download
download_quiet
Overview
overview
7Static
static
3b32e3308e2...18.exe
windows7-x64
3b32e3308e2...18.exe
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...ta.dll
windows7-x64
3$PLUGINSDI...ta.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3TeamViewer.exe
windows7-x64
7TeamViewer.exe
windows10-2004-x64
7TeamViewer...op.exe
windows7-x64
3TeamViewer...op.exe
windows10-2004-x64
3TeamViewer...fr.dll
windows7-x64
1TeamViewer...fr.dll
windows10-2004-x64
1TeamViewer...ce.exe
windows7-x64
1TeamViewer...ce.exe
windows10-2004-x64
1tv_w32.dll
windows7-x64
1tv_w32.dll
windows10-2004-x64
1tv_w32.exe
windows7-x64
1tv_w32.exe
windows10-2004-x64
1tv_x64.dll
windows7-x64
1tv_x64.dll
windows10-2004-x64
1tv_x64.exe
windows7-x64
1tv_x64.exe
windows10-2004-x64
1x64/TVMonitor.sys
windows7-x64
1x64/TVMonitor.sys
windows10-2004-x64
1x86/TVMonitor.sys
windows7-x64
1x86/TVMonitor.sys
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
b32e3308e29141278fd21ae5db88c736_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
b32e3308e29141278fd21ae5db88c736_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ReadCustomerData.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ReadCustomerData.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
TeamViewer.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
TeamViewer.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
TeamViewer_Desktop.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
TeamViewer_Desktop.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
TeamViewer_Resource_fr.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
TeamViewer_Resource_fr.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
TeamViewer_Service.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
TeamViewer_Service.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
tv_w32.dll
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
tv_w32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
tv_w32.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
tv_w32.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
tv_x64.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
tv_x64.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
tv_x64.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
tv_x64.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
x64/TVMonitor.sys
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
x64/TVMonitor.sys
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
x86/TVMonitor.sys
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
x86/TVMonitor.sys
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
b32e3308e29141278fd21ae5db88c736_JaffaCakes118
-
Size
2.6MB
-
MD5
b32e3308e29141278fd21ae5db88c736
-
SHA1
8405d2487d4e4388fd052025434160075dfa5159
-
SHA256
f6d456ffc95511424ed7a9444b740a3595dcc374f0512f1cff09d3ab664183de
-
SHA512
add6f7c8274e78934d638f482b675f0738daf0610dc514027e096b92379e53b47854e4742dd96a792a2b9df74004ef3818bbcb2c0d87fc6e14e4bf684d43375e
-
SSDEEP
49152:7JiF104Uf3BL0sAye3iUsHJtONN0oivmXppRFlW1dARl:9iFPUf3qLT39QJt20oMKblPR
Score
3/10
Malware Config
Signatures
-
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource b32e3308e29141278fd21ae5db88c736_JaffaCakes118 unpack001/$PLUGINSDIR/NSISdl.dll unpack001/$PLUGINSDIR/ReadCustomerData.dll unpack001/$PLUGINSDIR/System.dll unpack001/$PLUGINSDIR/TvGetVersion.dll unpack001/$PLUGINSDIR/nsis7z.dll -
NSIS installer 2 IoCs
resource yara_rule sample nsis_installer_1 sample nsis_installer_2
Files
-
b32e3308e29141278fd21ae5db88c736_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/NSISdl.dll.dll windows:4 windows x86 arch:x86
9cce555dd3ff1b6c7dc92d64c794c51a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread
user32
CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
ws2_32
gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup
Exports
Exports
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 836B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/ReadCustomerData.dll.dll windows:4 windows x86 arch:x86
d29e408dd9048e10d5936c6f2bfca832
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
MultiByteToWideChar
GetLastError
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
CloseHandle
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
RtlUnwind
RaiseException
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers
VirtualAlloc
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
InitializeCriticalSection
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetEndOfFile
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GlobalFree
lstrcpyA
Exports
Exports
ReadCustomerData
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/System.dll.dll windows:4 windows x86 arch:x86
2017f2acbdaa42ab3e4adeb8b4c37e7b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Exports
Exports
Alloc
Call
Copy
Free
Get
Int64Op
Store
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/TvGetVersion.dll.dll windows:4 windows x86 arch:x86
3e6973f711ba3e93140a87f28c26c445
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetVersionExA
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
lstrcpynA
GetTickCount
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
WriteFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSection
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
lstrcpyA
lstrlenA
lstrcatA
GetDriveTypeA
CreateFileA
GetFileSize
GlobalAlloc
ReadFile
CloseHandle
GlobalFree
GetLastError
GetCurrentProcessId
GetModuleHandleA
GetProcAddress
QueryPerformanceCounter
lstrcmpiA
user32
GetSystemMetrics
wsprintfA
SendMessageA
winspool.drv
EnumPrinterDriversA
EnumPrintProcessorsA
advapi32
DeleteService
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
Exports
Exports
GetCurrentSessionId
GetServiceStatus
IsNetPath
IsPrintProcessorInstalled
IsPrinterDriverInstalled
IsServiceInstalled
IsTvPasswordSet
LoadFile
RegCopyKey
RegCopyValue
RemoveService
RemoveServiceWait
RunService
RunServiceWait
StopService
StopServiceWait
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsVersion
WindowsVersionMajor
WindowsVersionMinor
Sections
.text Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/nsis7z.dll.dll windows:4 windows x86 arch:x86
b22ed27c346f001ed1b4410c1073cfa9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
LoadLibraryA
GetModuleFileNameA
RemoveDirectoryW
MoveFileA
MoveFileW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
GetFullPathNameA
GetFullPathNameW
GetCurrentThreadId
GetCurrentProcessId
SetLastError
CreateFileW
SetFileTime
CloseHandle
SetFileAttributesA
SetFileAttributesW
RemoveDirectoryA
FindClose
FindFirstFileA
FindFirstFileW
CreateFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetProcAddress
GetCurrentProcess
GetSystemInfo
GetModuleHandleA
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
DeleteCriticalSection
AreFileApisANSI
VirtualFree
VirtualAlloc
GetVersionExA
ResetEvent
WaitForSingleObject
SetEvent
InitializeCriticalSection
CreateEventA
SetFileApisToOEM
SetFileApisToANSI
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapAlloc
HeapFree
HeapReAlloc
ExitThread
CreateThread
GetCommandLineA
GetProcessHeap
HeapDestroy
HeapCreate
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
Sleep
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
VirtualQuery
user32
CharUpperW
CharUpperA
GetDlgItem
FindWindowExA
SetWindowTextA
wsprintfA
SendMessageA
oleaut32
VariantCopy
VariantClear
SysAllocString
Exports
Exports
Extract
ExtractWithCallback
ExtractWithDetails
Sections
.text Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$_0_/tvqsfiles.7z.7z
-
TeamViewer.exe.exe windows:4 windows x86 arch:x86
43cead90dd92b9243793ecab7180f407
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
cb:da:96:d4:fa:6d:92:55:5e:72:fe:cf:08:6f:26:92:dd:6e:6d:43Signer
Actual PE Digestcb:da:96:d4:fa:6d:92:55:5e:72:fe:cf:08:6f:26:92:dd:6e:6d:43Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\teamviewer_6.0_release\teamviewer\qs_release\TeamViewer.pdb
Imports
ws2_32
WSAResetEvent
getsockopt
WSAWaitForMultipleEvents
WSAEventSelect
recv
shutdown
send
recvfrom
sendto
__WSAFDIsSet
select
gethostbyname
ntohl
htonl
getservbyport
getservbyname
bind
gethostbyaddr
htons
WSACreateEvent
WSASetEvent
ntohs
getpeername
WSACloseEvent
inet_ntoa
WSARecvFrom
WSADuplicateSocketW
gethostname
WSARecv
WSAAddressToStringA
socket
closesocket
ioctlsocket
accept
connect
setsockopt
WSASocketW
WSACleanup
WSAStartup
getsockname
inet_addr
WSASetLastError
WSAGetLastError
listen
WSASend
iphlpapi
DeleteIPAddress
GetAdaptersInfo
GetAdapterIndex
comctl32
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_Destroy
ImageList_Create
ImageList_SetBkColor
ImageList_Remove
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
msvfw32
DrawDibOpen
DrawDibDraw
DrawDibClose
winmm
mixerSetControlDetails
mixerOpen
mixerGetID
waveOutUnprepareHeader
waveInStart
waveInReset
waveInGetNumDevs
waveInOpen
mixerClose
timeEndPeriod
waveInAddBuffer
waveOutClose
waveOutRestart
waveOutReset
waveOutGetNumDevs
waveOutOpen
waveInPrepareHeader
waveOutPrepareHeader
waveOutPause
waveOutWrite
waveInUnprepareHeader
waveInClose
timeBeginPeriod
kernel32
SetPriorityClass
GetExitCodeThread
TryEnterCriticalSection
CreateThread
ResumeThread
ResetEvent
GetCurrentThread
DuplicateHandle
FindClose
CompareFileTime
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
lstrcpyA
EnterCriticalSection
GetCurrentProcess
FlushInstructionCache
InitializeCriticalSection
HeapAlloc
DeleteCriticalSection
CreateSemaphoreA
WaitForMultipleObjects
ReleaseSemaphore
GetSystemTimeAsFileTime
MulDiv
SleepEx
ExpandEnvironmentStringsA
LocalAlloc
SetEnvironmentVariableA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetOEMCP
HeapCreate
GetStdHandle
ExitThread
GetStringTypeA
LCMapStringA
GetDateFormatA
GetTimeFormatA
ExitProcess
GetStartupInfoA
GetCommandLineA
RtlUnwind
IsDebuggerPresent
UnhandledExceptionFilter
CreateWaitableTimerA
SetWaitableTimer
OpenEventA
CreateFileMappingA
MapViewOfFileEx
CreateFileA
UnmapViewOfFile
GetSystemInfo
AreFileApisANSI
GetFileTime
SetEndOfFile
FormatMessageA
GetThreadLocale
GetACP
GetVersionExA
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
lstrlenA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
MoveFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
TlsGetValue
TlsSetValue
TerminateProcess
OpenProcess
SetFilePointer
GetLocaleInfoA
GetUserDefaultLCID
GetSystemDefaultLCID
LocalFree
SetThreadAffinityMask
QueueUserAPC
GetOverlappedResult
DeviceIoControl
GetExitCodeProcess
GlobalAlloc
GlobalLock
WriteFile
GlobalUnlock
GlobalFree
GetFileSize
ReadFile
InitializeCriticalSectionAndSpinCount
LoadResource
LockResource
InterlockedDecrement
InterlockedIncrement
GlobalHandle
SizeofResource
InterlockedExchange
FreeLibrary
GetCommandLineW
CreateEventA
Sleep
CloseHandle
TlsAlloc
SetEvent
GetTickCount
TlsFree
GetCurrentThreadId
GetProcessHeap
WaitForSingleObject
HeapFree
GetLastError
SetLastError
RaiseException
GetPriorityClass
SetThreadPriority
VirtualFree
VirtualAlloc
GetLocalTime
GetCurrentProcessId
InterlockedExchangeAdd
SetProcessShutdownParameters
ReleaseMutex
CreateMutexA
SetErrorMode
LeaveCriticalSection
user32
SetWindowPos
IsWindow
InvalidateRect
InflateRect
MoveWindow
ReleaseCapture
PtInRect
MapWindowPoints
GetWindowRect
SetScrollInfo
GetWindow
CreateIconIndirect
SetCursorPos
MsgWaitForMultipleObjectsEx
CheckMenuItem
EnableMenuItem
SetForegroundWindow
SetTimer
GetCursorPos
ScreenToClient
ShowWindow
UnregisterClassA
EnumWindows
GetCursorInfo
GetGUIThreadInfo
EnumDesktopWindows
BlockInput
GetThreadDesktop
MsgWaitForMultipleObjects
GetWindowRgn
GetKeyState
SetDlgItemTextA
SendDlgItemMessageA
GetDlgItemTextA
CreateWindowExA
DrawIconEx
GetIconInfo
DrawFocusRect
FrameRect
GetCapture
IsMenu
CreateMenu
ScrollWindowEx
SetScrollPos
GetScrollInfo
SetParent
FlashWindow
GetWindowPlacement
DrawEdge
GetNextDlgTabItem
GetMessagePos
SetWindowPlacement
GetUserObjectInformationW
AttachThreadInput
GetUpdateRgn
EnumChildWindows
ToUnicode
GetKeyboardState
UnhookWindowsHookEx
CallNextHookEx
SendInput
ToAscii
ExitWindowsEx
CloseDesktop
GetKeyboardLayout
ActivateKeyboardLayout
OpenInputDesktop
OpenDesktopW
SetThreadDesktop
SetCapture
GetClientRect
BeginPaint
GetParent
EndPaint
KillTimer
SetRect
InvalidateRgn
SetWindowRgn
DestroyWindow
TrackMouseEvent
SetFocus
GetMenuState
GetSubMenu
CheckMenuRadioItem
DestroyMenu
OffsetRect
ClientToScreen
TrackPopupMenuEx
CreatePopupMenu
RemoveMenu
IsWindowVisible
GetDlgItem
GetDesktopWindow
BringWindowToTop
GetDlgCtrlID
CopyRect
FillRect
IsIconic
ShowScrollBar
IntersectRect
UpdateWindow
AdjustWindowRect
GetSystemMetrics
RedrawWindow
MessageBeep
GetDC
EndDialog
GetForegroundWindow
SetActiveWindow
GetActiveWindow
GetSystemMenu
GetSysColorBrush
GetWindowThreadProcessId
WindowFromPoint
SetRectEmpty
IsRectEmpty
GetAsyncKeyState
GetMenuItemCount
DestroyIcon
DeleteMenu
PostQuitMessage
AdjustWindowRectEx
GetMenu
IsWindowEnabled
TranslateMessage
MessageBoxA
SetWindowContextHelpId
MapDialogRect
GetSysColor
IsChild
DestroyAcceleratorTable
GetFocus
OpenClipboard
GetClipboardViewer
ChangeClipboardChain
SetClipboardViewer
CloseClipboard
SetClipboardData
EmptyClipboard
ReleaseDC
GetWindowDC
SetCursor
DestroyCursor
GetCursor
EqualRect
UnionRect
gdi32
PtInRegion
GetSystemPaletteEntries
GetDCOrgEx
GetRegionData
GetRgnBox
PatBlt
SetPixel
GetObjectType
CreateRoundRectRgn
RealizePalette
SelectPalette
CreatePalette
CreateRectRgnIndirect
RoundRect
GetPixel
CreatePatternBrush
StretchBlt
SetStretchBltMode
CreateBitmap
SetViewportOrgEx
SetWindowOrgEx
GetClipBox
SetBkColor
SetBrushOrgEx
CreateCompatibleBitmap
SelectClipRgn
CreateDIBSection
GetDIBits
SetDIBColorTable
Polygon
LineTo
Ellipse
MoveToEx
GetDeviceCaps
SetTextColor
CreateCompatibleDC
OffsetRgn
SetRectRgn
Rectangle
SelectObject
CreateSolidBrush
CreatePen
RectInRegion
CombineRgn
GetStockObject
SetBkMode
BitBlt
CreatePolygonRgn
CreateRectRgn
DeleteObject
DeleteDC
advapi32
GetSidIdentifierAuthority
ImpersonateLoggedOnUser
RevertToSelf
RegSetValueExA
AllocateAndInitializeSid
SetSecurityInfo
GetSecurityInfo
LookupAccountSidW
LookupAccountNameW
EqualSid
FreeSid
CreateProcessAsUserW
StartServiceW
CloseServiceHandle
DeleteAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegFlushKey
RegisterEventSourceW
ReportEventW
RegCloseKey
DeregisterEventSource
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
shell32
ord680
SHAppBarMessage
DragFinish
DragAcceptFiles
SHGetMalloc
ord155
SHGetSpecialFolderLocation
ole32
CLSIDFromProgID
CreateStreamOnHGlobal
CLSIDFromString
CoCreateInstance
OleLockRunning
CoGetClassObject
CoTaskMemFree
CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoCreateGuid
CoTaskMemAlloc
StringFromGUID2
OleUninitialize
OleInitialize
CoTaskMemRealloc
oleaut32
SysStringLen
VarUI4FromStr
OleCreatePropertyFrame
SysAllocStringLen
LoadRegTypeLi
OleCreateFontIndirect
SysStringByteLen
SysAllocString
VariantInit
VariantClear
LoadTypeLi
SafeArrayGetDim
SafeArrayGetElement
VariantChangeType
VariantCopy
SysFreeString
shlwapi
PathCompactPathW
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
setupapi
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
crypt32
CertGetNameStringA
CertGetNameStringW
CryptVerifyMessageSignature
CertFreeCertificateContext
imagehlp
ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates
wininet
HttpSendRequestW
HttpOpenRequestW
InternetOpenW
InternetWriteFile
HttpSendRequestExA
HttpAddRequestHeadersA
InternetCloseHandle
HttpOpenRequestA
InternetConnectW
HttpQueryInfoW
InternetSetOptionW
InternetGoOnlineA
InternetQueryOptionW
InternetErrorDlg
HttpSendRequestA
InternetReadFile
InternetQueryDataAvailable
HttpEndRequestA
DetectAutoProxyUrl
sensapi
IsNetworkAlive
urlmon
URLDownloadToFileA
Sections
.text Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 151KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
TeamViewer_Desktop.exe.exe windows:4 windows x86 arch:x86
eb812f1a2bb33e1749080cfce55b78e4
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
74:9d:95:b5:fd:83:f2:4a:da:e2:a8:49:23:f8:f3:47:84:b2:e9:f6Signer
Actual PE Digest74:9d:95:b5:fd:83:f2:4a:da:e2:a8:49:23:f8:f3:47:84:b2:e9:f6Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\teamviewer_6.0_release\teamviewer\qs_release\TeamViewer_Desktop.pdb
Imports
ws2_32
__WSAFDIsSet
connect
WSASetLastError
accept
WSAGetLastError
WSASend
ioctlsocket
closesocket
bind
getsockname
inet_addr
listen
WSASocketW
setsockopt
select
WSARecv
gethostname
WSAStartup
WSAAddressToStringA
getsockopt
ntohl
getservbyname
ntohs
htons
gethostbyname
inet_ntoa
htonl
shutdown
getservbyport
gethostbyaddr
WSACleanup
comctl32
InitCommonControlsEx
kernel32
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
CompareStringA
InterlockedExchangeAdd
EnterCriticalSection
LoadResource
FreeLibrary
GetLastError
SizeofResource
GetCurrentThreadId
RaiseException
InterlockedExchange
LeaveCriticalSection
CloseHandle
SetProcessShutdownParameters
GetProcessShutdownParameters
GetCurrentProcessId
HeapFree
GetProcessHeap
SetLastError
CreateEventA
InitializeCriticalSection
FileTimeToSystemTime
FindClose
FileTimeToLocalFileTime
HeapAlloc
GetTickCount
WaitForSingleObject
SetEvent
InitializeCriticalSectionAndSpinCount
SetFilePointer
WriteFile
GetSystemTimeAsFileTime
ReleaseMutex
GetFileSize
DuplicateHandle
ReleaseSemaphore
CreateSemaphoreA
TlsGetValue
Sleep
ResetEvent
TlsSetValue
WaitForMultipleObjects
SetThreadAffinityMask
GetCurrentThread
QueryPerformanceCounter
QueryPerformanceFrequency
LocalFree
GetSystemDefaultLCID
GetUserDefaultLCID
GetLocaleInfoA
GetLocalTime
OpenProcess
ReadFile
TerminateProcess
GetExitCodeThread
QueueUserAPC
DeviceIoControl
CreateMutexA
LockResource
GlobalFree
lstrcpyA
ResumeThread
CreateThread
LocalAlloc
InterlockedCompareExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetVersionExA
GetACP
GetThreadLocale
HeapDestroy
HeapReAlloc
HeapSize
FormatMessageA
SetEndOfFile
AreFileApisANSI
GetSystemInfo
OpenEventA
SystemTimeToFileTime
SetWaitableTimer
CreateWaitableTimerA
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
GetTimeFormatA
GetDateFormatA
RtlUnwind
LCMapStringA
GetStringTypeA
ExitProcess
ExitThread
HeapCreate
GetStdHandle
GetOEMCP
FreeEnvironmentStringsA
GetEnvironmentStrings
SetHandleCount
GetFileType
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FlushFileBuffers
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
CreateFileA
SetEnvironmentVariableA
GetCurrentProcess
InterlockedDecrement
FlushInstructionCache
DeleteCriticalSection
GetCommandLineW
InterlockedIncrement
TlsFree
TlsAlloc
SetUnhandledExceptionFilter
user32
CopyRect
GetDC
ReleaseDC
IsRectEmpty
InflateRect
IntersectRect
SendInput
OpenDesktopW
EnumDesktopWindows
GetUserObjectInformationW
CloseDesktop
GetThreadDesktop
BlockInput
MsgWaitForMultipleObjectsEx
GetCursorPos
GetGUIThreadInfo
EnumWindows
GetWindowDC
WindowFromPoint
UnhookWindowsHookEx
CallNextHookEx
GetDesktopWindow
GetWindowRgn
IsWindowEnabled
GetCursorInfo
GetIconInfo
GetForegroundWindow
GetKeyboardLayout
GetKeyboardState
ToUnicode
GetKeyState
ActivateKeyboardLayout
OpenInputDesktop
SetThreadDesktop
ExitWindowsEx
UnregisterClassA
OffsetRect
EqualRect
GetAsyncKeyState
PostQuitMessage
GetParent
GetWindowThreadProcessId
DestroyWindow
MessageBoxA
IsWindowVisible
IsWindow
TranslateMessage
ScreenToClient
MapWindowPoints
GetWindowRect
FillRect
GetClientRect
GetSystemMetrics
GetDlgItem
SetWindowPos
GetWindow
UnionRect
RedrawWindow
advapi32
StartServiceW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegisterEventSourceW
ReportEventW
DeregisterEventSource
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
GetSecurityInfo
SetSecurityInfo
AllocateAndInitializeSid
RegSetValueExA
EqualSid
LookupAccountNameW
LookupAccountSidW
ImpersonateLoggedOnUser
RegFlushKey
GetSidIdentifierAuthority
RegCloseKey
CloseServiceHandle
RevertToSelf
ole32
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoInitializeEx
CoTaskMemFree
CoInitializeSecurity
CoTaskMemRealloc
oleaut32
VarUI4FromStr
VariantInit
SafeArrayGetDim
SafeArrayGetElement
SysAllocString
VariantChangeType
VariantCopy
VariantClear
SysFreeString
crypt32
CertGetNameStringA
CertGetNameStringW
CryptVerifyMessageSignature
CertFreeCertificateContext
imagehlp
ImageGetCertificateData
ImageGetCertificateHeader
ImageEnumerateCertificates
wininet
InternetQueryOptionW
DetectAutoProxyUrl
urlmon
URLDownloadToFileA
gdi32
CreateRectRgn
GetSystemPaletteEntries
GetDIBits
GetRegionData
CreateRectRgnIndirect
BitBlt
PtInRegion
GetDeviceCaps
SelectClipRgn
CreateCompatibleBitmap
DeleteObject
CombineRgn
SetBkMode
StretchBlt
DeleteDC
GetRgnBox
SetPixel
CreateSolidBrush
SelectObject
CreateCompatibleDC
GetStockObject
SetRectRgn
OffsetRgn
CreateDIBSection
GetDCOrgEx
RectInRegion
shell32
SHGetMalloc
SHGetSpecialFolderLocation
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 425KB - Virtual size: 425KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
TeamViewer_Resource_fr.dll.dll windows:4 windows x86 arch:x86
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
47:68:14:28:c6:f1:7e:0f:79:b9:21:2b:05:49:76:5e:7d:87:81:4dSigner
Actual PE Digest47:68:14:28:c6:f1:7e:0f:79:b9:21:2b:05:49:76:5e:7d:87:81:4dDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.rsrc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
TeamViewer_Service.exe.exe windows:4 windows x86 arch:x86
a2550362a7ae9ea6a5d75d336322cf4c
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
12:8a:d9:81:2c:ce:27:08:fa:9d:69:23:ae:ab:f7:2a:f4:e2:a2:eaSigner
Actual PE Digest12:8a:d9:81:2c:ce:27:08:fa:9d:69:23:ae:ab:f7:2a:f4:e2:a2:eaDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\teamviewer_6.0_release\teamviewer\qs_release\TeamViewer_Service.pdb
Imports
ws2_32
socket
WSASetEvent
htonl
sendto
getsockopt
recvfrom
ntohl
WSARecvFrom
WSASocketW
setsockopt
connect
WSASetLastError
WSASend
accept
WSACloseEvent
closesocket
inet_addr
WSAGetLastError
gethostname
inet_ntoa
gethostbyname
WSADuplicateSocketW
WSAStartup
WSACleanup
getpeername
WSAResetEvent
getservbyport
getservbyname
ntohs
WSAWaitForMultipleEvents
WSAEventSelect
gethostbyaddr
WSACreateEvent
listen
getsockname
bind
WSARecv
__WSAFDIsSet
select
send
shutdown
htons
ioctlsocket
recv
kernel32
GetDriveTypeA
FindFirstFileA
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
CompareStringA
FreeLibrary
InterlockedExchangeAdd
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
Sleep
SetLastError
SetConsoleCtrlHandler
GetCurrentThreadId
TlsFree
SleepEx
ExpandEnvironmentStringsA
lstrlenA
SetEnvironmentVariableA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
EnumSystemLocalesA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetOEMCP
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetStdHandle
HeapSize
GetLastError
TlsAlloc
GetFullPathNameA
GetCurrentDirectoryA
ReadFile
ExitThread
ExitProcess
LCMapStringA
GetStringTypeA
RtlUnwind
HeapReAlloc
GetDateFormatA
GetTimeFormatA
IsDebuggerPresent
UnhandledExceptionFilter
CreateWaitableTimerA
SetWaitableTimer
SystemTimeToFileTime
OpenEventA
AreFileApisANSI
SetEndOfFile
FormatMessageA
GetThreadLocale
GetACP
GetSystemTimeAsFileTime
CloseHandle
CreateSemaphoreA
SetEvent
WaitForSingleObject
GetTickCount
DuplicateHandle
CreateEventA
GetCurrentProcess
ReleaseSemaphore
SetThreadAffinityMask
GetCurrentThread
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocalTime
LocalFree
GetSystemDefaultLCID
GetUserDefaultLCID
GetLocaleInfoA
FindClose
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetFilePointer
WriteFile
ReleaseMutex
GetFileSize
GetCurrentProcessId
EnterCriticalSection
OpenProcess
FileTimeToSystemTime
TerminateProcess
WaitForMultipleObjects
ResetEvent
HeapAlloc
GetProcessHeap
HeapFree
TlsSetValue
TlsGetValue
RaiseException
SizeofResource
LoadResource
GetExitCodeProcess
DeviceIoControl
CreateThread
ResumeThread
SetThreadPriority
GetOverlappedResult
QueueUserAPC
GetExitCodeThread
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
InterlockedCompareExchange
GetVersionExA
user32
TranslateMessage
MessageBoxA
UnregisterClassA
ExitWindowsEx
MsgWaitForMultipleObjectsEx
DestroyWindow
advapi32
CloseServiceHandle
LookupAccountSidW
RevertToSelf
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
GetAce
DeleteAce
ControlService
QueryServiceStatus
DeleteService
RegFlushKey
RegCloseKey
RegSetValueExA
CreateProcessAsUserW
FreeSid
GetSecurityInfo
SetSecurityInfo
AllocateAndInitializeSid
CryptGenRandom
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext
CryptAcquireContextA
EqualSid
ole32
CoInitializeEx
CoUninitialize
CoCreateGuid
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoInitializeSecurity
CoTaskMemAlloc
oleaut32
SysFreeString
SysAllocString
VariantClear
VarUI4FromStr
mpr
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW
setupapi
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
iphlpapi
DeleteIPAddress
GetAdapterIndex
GetAdaptersInfo
crypt32
CertGetNameStringW
CertGetNameStringA
CertFreeCertificateContext
CryptVerifyMessageSignature
imagehlp
ImageGetCertificateData
ImageGetCertificateHeader
ImageEnumerateCertificates
wininet
InternetSetOptionW
InternetCloseHandle
InternetConnectW
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetGoOnlineA
InternetQueryOptionW
InternetErrorDlg
HttpSendRequestA
InternetWriteFile
InternetReadFile
InternetQueryDataAvailable
HttpEndRequestA
InternetOpenW
HttpQueryInfoW
sensapi
IsNetworkAlive
shell32
SHGetMalloc
SHGetSpecialFolderLocation
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 533KB - Virtual size: 532KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 43KB - Virtual size: 229KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
tv_w32.dll.dll windows:4 windows x86 arch:x86
798ed578c45b3498ce7896558c5e55e0
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
b8:20:18:66:6c:19:7b:20:cf:db:95:29:7e:40:b6:ba:9f:64:ab:fcSigner
Actual PE Digestb8:20:18:66:6c:19:7b:20:cf:db:95:29:7e:40:b6:ba:9f:64:ab:fcDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
c:\teamviewer_6.0_release\teamviewer\tvhooks64\release\tv_w32dll.pdb
Imports
crtdll
_snprintf
_strlwr
strncpy
strrchr
memset
memcpy
memmove
_vsnprintf
wcsstr
_wcslwr
_global_unwind2
_local_unwind2
_initterm
malloc
strncmp
strncat
comctl32
InitCommonControlsEx
kernel32
CreateEventW
GetVersionExW
UnmapViewOfFile
InterlockedDecrement
InterlockedIncrement
ReleaseMutex
SetEvent
WaitForSingleObject
GetTickCount
GetLastError
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
CreateFileMappingW
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
LocalAlloc
ResumeThread
CreateThread
SetLastError
GlobalFree
GlobalAlloc
GetVersion
GetCurrentThreadId
GetLocalTime
CreateMutexW
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DisableThreadLibraryCalls
CloseHandle
OpenMutexW
LeaveCriticalSection
GetModuleFileNameA
EnterCriticalSection
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
LocalFree
GetCurrentProcessId
user32
GetSysColor
LoadBitmapW
GetWindow
SystemParametersInfoW
GetClientRect
CreateWindowExW
IsZoomed
GetWindowInfo
GetClassNameA
IsRectEmpty
DefWindowProcW
RedrawWindow
CallWindowProcW
MoveWindow
DestroyWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
EndPaint
BeginPaint
GetActiveWindow
SetWindowLongW
GetWindowLongW
FindWindowExW
FindWindowW
MapWindowPoints
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
ShowWindow
GetClassInfoExW
UnregisterClassW
LoadCursorW
RegisterClassExW
SendMessageW
SendMessageTimeoutW
CallNextHookEx
GetWindowDC
GetWindowRect
ReleaseDC
UnhookWindowsHookEx
SendNotifyMessageW
IsWindow
SetWindowsHookExW
SetWindowPos
RegisterWindowMessageW
GetSystemMetrics
IsWindowVisible
gdi32
RectVisible
BitBlt
GetPixel
SetPixel
CreateCompatibleDC
GetObjectW
CreateCompatibleBitmap
CreateSolidBrush
MoveToEx
LineTo
ExtCreatePen
Polyline
DeleteDC
CreatePen
SelectObject
GetStockObject
Rectangle
DeleteObject
Exports
Exports
GetLoaderInterface
GetTeamViewerInterface
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
tv_w32.exe.exe windows:4 windows x86 arch:x86
68da36c705041bcb516a1b6caabad0aa
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
04:3d:03:28:74:25:d8:4e:88:62:2a:2e:fb:45:1d:2b:ad:5e:b9:0bSigner
Actual PE Digest04:3d:03:28:74:25:d8:4e:88:62:2a:2e:fb:45:1d:2b:ad:5e:b9:0bDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\teamviewer_6.0_release\teamviewer\tvhooks64\release\tv_w32exe.pdb
Imports
kernel32
GetLastError
SetEvent
GetVersionExW
CreateEventW
CloseHandle
GetProcAddress
LoadLibraryA
GetModuleFileNameA
FreeLibrary
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
GetCurrentProcessId
CreateMutexW
SetFilePointer
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcess
GetCommandLineW
FlushFileBuffers
CreateFileA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
LCMapStringA
LCMapStringW
Sleep
HeapSize
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VirtualQuery
user32
PeekMessageW
MsgWaitForMultipleObjectsEx
DispatchMessageW
TranslateMessage
shell32
ShellExecuteExW
Sections
.text Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
tv_x64.dll.dll windows:4 windows x64 arch:x64
09c5b20b66e0f7caa44c28dfae2d9a8d
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
36:75:d4:a3:b7:bd:7d:09:8f:9e:ca:61:4e:cb:20:e0:c6:b8:5e:1dSigner
Actual PE Digest36:75:d4:a3:b7:bd:7d:09:8f:9e:ca:61:4e:cb:20:e0:c6:b8:5e:1dDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
c:\TeamViewer_6.0_Release\TeamViewer\TVHooks64\release\tv_x64dll.pdb
Imports
msvcrt
malloc
free
_initterm
_wcslwr
wcsstr
strncmp
memmove
memcpy
__C_specific_handler
memset
strrchr
strncpy
_strlwr
_snprintf
_vsnprintf
strncat
comctl32
InitCommonControlsEx
kernel32
SetLastError
CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
CloseHandle
OpenMutexW
LeaveCriticalSection
GetModuleFileNameA
EnterCriticalSection
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
LocalFree
CreateMutexW
CreateEventW
GetVersionExW
UnmapViewOfFile
ReleaseMutex
SetEvent
WaitForSingleObject
GetTickCount
GetLastError
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
CreateFileMappingW
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
LocalAlloc
ResumeThread
user32
GetUpdateRect
RegisterWindowMessageW
SetWindowPos
IsWindowVisible
SetWindowsHookExW
IsWindow
SendNotifyMessageW
UnhookWindowsHookEx
ReleaseDC
GetWindowRect
GetWindowDC
CallNextHookEx
SendMessageTimeoutW
SendMessageW
RegisterClassExW
LoadCursorW
UnregisterClassW
GetClassInfoExW
ShowWindow
GetWindow
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
GetClientRect
CreateWindowExW
IsZoomed
GetWindowInfo
GetClassNameA
IsRectEmpty
DefWindowProcW
CallWindowProcW
RedrawWindow
MoveWindow
DestroyWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
GetActiveWindow
SetWindowLongPtrW
EndPaint
BeginPaint
GetWindowLongPtrW
FindWindowExW
FindWindowW
MapWindowPoints
GetDesktopWindow
ClientToScreen
GetDC
gdi32
BitBlt
GetPixel
SetPixel
CreateCompatibleDC
GetObjectW
CreateCompatibleBitmap
CreateSolidBrush
MoveToEx
RectVisible
ExtCreatePen
Polyline
DeleteDC
CreatePen
SelectObject
GetStockObject
Rectangle
DeleteObject
LineTo
Exports
Exports
GetLoaderInterface
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.shared Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 218B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
tv_x64.exe.exe windows:4 windows x64 arch:x64
fe0ec5a2a04130d9900b2dd133a00d2b
Code Sign
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08/08/2011, 00:00Not After07/08/2014, 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
79:68:03:70:37:b2:ee:17:99:a3:cd:fc:61:fa:e2:6b:f5:f9:a2:1fSigner
Actual PE Digest79:68:03:70:37:b2:ee:17:99:a3:cd:fc:61:fa:e2:6b:f5:f9:a2:1fDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
c:\TeamViewer_6.0_Release\TeamViewer\TVHooks64\release\tv_x64exe.pdb
Imports
kernel32
CreateEventW
CloseHandle
GetLastError
SetEvent
GetVersionExW
GetProcAddress
LoadLibraryA
GetModuleFileNameA
FreeLibrary
GetSystemDirectoryW
LoadLibraryW
OpenMutexA
GetTickCount
CreateMutexW
SetFilePointer
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCurrentProcess
GetCommandLineW
FlushFileBuffers
CreateFileA
WriteConsoleW
WideCharToMultiByte
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
FlsAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
Sleep
HeapSize
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapReAlloc
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
user32
MsgWaitForMultipleObjectsEx
DispatchMessageW
TranslateMessage
PeekMessageW
shell32
ShellExecuteExW
Sections
.text Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
x64/TVMonitor.inf
-
x64/TVMonitor.sys.sys windows:6 windows x64 arch:x64
f24b69173de020aa0ac1739d7b40e04c
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before16/07/2004, 00:00Not After15/07/2014, 23:59SubjectCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USNot Before16/01/2008, 00:00Not After22/02/2011, 23:59SubjectCN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
61:0c:12:06:00:00:00:00:00:1bCertificate
IssuerCN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before23/05/2006, 17:01Not After23/05/2016, 17:11SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3bSigner
Actual PE Digest28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3bDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
j:\teamviewer6.0\monitordriver\objfre_wlh_amd64\amd64\TVMonitor.pdb
Imports
ntoskrnl.exe
IoAcquireRemoveLockEx
KeClearEvent
IoDeleteSymbolicLink
_snwprintf
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoReleaseRemoveLockEx
IoDetachDevice
PoRequestPowerIrp
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
IoReleaseRemoveLockAndWaitEx
ObReferenceObjectByHandle
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
KeInitializeTimerEx
KeCancelTimer
KeWaitForMultipleObjects
IofCallDriver
KeBugCheckEx
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
x64/tvmonitor.cat
-
x86/TVMonitor.inf
-
x86/TVMonitor.sys.sys windows:6 windows x86 arch:x86
bc06eb1dad5e8285411e580cdee99e10
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before16/07/2004, 00:00Not After15/07/2014, 23:59SubjectCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USNot Before16/01/2008, 00:00Not After22/02/2011, 23:59SubjectCN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
61:0c:12:06:00:00:00:00:00:1bCertificate
IssuerCN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before23/05/2006, 17:01Not After23/05/2016, 17:11SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83Signer
Actual PE Digesta9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
j:\teamviewer6.0\monitordriver\objfre_wxp_x86\i386\TVMonitor.pdb
Imports
ntoskrnl.exe
RtlInitUnicodeString
_snwprintf
IofCompleteRequest
IoReleaseRemoveLockEx
PoCallDriver
IoAcquireRemoveLockEx
PoStartNextPowerIrp
IofCallDriver
ObfDereferenceObject
IoGetAttachedDeviceReference
IoDeleteDevice
IoDetachDevice
KeWaitForSingleObject
KeSetEvent
PoRequestPowerIrp
IoAttachDeviceToDeviceStack
IoDeleteSymbolicLink
IoInitializeRemoveLockEx
IoCreateSymbolicLink
IoCreateDevice
InterlockedIncrement
IoReleaseRemoveLockAndWaitEx
PsTerminateSystemThread
KeCancelTimer
KeWaitForMultipleObjects
KeSetTimerEx
KeClearEvent
KeInitializeTimerEx
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeTickCount
KeBugCheckEx
KeInitializeEvent
KeGetCurrentThread
hal
KeGetCurrentIrql
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 277B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 384B - Virtual size: 274B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
x86/tvmonitor.cat