

wininet

HttpSendRequestA
InternetErrorDlg
InternetQueryOptionW
InternetGoOnlineA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetQueryDataAvailable
InternetReadFile
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetCloseHandle
InternetConnectW

iphlpapi

IpRenewAddress
FlushIpNetTable
DeleteIPAddress
GetAdapterIndex
GetAdaptersInfo
SendARP

imagehlp

ImageGetCertificateData
ImageGetCertificateHeader
ImageEnumerateCertificates

secur32

GetUserNameExW

crypt32

CertGetNameStringW
CertFreeCertificateContext
CryptHashCertificate
CryptVerifyMessageSignature

wintrust

WinVerifyTrust

userenv

UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW
WTSCloseServer
WTSEnumerateProcessesW
WTSFreeMemory
WTSEnumerateSessionsW

shell32

SHGetPathFromIDListW
ShellExecuteW
SHGetMalloc
ShellExecuteExW
SHGetSpecialFolderLocation

mswsock

AcceptEx
GetAcceptExSockaddrs

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TeamViewer_StaticRes.dll
.dll windows:5 windows x86 arch:x86

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:af:0d:fd:cf:65:57:23:a2:c3:d3:48:70:c4:67:ea:67:89:e4:78
Signer

Actual PE Digest

0d:af:0d:fd:cf:65:57:23:a2:c3:d3:48:70:c4:67:ea:67:89:e4:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tv_w32.dll
.dll windows:5 windows x86 arch:x86

714e5bc40dee78cd885497d6a83a0771

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

64:6c:b3:4a:df:9d:f2:b0:41:cc:c0:86:ed:58:fe:93:62:c1:18:2b
Signer

Actual PE Digest

64:6c:b3:4a:df:9d:f2:b0:41:cc:c0:86:ed:58:fe:93:62:c1:18:2b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_w32dll.pdb

Imports

crtdll

strncat
strncpy
_vsnprintf
_snprintf
_strlwr
strrchr
memmove
memcpy
wcsstr
_wcslwr
_global_unwind2
_local_unwind2
_initterm
malloc
__dllonexit
strncmp
memset

comctl32

InitCommonControlsEx

kernel32

GetFileAttributesExW
HeapAlloc
GlobalLock
DeleteCriticalSection
GetProcAddress
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetLocalTime
InterlockedCompareExchange
GlobalUnlock
DisableThreadLibraryCalls
OpenMutexW
GetModuleFileNameA
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
CreateThread
LocalFree
CreateMutexW
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
SetEvent
GetTickCount
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
LocalAlloc
SetLastError
GlobalFree
GlobalAlloc
GetVersion
QueryPerformanceCounter
GetVersionExW
VirtualProtect
ResumeThread
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
Thread32Next
CloseHandle
GetProcessHeap
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSection
FileTimeToSystemTime
InterlockedExchange

user32

ShowWindow
GetWindow
GetWindowLongW
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
SendMessageW
GetClientRect
IsZoomed
GetWindowInfo
IsRectEmpty
CallWindowProcW
RedrawWindow
MoveWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
EndPaint
BeginPaint
GetActiveWindow
SetWindowLongW
FindWindowExW
FindWindowW
GetClassNameA
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
GetWindowRect
ReleaseDC
IsWindow
IsWindowVisible
SetWindowPos
GetClassInfoExW
LoadCursorW
RegisterClassExW
CallNextHookEx
DestroyWindow
DefWindowProcW
KillTimer
SetTimer
RegisterClipboardFormatW
CreateWindowExW
UnregisterClassW
SendMessageTimeoutW
UnhookWindowsHookEx
SendNotifyMessageW
SetWindowsHookExW
RegisterWindowMessageW
MapWindowPoints
GetWindowDC

gdi32

DeleteObject
GdiFlush
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
Rectangle
GetStockObject
CreatePen
Polyline
ExtCreatePen
LineTo
MoveToEx
CreateSolidBrush
CreateCompatibleBitmap
GetObjectW
SetPixel
GetPixel
RectVisible
DeleteDC

shell32

DragQueryFileW

ole32

ReleaseStgMedium
CoCreateInstance

Exports

Exports

GetLoaderInterface
GetTeamViewerInterface

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_w32.exe
.exe windows:5 windows x86 arch:x86

50a1bd551f06f6cf63b0687e32d02be5

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:b0:4d:2d:a9:05:88:ce:7b:b1:60:7d:fa:99:85:77:7e:20:2d:97
Signer

Actual PE Digest

12:b0:4d:2d:a9:05:88:ce:7b:b1:60:7d:fa:99:85:77:7e:20:2d:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_w32exe.pdb

Imports

kernel32

SetEvent
GetVersionExW
GetLastError
CreateEventW
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
CreateMutexW
SetFilePointer
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringW
HeapFree
HeapAlloc
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
WriteConsoleA
VirtualQuery

user32

PeekMessageW
DispatchMessageW
SendInput
BlockInput
MsgWaitForMultipleObjectsEx
TranslateMessage

shell32

ShellExecuteExW

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_x64.dll
.dll windows:5 windows x64 arch:x64

2b7e8ea5f94b83a0c345d3ae26628b16

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:66:b4:55:50:bc:5d:3c:97:a3:3f:31:5e:b0:14:73:6e:bf:0e:af
Signer

Actual PE Digest

11:66:b4:55:50:bc:5d:3c:97:a3:3f:31:5e:b0:14:73:6e:bf:0e:af

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_x64dll.pdb

Imports

msvcrt

_onexit
__dllonexit
realloc
calloc
malloc
free
_initterm
_wcslwr
wcsstr
strncmp
memmove
__C_specific_handler
strrchr
_strlwr
_snprintf
_vsnprintf
strncpy
strncat
memcpy
memset

comctl32

InitCommonControlsEx

kernel32

FileTimeToSystemTime
InitializeCriticalSection
GetLastError
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetProcessHeap
CloseHandle
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
ResumeThread
VirtualProtect
GetVersionExW
QueryPerformanceCounter
GlobalUnlock
GetFileAttributesExW
HeapAlloc
GlobalLock
DeleteCriticalSection
GetProcAddress
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetLocalTime
DisableThreadLibraryCalls
OpenMutexW
GetModuleFileNameA
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
CreateThread
LocalFree
CreateMutexW
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
SetEvent
GetTickCount
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
LocalAlloc
SetLastError

user32

SendNotifyMessageW
UnhookWindowsHookEx
SendMessageTimeoutW
UnregisterClassW
CreateWindowExW
RegisterClipboardFormatW
SetTimer
KillTimer
DefWindowProcW
DestroyWindow
CallNextHookEx
RegisterClassExW
LoadCursorW
GetClassInfoExW
SetWindowPos
IsWindowVisible
IsWindow
ReleaseDC
GetWindowRect
GetWindowDC
GetClassNameA
ShowWindow
GetWindow
GetWindowLongPtrW
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
SendMessageW
GetClientRect
IsZoomed
GetWindowInfo
IsRectEmpty
CallWindowProcW
RedrawWindow
MoveWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
GetActiveWindow
SetWindowLongPtrW
EndPaint
BeginPaint
FindWindowExW
FindWindowW
MapWindowPoints
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
RegisterWindowMessageW
SetWindowsHookExW

gdi32

RectVisible
GetPixel
SetPixel
GetObjectW
CreateCompatibleBitmap
CreateSolidBrush
MoveToEx
LineTo
DeleteObject
Polyline
CreatePen
GetStockObject
Rectangle
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
GdiFlush
ExtCreatePen
DeleteDC

shell32

DragQueryFileW

ole32

ReleaseStgMedium
CoCreateInstance

Exports

Exports

GetLoaderInterface

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 310B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tv_x64.exe
.exe windows:5 windows x64 arch:x64

2c5c62562658e3dcbc628c79afc9f4a7

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/08/2011, 00:00

Not After

07/08/2014, 23:59

Subject

CN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:72:60:c0:5f:48:fc:2a:90:70:66:3c:cd:37:ab:bd:f4:83:af:c6
Signer

Actual PE Digest

06:72:60:c0:5f:48:fc:2a:90:70:66:3c:cd:37:ab:bd:f4:83:af:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_x64exe.pdb

Imports

kernel32

SetEvent
GetVersionExW
GetLastError
CreateEventW
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
CreateMutexW
SetFilePointer
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
FlsAlloc
LCMapStringW
HeapFree
HeapAlloc
GetModuleHandleW
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
InitializeCriticalSectionAndSpinCount
HeapReAlloc

user32

PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage

shell32

ShellExecuteExW

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_2_/tvqsfilesx64.7z
.7z
x64/TVMonitor.inf
x64/TVMonitor.sy_
.sys windows:6 windows x64 arch:x64

f24b69173de020aa0ac1739d7b40e04c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3b
Signer

Actual PE Digest

28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

j:\teamviewer6.0\monitordriver\objfre_wlh_amd64\amd64\TVMonitor.pdb

Imports

ntoskrnl.exe

IoAcquireRemoveLockEx
KeClearEvent
IoDeleteSymbolicLink
_snwprintf
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoReleaseRemoveLockEx
IoDetachDevice
PoRequestPowerIrp
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
IoReleaseRemoveLockAndWaitEx
ObReferenceObjectByHandle
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
KeInitializeTimerEx
KeCancelTimer
KeWaitForMultipleObjects
IofCallDriver
KeBugCheckEx

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/tvmonitor.cat
$_2_/tvqsfilesx86.7z
.7z
x86/TVMonitor.inf
x86/TVMonitor.sy_
.sys windows:6 windows x86 arch:x86

bc06eb1dad5e8285411e580cdee99e10

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83
Signer

Actual PE Digest

a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

j:\teamviewer6.0\monitordriver\objfre_wxp_x86\i386\TVMonitor.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
_snwprintf
IofCompleteRequest
IoReleaseRemoveLockEx
PoCallDriver
IoAcquireRemoveLockEx
PoStartNextPowerIrp
IofCallDriver
ObfDereferenceObject
IoGetAttachedDeviceReference
IoDeleteDevice
IoDetachDevice
KeWaitForSingleObject
KeSetEvent
PoRequestPowerIrp
IoAttachDeviceToDeviceStack
IoDeleteSymbolicLink
IoInitializeRemoveLockEx
IoCreateSymbolicLink
IoCreateDevice
InterlockedIncrement
IoReleaseRemoveLockAndWaitEx
PsTerminateSystemThread
KeCancelTimer
KeWaitForMultipleObjects
KeSetTimerEx
KeClearEvent
KeInitializeTimerEx
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeTickCount
KeBugCheckEx
KeInitializeEvent
KeGetCurrentThread

hal

KeGetCurrentIrql

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 277B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 384B - Virtual size: 274B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/tvmonitor.cat
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

02:80:5f:99:db:4b:23:34:4d:b2:2e:77:25:d7:12:24:90:89:32:22Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 200KB

UPX1 Size: 17KB - Virtual size: 20KB

.rsrc Size: 25KB - Virtual size: 28KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

d29e408dd9048e10d5936c6f2bfca832

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 42KB - Virtual size: 42KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 5KB - Virtual size: 5KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

3e6973f711ba3e93140a87f28c26c445

Headers

File Characteristics

Imports

kernel32

user32

winspool.drv

advapi32

Exports

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

02:80:5f:99:db:4b:23:34:4d:b2:2e:77:25:d7:12:24:90:89:32:22
Signer

UPX0
Size: - Virtual size: 200KB

UPX1
Size: 17KB - Virtual size: 20KB

.rsrc
Size: 25KB - Virtual size: 28KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 42KB - Virtual size: 42KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 33KB - Virtual size: 33KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 6KB - Virtual size: 22KB

.rsrc
Size: 1024B - Virtual size: 840B

.reloc
Size: 12KB - Virtual size: 11KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

e1:da:5e:04:9d:3a:d4:ee:05:ac:b8:1f:e4:24:5c:ba:eb:68:a9:7a
Signer