SW_DVD5_Office_Professional_Plus_2016_64Bit_English[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

SW_DVD5_Office_Professional_Plus_2016_64Bit_English.rar
Size

827.5MB
MD5

fe0ee6746b613c2f95f973775225a2c2
SHA1

95d06004ffb268692e16240ce882f2f407bf5c2e
SHA256

e28698116622fcd55d32e3ddf43f6ba7d8a20d97505f2b7bbf1974dfb47aec5d
SHA512

ee4f71d4bf64e37bd99ebdbbcd404f647df568b1d67e03d17e479c7d765acdb9b33f78b300174bdab874d454730b878c776ed5b5d2907ab8938b7357157802c1
SSDEEP

25165824:ueAWSkttr3nmJ/naWO/uNp1cOjjEKjVSCjt8j3Mg5E9:skbr3nmJ/ndO0jjrjoiRg5E9

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
static1/unpack001/SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/proplusww.msi	office_macro_on_action

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/MSACCESS.HXS_1033

Files

SW_DVD5_Office_Professional_Plus_2016_64Bit_English.rar
.rar
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/Key.txt
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/access.en-us/access.en-us/accessmui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/access.en-us/access.en-us/accessmui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/access.en-us/access.en-us/acclr.cab
.cab
ACCESS12.ACC_1033
ACCESSTEMPLATE_DATATYPEADDRESS.ACCFT_1033
.zip
[Content_Types].xml
.xml
_rels/.rels
.xml
docProps/core.xml
template/_rels/template.xml.rels
.xml
template/database/objects/_rels/tableD1DC3A9F-29B3-42DB-A261-7229AD3E561A.xsd.rels
.xml
template/database/objects/properties/tableD1DC3A9F-29B3-42DB-A261-7229AD3E561A_Metadata.xml
template/database/objects/tableD1DC3A9F-29B3-42DB-A261-7229AD3E561A.xsd
template/template.xml
ACCESSTEMPLATE_DATATYPECATEGORY.ACCFT_1033
.zip
[Content_Types].xml
.xml
_rels/.rels
.xml
docProps/core.xml
template/_rels/template.xml.rels
.xml
template/database/objects/_rels/table481AE5DF-008B-43CB-B6F6-E729E86A5DE3.xsd.rels
.xml
template/database/objects/properties/table481AE5DF-008B-43CB-B6F6-E729E86A5DE3_Metadata.xml
template/database/objects/table481AE5DF-008B-43CB-B6F6-E729E86A5DE3.xsd
template/template.xml
ACCESSTEMPLATE_DATATYPENAME.ACCFT_1033
.zip
[Content_Types].xml
.xml
_rels/.rels
.xml
docProps/core.xml
template/_rels/template.xml.rels
.xml
template/database/objects/_rels/tableB0853420-1141-4A28-B8E1-05B0782FC961.xsd.rels
.xml
template/database/objects/properties/tableB0853420-1141-4A28-B8E1-05B0782FC961_Metadata.xml
template/database/objects/tableB0853420-1141-4A28-B8E1-05B0782FC961.xsd
template/template.xml
ACCESSTEMPLATE_DATATYPEPAYMENTTYPE.ACCFT_1033
.zip
[Content_Types].xml
.xml
_rels/.rels
.xml
docProps/core.xml
template/_rels/template.xml.rels
.xml
template/database/objects/_rels/table6A7DC5C9-A3F5-4D31-B5CE-FAEC022C3B01.xsd.rels
.xml
template/database/objects/properties/table6A7DC5C9-A3F5-4D31-B5CE-FAEC022C3B01_Metadata.xml
template/database/objects/table6A7DC5C9-A3F5-4D31-B5CE-FAEC022C3B01.xsd
template/template.xml
ACCESSTEMPLATE_DATATYPEPHONE.ACCFT_1033
.zip
[Content_Types].xml
.xml
_rels/.rels
.xml
docProps/core.xml
template/_rels/template.xml.rels
.xml
template/database/objects/_rels/tableF6F59BF9-D32B-43E2-BF63-EB8BA1631869.xsd.rels
.xml
template/database/objects/properties/tableF6F59BF9-D32B-43E2-BF63-EB8BA1631869_Metadata.xml
template/database/objects/tableF6F59BF9-D32B-43E2-BF63-EB8BA1631869.xsd
template/template.xml
ACCESSTEMPLATE_DATATYPEPRIORITY.ACCFT_1033
.zip
[Content_Types].xml
.xml
_rels/.rels
.xml
docProps/core.xml
template/_rels/template.xml.rels
.xml
template/database/objects/_rels/table8594BE01-EEB4-40C1-B9D7-7AA6F03A49EC.xsd.rels
.xml
template/database/objects/properties/table8594BE01-EEB4-40C1-B9D7-7AA6F03A49EC_Metadata.xml
template/database/objects/table8594BE01-EEB4-40C1-B9D7-7AA6F03A49EC.xsd
template/template.xml
ACCESSTEMPLATE_DATATYPESTARTENDDATES.ACCFT_1033
.zip
[Content_Types].xml
.xml
_rels/.rels
.xml
docProps/core.xml
template/_rels/template.xml.rels
.xml
template/database/objects/_rels/table9FED2F3B-9D51-450C-99B6-207D2879733E.xsd.rels
.xml
template/database/objects/properties/table9FED2F3B-9D51-450C-99B6-207D2879733E_Metadata.xml
template/database/objects/table9FED2F3B-9D51-450C-99B6-207D2879733E.xsd
template/template.xml
ACCESSTEMPLATE_DATATYPESTATUS.ACCFT_1033
.zip
ACCESSTEMPLATE_DATATYPETAGS.ACCFT_1033
.zip
ACCESSTEMPLATE_PART1RIGHT.ACCDT_1033
.zip
ACCESSTEMPLATE_PART1TOP.ACCDT_1033
.zip
ACCESSTEMPLATE_PART2RIGHT.ACCDT_1033
.zip
ACCESSTEMPLATE_PART2TOP.ACCDT_1033
.zip
ACCESSTEMPLATE_PARTCOMMENTS.ACCDT_1033
.zip
ACCESSTEMPLATE_PARTCONTACTS.ACCDT_1033
.zip
ACCESSTEMPLATE_PARTDETAILS.ACCDT_1033
.zip
ACCESSTEMPLATE_PARTDIALOG.ACCDT_1033
.zip
ACCESSTEMPLATE_PARTISSUES.ACCDT_1033
.zip
ACCESSTEMPLATE_PARTLIST.ACCDT_1033
.zip
ACCESSTEMPLATE_PARTMEDIA.ACCDT_1033
.zip
ACCESSTEMPLATE_PARTMSGBOX.ACCDT_1033
.zip
ACCESSTEMPLATE_PARTTABS.ACCDT_1033
.zip
ACCESSTEMPLATE_PARTTASKS.ACCDT_1033
.zip
ACCESSTEMPLATE_PARTUSERS.ACCDT_1033
.zip
ACCESS_PARTS.XML_1033
.xml
ACCOLKI.DLL_1033
.dll windows x64

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:47:3c:4f:aa:0e:17:93:86:a4:32:d8:34:3b:0a:e5:5f:f0:ec:8b
Signer

Actual PE Digest

7c:47:3c:4f:aa:0e:17:93:86:a4:32:d8:34:3b:0a:e5:5f:f0:ec:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ACTIP10.HLP_1033
ACWIZRC.DLL_1033
.dll windows x64

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:fd:5a:ec:4c:04:90:61:08:56:40:ca:07:01:bd:7d:5e:b8:8c:86
Signer

Actual PE Digest

75:fd:5a:ec:4c:04:90:61:08:56:40:ca:07:01:bd:7d:5e:b8:8c:86

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ADO210.CHM_0001_1033
.chm
AS_ClientMsmdsrv_rll_32_1033.213F050E_BC85_41CA_B2F1_B436038C1E58
.dll windows x86

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:dd:5b:7b:3b:0f:af:0f:c2:79:5a:bc:e6:a1:17:fc:ab:dd:07:9d
Signer

Actual PE Digest

c8:dd:5b:7b:3b:0f:af:0f:c2:79:5a:bc:e6:a1:17:fc:ab:dd:07:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 139B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AS_ClientMsmdsrv_rll_64_1033.213F050E_BC85_41CA_B2F1_B436038C1E58
.dll windows x64

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f2:b0:c8:62:03:d2:df:b0:87:b7:bb:39:d3:bd:3a:9b:6b:90:5c:e9
Signer

Actual PE Digest

f2:b0:c8:62:03:d2:df:b0:87:b7:bb:39:d3:bd:3a:9b:6b:90:5c:e9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 139B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AS_ClientMsmdsrvi_rll_32_1033.213F050E_BC85_41CA_B2F1_B436038C1E58
.dll windows x86

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:1f:d2:14:80:15:ab:c6:4f:da:f8:6c:11:3a:e5:00:40:76:02:c2
Signer

Actual PE Digest

9b:1f:d2:14:80:15:ab:c6:4f:da:f8:6c:11:3a:e5:00:40:76:02:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AS_ClientMsmdsrvi_rll_64_1033.213F050E_BC85_41CA_B2F1_B436038C1E58
.dll windows x64

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ff:26:84:2a:79:3c:1a:6d:61:e4:0d:9f:4b:c6:37:2f:8f:51:a9:ce
Signer

Actual PE Digest

ff:26:84:2a:79:3c:1a:6d:61:e4:0d:9f:4b:c6:37:2f:8f:51:a9:ce

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AS_msolui110_rll_32_1033.213F050E_BC85_41CA_B2F1_B436038C1E58
.dll windows x86

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:23:e7:e2:a0:28:41:26:a1:63:f0:60:6a:d8:a1:3d:66:40:bc:16
Signer

Actual PE Digest

11:23:e7:e2:a0:28:41:26:a1:63:f0:60:6a:d8:a1:3d:66:40:bc:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 223B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AS_msolui110_rll_64_1033.213F050E_BC85_41CA_B2F1_B436038C1E58
.dll windows x64

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:65:48:3f:ce:33:eb:23:7b:5c:d6:62:ee:9c:63:c7:87:8b:e7:e4
Signer

Actual PE Digest

46:65:48:3f:ce:33:eb:23:7b:5c:d6:62:ee:9c:63:c7:87:8b:e7:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 223B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
MSACCESS.HXS_1033
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

Sections

.rsrc
Size: 1024B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.its
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
MSACCESS_COL.HXC_1033
MSACCESS_COL.HXT_1033
MSACCESS_F_COL.HXK_1033
MSACCESS_K_COL.HXK_1033
MSAIN.DLL_1033
.dll windows x64

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

63:7f:bd:a9:bb:10:01:b0:ee:be:73:e8:f9:a3:70:f1:a2:0b:cc:c3
Signer

Actual PE Digest

63:7f:bd:a9:bb:10:01:b0:ee:be:73:e8:f9:a3:70:f1:a2:0b:cc:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
STSLIST.CHM_1033
.chm
STSLISTI.DLL_1033
.dll windows x64

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:d5:d2:73:a0:3f:5b:e3:20:7a:70:77:59:c8:84:e9:41:71:25:dc
Signer

Actual PE Digest

ad:d5:d2:73:a0:3f:5b:e3:20:7a:70:77:59:c8:84:e9:41:71:25:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TELLMEACCESS.NRR_1033
VBCN6.CHM.x86.1033
.chm
VBENDF98.CHM.x86.1033
.chm
VBHW6.CHM.x86.1033
.chm
VBLR6.CHM.x86.1033
.chm
VBOB6.CHM.x86.1033
.chm
VBUI6.CHM.x86.1033
.chm
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/access.en-us/access.en-us/branding.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/access.en-us/accessmuiset.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/access.en-us/accessmuiset.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/access.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/access16.opax
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/access16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/excel16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/lync16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/octres.dll
.dll windows x64

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:bd:f9:6b:94:92:0e:e9:47:27:27:11:db:4c:84:1f:88:b1:b6:ca
Signer

Actual PE Digest

e0:bd:f9:6b:94:92:0e:e9:47:27:27:11:db:4c:84:1f:88:b1:b6:ca

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 418KB - Virtual size: 418KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/office16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/onent16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/outlk16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/ppt16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/proj16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/pub16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/spd16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/visio16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/de-de/word16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/access16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/excel16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/octres.dll
.dll windows x64

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f5:2e:b7:d8:69:f5:b4:c3:f0:d4:8f:31:0e:73:7d:88:de:8f:89:84
Signer

Actual PE Digest

f5:2e:b7:d8:69:f5:b4:c3:f0:d4:8f:31:0e:73:7d:88:de:8f:89:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 400KB - Virtual size: 399KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/office16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/onent16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/outlk16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/ppt16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/proj16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/pub16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/spd16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/visio16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/en-us/word16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/access16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/excel16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/lync16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/octres.dll
.dll windows x64

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:48:45:d2:88:c3:7b:5a:20:a3:20:f4:cc:5f:9c:f7:fc:0d:48:93
Signer

Actual PE Digest

c8:48:45:d2:88:c3:7b:5a:20:a3:20:f4:cc:5f:9c:f7:fc:0d:48:93

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 419KB - Virtual size: 419KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/office16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/onent16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/outlk16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/ppt16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/proj16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/pub16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/spd16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/visio16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/es-es/word16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/excel16.opax
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/access16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/excel16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/lync16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/octres.dll
.dll windows x64

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

df:8d:f1:76:03:63:f3:00:f3:38:27:7c:33:02:87:c4:3d:21:ea:c4
Signer

Actual PE Digest

df:8d:f1:76:03:63:f3:00:f3:38:27:7c:33:02:87:c4:3d:21:ea:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 421KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/office16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/onent16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/outlk16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/ppt16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/proj16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/pub16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/spd16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/visio16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/fr-fr/word16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/access16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/excel16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/lync16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/octres.dll
.dll windows x64

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

24:1e:9b:d7:55:dc:40:83:8f:16:10:46:cf:96:85:d3:54:0d:da:dd
Signer

Actual PE Digest

24:1e:9b:d7:55:dc:40:83:8f:16:10:46:cf:96:85:d3:54:0d:da:dd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/office16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/onent16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/outlk16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/ppt16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/proj16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/pub16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/spd16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/visio16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/it-it/word16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/access16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/excel16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/lync16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/octres.dll
.dll windows x64

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

92:e2:ee:3a:03:c4:31:3a:23:ac:2c:22:20:23:d4:59:d4:97:ea:07
Signer

Actual PE Digest

92:e2:ee:3a:03:c4:31:3a:23:ac:2c:22:20:23:d4:59:d4:97:ea:07

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 382KB - Virtual size: 381KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/office16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/onent16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/outlk16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/ppt16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/proj16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/pub16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/spd16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/visio16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ja-jp/word16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/access16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/excel16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/lync16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/octres.dll
.dll windows x64

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:a5:ae:48:74:fb:c8:6a:e2:2e:d2:9d:0d:67:49:44:02:95:32:b8
Signer

Actual PE Digest

50:a5:ae:48:74:fb:c8:6a:e2:2e:d2:9d:0d:67:49:44:02:95:32:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 379KB - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/office16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/onent16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/outlk16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/ppt16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/proj16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/pub16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/spd16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/visio16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ko-kr/word16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/oct.dll
.dll windows x64

29aa281db01fb679e734b13ba2bbcafc

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e4:03:3d:4e:24:11:6f:36:a0:7f:f6:10:a1:03:a1:2f:c5:2d:cb:70
Signer

Actual PE Digest

e4:03:3d:4e:24:11:6f:36:a0:7f:f6:10:a1:03:a1:2f:c5:2d:cb:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdi32

CreatePen
CreateSolidBrush
DeleteObject
Rectangle
CreateFontIndirectW
GetDeviceCaps
CreateCompatibleDC
DeleteDC
StretchBlt
SetStretchBltMode
GetObjectW
SelectObject
ExtTextOutW
CreateDCW
ExtFloodFill
SetBkMode
EnumFontFamiliesExW
CreateFontW
TextOutW
GetTextMetricsW
SetTextColor
SetBkColor
GetTextExtentPoint32W

kernel32

VirtualProtect
GetGeoInfoW
IsWow64Process
HeapReAlloc
GetFileAttributesExW
GetSystemDirectoryW
SetErrorMode
GetUserDefaultLCID
SetFilePointerEx
CreateProcessW
GetSystemTime
GetSystemTimeAsFileTime
GetNativeSystemInfo
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
IsValidLocale
GetCurrentProcessId
GetCurrentThread
FlushInstructionCache
GetCurrentProcess
HeapAlloc
GetUserGeoID
ExpandEnvironmentStringsW
WideCharToMultiByte
WriteFile
SetFileAttributesW
ReadFile
FindNextFileW
DeleteFileW
SearchPathW
GetProcessHeap
HeapFree
CloseHandle
SetFilePointer
GetDateFormatW
FileTimeToSystemTime
lstrcmpiW
FindFirstFileExW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
lstrlenW
LocalFree
LocalAlloc
LoadLibraryW
GetProcAddress
GetModuleHandleExW
GetTickCount
SetLastError
OutputDebugStringA
lstrcmpW
CompareStringEx
GetCurrentThreadId
GetModuleFileNameW
GetLastError
CompareStringW
RaiseException
GetVersionExA
GetTempPathW
RemoveDirectoryW
CreateDirectoryW
GetSystemDefaultLangID
GetLocaleInfoW
GlobalFree
GlobalAlloc
GetVersionExW
IsDBCSLeadByte
MultiByteToWideChar
GetFileSize
FindAtomA
DecodePointer
InitializeCriticalSectionEx
TerminateProcess
GetModuleFileNameA
AddAtomA
Sleep
WaitForSingleObject
OpenEventW
CreateFileW
GetStdHandle
GetTempPathA
HeapSize
LCIDToLocaleName
LocaleNameToLCID
GetLocaleInfoEx
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
EnumSystemLocalesEx
GetFileType
SetEndOfFile
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
UnmapViewOfFile
FormatMessageW
WaitForSingleObjectEx
CreateWaitableTimerW
QueryDepthSList
TryEnterCriticalSection
CreateEventExW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
QueryPerformanceCounter
QueryPerformanceFrequency
DuplicateHandle
GetStringTypeW
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
LCMapStringW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SetEvent
ResetEvent
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
VirtualAlloc
VirtualFree
ReleaseSemaphore
UnregisterWaitEx
ExitProcess
GetACP
FlushFileBuffers
GetConsoleCP
GetConsoleMode
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetStdHandle
ReadConsoleW
WriteConsoleW
MulDiv
GetSystemInfo
VirtualQuery
LoadLibraryExA
DeleteFileA
FileTimeToDosDateTime
SystemTimeToFileTime
DeleteAtom
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetFileAttributesW
CopyFileW
EnumResourceNamesW
FindResourceA
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetModuleHandleW
GetShortPathNameA
FreeLibrary

oleaut32

VariantClear
VariantInit
SysFreeString
VarI4FromStr
VarBstrFromI4
SysAllocString

ole32

CoCreateGuid
CoInitialize
StringFromIID
StgOpenStorage
StgCreateDocfile
CoTaskMemFree
CoCreateInstance

msimg32

TransparentBlt

advapi32

RegEnumKeyExW
RegGetValueW
EventRegister
EventUnregister
EventWrite
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
EventWriteTransfer
ConvertSidToStringSidW
LookupAccountNameW
CreateWellKnownSid
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

imm32

ImmAssociateContext

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust

rpcrt4

NdrClientCall2
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW

setupapi

SetupIterateCabinetW

cabinet

ord13
ord11
ord10
ord14

Exports

Exports

ShowCustomizationUI

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1005KB - Virtual size: 1004KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/octca.dll
.dll windows x64

259f4b141eee2b2609ac488e4315215b

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9d:f4:41:42:d8:4d:84:32:27:68:87:d1:45:56:bd:7c:5f:43:a4:c5
Signer

Actual PE Digest

9d:f4:41:42:d8:4d:84:32:27:68:87:d1:45:56:bd:7c:5f:43:a4:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle

kernel32

HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
lstrlenA
LoadLibraryExA
SetLastError
VirtualProtect
GetSystemInfo
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
GetCommandLineW
GetCommandLineA
CreateProcessW
Sleep
OpenEventW
WaitForSingleObject
CloseHandle
lstrcmpW
lstrlenW
GetLastError
VirtualQuery
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
FindClose
FindFirstFileW
ExitProcess
GetStdHandle
WriteFile
HeapSize
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateEventW
GetModuleHandleW
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RtlUnwindEx
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
GetModuleHandleExW
GetACP
GetFileType
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW

rpcrt4

NdrClientCall2
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFree
RpcBindingFromStringBindingW

Exports

Exports

AddLISSources
CACertificatesAdd
CACertificatesScheduleCommit
EnablePerUserInstall

Sections

.text
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/office16.opax
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/onent16.opax
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/outlk16.opax
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ppt16.opax
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/proj16.opax
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/access16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/excel16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/lync16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/octres.dll
.dll windows x64

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:90:c3:29:99:b4:89:35:fd:bb:7d:9a:e5:6b:24:69:cf:00:40:26
Signer

Actual PE Digest

80:90:c3:29:99:b4:89:35:fd:bb:7d:9a:e5:6b:24:69:cf:00:40:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 413KB - Virtual size: 413KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/office16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/onent16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/outlk16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/ppt16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/proj16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/pub16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/spd16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/visio16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pt-br/word16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/pub16.opax
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/access16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/excel16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/lync16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/octres.dll
.dll windows x64

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e7:50:0d:7c:30:c9:96:b3:b2:26:7a:b1:2b:f1:49:39:cf:2c:1a:de
Signer

Actual PE Digest

e7:50:0d:7c:30:c9:96:b3:b2:26:7a:b1:2b:f1:49:39:cf:2c:1a:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 411KB - Virtual size: 411KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/office16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/onent16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/outlk16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/ppt16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/proj16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/pub16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/spd16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/visio16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/ru-ru/word16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/spd16.opax
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/visio16.opax
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/word16.opax
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/access16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/excel16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/lync16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/octres.dll
.dll windows x64

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:20:27:b0:df:ea:af:af:07:87:e9:54:23:cd:bc:6b:87:6a:8d:73
Signer

Actual PE Digest

48:20:27:b0:df:ea:af:af:07:87:e9:54:23:cd:bc:6b:87:6a:8d:73

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/office16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/onent16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/outlk16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/ppt16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/proj16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/pub16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/spd16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/visio16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-cn/word16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/access16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/excel16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/lync16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/octres.dll
.dll windows x64

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c1:52:aa:9e:4b:6f:d0:7f:39:50:8a:02:6e:df:fb:f7:6c:58:14:5d
Signer

Actual PE Digest

c1:52:aa:9e:4b:6f:d0:7f:39:50:8a:02:6e:df:fb:f7:6c:58:14:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 371KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/office16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/onent16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/outlk16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/ppt16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/proj16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/pub16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/spd16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/visio16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/admin/zh-tw/word16.opal
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/autorun.inf
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/catalog/files.cat
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/dcf.en-us/dcfmui.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/dcf.en-us/dcfmui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/dcf.en-us/dcfmui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/dcf.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/excel.en-us/excellr.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/excel.en-us/excelmui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/excel.en-us/excelmui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/excel.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/groove.en-us/groovelr.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/groove.en-us/groovemui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/groove.en-us/groovemui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/groove.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/hotfixes/windows6.1-kb2999226-x64.msu
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/hotfixes/windows8-rt-kb2999226-x64.msu
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/hotfixes/windows8.1-kb2999226-x64.msu
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/infopath.en-us/inflr.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/infopath.en-us/infopathmui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/infopath.en-us/infopathmui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/infopath.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/lync.en-us/lyncmui.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/lync.en-us/lyncmui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/lync.en-us/lyncmui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/lync.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/branding.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/officelr.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/officemui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/officemui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/officemuiset.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/officemuiset.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/offsetlr.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/osetupui.dll
.dll windows x64

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:a5:53:6c:ed:e8:79:75:03:34:37:a7:20:89:52:fc:08:9d:dd:4f
Signer

Actual PE Digest

a7:a5:53:6c:ed:e8:79:75:03:34:37:a7:20:89:52:fc:08:9d:dd:4f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/pss10r.chm
.chm
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/setup.chm
.chm
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office.en-us/shellui.mst
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office32.en-us/office32mui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office32.en-us/office32mui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office32.en-us/owow32lr.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/office32.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/onenote.en-us/onenotemui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/onenote.en-us/onenotemui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/onenote.en-us/onotelr.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/onenote.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/osm.en-us/osmmui.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/osm.en-us/osmmui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/osm.en-us/osmmui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/osm.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/osmux.en-us/osmuxmui.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/osmux.en-us/osmuxmui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/osmux.en-us/osmuxmui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/osmux.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/outlook.en-us/outlklr.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/outlook.en-us/outlookmui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/outlook.en-us/outlookmui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/outlook.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/powerpoint.en-us/powerpointmui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/powerpoint.en-us/powerpointmui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/powerpoint.en-us/pptlr.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/powerpoint.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/proof.en/proof.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/proof.en/proof.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/proof.en/proof.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/proof.es/proof.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/proof.es/proof.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/proof.es/proof.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/proof.fr/proof.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/proof.fr/proof.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/proof.fr/proof.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/proofing.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/proofing.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proofing.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/config.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/office32ww.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/office32ww.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/ose.exe
.exe windows x64

69c8890c645bc52baf5347009201dcb7

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:48:03:c8:17:96:2b:2a:06:61:e0:65:94:5b:ee:9d:13:db:bd:8a
Signer

Actual PE Digest

b4:48:03:c8:17:96:2b:2a:06:61:e0:65:94:5b:ee:9d:13:db:bd:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

advapi32

RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
SetThreadToken
RegEnumValueW
RegQueryValueExW
RegSetValueExW
RegNotifyChangeKeyValue
SetServiceStatus
StartServiceCtrlDispatcherW
DuplicateToken
GetUserNameA
RegDeleteValueW
RegisterServiceCtrlHandlerW
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
LookupAccountNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptAcquireContextW
CryptReleaseContext
SetFileSecurityW
RegDeleteKeyW
OpenThreadToken

kernel32

CloseHandle
GetLastError
SetEvent
GetModuleFileNameW
GetDriveTypeW
GetLogicalDrives
lstrcmpW
lstrlenW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
ExitProcess
GetCommandLineW
SetErrorMode
ResetEvent
ReleaseMutex
WaitForMultipleObjectsEx
CreateMutexW
CreateEventW
CreateProcessW
GetSystemInfo
GetTickCount
MoveFileExW
CreateFileA
CreateFileW
ReadFile
SetFilePointer
RaiseException
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
DosDateTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjects
CreateSemaphoreW
CreateThread
SetFilePointerEx
VirtualAlloc
VirtualFree
GlobalAlloc
GlobalFree
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
CompareStringW
SetEndOfFile
SetFileTime
WriteFile
GetSystemTime
SystemTimeToFileTime
LocalFree
FindClose
GetTempPathA
CreateDirectoryW
GetFileAttributesW
GetTempPathW
FindFirstFileW
GetFileSizeEx
QueryPerformanceCounter
DeleteFileW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetStdHandle
lstrlenA
FindNextFileW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesExW
GetFileTime
CopyFileW
CreateHardLinkW
FormatMessageA
GetComputerNameW
GetCurrentThread
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleFileNameA
GetModuleHandleExW
GetACP
GetStringTypeW
GetFileType
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
WriteConsoleW
LoadLibraryExA
VirtualQuery
VirtualProtect

rpcrt4

RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcServerUnregisterIf
NdrServerCall2
RpcImpersonateClient
RpcRevertToSelf

wintrust

WinVerifyTrust

Sections

.text
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/osetup.dll
.dll windows x64

3485cf32e33b476548fc2a0648845ffb

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:47:2a:be:ae:59:cf:ee:3d:7e:69:d7:7c:87:59:b2:e0:1b:da:c3
Signer

Actual PE Digest

8e:47:2a:be:ae:59:cf:ee:3d:7e:69:d7:7c:87:59:b2:e0:1b:da:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

gdi32

SetTextColor
SetBkMode
RectVisible
GetStockObject
ExcludeClipRect
GetDIBColorTable
CreateFontW
GetTextExtentPoint32W
CreateSolidBrush
CreateFontIndirectW
SetLayout
SetDIBitsToDevice
CreateDIBSection
StretchDIBits
SelectObject
DeleteDC
GetTextExtentPointW
GetCharWidthW
CreateCompatibleDC
CreateCompatibleBitmap
ExtTextOutW
GetObjectW
SetPixel
SetBkColor
SaveDC
RestoreDC
OffsetClipRgn
IntersectClipRect
GetPixel
CreateRectRgn
BitBlt
ExtSelectClipRgn
GetRgnBox
GetObjectA
TranslateCharsetInfo
CreateFontIndirectA
SetAbortProc
ResetDCW
DeleteColorSpace
CreateColorSpaceW
ExtCreatePen
ExtCreateRegion
CreateRoundRectRgn
CreatePolyPolygonRgn
CreatePenIndirect
CreatePalette
DeleteObject
CreateHatchBrush
CreateEllipticRgnIndirect
CreateEllipticRgn
CreateDIBPatternBrushPt
CreateDIBitmap
CreateBrushIndirect
CreateBitmapIndirect
SetColorSpace
ColorCorrectPalette
EnumICMProfilesW
ColorMatchToTarget
SetDeviceGammaRamp
GetDeviceGammaRamp
SetICMProfileW
GetICMProfileW
GetLogColorSpaceW
CheckColorsInGamut
SetICMMode
UnrealizeObject
GetDCOrgEx
GetKerningPairsW
SetBitmapDimensionEx
PolyTextOutW
ExtTextOutA
TextOutW
SelectClipPath
AbortDoc
EndPage
StartPage
EndDoc
StartDocW
GetColorAdjustment
SetColorAdjustment
SetWorldTransform
GdiComment
UpdateColors
SetTextJustification
SetTextAlign
SetTextCharacterExtra
SetSystemPaletteUse
SetROP2
SetPolyFillMode
SetPaletteEntries
GetLayout
SetMapperFlags
SetBoundsRect
SetDCPenColor
SetMetaRgn
ResizePalette
RoundRect
Rectangle
RectInRegion
PtVisible
PtInRegion
PolyPolygon
PaintRgn
Pie
PlgBlt
MaskBlt
InvertRgn
GetWindowOrgEx
GetCharABCWidthsI
GetCharWidthI
GetTextExtentExPointI
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
GetCharacterPlacementW
GetFontLanguageInfo
GetTextCharset
GetTextExtentExPointW
GetTextExtentExPointA
GetTextExtentPoint32A
GetTextAlign
GetTextCharacterExtra
GetSystemPaletteUse
GetSystemPaletteEntries
GetStretchBltMode
GetRegionData
GetRandomRgn
GetPolyFillMode
GetPaletteEntries
GetOutlineTextMetricsW
GetNearestPaletteIndex
GetNearestColor
GetMapMode
GetGlyphOutlineW
GetMetaRgn
GetCharABCWidthsFloatW
GetCharABCWidthsW
GetCharWidthFloatW
GetCharWidth32W
GetBoundsRect
GetBitmapDimensionEx
GetBkMode
GetDCPenColor
GetDCBrushColor
GetAspectRatioFilterEx
GetROP2
FrameRgn
FillRgn
ExtFloodFill
ExtEscape
Escape
EnumObjects
DrawEscape
Chord
CancelDC
AnimatePalette
GetObjectType
SetDIBits
CreateBitmap
GetTextFaceW
GetFontData
GetTextCharsetInfo
EnumFontFamiliesExW
CreateDCW
GetTextColor
GetBkColor
Polygon
CreatePolygonRgn
SetDCBrushColor
Ellipse
PatBlt
GetWindowExtEx
GetViewportExtEx
MoveToEx
LineTo
CreatePen
GetCurrentObject
GetClipRgn
CreateRectRgnIndirect
SetViewportOrgEx
GetViewportOrgEx
CreateICW
GetDeviceCaps
SetBrushOrgEx
CreateHalftonePalette
SelectPalette
RealizePalette
GetBrushOrgEx
CreatePatternBrush
GetDIBits
SetRectRgn
OffsetRgn
EqualRgn
CombineRgn
GetTextMetricsW
SetMapMode
GdiFlush
SetWindowOrgEx
SelectClipRgn
GetClipBox
StretchBlt
SetStretchBltMode
SetDIBColorTable

advapi32

AddAccessDeniedAce
AllocateAndInitializeSid
CreateProcessAsUserW
LookupPrivilegeValueW
AdjustTokenPrivileges
EventWriteTransfer
QueryServiceStatus
StartServiceW
IsTextUnicode
ConvertStringSecurityDescriptorToSecurityDescriptorW
QueryServiceConfigW
OpenServiceW
RegDeleteValueA
RegEnumValueA
GetSecurityDescriptorDacl
ConvertSidToStringSidA
LookupAccountSidW
RevertToSelf
GetSidSubAuthority
FreeSid
EqualSid
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
OpenThreadToken
AddAccessAllowedAce
CreateWellKnownSid
AddAce
CopySid
GetAce
GetAclInformation
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
IsValidSid
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
LookupAccountNameW
EventWrite
RegDeleteKeyW
RegGetValueW
EventRegister
EventUnregister
RegSetValueExW
RegDeleteKeyValueW
EventProviderEnabled
RegSetKeyValueW
ConvertSidToStringSidW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteTreeW
RegOpenKeyExA
RegQueryValueExA
ChangeServiceConfigW
CloseServiceHandle
OpenSCManagerW

kernel32

OpenSemaphoreA
CreateSemaphoreA
OpenMutexA
OpenEventA
CreateEventA
CreateMutexA
WerUnregisterMemoryBlock
WerRegisterMemoryBlock
QueryFullProcessImageNameW
GetThreadIOPendingFlag
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
GetFileInformationByHandleEx
SetFileInformationByHandle
GetLastError
FlsAlloc
FlsFree
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemDefaultLangID
GetUserDefaultUILanguage
GetSystemDefaultLCID
CancelIoEx
GetOverlappedResult
GetSystemPowerStatus
IsSystemResumeAutomatic
SystemTimeToFileTime
FileTimeToSystemTime
WriteFile
lstrcmpW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
GlobalFree
SetEnvironmentVariableW
GetCommandLineW
OpenMutexW
GetComputerNameW
K32EnumProcessModulesEx
K32EnumProcessModules
K32EnumProcesses
GetPriorityClass
IsValidLocale
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetSystemTime
GetVolumeInformationW
CopyFileW
DeviceIoControl
GetFileSizeEx
GetFileAttributesW
CompareFileTime
GetSystemDirectoryW
GetTempFileNameW
GetNumberFormatW
ReadFile
lstrlenW
SetFilePointerEx
SetFileAttributesW
DeleteFileW
LocalFree
LocalAlloc
K32GetModuleFileNameExW
GetShortPathNameA
GetModuleFileNameA
GetTickCount64
GetSystemTimeAsFileTime
CreateProcessW
TerminateProcess
OpenProcess
CreateDirectoryW
GetDriveTypeW
GetDiskFreeSpaceExW
GetUserDefaultLCID
IsProcessorFeaturePresent
MulDiv
QueryPerformanceFrequency
SetWaitableTimerEx
SetThreadPriority
CreateWaitableTimerW
SetWaitableTimer
WerRegisterRuntimeExceptionModule
WaitForMultipleObjects
GetFileAttributesExW
InitializeCriticalSection
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseSemaphore
CreateEventW
ResetEvent
FindResourceW
SizeofResource
LockResource
LoadResource
WaitForMultipleObjectsEx
OutputDebugStringW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeSRWLock
RtlCaptureStackBackTrace
K32GetProcessImageFileNameW
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
VerifyVersionInfoW
GetNativeSystemInfo
GetVersionExW
GetSystemDirectoryA
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
GetFileAttributesA
VerSetConditionMask
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
LoadLibraryW
GetModuleHandleExW
GetTickCount
GetCurrentThread
CreateThread
Sleep
CreateEventExW
CreateMutexW
ReleaseMutex
SetEvent
SetLastError
CreateFileMappingA
CloseHandle
DecodePointer
OutputDebugStringA
ExpandEnvironmentStringsW
GetCurrentProcessId
WideCharToMultiByte
LoadLibraryExW
GetProcAddress
GetModuleHandleW
FreeLibrary
SetErrorMode
FindFirstFileExW
FindClose
MultiByteToWideChar
LCIDToLocaleName
LocaleNameToLCID
GetLocaleInfoEx
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
EnumSystemLocalesEx
GetDateFormatEx
GetCalendarInfoEx
HeapAlloc
HeapFree
GetProcessHeap
GetThreadUILanguage
CreateFileW
GetFileType
SetEndOfFile
CreateFileMappingW
FlsGetValue
FlsSetValue
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathW
UnmapViewOfFile
MapViewOfFile
CancelWaitableTimer
QueryDepthSList
TryEnterCriticalSection
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
LoadLibraryExA
ExpandEnvironmentStringsA
OpenEventW
GetStdHandle
TlsGetValue
GetTimeFormatEx
GetAtomNameW
TlsAlloc
TlsSetValue
TlsFree
DeleteAtom
AddAtomW
FindAtomW
GetFileSize
GetAtomNameA
GetStringTypeExW
GetLocaleInfoW
HeapCreate
HeapDestroy
HeapReAlloc
InitializeCriticalSectionAndSpinCount
GlobalDeleteAtom
GlobalAddAtomW
InterlockedFlushSList
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrencyFormatW
VirtualAlloc
IsValidCodePage
CompareStringOrdinal
RtlPcToFileHeader
EncodePointer
GetStringTypeW
DuplicateHandle
GetCPInfo
CompareStringW
LCMapStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetStartupInfoW
RtlUnwindEx
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
VirtualFree
VirtualProtect
UnregisterWaitEx
HeapSize
ExitProcess
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetSystemInfo
VirtualQuery
GetACP
EnumSystemLocalesW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetCommandLineA
ReleaseActCtx
WriteProcessMemory
lstrcmpiA
IsDBCSLeadByte
GetCPInfoExW
CreateMemoryResourceNotification
LCMapStringEx
GetLongPathNameW
GetUserDefaultLangID
GetCurrentProcess
IsWow64Process
CompareStringEx
GetCurrentThreadId
GetExitCodeThread
OpenFileMappingA
RaiseException
GetModuleFileNameW
FormatMessageW

ole32

CoTaskMemAlloc
RevokeDragDrop
CreateFileMoniker
CoDisconnectObject
CoRevokeClassObject
StringFromIID
CoCreateGuid
CLSIDFromString
OleDraw
CreateStreamOnHGlobal
CoRegisterClassObject
CoTaskMemFree
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoLockObjectExternal
OleUninitialize
CoRevokeInitializeSpy
CoRegisterInitializeSpy

oleaut32

VariantChangeTypeEx
VarDecFromI4
VarDecFromR8
VarCmp
VarDecCmp
VariantChangeType
VarDecFromR4
SysAllocStringLen
SysStringLen
OleCreateFontIndirect
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayCreate
SafeArrayDestroy
VariantCopy
VarDecAdd
VarDecDiv
VarDecMul
VarDecSu
VarDecInt
VarR8FromDec
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
VarDecRound
SysFreeString
SysAllocString
VariantInit
VariantClear
SysStringByteLen
SafeArrayPutElement
VariantTimeToSystemTime

wtsapi32

WTSRegisterSessionNotificationEx
WTSUnRegisterSessionNotificationEx

wer

WerReportSubmit
WerReportAddFile
WerReportSetParameter
WerReportCreate
WerReportCloseHandle

hid

HidD_GetHidGuid

rpcrt4

RpcStringFreeW
RpcStringBindingComposeW
NdrClientCall2
RpcBindingFromStringBindingW
RpcBindingFree

msimg32

GradientFill

imm32

ImmAssociateContext

Exports

Exports

?AddRef@BaseValue@NetUI@@QEAAXXZ
?CreateAtom@FlexValue@FlexUI@@SA_NIAEAVFlexValueSP@2@@Z
?CreateBoolean@FlexValue@FlexUI@@SA_N_NAEAVFlexValueSP@2@@Z
?CreateByte@FlexValue@FlexUI@@SA_NEAEAVFlexValueSP@2@@Z
?CreateChar@FlexValue@FlexUI@@SA_NDAEAVFlexValueSP@2@@Z
?CreateDataSource@FlexValue@FlexUI@@SA_NPEAUIDataSource@2@AEAVFlexValueSP@2@@Z
?CreateDecimal@FlexValue@FlexUI@@SA_NHAEAVFlexValueSP@2@@Z
?CreateDouble@FlexValue@FlexUI@@SA_NNAEAVFlexValueSP@2@@Z
?CreateFlexEvent@FlexValue@FlexUI@@SA_NAEAVFlexValueSP@2@@Z
?CreateInt16@FlexValue@FlexUI@@SA_NFAEAVFlexValueSP@2@@Z
?CreateInt32@FlexValue@FlexUI@@SA_NHAEAVFlexValueSP@2@@Z
?CreateInt64@FlexValue@FlexUI@@SA_N_JAEAVFlexValueSP@2@@Z
?CreateLength@FlexValue@FlexUI@@SA_NPEBUFlexLength@2@AEAVFlexValueSP@2@@Z
?CreateSByte@FlexValue@FlexUI@@SA_NCAEAVFlexValueSP@2@@Z
?CreateSingle@FlexValue@FlexUI@@SA_NMAEAVFlexValueSP@2@@Z
?CreateString@FlexValue@FlexUI@@SA_NPEB_WAEAVFlexValueSP@2@@Z
?CreateUInt16@FlexValue@FlexUI@@SA_NGAEAVFlexValueSP@2@@Z
?CreateUInt32@FlexValue@FlexUI@@SA_NIAEAVFlexValueSP@2@@Z
?CreateUInt64@FlexValue@FlexUI@@SA_N_KAEAVFlexValueSP@2@@Z
?EnsureDataSourceState@@YAXPEAUIDataSource@FlexUI@@@Z
?GetAtom@FlexValue@FlexUI@@QEBAGXZ
?GetBoolean@FlexValue@FlexUI@@QEBA_NXZ
?GetByte@FlexValue@FlexUI@@QEBAEXZ
?GetChar@FlexValue@FlexUI@@QEBA_WXZ
?GetDataSource@FlexValue@FlexUI@@QEBAPEAUIDataSource@2@XZ
?GetDecimal@FlexValue@FlexUI@@QEBA?AUtagDEC@@XZ
?GetDouble@FlexValue@FlexUI@@QEBANXZ
?GetInt16@FlexValue@FlexUI@@QEBAFXZ
?GetInt32@FlexValue@FlexUI@@QEBAHXZ
?GetInt64@FlexValue@FlexUI@@QEBA_JXZ
?GetLength@FlexValue@FlexUI@@QEBA?AUFlexLength@2@XZ
?GetList@FlexValue@FlexUI@@QEBAPEAUIFlexList@2@XZ
?GetSByte@FlexValue@FlexUI@@QEBACXZ
?GetSingle@FlexValue@FlexUI@@QEBAMXZ
?GetString@FlexValue@FlexUI@@QEBAPEB_WXZ
?GetType@FlexValue@FlexUI@@QEBA?AW4FlexValueType@2@XZ
?GetUInt16@FlexValue@FlexUI@@QEBAGXZ
?GetUInt32@FlexValue@FlexUI@@QEBAIXZ
?GetUInt64@FlexValue@FlexUI@@QEBA_KXZ
?HFree@NetUI@@YAXPEAX@Z
?IsDataSourceSubclassOf@FlexUI@@YA_NPEAUIDataSourceDescription@1@I@Z
?Release@BaseValue@NetUI@@QEAAXXZ
RunDevSetup
RunSetup

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.1MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/owow32ww.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/pidgenx.dll
.dll windows x64

80ca698e066444e9f8c0272252110998

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:13:36:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

34:5a:d7:e1:4f:6f:75:9b:ed:ee:79:28:be:8a:a2:2d:2d:e8:8f:e6
Signer

Actual PE Digest

34:5a:d7:e1:4f:6f:75:9b:ed:ee:79:28:be:8a:a2:2d:2d:e8:8f:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_vsnwprintf
_wcsicmp
_purecall
_onexit
_lock
__dllonexit
_unlock
memmove
memset
memcpy
__C_specific_handler
_amsg_exit
free
_initterm
memcmp
rand
srand
time
wcsncmp
_wtoi
_wcsnicmp
_ui64tow
_itow
malloc
_XcptFilter
wcschr
wcsstr

kernel32

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateSemaphoreW
CreateEventW
CreateThread
GetModuleFileNameW
VirtualQuery
FreeLibraryAndExitThread
GetCurrentThread
SetThreadPriority
GetVersion
DeleteCriticalSection
RtlDeleteFunctionTable
GetSystemInfo
EnterCriticalSection
VirtualAlloc
GetProcAddress
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryW
RtlInstallFunctionTableCallback
WaitForSingleObject
FreeLibrary
FileTimeToSystemTime
GetSystemDefaultLangID
GetVersionExW
RaiseException
ReleaseSemaphore
SetEvent
WaitForMultipleObjects
GetProcessAffinityMask
GetThreadPriority
GetLocalTime
SystemTimeToFileTime
InitializeCriticalSection
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
LocalAlloc
GetVersionExA
GetLastError
LocalFree
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
CreateFileW
GetFileSize
ReadFile
SetFilePointer
VirtualProtect
Sleep
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualFree

advapi32

TraceEvent
CryptGenKey
CryptExportKey
CryptVerifySignatureA
CryptSignHashA
CryptImportKey
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
GetTraceLoggerHandle

rpcrt4

I_RpcMapWin32Status
UuidToStringW
RpcStringFreeW
UuidFromStringW

Exports

Exports

PidGenX
PidGenX2

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/pkeyconfig-office.xrm-ms
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/proplusww.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/proplusww.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/propsww.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/propsww2.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/proplus.ww/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/publisher.en-us/publishermui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/publisher.en-us/publishermui.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/publisher.en-us/publr.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/publisher.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/readme.htm
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/setup.dll
.dll windows x64

7d65b6c1a954da6bd093be0b9a78a6d9

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:bd:8b:b8:35:be:a1:22:62:56:2e:d1:db:86:fb:be:74:55:90:9c
Signer

Actual PE Digest

0f:bd:8b:b8:35:be:a1:22:62:56:2e:d1:db:86:fb:be:74:55:90:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

advapi32

RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
EventRegister
EventUnregister
EventWrite
EventWriteTransfer

kernel32

WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EnterCriticalSection
LeaveCriticalSection
HeapSize
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
HeapFree
HeapAlloc
GetCurrentThread
GetACP
GetStdHandle
GetFileType
HeapReAlloc
GetProcessHeap
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineA
FreeLibrary
GetStringTypeW
SetStdHandle
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
CloseHandle
OutputDebugStringW
CreateFileW
ExpandEnvironmentStringsW
FormatMessageW
DeleteFileW
FindFirstFileW
FindNextFileW
GetFileAttributesExW
RemoveDirectoryW
SetFileAttributesW
lstrcmpW
CopyFileW
SetCurrentDirectoryW
GlobalFree
GetFullPathNameW
VerSetConditionMask
DecodePointer
GetTickCount64
GetModuleFileNameA
GetShortPathNameA
LocalFree
GetVersionExW
SetErrorMode
LoadLibraryExW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
GetModuleFileNameW
FindFirstFileExW
FindClose
CompareStringEx
IsWow64Process
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
FlsFree
FlsAlloc
GetLastError
GetCommandLineW
VerifyVersionInfoW
FlsGetValue
FlsSetValue
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
FileTimeToSystemTime
GetTempPathW
GetSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
Sleep
CreateWaitableTimerW
QueryDepthSList
TryEnterCriticalSection
CreateEventExW
InterlockedPopEntrySList
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
QueryPerformanceFrequency
CreateEventW
SetEvent
GetThreadTimes

ole32

CoTaskMemFree
StringFromIID
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust

Exports

Exports

WinMain

Sections

.text
Size: 306KB - Virtual size: 306KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/setup.exe
.exe windows x64

8df305cbfddc966a7b6ab459d5570a2d

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:bc:20:cb:d4:49:01:27:95:2e:b8:3d:90:90:ff:08:c3:3d:b7:9a
Signer

Actual PE Digest

ee:bc:20:cb:d4:49:01:27:95:2e:b8:3d:90:90:ff:08:c3:3d:b7:9a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

GetLastError
SetLastError
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryW
OutputDebugStringA
VerifyVersionInfoW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
FormatMessageW
VerSetConditionMask
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwindEx
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapSize
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetProcessHeap
CloseHandle
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
CreateFileW
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/updates/readme.txt
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/word.en-us/setup.xml
.xml
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/word.en-us/wordlr.cab
.cab
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/word.en-us/wordmui.msi
.msi
SW_DVD5_Office_Professional_Plus_2016_64Bit_English/word.en-us/wordmui.xml
.xml

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6fCertificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

7c:47:3c:4f:aa:0e:17:93:86:a4:32:d8:34:3b:0a:e5:5f:f0:ec:8bSigner

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 184B

.rsrc Size: 5KB - Virtual size: 4KB

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71Certificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

75:fd:5a:ec:4c:04:90:61:08:56:40:ca:07:01:bd:7d:5e:b8:8c:86Signer

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 184B

.rsrc Size: 273KB - Virtual size: 272KB

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71Certificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

c8:dd:5b:7b:3b:0f:af:0f:c2:79:5a:bc:e6:a1:17:fc:ab:dd:07:9dSigner

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 139B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71Certificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

f2:b0:c8:62:03:d2:df:b0:87:b7:bb:39:d3:bd:3a:9b:6b:90:5c:e9Signer

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 139B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71Certificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

7c:47:3c:4f:aa:0e:17:93:86:a4:32:d8:34:3b:0a:e5:5f:f0:ec:8b
Signer

.rdata
Size: 512B - Virtual size: 184B

.rsrc
Size: 5KB - Virtual size: 4KB

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

75:fd:5a:ec:4c:04:90:61:08:56:40:ca:07:01:bd:7d:5e:b8:8c:86
Signer

.rdata
Size: 512B - Virtual size: 184B

.rsrc
Size: 273KB - Virtual size: 272KB

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

c8:dd:5b:7b:3b:0f:af:0f:c2:79:5a:bc:e6:a1:17:fc:ab:dd:07:9d
Signer

.rdata
Size: 512B - Virtual size: 139B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

f2:b0:c8:62:03:d2:df:b0:87:b7:bb:39:d3:bd:3a:9b:6b:90:5c:e9
Signer

.rdata
Size: 512B - Virtual size: 139B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

9b:1f:d2:14:80:15:ab:c6:4f:da:f8:6c:11:3a:e5:00:40:76:02:c2
Signer

.rdata
Size: 512B - Virtual size: 146B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

ff:26:84:2a:79:3c:1a:6d:61:e4:0d:9f:4b:c6:37:2f:8f:51:a9:ce
Signer

.rdata
Size: 512B - Virtual size: 146B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

11:23:e7:e2:a0:28:41:26:a1:63:f0:60:6a:d8:a1:3d:66:40:bc:16
Signer

.rdata
Size: 512B - Virtual size: 223B

.rsrc
Size: 5KB - Virtual size: 5KB

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

46:65:48:3f:ce:33:eb:23:7b:5c:d6:62:ee:9c:63:c7:87:8b:e7:e4
Signer

.rdata
Size: 512B - Virtual size: 223B

.rsrc
Size: 5KB - Virtual size: 5KB