Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Overview
overview
7Static
static
7658e8407e9...18.exe
windows7-x64
3658e8407e9...18.exe
windows10-2004-x64
3$TEMP/Team...r_.exe
windows7-x64
7$TEMP/Team...r_.exe
windows10-2004-x64
7$PLUGINSDI...64.dll
windows7-x64
3$PLUGINSDI...64.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$TEMP/Team...AS.exe
windows7-x64
1$TEMP/Team...AS.exe
windows10-2004-x64
1$TEMP/Team...TV.dll
windows7-x64
3$TEMP/Team...TV.dll
windows10-2004-x64
3$TEMP/Team...er.exe
windows7-x64
7$TEMP/Team...er.exe
windows10-2004-x64
7$TEMP/Team...ce.exe
windows7-x64
1$TEMP/Team...ce.exe
windows10-2004-x64
1Behavioral task
behavioral1
Sample
658e8407e9f68028acd01f749fae5fdd_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
658e8407e9f68028acd01f749fae5fdd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$TEMP/TeamViewer/Version4/TeamViewer_.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$TEMP/TeamViewer/Version4/TeamViewer_.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Base64.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Base64.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
$TEMP/TeamViewer/Version4/SAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$TEMP/TeamViewer/Version4/SAS.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
$TEMP/TeamViewer/Version4/TV.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
$TEMP/TeamViewer/Version4/TV.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
$TEMP/TeamViewer/Version4/TeamViewer.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
$TEMP/TeamViewer/Version4/TeamViewer.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
$TEMP/TeamViewer/Version4/TeamViewer_Service.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$TEMP/TeamViewer/Version4/TeamViewer_Service.exe
Resource
win10v2004-20240426-en
Target
658e8407e9f68028acd01f749fae5fdd_JaffaCakes118
Size
1.5MB
MD5
658e8407e9f68028acd01f749fae5fdd
SHA1
b6bb04659551ca77a5174ee0f34d51d9dc56e635
SHA256
1a0b08df8b00187140cba1f2643cfcd5b912b1fd91249064d1fc7320759f88e7
SHA512
1b0b0271fb4b80df957f03ed0d637cc7ffb458b8a233d45c6e9fc0456cdfeabe8ee4d34681d7886d4f4cbf59913a6c91db91c95415076510d6fd035903a9477d
SSDEEP
24576:xaTstd4Y2e+WA6KOGGeRY2lrWE/eNZ+8+THJr+PD7RhgqkvjE1zabQgNMlIOtuoM:wTWQ3OGGeN/KPdhzabQgNMlDtuF52E
Processes:
resource | yara_rule |
---|---|
static1/unpack001/$TEMP/TeamViewer/Version4/TeamViewer_.exe | upx |
Checks for missing Authenticode signature.
Processes:
resource |
---|
658e8407e9f68028acd01f749fae5fdd_JaffaCakes118 |
unpack002/$PLUGINSDIR/Base64.dll |
unpack002/$PLUGINSDIR/GetVersion.dll |
unpack002/$PLUGINSDIR/NSISdl.dll |
unpack002/$PLUGINSDIR/System.dll |
unpack002/$PLUGINSDIR/UAC.dll |
unpack002/$PLUGINSDIR/UserInfo.dll |
unpack002/$TEMP/TeamViewer/Version4/TV.dll |
unpack002/out.upx |
Processes:
resource | yara_rule |
---|---|
sample | nsis_installer_1 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
c:\Test\base64\Debug\Base64.pdb
lstrlenA
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
DebugBreak
WideCharToMultiByte
IsDebuggerPresent
MultiByteToWideChar
GetProcAddress
LoadLibraryA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
GetCurrentThread
HeapValidate
IsBadReadPtr
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameW
VirtualQuery
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapReAlloc
VirtualAlloc
WriteFile
SetConsoleCtrlHandler
InterlockedExchange
InitializeCriticalSection
RtlUnwind
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
GetTimeFormatA
GetDateFormatA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
LCMapStringA
LCMapStringW
GetLocaleInfoW
GetTimeZoneInformation
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CloseHandle
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
Decode
Encode
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetVersionExA
GetProcAddress
GetModuleHandleA
lstrcmpiA
FreeLibrary
GlobalAlloc
lstrcatA
lstrcpynA
wsprintfA
GetSystemMetrics
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
IEVersion
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsServicePack
WindowsServicePackBuild
WindowsType
WindowsVersion
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread
CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup
download
download_quiet
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect
wsprintfA
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameA
SetLastError
CloseHandle
GlobalFree
LocalFree
FormatMessageA
MultiByteToWideChar
GetLastError
CreateProcessA
GlobalAlloc
lstrlenA
GetVersionExA
LoadLibraryA
lstrcatA
GetProcAddress
lstrcpynA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiA
lstrcpyA
GetCurrentProcess
GetCurrentThread
GetCurrentProcessId
Sleep
CreateThread
GetStartupInfoA
GetCommandLineA
GetPrivateProfileIntA
GetPrivateProfileStringA
FreeLibrary
GetModuleHandleA
EnableWindow
GetWindowLongA
DestroyWindow
LoadImageA
SetWindowLongA
EndDialog
MessageBoxA
SendMessageW
DialogBoxParamA
CharNextA
SendMessageTimeoutA
WaitForInputIdle
DefWindowProcA
PostMessageA
GetLastActivePopup
PostQuitMessage
SetForegroundWindow
DispatchMessageA
GetMessageA
CreateWindowExA
RegisterClassA
UnregisterClassA
GetWindowTextA
TranslateMessage
IsDialogMessageA
PeekMessageA
MsgWaitForMultipleObjects
IsWindow
ShowWindow
wsprintfA
GetDlgItem
SendMessageA
LoadStringA
SetWindowTextA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
ShellExecuteExA
CoInitialize
CoUninitialize
Exec
ExecCodeSegment
ExecWait
GetElevationType
GetOuterHwnd
IsAdmin
RunElevated
ShellExec
ShellExecWait
StackPush
SupportsUAC
Unload
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynA
GlobalAlloc
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken
GetAccountType
GetName
GetOriginalAccountType
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
c:\TeamViewer\SAS Lib\release\SAS.pdb
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
I_RpcExceptionFilter
NdrClientCall2
FlushFileBuffers
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FreeLibrary
GetProcAddress
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
SetLastError
GetVersionExA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Sleep
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateMutexA
ReleaseMutex
CloseHandle
LocalUnlock
GetProcAddress
LCMapStringW
LCMapStringA
GetStringTypeW
WaitForSingleObject
GetLocaleInfoA
MultiByteToWideChar
HeapSize
RtlUnwind
HeapReAlloc
VirtualAlloc
IsValidCodePage
LocalAlloc
OpenMutexA
LoadLibraryA
FreeLibrary
GetStringTypeA
LocalLock
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualQuery
SetRectEmpty
RegisterWindowMessageA
GetWindowThreadProcessId
SetRect
UnionRect
ReleaseDC
SetWindowsHookExA
GetDesktopWindow
SetWindowPos
IsWindow
GetWindowRect
PostMessageA
GetWindowDC
UnhookWindowsHookEx
IsWindowVisible
CallNextHookEx
FindWindowExA
MapWindowPoints
FindWindowA
GetClientRect
DeleteObject
SelectObject
Rectangle
CreatePen
GetStockObject
GetChangeRect
GetChangedWindowList
SetSingleWindow
StartHooks
StopHooks
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
c:\TeamViewer_Beta\TeamViewer\qs_release\TeamViewer_qs.pdb
ImageList_SetBkColor
InitCommonControlsEx
ImageList_Remove
ImageList_ReplaceIcon
ImageList_LoadImageW
ImageList_Create
GetAdaptersInfo
DeleteIPAddress
GetAdapterIndex
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
CreateThread
ResumeThread
SetThreadPriority
GetCurrentThread
CreateEventW
GetOverlappedResult
lstrcmpW
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
DeleteFileA
FindFirstFileA
CreateFileA
FindNextFileA
QueryPerformanceCounter
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
DebugBreak
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
SetHandleCount
GetTimeZoneInformation
HeapCreate
GetOEMCP
ExitThread
LCMapStringA
GetStringTypeA
VirtualQuery
DeviceIoControl
GetFileType
ExitProcess
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetDateFormatA
GetTimeFormatA
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
FormatMessageA
GetFileTime
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjects
TlsSetValue
ResetEvent
TlsGetValue
TlsFree
TlsAlloc
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
lstrcpyW
LocalAlloc
GetProcAddress
WritePrivateProfileStringW
SetEndOfFile
SetEnvironmentVariableA
GetTickCount
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
WaitForSingleObject
CreateEventA
DuplicateHandle
SetEvent
OpenProcess
GlobalFree
InterlockedExchange
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleHandleA
CompareStringA
SetProcessShutdownParameters
LocalSize
LocalLock
LocalUnlock
CompareFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
SetErrorMode
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFilePointer
GetLocalTime
LockResource
LocalFree
GetCommandLineW
MoveFileExW
LoadResource
SizeofResource
InterlockedDecrement
InterlockedIncrement
FlushFileBuffers
WriteFile
ReadFile
GetFileSize
GetModuleFileNameA
ReleaseMutex
InitializeCriticalSection
FreeLibrary
CreateMutexA
DeleteCriticalSection
GetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
Sleep
GetCurrentProcessId
HeapAlloc
FlushInstructionCache
RaiseException
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
SetLastError
ReleaseSemaphore
CreateSemaphoreA
GetCurrentThreadId
CloseHandle
GetStdHandle
IsMenu
GetCursorInfo
EnumWindows
CloseDesktop
GetUserObjectInformationW
GetThreadDesktop
SetThreadDesktop
OpenInputDesktop
SetCursorPos
CreateIconIndirect
InvalidateRgn
GetSystemMenu
GetWindowPlacement
DestroyAcceleratorTable
SetWindowPlacement
SetRectEmpty
GetMessagePos
GetNextDlgTabItem
EndDeferWindowPos
BeginDeferWindowPos
DrawEdge
FlashWindow
GetDialogBaseUnits
MapDialogRect
DeferWindowPos
DestroyIcon
SetScrollPos
GetScrollInfo
ScrollWindowEx
CreatePopupMenu
SetScrollInfo
GetDlgItemTextA
CreateWindowExA
DrawFocusRect
CreateMenu
FrameRect
GetIconInfo
GetCapture
MessageBeep
GetWindowDC
WindowFromPoint
GetShellWindow
IsWindowEnabled
SetActiveWindow
OpenDesktopW
RegisterWindowMessageW
CharLowerW
CharUpperW
UnregisterClassA
GetWindow
GetWindowRect
TranslateMessage
MapWindowPoints
InvalidateRect
MoveWindow
SetWindowPos
ShowWindow
IsWindow
KillTimer
SetTimer
GetParent
GetClientRect
ScreenToClient
PostQuitMessage
RedrawWindow
MessageBoxA
UnhookWindowsHookEx
CallNextHookEx
GetAsyncKeyState
GetFocus
SendInput
GetSysColor
DestroyWindow
GetDC
TrackPopupMenuEx
SetWindowRgn
CheckMenuItem
SetFocus
EnableMenuItem
DestroyMenu
GetSubMenu
RemoveMenu
CheckMenuRadioItem
GetDlgCtrlID
GetDesktopWindow
BringWindowToTop
GetDlgItem
GetSystemMetrics
AdjustWindowRect
FillRect
ShowScrollBar
UpdateWindow
OffsetRect
SetForegroundWindow
SetParent
CopyRect
BeginPaint
EndPaint
InflateRect
UnionRect
SetRect
IntersectRect
IsRectEmpty
ReleaseDC
EndDialog
BlockInput
GetActiveWindow
GetCursorPos
GetForegroundWindow
GetWindowThreadProcessId
GetGUIThreadInfo
EqualRect
SetCursor
ReleaseCapture
SetCapture
IsWindowVisible
DestroyCursor
PtInRect
GetKeyState
ToUnicode
GetKeyboardState
ToAscii
CloseClipboard
TrackMouseEvent
ClientToScreen
SetClipboardViewer
OpenClipboard
SetClipboardData
EmptyClipboard
ChangeClipboardChain
CreatePatternBrush
PatBlt
SetViewportOrgEx
MaskBlt
RoundRect
SetBrushOrgEx
SelectPalette
RealizePalette
GetObjectType
CreatePalette
GetDIBits
GetSystemPaletteEntries
SetStretchBltMode
SetDIBitsToDevice
CreateCompatibleBitmap
DPtoLP
SetPixel
SetDIBColorTable
Polygon
Ellipse
SetTextColor
LineTo
MoveToEx
GetDeviceCaps
SetBkMode
DeleteDC
CreateCompatibleDC
BitBlt
DeleteObject
SelectObject
GetStockObject
StretchBlt
CombineRgn
CreateRoundRectRgn
CreateRectRgn
CreateSolidBrush
CreatePen
Rectangle
CreateBitmap
SetBkColor
GetPixel
BeginPath
EndPath
CreateDIBSection
StrokeAndFillPath
GetSidIdentifierAuthority
RegCloseKey
InitializeSecurityDescriptor
SetTokenInformation
DuplicateTokenEx
OpenProcessToken
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
RegEnumValueW
RegEnumKeyExA
RegEnumValueA
SetSecurityDescriptorDacl
DuplicateToken
RegOpenKeyW
ImpersonateLoggedOnUser
RevertToSelf
CreateProcessAsUserW
SetEntriesInAclW
SetNamedSecurityInfoW
ord680
ord155
CommandLineToArgvW
SHGetSpecialFolderLocation
DragAcceptFiles
OleInitialize
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop
CoTaskMemAlloc
CoTaskMemFree
CoInitializeSecurity
StringFromGUID2
CoCreateGuid
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemRealloc
SysFreeString
VariantInit
VariantCopy
VariantClear
SysAllocString
VariantChangeType
SafeArrayGetElement
SafeArrayGetDim
VarUI4FromStr
PathRemoveFileSpecW
PathCompactPathW
inet_addr
gethostbyname
socket
gethostname
bind
listen
accept
connect
getpeername
send
recvfrom
inet_ntoa
htons
sendto
recv
setsockopt
select
WSAGetLastError
getsockname
__WSAFDIsSet
ntohs
htonl
WSAStartup
WSACleanup
ioctlsocket
shutdown
closesocket
HttpEndRequestA
InternetQueryOptionW
InternetSetOptionW
InternetOpenW
HttpSendRequestA
InternetGoOnlineA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
InternetCloseHandle
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetErrorDlg
HttpQueryInfoW
HttpQueryInfoA
InternetReadFile
CertGetNameStringW
CertGetNameStringA
CertFreeCertificateContext
CryptVerifyMessageSignature
ImageGetCertificateData
ImageGetCertificateHeader
ImageEnumerateCertificates
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
CreateEnvironmentBlock
DestroyEnvironmentBlock
CertFreeCertificateContext
CryptVerifyMessageSignature
CertGetNameStringA
ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData
WinVerifyTrust
WTSQuerySessionInformationA
WTSFreeMemory
WritePrivateProfileStringA
FreeLibrary
GetExitCodeProcess
ProcessIdToSessionId
DisconnectNamedPipe
GetModuleFileNameA
WaitForSingleObject
DeleteFileA
SetEvent
CreateEventA
GetConsoleCP
SetFilePointer
IsValidLocale
SetCurrentDirectoryA
MultiByteToWideChar
CreateFileA
SetLastError
CreateNamedPipeA
GetPrivateProfileIntA
LocalFree
GetVersionExA
LoadLibraryA
GetProcAddress
GetCurrentProcessId
OpenProcess
GetLastError
CloseHandle
TerminateProcess
Sleep
GetConsoleMode
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetPrivateProfileStringA
CreateProcessA
LocalAlloc
GetCurrentProcess
ReadFile
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapFree
HeapAlloc
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetProcessHeap
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
LCMapStringA
WideCharToMultiByte
LCMapStringW
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSection
InterlockedExchange
GetStringTypeA
GetStringTypeW
MessageBoxA
ExitWindowsEx
CreateServiceA
StartServiceCtrlDispatcherA
SetServiceStatus
RegDeleteKeyA
CreateProcessAsUserA
DuplicateToken
ImpersonateLoggedOnUser
RevertToSelf
RegCreateKeyA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
DuplicateTokenEx
SetTokenInformation
RegOpenKeyExA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ShellExecuteExA
ShellExecuteA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ