dialog
initDialog
show
Overview
overview
7Static
static
3db4fc048dd...18.exe
windows7-x64
3db4fc048dd...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ta.dll
windows7-x64
3$PLUGINSDI...ta.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3TeamViewer.exe
windows7-x64
7TeamViewer.exe
windows10-2004-x64
7TeamViewer...op.exe
windows7-x64
3TeamViewer...op.exe
windows10-2004-x64
3TeamViewer...en.dll
windows7-x64
1TeamViewer...en.dll
windows10-2004-x64
1TeamViewer...ce.exe
windows7-x64
3TeamViewer...ce.exe
windows10-2004-x64
3TeamViewer...es.dll
windows7-x64
1TeamViewer...es.dll
windows10-2004-x64
1tv_w32.dll
windows7-x64
3tv_w32.dll
windows10-2004-x64
3tv_w32.exe
windows7-x64
3tv_w32.exe
windows10-2004-x64
3tv_x64.dll
windows7-x64
1tv_x64.dll
windows10-2004-x64
1tv_x64.exe
windows7-x64
1tv_x64.exe
windows10-2004-x64
1x64/TVMonitor.sys
windows7-x64
1x64/TVMonitor.sys
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
db4fc048dd3971c76f902f2bc95c9a64_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
db4fc048dd3971c76f902f2bc95c9a64_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ReadCustomerData.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ReadCustomerData.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
TeamViewer.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral14
Sample
TeamViewer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral15
Sample
TeamViewer_Desktop.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
TeamViewer_Desktop.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
TeamViewer_Resource_en.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
TeamViewer_Resource_en.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
TeamViewer_Service.exe
Resource
win7-20240729-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
TeamViewer_Service.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
TeamViewer_StaticRes.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
TeamViewer_StaticRes.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
tv_w32.dll
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
tv_w32.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
tv_w32.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
tv_w32.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
tv_x64.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
tv_x64.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
tv_x64.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
tv_x64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
x64/TVMonitor.sys
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
x64/TVMonitor.sys
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
db4fc048dd3971c76f902f2bc95c9a64_JaffaCakes118
-
Size
2.9MB
-
MD5
db4fc048dd3971c76f902f2bc95c9a64
-
SHA1
2da8e716b5570eca8aa5c77dcb4e9d66581567b0
-
SHA256
705efa778e40a383fbe5a8acc5178ea636902ac47fe16db0f015d3840fd41d75
-
SHA512
8c75a1ee62c6506250119db9e07e1145484142b72b5438ceb4b08cfe722006ff0f4ad52c8634a1cde8669816b4f4c472bd7356d2051c4ea99c7781bfe5dcb3f2
-
SSDEEP
49152:HEN6oZDhMcToUcHx0ZrKSrseqPs4OB8ecNifpf0a7YPb/lIKftzDKtj36:kNjDhMOoUcHSr2s4OB+Mt0BT/lIKftI
Score
3/10
Malware Config
Signatures
-
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource db4fc048dd3971c76f902f2bc95c9a64_JaffaCakes118 unpack001/$PLUGINSDIR/InstallOptions.dll unpack001/$PLUGINSDIR/ReadCustomerData.dll unpack001/$PLUGINSDIR/System.dll unpack001/$PLUGINSDIR/TvGetVersion.dll unpack001/$PLUGINSDIR/nsis7z.dll -
NSIS installer 2 IoCs
resource yara_rule sample nsis_installer_1 sample nsis_installer_2
Files
-
db4fc048dd3971c76f902f2bc95c9a64_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 44KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/InstallOptions.dll.dll windows:4 windows x86 arch:x86
b1cd0d78f652ce5fc63f0879371af012
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc
user32
MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect
gdi32
SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject
shell32
SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Exports
Exports
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/ReadCustomerData.dll.dll windows:4 windows x86 arch:x86
d29e408dd9048e10d5936c6f2bfca832
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
MultiByteToWideChar
GetLastError
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
CloseHandle
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
RtlUnwind
RaiseException
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers
VirtualAlloc
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
InitializeCriticalSection
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetEndOfFile
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GlobalFree
lstrcpyA
Exports
Exports
ReadCustomerData
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/System.dll.dll windows:4 windows x86 arch:x86
2017f2acbdaa42ab3e4adeb8b4c37e7b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Exports
Exports
Alloc
Call
Copy
Free
Get
Int64Op
Store
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/TvGetVersion.dll.dll windows:4 windows x86 arch:x86
7f27fb2f8604769e3f1416e79e2b660f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetVersionExA
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
lstrcpynA
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
lstrcmpiA
lstrcpyA
lstrlenA
lstrcatA
GetDriveTypeA
CreateFileA
GetFileSize
GlobalAlloc
ReadFile
CloseHandle
GlobalFree
GetLastError
GetCurrentProcessId
GetModuleHandleA
QueryPerformanceCounter
GetProcAddress
user32
GetSystemMetrics
SendMessageA
wsprintfA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
DeleteService
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
RegDeleteValueA
RegCreateKeyExA
RegEnumKeyExA
RegEnumValueA
RegSetValueExA
Exports
Exports
GetCurrentSessionId
GetServiceStatus
IsNetPath
IsServiceInstalled
IsTvPasswordSet
LoadFile
RegCopyKey
RegCopyValue
RemoveService
RemoveServiceWait
RunService
RunServiceWait
StopService
StopServiceWait
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsVersion
WindowsVersionMajor
WindowsVersionMinor
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/nsis7z.dll.dll windows:4 windows x86 arch:x86
b22ed27c346f001ed1b4410c1073cfa9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
LoadLibraryA
GetModuleFileNameA
RemoveDirectoryW
MoveFileA
MoveFileW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
GetFullPathNameA
GetFullPathNameW
GetCurrentThreadId
GetCurrentProcessId
SetLastError
CreateFileW
SetFileTime
CloseHandle
SetFileAttributesA
SetFileAttributesW
RemoveDirectoryA
FindClose
FindFirstFileA
FindFirstFileW
CreateFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetProcAddress
GetCurrentProcess
GetSystemInfo
GetModuleHandleA
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
DeleteCriticalSection
AreFileApisANSI
VirtualFree
VirtualAlloc
GetVersionExA
ResetEvent
WaitForSingleObject
SetEvent
InitializeCriticalSection
CreateEventA
SetFileApisToOEM
SetFileApisToANSI
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapAlloc
HeapFree
HeapReAlloc
ExitThread
CreateThread
GetCommandLineA
GetProcessHeap
HeapDestroy
HeapCreate
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
Sleep
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
VirtualQuery
user32
CharUpperW
CharUpperA
GetDlgItem
FindWindowExA
SetWindowTextA
wsprintfA
SendMessageA
oleaut32
VariantCopy
VariantClear
SysAllocString
Exports
Exports
Extract
ExtractWithCallback
ExtractWithDetails
Sections
.text Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/wincheck.ini
-
$_2_/tvqsfiles.7z.7z
-
TeamViewer.exe.exe windows:5 windows x86 arch:x86
f6e72ae7bc091ffa9e18ef49ede11c96
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08-08-2011 00:00Not After07-08-2014 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08-02-2010 00:00Not After07-02-2020 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
5f:6b:a0:a7:2c:77:b0:39:d3:df:43:2d:b9:4a:f4:fb:ba:26:ef:c0Signer
Actual PE Digest5f:6b:a0:a7:2c:77:b0:39:d3:df:43:2d:b9:4a:f4:fb:ba:26:ef:c0Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer.pdb
Imports
avicap32
capGetDriverDescriptionA
msvfw32
DrawDibOpen
DrawDibDraw
DrawDibClose
winmm
waveOutReset
waveOutClose
waveOutUnprepareHeader
waveOutRestart
waveInGetNumDevs
waveOutPause
waveOutPrepareHeader
waveOutOpen
waveInStart
waveInReset
waveInClose
waveInUnprepareHeader
waveInAddBuffer
waveInPrepareHeader
waveInOpen
timeEndPeriod
timeBeginPeriod
mixerSetControlDetails
mixerGetControlDetailsW
mixerClose
mixerGetLineControlsW
mixerGetLineInfoW
mixerGetID
waveOutGetDevCapsW
waveInGetDevCapsW
mixerGetDevCapsW
mixerOpen
waveOutGetNumDevs
waveOutWrite
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
iphlpapi
GetAdaptersInfo
GetAdapterIndex
DeleteIPAddress
SendARP
kernel32
CompareStringW
GetThreadTimes
GetSystemDirectoryA
GetVersionExA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStringTypeA
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
HeapCreate
GetModuleFileNameA
GetStdHandle
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetDateFormatA
GetTimeFormatA
ExitProcess
GetStartupInfoA
GetCommandLineA
ExitThread
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
CreateWaitableTimerA
CreateFileMappingA
MapViewOfFileEx
CreateFileA
UnmapViewOfFile
AreFileApisANSI
GetModuleHandleA
GetFileTime
GetVolumeInformationW
RemoveDirectoryW
FormatMessageA
HeapSize
HeapReAlloc
HeapDestroy
IsProcessorFeaturePresent
LoadLibraryA
lstrlenA
DeviceIoControl
SetFileAttributesW
SetEndOfFile
CompareFileTime
GetOverlappedResult
CancelIo
GlobalSize
WaitForMultipleObjectsEx
GetFileAttributesExW
GetSystemTime
SetFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetFileAttributesW
WaitForSingleObjectEx
GetLogicalDriveStringsW
GetDateFormatW
SystemTimeToTzSpecificLocalTime
GetTempPathW
SystemTimeToFileTime
GetSystemDefaultLCID
GetUserDefaultLCID
GetLocaleInfoA
MoveFileExW
CreateProcessW
TerminateProcess
WaitNamedPipeW
GetPrivateProfileIntW
InterlockedCompareExchange
GetQueuedCompletionStatus
TerminateThread
QueueUserAPC
CreateIoCompletionPort
OpenEventA
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
OpenProcess
ExpandEnvironmentStringsW
FormatMessageW
LocalFree
SetThreadAffinityMask
QueryPerformanceCounter
QueryPerformanceFrequency
MoveFileW
SetFilePointer
GetSystemDirectoryW
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDriveTypeW
lstrcpyW
FindFirstFileW
GetFullPathNameW
FindClose
GetCurrentDirectoryA
GetFullPathNameA
FindNextFileW
GetCurrentThread
ResetEvent
SetThreadPriority
GetPriorityClass
SetPriorityClass
TryEnterCriticalSection
VirtualAlloc
VirtualFree
DuplicateHandle
GetLocalTime
GetTimeFormatW
DeleteFileW
GetCurrentProcessId
CopyFileW
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
CloseHandle
FindFirstFileA
GetDriveTypeA
ReadFileEx
LocalAlloc
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
CreateMutexW
lstrcmpiW
GetModuleHandleW
ReleaseMutex
GetCurrentProcess
TlsAlloc
TlsFree
GlobalHandle
InterlockedDecrement
lstrcmpW
MulDiv
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateThread
ResumeThread
GetExitCodeThread
WaitForMultipleObjects
ReleaseSemaphore
CreateSemaphoreA
GetModuleFileNameW
CreateDirectoryW
SetErrorMode
SetProcessShutdownParameters
lstrcpynW
GetVersionExW
WritePrivateProfileStringW
GetFileSize
ReadFile
GetPrivateProfileStringW
CreateWaitableTimerW
CreateEventW
InterlockedExchangeAdd
InterlockedExchange
PostQueuedCompletionStatus
SetWaitableTimer
GetSystemTimeAsFileTime
InterlockedIncrement
SleepEx
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GetProcAddress
GlobalAlloc
GlobalLock
CreateFileW
WriteFile
GlobalUnlock
GlobalFree
Sleep
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
GetLastError
GetTickCount
SetEvent
WaitForSingleObject
HeapAlloc
CreateEventA
SetLastError
GetCurrentThreadId
GetProcessHeap
HeapFree
user32
BringWindowToTop
SendNotifyMessageW
SendMessageW
MonitorFromWindow
SetWindowLongW
ExitWindowsEx
DrawStateW
DrawFocusRect
GetSysColorBrush
SendDlgItemMessageW
GetClassLongW
GetWindowThreadProcessId
WindowFromPoint
CopyIcon
ChildWindowFromPointEx
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SetForegroundWindow
DrawTextW
SetRect
MessageBoxA
FrameRect
MapDialogRect
GetCapture
DrawIconEx
SetFocus
IsWindow
DestroyWindow
ReleaseDC
GetAsyncKeyState
CreateDialogParamW
SetClassLongW
LoadCursorW
UnregisterClassA
BlockInput
RegisterClipboardFormatW
GetDC
RegisterClassW
EnumDisplaySettingsW
AttachThreadInput
EnumChildWindows
GetUpdateRgn
LoadBitmapW
SetWindowsHookExW
CallNextHookEx
ActivateKeyboardLayout
GetKeyboardLayout
SendInput
GetKeyboardState
VkKeyScanExW
UnhookWindowsHookEx
MapVirtualKeyW
ToUnicode
OpenDesktopW
SetThreadDesktop
CloseDesktop
LoadStringW
GetActiveWindow
CreatePopupMenu
AppendMenuW
InsertMenuW
InsertMenuItemW
DrawIcon
GetDlgItemTextW
GetKeyState
GetMessageW
TranslateAcceleratorW
IsIconic
GetWindowPlacement
SetWindowPlacement
GetNextDlgTabItem
SendMessageTimeoutW
LoadAcceleratorsW
DrawEdge
GetMessagePos
GetSystemMenu
GetClassInfoW
ShowWindow
IsMenu
CreateMenu
DestroyMenu
PostMessageW
GetWindowRect
InvalidateRect
IsWindowVisible
PtInRect
GetCursorPos
GetWindowLongW
CallWindowProcW
DefWindowProcW
MoveWindow
GetClientRect
ScreenToClient
InvalidateRgn
SetTimer
CreateDialogIndirectParamW
RegisterWindowMessageW
CreateAcceleratorTableW
GetFocus
KillTimer
SetCapture
ScrollWindowEx
SetParent
SetWindowContextHelpId
DestroyAcceleratorTable
IsChild
CharNextW
GetSysColor
GetCursor
UnionRect
DestroyCursor
SetActiveWindow
MonitorFromPoint
GetMenuItemCount
GetClassNameW
IntersectRect
RedrawWindow
MsgWaitForMultipleObjects
PostQuitMessage
TrackPopupMenuEx
AdjustWindowRectEx
GetMenu
DeleteMenu
DrawTextExW
DialogBoxParamW
MessageBoxW
MessageBeep
SetDlgItemTextW
IsWindowEnabled
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
OpenClipboard
GetClipboardViewer
SetClipboardViewer
ChangeClipboardChain
FindWindowW
GetForegroundWindow
PeekMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageW
PostThreadMessageW
GetWindowDC
EndDialog
LoadImageW
LoadIconW
MonitorFromRect
GetMonitorInfoW
AdjustWindowRect
GetSystemMetrics
FillRect
SetRectEmpty
ShowScrollBar
ClientToScreen
GetMenuState
IsDialogMessageW
GetDesktopWindow
GetDlgItem
EnableWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetDlgCtrlID
GetSubMenu
LoadMenuW
CheckMenuRadioItem
GetMenuStringW
RemoveMenu
TrackMouseEvent
EqualRect
SetWindowRgn
GetParent
SetMenuItemInfoW
GetMenuItemInfoW
EnableMenuItem
CheckMenuItem
ReleaseCapture
CreateIconIndirect
SetCursor
SetCursorPos
EndPaint
BeginPaint
GetScrollInfo
SetScrollPos
UpdateWindow
SystemParametersInfoW
CreateWindowExW
RegisterClassExW
GetWindow
MapWindowPoints
SetWindowPos
DestroyIcon
OffsetRect
InflateRect
IsRectEmpty
CopyRect
GetClassInfoExW
SetScrollInfo
gdi32
CreatePolygonRgn
SetLayout
ExtTextOutW
GetObjectType
SetBkColor
SetTextColor
SetPixel
SetViewportOrgEx
SetBrushOrgEx
CreateCompatibleBitmap
BitBlt
SelectObject
CreateCompatibleDC
GetObjectW
CreatePalette
CombineRgn
SelectClipRgn
StretchBlt
SetStretchBltMode
CreateDIBSection
RealizePalette
SelectPalette
DeleteDC
GetDeviceCaps
DeleteObject
BeginPath
EndPath
StrokeAndFillPath
CreateRectRgnIndirect
RoundRect
CreateRoundRectRgn
PatBlt
SetBkMode
GetStockObject
GetTextExtentPoint32W
MoveToEx
LineTo
CreatePen
GetPixel
CreatePatternBrush
SetRectRgn
OffsetRgn
CreateSolidBrush
CreateFontIndirectW
Ellipse
Polygon
Rectangle
SetDIBColorTable
GetClipBox
GetViewportOrgEx
CreateFontW
TextOutW
SetWindowOrgEx
CreateBitmap
CreateRectRgn
GetCurrentObject
GetBitmapBits
GetBkMode
GetTextColor
GetRgnBox
GetTextMetricsW
comdlg32
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
advapi32
GetSidIdentifierAuthority
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExW
LsaLookupNames
LsaFreeMemory
LsaClose
ConvertSidToStringSidW
LsaOpenPolicy
RegFlushKey
GetUserNameW
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetSecurityInfo
SetSecurityInfo
CreateProcessAsUserW
LookupAccountSidW
LookupAccountNameW
EqualSid
FreeSid
RegCreateKeyW
StartServiceW
CloseServiceHandle
SetEntriesInAclW
GetNamedSecurityInfoW
GetAce
DeleteAce
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RevertToSelf
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegCloseKey
shell32
DragQueryFileW
ExtractIconW
SHAppBarMessage
DragFinish
SHGetFileInfoW
SHGetSpecialFolderLocation
ExtractIconExW
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHGetMalloc
SHBrowseForFolderW
ord680
DragAcceptFiles
ord155
ShellExecuteExW
SHGetPathFromIDListW
ole32
ReleaseStgMedium
CoMarshalInterThreadInterfaceInStream
OleDuplicateData
CoTaskMemFree
CoTaskMemRealloc
OleUninitialize
OleInitialize
CoCreateGuid
CoGetInterfaceAndReleaseStream
DoDragDrop
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
RevokeDragDrop
CoInitializeSecurity
RegisterDragDrop
oleaut32
VariantClear
VariantInit
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
OleCreatePropertyFrame
shlwapi
PathCompactPathW
comctl32
InitCommonControlsEx
ImageList_Draw
ImageList_GetIconSize
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragMove
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetIcon
ImageList_SetBkColor
ImageList_Remove
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon
ws2_32
shutdown
setsockopt
recv
closesocket
WSAGetLastError
inet_ntoa
gethostname
gethostbyname
ioctlsocket
htonl
ntohl
__WSAFDIsSet
getsockname
select
socket
WSAResetEvent
getpeername
ntohs
WSACreateEvent
htons
connect
getsockopt
sendto
send
WSACloseEvent
WSAWaitForMultipleEvents
WSAEventSelect
WSASetEvent
bind
recvfrom
accept
listen
WSASetLastError
WSARecv
WSARecvFrom
WSASend
WSASocketW
WSADuplicateSocketW
WSAAddressToStringA
inet_addr
WSACleanup
WSAStartup
getservbyport
getservbyname
gethostbyaddr
mpr
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW
netapi32
NetApiBufferFree
NetUserGetInfo
NetWkstaGetInfo
setupapi
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
sensapi
IsNetworkAlive
wininet
InternetConnectW
HttpSendRequestA
InternetErrorDlg
InternetQueryOptionW
InternetGoOnlineA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetQueryDataAvailable
InternetReadFile
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetCloseHandle
imagehlp
ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates
secur32
GetUserNameExW
crypt32
CertGetNameStringA
CertGetNameStringW
CertFreeCertificateContext
CryptVerifyMessageSignature
mswsock
GetAcceptExSockaddrs
AcceptEx
Sections
.text Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 230KB - Virtual size: 306KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 496KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
TeamViewer_Desktop.exe.exe windows:5 windows x86 arch:x86
de8b218615d3a6d615cedf7273b2fb7b
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08-08-2011 00:00Not After07-08-2014 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08-02-2010 00:00Not After07-02-2020 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
a4:91:92:78:0e:23:15:f3:6b:d2:9f:42:28:ff:df:86:e1:38:aa:d4Signer
Actual PE Digesta4:91:92:78:0e:23:15:f3:6b:d2:9f:42:28:ff:df:86:e1:38:aa:d4Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer_Desktop.pdb
Imports
kernel32
InterlockedDecrement
GetProcAddress
GetModuleHandleW
lstrcmpiW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
GetCurrentProcess
GetThreadTimes
SetEnvironmentVariableA
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FindResourceW
LoadLibraryExW
GetModuleFileNameW
SetProcessShutdownParameters
GetProcessShutdownParameters
GetCurrentProcessId
GetCommandLineW
SleepEx
GetExitCodeThread
SetWaitableTimer
PostQueuedCompletionStatus
InterlockedExchangeAdd
QueueUserAPC
CreateEventW
lstrcpyW
CreateWaitableTimerW
DeviceIoControl
CreateFileW
Sleep
DuplicateHandle
LocalFree
LocalAlloc
InterlockedIncrement
GetCurrentThread
CreateMutexA
TlsAlloc
FlushInstructionCache
RaiseException
InterlockedExchange
WaitForMultipleObjects
GetLastError
SetLastError
ReleaseSemaphore
CreateSemaphoreA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
GetTickCount
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
GetModuleFileNameA
GetStdHandle
ExitProcess
CompareStringW
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
GetDateFormatA
GetTimeFormatA
GetCurrentThreadId
SetEvent
WaitForSingleObject
GetStartupInfoA
GetCommandLineA
ExitThread
RtlUnwind
IsDebuggerPresent
UnhandledExceptionFilter
CreateWaitableTimerA
GetSystemInfo
AreFileApisANSI
GetModuleHandleA
LoadLibraryW
lstrlenW
FormatMessageA
HeapSize
HeapReAlloc
HeapAlloc
CreateEventA
GetProcessHeap
HeapFree
TlsFree
FileTimeToSystemTime
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
GetSystemDirectoryW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
QueryPerformanceFrequency
QueryPerformanceCounter
SetThreadAffinityMask
GetVersionExW
FormatMessageW
WideCharToMultiByte
GetLocalTime
GetFileSize
WriteFile
SetFilePointer
ReleaseMutex
CreateMutexW
CreateDirectoryW
OpenProcess
TerminateProcess
ReadFile
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
OpenEventA
ResetEvent
CreateIoCompletionPort
TerminateThread
GetQueuedCompletionStatus
InterlockedCompareExchange
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocaleInfoA
GetUserDefaultLCID
GetSystemDefaultLCID
SystemTimeToFileTime
GlobalUnlock
GlobalLock
SetFileAttributesW
GetFileAttributesW
ResumeThread
CreateThread
LockResource
FindResourceExW
GetSystemTime
WaitForMultipleObjectsEx
CancelIo
GetOverlappedResult
ReadFileEx
SetEndOfFile
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapDestroy
CloseHandle
user32
GetWindowThreadProcessId
CopyRect
IsRectEmpty
PtInRect
SetRectEmpty
InflateRect
OffsetRect
IntersectRect
EqualRect
SystemParametersInfoW
GetClassNameW
IsWindow
GetForegroundWindow
GetWindowRect
SendMessageW
EnumWindows
SetWindowPos
FindWindowW
FindWindowExW
SetWindowsHookExW
UnhookWindowsHookEx
GetCursorInfo
GetIconInfo
DrawTextW
GetDC
GetSystemMetrics
GetWindowRgn
IsWindowEnabled
WindowFromPoint
GetDesktopWindow
CallNextHookEx
GetWindow
ReleaseDC
GetWindowDC
LoadStringW
OpenInputDesktop
SetThreadDesktop
ExitWindowsEx
ChangeDisplaySettingsExW
EnumDisplaySettingsW
ScreenToClient
FillRect
GetDlgItem
LoadBitmapW
GetAsyncKeyState
LoadImageW
ToUnicode
DestroyWindow
VkKeyScanExW
GetKeyboardState
GetKeyState
GetKeyboardLayout
ActivateKeyboardLayout
RegisterClipboardFormatW
UnregisterClassA
MapWindowPoints
UnionRect
RedrawWindow
GetCursorPos
MapVirtualKeyW
GetGUIThreadInfo
GetParent
GetWindowLongW
CallWindowProcW
DefWindowProcW
GetClientRect
SetLayeredWindowAttributes
MsgWaitForMultipleObjectsEx
GetUserObjectInformationW
GetThreadDesktop
BlockInput
KillTimer
SetTimer
OpenDesktopW
EnumDesktopWindows
CloseDesktop
PostThreadMessageW
IsWindowVisible
PostMessageW
SendInput
SendNotifyMessageW
MessageBoxA
PostQuitMessage
MessageBoxW
CreateDialogParamW
CreateWindowExW
RegisterClassExW
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
GetClassInfoExW
SetWindowLongW
gdi32
SelectObject
SetBkMode
GetSystemPaletteEntries
GetDIBits
GetDeviceCaps
StretchBlt
CreateCompatibleDC
GetObjectW
RectInRegion
CreateRectRgnIndirect
CreateDIBSection
SetPixel
CreateDCW
DeleteDC
GetDCOrgEx
BitBlt
PtInRegion
GetRgnBox
OffsetRgn
SetRectRgn
Rectangle
SelectClipRgn
CreateCompatibleBitmap
DeleteObject
GetRegionData
CombineRgn
CreateRectRgn
GetStockObject
RoundRect
CreatePatternBrush
CreateFontIndirectW
CreatePen
GetTextExtentPoint32W
ExtCreateRegion
GdiFlush
SetBkColor
CreateSolidBrush
TextOutW
advapi32
GetSidIdentifierAuthority
StartServiceW
CloseServiceHandle
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenCurrentUser
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
GetUserNameW
RevertToSelf
FreeSid
EqualSid
LookupAccountNameW
LookupAccountSidW
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
AllocateAndInitializeSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
ImpersonateLoggedOnUser
RegCreateKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegFlushKey
ole32
OleInitialize
CoGetInterfaceAndReleaseStream
ReleaseStgMedium
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
OleUninitialize
oleaut32
SafeArrayGetElement
VariantClear
VariantChangeType
VariantCopy
VariantInit
SafeArrayGetDim
SysFreeString
SysAllocString
VarUI4FromStr
comctl32
ImageList_Draw
InitCommonControlsEx
ws2_32
inet_ntoa
WSAGetLastError
inet_addr
closesocket
setsockopt
shutdown
ioctlsocket
gethostname
gethostbyname
WSACleanup
WSAAddressToStringA
select
WSASocketW
WSASend
WSARecv
listen
htonl
getsockname
WSASetLastError
ntohl
htons
__WSAFDIsSet
accept
bind
connect
getsockopt
WSAStartup
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
imagehlp
ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData
crypt32
CertFreeCertificateContext
CertGetNameStringA
CertGetNameStringW
CryptVerifyMessageSignature
shell32
ShellExecuteW
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHGetFileInfoW
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 406KB - Virtual size: 406KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 203KB - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
TeamViewer_Resource_en.dll.dll windows:5 windows x86 arch:x86
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08-08-2011 00:00Not After07-08-2014 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08-02-2010 00:00Not After07-02-2020 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
56:77:04:8b:01:12:9c:01:6e:24:7c:5d:94:32:e1:ba:10:69:f7:c2Signer
Actual PE Digest56:77:04:8b:01:12:9c:01:6e:24:7c:5d:94:32:e1:ba:10:69:f7:c2Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.rsrc Size: 222KB - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
TeamViewer_Service.exe.exe windows:5 windows x86 arch:x86
3d195209ce847960d828e89eb51485a4
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08-08-2011 00:00Not After07-08-2014 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08-02-2010 00:00Not After07-02-2020 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
b4:f9:fc:9e:9e:5f:b7:63:7d:16:92:ce:d8:93:b9:ea:82:90:9a:3fSigner
Actual PE Digestb4:f9:fc:9e:9e:5f:b7:63:7d:16:92:ce:d8:93:b9:ea:82:90:9a:3fDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\QS_Release2008\TeamViewer_Service.pdb
Imports
kernel32
GetDriveTypeA
FindFirstFileA
GetFullPathNameA
GetCurrentDirectoryA
TlsAlloc
InterlockedExchangeAdd
PostQueuedCompletionStatus
TlsFree
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
GetModuleFileNameW
lstrcmpiW
GetThreadTimes
GetSystemDirectoryA
GetVersionExA
ExpandEnvironmentStringsA
lstrlenA
SetEnvironmentVariableA
CreateFileA
SetStdHandle
WriteConsoleW
WriteConsoleA
GetLocaleInfoW
LoadLibraryA
IsValidLocale
EnumSystemLocalesA
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
HeapSize
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
GetExitCodeThread
GetPrivateProfileStringW
WritePrivateProfileStringW
GetConsoleOutputCP
GetPrivateProfileIntW
GetModuleFileNameA
GetStdHandle
CompareStringW
CompareStringA
SetConsoleCtrlHandler
SetLastError
GetLastError
Sleep
GetCurrentThreadId
FileTimeToSystemTime
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
GetSystemDirectoryW
FreeLibrary
CloseHandle
CreateFileW
GetProcAddress
LoadLibraryW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentProcess
GetCurrentProcessId
GetSystemTimeAsFileTime
ReleaseSemaphore
WaitForSingleObject
CreateEventA
CreateSemaphoreA
DuplicateHandle
SetEvent
GetTickCount
GetFileSize
SleepEx
InitializeCriticalSection
DeleteCriticalSection
SetWaitableTimer
WriteFile
SetFilePointer
ReleaseMutex
CreateMutexW
CreateDirectoryW
MoveFileW
CreateEventW
CreateWaitableTimerW
LocalFree
OpenProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThread
SetThreadAffinityMask
GetVersionExW
FormatMessageW
WideCharToMultiByte
GetLocalTime
MultiByteToWideChar
GetVolumeInformationW
WaitNamedPipeW
TerminateProcess
ReadFile
CreateProcessW
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
HeapFree
GetProcessHeap
TlsGetValue
TlsSetValue
OpenEventA
ResetEvent
HeapAlloc
CreateIoCompletionPort
QueueUserAPC
TerminateThread
GetQueuedCompletionStatus
InterlockedCompareExchange
GetLocaleInfoA
GetUserDefaultLCID
GetSystemDefaultLCID
SystemTimeToFileTime
RaiseException
lstrlenW
GetModuleHandleW
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
DeviceIoControl
ResumeThread
CreateThread
SetThreadPriority
GetOverlappedResult
FormatMessageA
SetEndOfFile
GetFileAttributesW
SetFileAttributesW
GetModuleHandleA
AreFileApisANSI
CreateWaitableTimerA
RtlUnwind
UnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetTimeFormatA
GetDateFormatA
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeW
user32
MessageBoxW
GetMessageW
TranslateMessage
DispatchMessageW
MessageBoxA
PostThreadMessageW
CharNextW
DestroyWindow
SendMessageW
FindWindowW
PeekMessageW
MsgWaitForMultipleObjectsEx
ExitWindowsEx
advapi32
DeleteService
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RevertToSelf
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetNamedSecurityInfoW
DeleteAce
GetAce
GetNamedSecurityInfoW
SetEntriesInAclW
CloseServiceHandle
StartServiceW
QueryServiceStatus
ControlService
CreateProcessAsUserW
FreeSid
EqualSid
LookupAccountSidW
RegCloseKey
RegCreateKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LsaLookupNames
LsaFreeMemory
LsaClose
ConvertSidToStringSidW
LsaOpenPolicy
GetUserNameW
RegFlushKey
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetSecurityInfo
SetSecurityInfo
RegCreateKeyW
ole32
CoInitializeSecurity
CoTaskMemAlloc
StringFromGUID2
OleInitialize
OleUninitialize
CoTaskMemRealloc
CoCreateInstance
CoCreateGuid
CoTaskMemFree
oleaut32
VariantClear
SysFreeString
SysAllocString
VarUI4FromStr
ws2_32
socket
htonl
select
getsockname
__WSAFDIsSet
ntohl
ioctlsocket
shutdown
setsockopt
WSAResetEvent
closesocket
inet_addr
WSAGetLastError
inet_ntoa
gethostname
gethostbyname
WSACleanup
WSAStartup
WSADuplicateSocketW
getpeername
ntohs
WSACreateEvent
htons
connect
getsockopt
sendto
send
WSACloseEvent
WSAWaitForMultipleEvents
WSAEventSelect
WSASetEvent
bind
recvfrom
accept
WSASetLastError
listen
WSARecv
WSARecvFrom
recv
WSASocketW
WSASend
gethostbyaddr
getservbyname
getservbyport
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
netapi32
NetApiBufferFree
NetWkstaGetInfo
setupapi
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
sensapi
IsNetworkAlive
wininet
HttpSendRequestA
InternetErrorDlg
InternetQueryOptionW
InternetGoOnlineA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetQueryDataAvailable
InternetReadFile
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetCloseHandle
InternetConnectW
iphlpapi
DeleteIPAddress
GetAdapterIndex
GetAdaptersInfo
SendARP
imagehlp
ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates
crypt32
CertGetNameStringA
CertGetNameStringW
CryptVerifyMessageSignature
CertFreeCertificateContext
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetMalloc
ShellExecuteW
mswsock
AcceptEx
GetAcceptExSockaddrs
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 516KB - Virtual size: 515KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 208KB - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
TeamViewer_StaticRes.dll.dll windows:5 windows x86 arch:x86
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08-08-2011 00:00Not After07-08-2014 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08-02-2010 00:00Not After07-02-2020 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
44:36:70:b8:2d:27:68:f8:47:b9:d3:0e:d3:45:af:31:c5:e7:6e:b3Signer
Actual PE Digest44:36:70:b8:2d:27:68:f8:47:b9:d3:0e:d3:45:af:31:c5:e7:6e:b3Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.rsrc Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
tv_w32.dll.dll windows:5 windows x86 arch:x86
2ca28be43421dd21ac4263087f72f259
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08-08-2011 00:00Not After07-08-2014 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08-02-2010 00:00Not After07-02-2020 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
6a:89:40:b1:10:2a:ee:6c:80:ed:9d:89:68:a0:a5:f4:6a:33:f9:28Signer
Actual PE Digest6a:89:40:b1:10:2a:ee:6c:80:ed:9d:89:68:a0:a5:f4:6a:33:f9:28Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_w32dll.pdb
Imports
crtdll
strncat
strncpy
_vsnprintf
_snprintf
_strlwr
strrchr
memmove
memcpy
wcsstr
_wcslwr
_global_unwind2
_local_unwind2
_initterm
malloc
__dllonexit
strncmp
memset
comctl32
InitCommonControlsEx
kernel32
GetFileAttributesExW
HeapAlloc
GlobalLock
DeleteCriticalSection
GetProcAddress
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetLocalTime
InterlockedCompareExchange
GlobalUnlock
DisableThreadLibraryCalls
OpenMutexW
GetModuleFileNameA
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
CreateThread
LocalFree
CreateMutexW
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
SetEvent
GetTickCount
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
LocalAlloc
SetLastError
GlobalFree
GlobalAlloc
GetVersion
QueryPerformanceCounter
GetVersionExW
VirtualProtect
ResumeThread
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
Thread32Next
CloseHandle
GetProcessHeap
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSection
FileTimeToSystemTime
InterlockedExchange
user32
GetWindow
GetWindowLongW
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
SendMessageW
GetClientRect
IsZoomed
GetWindowInfo
GetClassNameA
IsRectEmpty
CallWindowProcW
RedrawWindow
MoveWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
EndPaint
BeginPaint
GetActiveWindow
SetWindowLongW
FindWindowExW
FindWindowW
ShowWindow
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
GetWindowRect
ReleaseDC
IsWindow
IsWindowVisible
SetWindowPos
GetClassInfoExW
LoadCursorW
RegisterClassExW
CallNextHookEx
DestroyWindow
DefWindowProcW
KillTimer
SetTimer
RegisterClipboardFormatW
CreateWindowExW
UnregisterClassW
SendMessageTimeoutW
UnhookWindowsHookEx
SendNotifyMessageW
SetWindowsHookExW
RegisterWindowMessageW
MapWindowPoints
GetWindowDC
gdi32
DeleteObject
GdiFlush
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
Rectangle
GetStockObject
CreatePen
Polyline
ExtCreatePen
LineTo
MoveToEx
CreateSolidBrush
CreateCompatibleBitmap
GetObjectW
SetPixel
GetPixel
RectVisible
DeleteDC
shell32
DragQueryFileW
ole32
ReleaseStgMedium
CoCreateInstance
Exports
Exports
GetLoaderInterface
GetTeamViewerInterface
Sections
.text Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
tv_w32.exe.exe windows:5 windows x86 arch:x86
50a1bd551f06f6cf63b0687e32d02be5
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08-08-2011 00:00Not After07-08-2014 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08-02-2010 00:00Not After07-02-2020 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
48:81:5e:d3:20:a0:c9:c5:82:28:5b:8d:ac:7a:3a:16:9c:34:75:f9Signer
Actual PE Digest48:81:5e:d3:20:a0:c9:c5:82:28:5b:8d:ac:7a:3a:16:9c:34:75:f9Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_w32exe.pdb
Imports
kernel32
SetEvent
GetVersionExW
GetLastError
CreateEventW
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
CreateMutexW
SetFilePointer
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringW
HeapFree
HeapAlloc
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
WriteConsoleA
VirtualQuery
user32
PeekMessageW
DispatchMessageW
SendInput
BlockInput
MsgWaitForMultipleObjectsEx
TranslateMessage
shell32
ShellExecuteExW
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
tv_x64.dll.dll windows:5 windows x64 arch:x64
4ddc3c35228a7a7ce89029d91ef1da7b
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08-08-2011 00:00Not After07-08-2014 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08-02-2010 00:00Not After07-02-2020 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
fd:89:4f:3d:28:df:8d:df:4b:58:03:69:de:20:5f:fe:c1:d6:9a:a9Signer
Actual PE Digestfd:89:4f:3d:28:df:8d:df:4b:58:03:69:de:20:5f:fe:c1:d6:9a:a9Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_x64dll.pdb
Imports
msvcrt
_onexit
__dllonexit
realloc
calloc
malloc
free
_initterm
_wcslwr
wcsstr
strncmp
memmove
__C_specific_handler
strrchr
_strlwr
_snprintf
_vsnprintf
strncpy
strncat
memcpy
memset
comctl32
InitCommonControlsEx
kernel32
FileTimeToSystemTime
InitializeCriticalSection
GetLastError
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetProcessHeap
CloseHandle
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
ResumeThread
VirtualProtect
GetVersionExW
QueryPerformanceCounter
GlobalUnlock
GetFileAttributesExW
HeapAlloc
GlobalLock
DeleteCriticalSection
GetProcAddress
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetLocalTime
DisableThreadLibraryCalls
OpenMutexW
GetModuleFileNameA
FreeLibraryAndExitThread
Sleep
LoadLibraryW
GetModuleFileNameW
CreateThread
LocalFree
CreateMutexW
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
SetEvent
GetTickCount
IsBadWritePtr
IsBadReadPtr
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
LocalAlloc
SetLastError
user32
SendNotifyMessageW
UnhookWindowsHookEx
SendMessageTimeoutW
UnregisterClassW
CreateWindowExW
RegisterClipboardFormatW
SetTimer
KillTimer
DefWindowProcW
DestroyWindow
CallNextHookEx
RegisterClassExW
LoadCursorW
GetClassInfoExW
SetWindowPos
IsWindowVisible
IsWindow
ReleaseDC
GetWindowRect
GetWindowDC
ShowWindow
GetWindow
GetWindowLongPtrW
GetSysColor
LoadBitmapW
GetSystemMetrics
SystemParametersInfoW
SendMessageW
GetClientRect
IsZoomed
GetWindowInfo
GetClassNameA
IsRectEmpty
CallWindowProcW
RedrawWindow
MoveWindow
IsIconic
PostMessageW
TrackMouseEvent
InvalidateRect
GetActiveWindow
SetWindowLongPtrW
EndPaint
BeginPaint
FindWindowExW
FindWindowW
MapWindowPoints
GetDesktopWindow
ClientToScreen
GetDC
GetUpdateRect
RegisterWindowMessageW
SetWindowsHookExW
gdi32
RectVisible
GetPixel
SetPixel
GetObjectW
CreateCompatibleBitmap
CreateSolidBrush
MoveToEx
LineTo
DeleteObject
Polyline
CreatePen
GetStockObject
Rectangle
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
GdiFlush
ExtCreatePen
DeleteDC
shell32
DragQueryFileW
ole32
ReleaseStgMedium
CoCreateInstance
Exports
Exports
GetLoaderInterface
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.shared Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 306B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
tv_x64.exe.exe windows:5 windows x64 arch:x64
2c5c62562658e3dcbc628c79afc9f4a7
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:27:af:be:a5:99:6f:13:e5:b5:62:44:21:f1:62:95Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before08-08-2011 00:00Not After07-08-2014 23:59SubjectCN=TeamViewer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer,L=Goeppingen,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08-02-2010 00:00Not After07-02-2020 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
ea:15:51:b4:e5:dd:90:69:6b:01:68:36:9a:fe:8f:0b:35:30:fa:44Signer
Actual PE Digestea:15:51:b4:e5:dd:90:69:6b:01:68:36:9a:fe:8f:0b:35:30:fa:44Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\TeamViewer_7.0_Release\TeamViewer\TVHooks64\Release\tv_x64exe.pdb
Imports
kernel32
SetEvent
GetVersionExW
GetLastError
CreateEventW
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
Sleep
GetSystemDirectoryW
LoadLibraryW
GetTickCount
OpenMutexA
CreateMutexW
SetFilePointer
WaitForSingleObject
WriteFile
CreateFileW
GetLocalTime
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId
GetCommandLineW
GetCurrentProcess
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
FlsAlloc
LCMapStringW
HeapFree
HeapAlloc
GetModuleHandleW
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
InitializeCriticalSectionAndSpinCount
HeapReAlloc
user32
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
shell32
ShellExecuteExW
Sections
.text Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
x64/TVMonitor.inf
-
x64/TVMonitor.sys.sys windows:6 windows x64 arch:x64
f24b69173de020aa0ac1739d7b40e04c
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before16-07-2004 00:00Not After15-07-2014 23:59SubjectCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USNot Before16-01-2008 00:00Not After22-02-2011 23:59SubjectCN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
61:0c:12:06:00:00:00:00:00:1bCertificate
IssuerCN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before23-05-2006 17:01Not After23-05-2016 17:11SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3bSigner
Actual PE Digest28:b9:c1:45:0c:8e:03:ed:63:23:c6:60:a2:8f:f1:31:e1:99:44:3bDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
j:\teamviewer6.0\monitordriver\objfre_wlh_amd64\amd64\TVMonitor.pdb
Imports
ntoskrnl.exe
IoAcquireRemoveLockEx
KeClearEvent
IoDeleteSymbolicLink
_snwprintf
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
IoReleaseRemoveLockEx
IoDetachDevice
PoRequestPowerIrp
KeSetTimerEx
PsCreateSystemThread
PsTerminateSystemThread
PoStartNextPowerIrp
ZwClose
IofCompleteRequest
IoReleaseRemoveLockAndWaitEx
ObReferenceObjectByHandle
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
PoCallDriver
IoCreateSymbolicLink
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
KeInitializeTimerEx
KeCancelTimer
KeWaitForMultipleObjects
IofCallDriver
KeBugCheckEx
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
x64/tvmonitor.cat
-
x86/TVMonitor.inf
-
x86/TVMonitor.sys.sys windows:6 windows x86 arch:x86
bc06eb1dad5e8285411e580cdee99e10
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before16-07-2004 00:00Not After15-07-2014 23:59SubjectCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USNot Before16-01-2008 00:00Not After22-02-2011 23:59SubjectCN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
61:0c:12:06:00:00:00:00:00:1bCertificate
IssuerCN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before23-05-2006 17:01Not After23-05-2016 17:11SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
a9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83Signer
Actual PE Digesta9:a5:16:65:95:db:d6:e5:d9:29:b0:53:6a:3f:4b:f8:81:cb:42:83Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
j:\teamviewer6.0\monitordriver\objfre_wxp_x86\i386\TVMonitor.pdb
Imports
ntoskrnl.exe
RtlInitUnicodeString
_snwprintf
IofCompleteRequest
IoReleaseRemoveLockEx
PoCallDriver
IoAcquireRemoveLockEx
PoStartNextPowerIrp
IofCallDriver
ObfDereferenceObject
IoGetAttachedDeviceReference
IoDeleteDevice
IoDetachDevice
KeWaitForSingleObject
KeSetEvent
PoRequestPowerIrp
IoAttachDeviceToDeviceStack
IoDeleteSymbolicLink
IoInitializeRemoveLockEx
IoCreateSymbolicLink
IoCreateDevice
InterlockedIncrement
IoReleaseRemoveLockAndWaitEx
PsTerminateSystemThread
KeCancelTimer
KeWaitForMultipleObjects
KeSetTimerEx
KeClearEvent
KeInitializeTimerEx
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeTickCount
KeBugCheckEx
KeInitializeEvent
KeGetCurrentThread
hal
KeGetCurrentIrql
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 277B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 384B - Virtual size: 274B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
x86/tvmonitor.cat