TeamViewer.exe
TeamViewer file version info
Program on Windows LOLRMM TeamViewer 3 known copies with hashes
A file of TeamViewer
LOLRMM lists a file named TeamViewer.exe as TeamViewer’s. TeamViewer is a remote monitoring and management (RMM) tool.
From LOLRMM (Apache 2.0), which lists the remote management tools intruders are known to use as well as administrators. It goes by the file’s name: a copy that is the file above is not necessarily TeamViewer’s.
Is it the real TeamViewer.exe?
C:\Program Files (x86)\TeamViewer\3 known copies
15.10.5.0 · C:\Program Files (x86)\TeamViewer\TeamViewer.exe · signed by TeamViewer Germany GmbH
57f4bfdf47ba8b80e2641e19e28eace5bfa6a65158d3b79ede80be6dcf82ea3e15.9.4.0 · C:\program files (x86)\TeamViewer\TeamViewer.exe · signed by TeamViewer Germany GmbH
26e19f0840e2d4cd80c234742c4449855a26baa2423bf5e66e30a2f97b985b2415.8.3.0 · C:\Program Files (x86)\TeamViewer\TeamViewer.exe · signed by TeamViewer Germany GmbH
4647a694120276be1bc772645fc3cf8013169d43e91dea6ada9f9455a302946cFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.