1f07f75b7af4a3052319f4b981f94141a286e2cdc71f40c0c1c217d820b42201[.]zip[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

1f07f75b7af4a3052319f4b981f94141a286e2cdc71f40c0c1c217d820b42201.zip.zip
Size

10.5MB
MD5

1bc6f3d86fdf36b07fb0dc898261d4f0
SHA1

e36eebcd71df63676f78ebdeec5d0355b8548676
SHA256

52b45797dce6409066f10bdb14e9c42593169d1162766bcedecca296a6ceb2e5
SHA512

e1387b1de07be8b290747cf79b7e741b561a3e5f8b863ce7005bab76cc08e61a7e95fce4c9120ea89c2bb1c53cb10e17de3d21a9e09c96a4ff9b3690bbbc5d67
SSDEEP

196608:gxt+i9GuSdLcGG3N1/11J1myZvg2LucXR1qOaeJov052zvyv41n:gv+ijS9cGG91XJPg2Lu6XqEn2zvv

Score

10^/10

upx pdf link

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://www.microsoft.com/en-us/download/confirmation.aspx?id=49117

Extracted

Language

ps1

Source

URLs

exe.dropper

https://learn.microsoft.com/en-us/officeupdates/odt-release-history

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack002/OfficeRTool.v3.07/Data/bin/7z.dll	acprotect
static1/unpack002/OfficeRTool.v3.07/Data/bin/7zxa.dll	acprotect
static1/unpack002/OfficeRTool.v3.07/Data/bin/msvcr100.dll	acprotect

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/OfficeRTool.v3.07/Data/bin/7z.dll	upx
static1/unpack002/OfficeRTool.v3.07/Data/bin/7z.exe	upx
static1/unpack002/OfficeRTool.v3.07/Data/bin/7zxa.dll	upx
static1/unpack002/OfficeRTool.v3.07/Data/bin/cleanospp.exe	upx
static1/unpack002/OfficeRTool.v3.07/Data/bin/cmdow.exe	upx
static1/unpack002/OfficeRTool.v3.07/Data/bin/handle.exe	upx
static1/unpack002/OfficeRTool.v3.07/Data/bin/hex2dec.exe	upx
static1/unpack002/OfficeRTool.v3.07/Data/bin/msvcr100.dll	upx
static1/unpack002/OfficeRTool.v3.07/Data/bin/setup.exe	upx
static1/unpack002/OfficeRTool.v3.07/Data/bin/setup_latest.exe	upx
static1/unpack002/OfficeRTool.v3.07/Data/bin/upx32.exe	upx
static1/unpack002/OfficeRTool.v3.07/Data/bin/wget.exe	upx

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
static1/unpack002/OfficeRTool.v3.07/readme.pdf	pdf_with_link_action

Unsigned PE 21 IoCs

Checks for missing Authenticode signature.

resource
unpack002/OfficeRTool.v3.07/Data/bin/7z.dll
unpack003/out.upx
unpack002/OfficeRTool.v3.07/Data/bin/7z.exe
unpack004/out.upx
unpack002/OfficeRTool.v3.07/Data/bin/7zxa.dll
unpack005/out.upx
unpack002/OfficeRTool.v3.07/Data/bin/cleanospp.exe
unpack006/out.upx
unpack002/OfficeRTool.v3.07/Data/bin/cmdow.exe
unpack007/out.upx
unpack002/OfficeRTool.v3.07/Data/bin/handle.exe
unpack008/out.upx
unpack002/OfficeRTool.v3.07/Data/bin/hex2dec.exe
unpack009/out.upx
unpack002/OfficeRTool.v3.07/Data/bin/msvcr100.dll
unpack002/OfficeRTool.v3.07/Data/bin/setup.exe
unpack002/OfficeRTool.v3.07/Data/bin/setup_latest.exe
unpack002/OfficeRTool.v3.07/Data/bin/upx32.exe
unpack002/OfficeRTool.v3.07/Data/bin/wget.exe
unpack002/OfficeRTool.v3.07/Data/dll/x64.dll
unpack002/OfficeRTool.v3.07/Data/dll/x86.dll

Files

1f07f75b7af4a3052319f4b981f94141a286e2cdc71f40c0c1c217d820b42201.zip.zip
.zip

Password: infected
1f07f75b7af4a3052319f4b981f94141a286e2cdc71f40c0c1c217d820b42201.zip
.zip
OfficeRTool.v3.07/Build_Info.ini
OfficeRTool.v3.07/Data/backup.cmd
OfficeRTool.v3.07/Data/bin/.wget-hsts
OfficeRTool.v3.07/Data/bin/7z.dll
.dll windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode

Sections

UPX0
Size: - Virtual size: 720KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 489KB - Virtual size: 492KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 885KB - Virtual size: 885KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OfficeRTool.v3.07/Data/bin/7z.exe
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 212KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 145KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OfficeRTool.v3.07/Data/bin/7zxa.dll
.dll windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode

Sections

UPX0
Size: - Virtual size: 120KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 75KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OfficeRTool.v3.07/Data/bin/UnRAR.exe
.exe windows:5 windows x86

f211c716e35cd0680ca49f3052caba63

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:1d:40:ae:3f:3a:1f:b2:bc:3d:83:95
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

25/08/2020, 13:42

Not After

26/08/2023, 13:42

Subject

CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:1d:40:ae:3f:3a:1f:b2:bc:3d:83:95
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

25/08/2020, 13:42

Not After

26/08/2023, 13:42

Subject

CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27/05/2021, 09:55

Not After

28/06/2032, 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:24:7b:ae:da:dd:fd:28:af:a0:e1:08:21:48:ab:65:0b:2a:f1:9d:fe:6f:f4:d1:03:48:01:a8:cf:f2:be:a4
Signer

Actual PE Digest

74:24:7b:ae:da:dd:fd:28:af:a0:e1:08:21:48:ab:65:0b:2a:f1:9d:fe:6f:f4:d1:03:48:01:a8:cf:f2:be:a4

Digest Algorithm

sha256

PE Digest Matches

true

83:4b:6c:fe:60:80:da:99:5a:28:d9:24:f0:af:87:50:ea:6d:b9:e6
Signer

Actual PE Digest

83:4b:6c:fe:60:80:da:99:5a:28:d9:24:f0:af:87:50:ea:6d:b9:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetDriveTypeW
GetDiskFreeSpaceExW
SetFileAttributesW
GetFileAttributesW
GetVolumeInformationW
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetModuleFileNameW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
SetErrorMode
GetModuleHandleW
FreeLibrary
LoadLibraryW
LoadLibraryExW
GetProcAddress
GetCurrentProcessId
GetCurrentProcess
SetThreadPriority
SetThreadExecutionState
CreateEventW
GetSystemDirectoryW
SetPriorityClass
GetProcessAffinityMask
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
GetConsoleCP
DecodePointer
HeapSize
SetFilePointerEx
LCMapStringW
SetConsoleCtrlHandler
FormatMessageW
Sleep
SetLastError
GetLastError
WriteConsoleW
ReadConsoleW
SetConsoleMode
GetConsoleMode
WriteFile
GetStdHandle
GetFileType
GetCurrentThread
GetCommandLineW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetStringTypeW
FindNextFileA
FindFirstFileExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
RtlUnwind
RaiseException
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
QueryPerformanceFrequency
GetModuleFileNameA
GetCommandLineA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
SetStdHandle

user32

OemToCharA
CharToOemA
OemToCharBuffA
CharUpperW
CharLowerW
MessageBeep
ExitWindowsEx
LoadStringW
CharToOemBuffW

advapi32

CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeValueW
SetFileSecurityW
AdjustTokenPrivileges
OpenProcessToken

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc

ole32

CoCreateInstance
CoSetProxyBlanket

oleaut32

SysFreeString
SysAllocString
VariantClear

powrprof

SetSuspendState

Sections

.text
Size: 287KB - Virtual size: 286KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OfficeRTool.v3.07/Data/bin/cleanospp.exe
.exe windows:6 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:6 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OfficeRTool.v3.07/Data/bin/cmdow.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
OfficeRTool.v3.07/Data/bin/handle.exe
.exe windows:6 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 488KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 314KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:6 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 437KB - Virtual size: 437KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OfficeRTool.v3.07/Data/bin/hex2dec.exe
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 264KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 134KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 298KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OfficeRTool.v3.07/Data/bin/msvcr100.dll
.dll windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

$I10_OUTPUT
??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
??0SchedulerPolicy@Concurrency@@QAA@IZZ
??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z
??0SchedulerPolicy@Concurrency@@QAE@XZ
??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_ReaderWriterLock@details@Concurrency@@QAE@XZ
??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_ReentrantLock@details@Concurrency@@QAE@XZ
??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_SpinLock@details@Concurrency@@QAE@ACJ@Z
??0_TaskCollection@details@Concurrency@@QAE@XZ
??0_Timer@details@Concurrency@@IAE@I_N@Z
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0__non_rtti_object@std@@QAE@PBD@Z
??0bad_cast@std@@AAE@PBQBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@XZ
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@XZ
??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z
??0context_unblock_unbalanced@Concurrency@@QAE@XZ
??0critical_section@Concurrency@@QAE@XZ
??0default_scheduler_exists@Concurrency@@QAE@PBD@Z
??0default_scheduler_exists@Concurrency@@QAE@XZ
??0event@Concurrency@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??0improper_lock@Concurrency@@QAE@PBD@Z
??0improper_lock@Concurrency@@QAE@XZ
??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_attach@Concurrency@@QAE@XZ
??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_detach@Concurrency@@QAE@XZ
??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z
??0improper_scheduler_reference@Concurrency@@QAE@XZ
??0invalid_link_target@Concurrency@@QAE@PBD@Z
??0invalid_link_target@Concurrency@@QAE@XZ
??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z
??0invalid_multiple_scheduling@Concurrency@@QAE@XZ
??0invalid_operation@Concurrency@@QAE@PBD@Z
??0invalid_operation@Concurrency@@QAE@XZ
??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z
??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ
??0message_not_found@Concurrency@@QAE@PBD@Z
??0message_not_found@Concurrency@@QAE@XZ
??0missing_wait@Concurrency@@QAE@PBD@Z
??0missing_wait@Concurrency@@QAE@XZ
??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z
??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ
??0operation_timed_out@Concurrency@@QAE@PBD@Z
??0operation_timed_out@Concurrency@@QAE@XZ
??0reader_writer_lock@Concurrency@@QAE@XZ
??0scheduler_not_attached@Concurrency@@QAE@PBD@Z
??0scheduler_not_attached@Concurrency@@QAE@XZ
??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z
??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z
??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z
??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0task_canceled@details@Concurrency@@QAE@PBD@Z
??0task_canceled@details@Concurrency@@QAE@XZ
??0unsupported_os@Concurrency@@QAE@PBD@Z
??0unsupported_os@Concurrency@@QAE@XZ
??1SchedulerPolicy@Concurrency@@QAE@XZ
??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_SpinLock@details@Concurrency@@QAE@XZ
??1_TaskCollection@details@Concurrency@@QAE@XZ
??1_Timer@details@Concurrency@@IAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1critical_section@Concurrency@@QAE@XZ
??1event@Concurrency@@QAE@XZ
??1exception@std@@UAE@XZ
??1reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock@critical_section@Concurrency@@QAE@XZ
??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z
??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z
??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ
??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?Alloc@Concurrency@@YAPAXI@Z
?Block@Context@Concurrency@@SAXXZ
?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z
?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ
?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ
?CurrentContext@Context@Concurrency@@SAPAV12@XZ
?Detach@CurrentScheduler@Concurrency@@SAXXZ
?DisableTracing@Concurrency@@YAJXZ
?EnableTracing@Concurrency@@YAJXZ
?Free@Concurrency@@YAXPAX@Z
?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ
?GetExecutionContextId@Concurrency@@YAIXZ
?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ
?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ
?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ
?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z
?GetProcessorCount@Concurrency@@YAIXZ
?GetProcessorNodeCount@Concurrency@@YAIXZ
?GetSchedulerId@Concurrency@@YAIXZ
?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ
?Id@Context@Concurrency@@SAIXZ
?Id@CurrentScheduler@Concurrency@@SAIXZ
?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ
?Log2@details@Concurrency@@YAKI@Z
?Oversubscribe@Context@Concurrency@@SAX_N@Z
?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z
?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ
?ScheduleGroupId@Context@Concurrency@@SAIXZ
?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z
?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z
?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z
?VirtualProcessorId@Context@Concurrency@@SAIXZ
?Yield@Context@Concurrency@@SAXXZ
?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ
?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ
?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ
?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ
?_ConcRT_Assert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_DumpMessage@details@Concurrency@@YAXPB_WZZ
?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ
?_Copy_str@exception@std@@AAEXPBD@Z
?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ
?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ
?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ
?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ
?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z
?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z
?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ
?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ
?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ
?_SpinYield@Context@Concurrency@@SAXXZ
?_Start@_Timer@details@Concurrency@@IAEXXZ
?_Stop@_Timer@details@Concurrency@@IAEXXZ
?_Tidy@exception@std@@AAEXXZ
?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z
?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ
?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_UnderlyingYield@details@Concurrency@@YAXXZ
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_Value@_SpinCount@details@Concurrency@@SAIXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCompare@@YA_NPBX0@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ
?lock@critical_section@Concurrency@@QAEXXZ
?lock@reader_writer_lock@Concurrency@@QAEXXZ
?lock_read@reader_writer_lock@Concurrency@@QAEXXZ
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?native_handle@critical_section@Concurrency@@QAEAAV12@XZ
?raw_name@type_info@@QBEPBDXZ
?reset@event@Concurrency@@QAEXXZ
?set@event@Concurrency@@QAEXXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?try_lock@critical_section@Concurrency@@QAE_NXZ
?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ
?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ
?unexpected@@YAXXZ
?unlock@critical_section@Concurrency@@QAEXXZ
?unlock@reader_writer_lock@Concurrency@@QAEXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?wait@Concurrency@@YAXI@Z
?wait@event@Concurrency@@QAEII@Z
?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
?what@exception@std@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p

Sections

UPX0
Size: - Virtual size: 484KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 294KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
OfficeRTool.v3.07/Data/bin/oscdimg.exe
.exe windows:10 windows x86

1e51fc9ceb483eef5a26d8632464b381

Code Sign

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:63:cd:26:7b:1d:0a:59:bd:bd:00:01:00:00:01:63
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/07/2017, 20:21

Not After

02/07/2018, 20:21

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:04:22:e0:25:46:23:4d:67:2c:17:00:00:00:00:04:22
Certificate

Issuer

CN=Microsoft Windows PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/07/2017, 20:38

Not After

02/07/2018, 20:38

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:6a:19:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Windows PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:92:f8:f6:18:b3:13:0e:4c:ba:bf:1d:5e:68:6c:53:b6:01:ec:aa:62:fb:50:0c:cb:7a:b7:63:c6:56:3d:b0
Signer

Actual PE Digest

17:92:f8:f6:18:b3:13:0e:4c:ba:bf:1d:5e:68:6c:53:b6:01:ec:aa:62:fb:50:0c:cb:7a:b7:63:c6:56:3d:b0

Digest Algorithm

sha256

PE Digest Matches

true

c7:83:7c:bd:77:95:a8:0f:88:39:0c:f5:17:07:2e:08:e1:6c:dc:f8
Signer

Actual PE Digest

c7:83:7c:bd:77:95:a8:0f:88:39:0c:f5:17:07:2e:08:e1:6c:dc:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
SetErrorMode
GetSystemTime
SystemTimeToFileTime
SetFileApisToANSI
SetFileApisToOEM
GetTimeZoneInformation
GetFullPathNameA
GetFullPathNameW
lstrlenW
FindFirstFileW
FindFirstFileA
FindClose
GetLongPathNameW
GetLastError
GetLongPathNameA
HeapFree
CreateFileW
CreateFileA
CloseHandle
WaitForSingleObject
SetEvent
FileTimeToSystemTime
DeleteFileA
MultiByteToWideChar
WideCharToMultiByte
GetFileSize
ReadFile
GetFileTime
GetFileInformationByHandle
FindNextFileA
FindNextFileW
GetOverlappedResult
SetEndOfFile
SetFilePointer
CreateEventA
WriteFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
GetModuleHandleA
GetProcessWorkingSetSize
SetProcessWorkingSetSize
InitializeCriticalSection
VirtualFree
SetConsoleCtrlHandler
ExitProcess
FormatMessageA
GetProcessHeap
HeapAlloc
VirtualAlloc
VirtualLock
ResetEvent
GetProcAddress
ReleaseSemaphore
CreateThread
WaitForMultipleObjects
SetThreadPriority
CreateSemaphoreA
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep

msvcrt

sprintf_s
wprintf
wcsrchr
_wcsicmp
strrchr
_stricmp
wcscpy_s
wcstok
wcscat_s
strtok
_wfopen
fgetws
feof
fclose
fopen
fgets
swprintf_s
_strnicmp
_strtoui64
strtoul
tolower
atoi
srand
time
vfprintf
_ultoa
rand
_wcsnicmp
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
_except_handler4_common
?terminate@@YAXXZ
_controlfp
memcpy
wcschr
_strupr
wcsncmp
strcat_s
strcpy_s
exit
printf
fflush
fprintf
strchr
__iob_func
memcmp
memset

Sections

.text
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OfficeRTool.v3.07/Data/bin/setup.exe
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Sections

UPX0
Size: - Virtual size: 4.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
OfficeRTool.v3.07/Data/bin/setup_latest.exe
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Sections

UPX0
Size: - Virtual size: 4.9MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 174KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
OfficeRTool.v3.07/Data/bin/upx32.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 462KB - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
OfficeRTool.v3.07/Data/bin/wget.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
OfficeRTool.v3.07/Data/defaults.ini
OfficeRTool.v3.07/Data/dll/A64.dll
OfficeRTool.v3.07/Data/dll/SvcTrigger.xml
OfficeRTool.v3.07/Data/dll/x64.dll
.dll windows:6 windows x64

09aa7a1a68855623e3ac071d6080ef31

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

LdrDisableThreadCalloutsForDll
NtProtectVirtualMemory
RtlInitUnicodeString
LdrGetDllHandle
LdrLoadDll
RtlInitAnsiString
LdrGetProcedureAddress
RtlTimeToTimeFields
NtSetEvent
RtlRandomEx
NtQueryPerformanceCounter
NtQuerySystemTime
RtlTimeFieldsToTime
RtlAllocateHeap
LdrOpenImageFileOptionsKey
LdrQueryImageFileKeyOption
NtClose
swprintf_s
strcmp
_wcsnicmp
memmove
memcpy
memset
wcslen
_wcsicmp
memcmp

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 950B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OfficeRTool.v3.07/Data/dll/x86.dll
.dll windows:6 windows x86

8a7f219820c2adf212c4edf3841eebff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

LdrDisableThreadCalloutsForDll
NtProtectVirtualMemory
RtlInitUnicodeString
LdrGetDllHandle
LdrLoadDll
RtlInitAnsiString
LdrGetProcedureAddress
RtlTimeToTimeFields
NtSetEvent
RtlRandomEx
NtQueryPerformanceCounter
NtQuerySystemTime
RtlTimeFieldsToTime
RtlAllocateHeap
LdrOpenImageFileOptionsKey
LdrQueryImageFileKeyOption
NtClose
_aulldvrm
strcmp
_wcsnicmp
memmove
memcpy
memset
wcslen
_wcsicmp
swprintf_s
memcmp
_alldiv
_allmul
_allshl
_aulldiv
_aullrem

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OfficeRTool.v3.07/Data/licenses/Access2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Access2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Access2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/Access2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Access2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Access2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/AccessVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/AccessVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/AccessVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/Excel2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Excel2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/Excel2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Excel2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Excel2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ExcelVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ExcelVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ExcelVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/MondoVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/MondoVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/MondoVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/MondoVL_MAK-pl.xrm-ms
OfficeRTool.v3.07/Data/licenses/MondoVL_MAK-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/MondoVL_MAK-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/MondoVL_MAK-ul-phn.xrm-ms
OfficeRTool.v3.07/Data/licenses/OneNoteVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/OneNoteVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/OneNoteVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/Outlook2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Outlook2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/Outlook2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Outlook2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Outlook2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/OutlookVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/OutlookVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/OutlookVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/PowerPoint2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/PowerPoint2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/PowerPoint2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/PowerPointVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/PowerPointVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/PowerPointVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2021PreviewVL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2021PreviewVL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2021PreviewVL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlus2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlusVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlusVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProPlusVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2021PreviewVL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2021PreviewVL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2021PreviewVL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectPro2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectProVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectProVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectProVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStd2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStd2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStd2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStdVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStdVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStdVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/Publisher2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Publisher2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/Publisher2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Publisher2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Publisher2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/PublisherVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/PublisherVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/PublisherVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/SkypeforBusiness2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/SkypeforBusiness2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/SkypeforBusiness2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/SkypeforBusinessVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/SkypeforBusinessVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/Standard2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Standard2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/Standard2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Standard2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Standard2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/StandardVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/StandardVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/StandardVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2021PreviewVL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2021PreviewVL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2021PreviewVL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioPro2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioProVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioProVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioProVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStd2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStd2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStd2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStd2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStdVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStdVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStdVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/Word2019VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Word2019VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Word2019VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/Word2021VL_KMS_Client_AE-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/Word2021VL_KMS_Client_AE-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/Word2021VL_KMS_Client_AE-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/WordVL_KMS_Client-ppd.xrm-ms
OfficeRTool.v3.07/Data/licenses/WordVL_KMS_Client-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/WordVL_KMS_Client-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/c2rpridslicensefiles_auto.xml
OfficeRTool.v3.07/Data/licenses/client-issuance-bridge-office.xrm-ms
OfficeRTool.v3.07/Data/licenses/client-issuance-root-bridge-test.xrm-ms
OfficeRTool.v3.07/Data/licenses/client-issuance-root.xrm-ms
OfficeRTool.v3.07/Data/licenses/client-issuance-stil.xrm-ms
OfficeRTool.v3.07/Data/licenses/client-issuance-ul-oob.xrm-ms
OfficeRTool.v3.07/Data/licenses/client-issuance-ul.xrm-ms
OfficeRTool.v3.07/Data/licenses/pkeyconfig-office-client15.xrm-ms
OfficeRTool.v3.07/Data/licenses/pkeyconfig-office.xrm-ms
OfficeRTool.v3.07/Data/ps1/CheckWindowsStatus.ps1
.ps1
OfficeRTool.v3.07/Data/ps1/Clean_Office.ps1
.ps1
OfficeRTool.v3.07/Data/ps1/Convert_RT_VL.ps1
.ps1
OfficeRTool.v3.07/Data/ps1/Disable_Size.ps1
.ps1
OfficeRTool.v3.07/Data/ps1/GetInstances.ps1
.ps1
OfficeRTool.v3.07/Data/ps1/Set_Window.ps1
.ps1
OfficeRTool.v3.07/Data/ps1/Setup_Complete.ps1
.ps1
OfficeRTool.v3.07/Data/ps1/get_latest_setup_link.ps1
.ps1
OfficeRTool.v3.07/Data/ps1/get_latest_setup_version.ps1
.ps1
OfficeRTool.v3.07/Data/ps1/termproc_ps.ps1
.ps1
OfficeRTool.v3.07/Data/ps1/verify_Sub_Process.ps1
.ps1
OfficeRTool.v3.07/Data/start_setup.cmd
.cmd .vbs
OfficeRTool.v3.07/Data/template.ini
OfficeRTool.v3.07/Data/vbs/Arit.vbs
.vbs
OfficeRTool.v3.07/Data/vbs/Hex.vbs
.vbs
OfficeRTool.v3.07/Data/vbs/KMS Helper.vbs
.vbs
OfficeRTool.v3.07/Data/vbs/OLicenseCleanup.vbs.vbs
.vbs
OfficeRTool.v3.07/Data/vbs/OSPP.HTM
OfficeRTool.v3.07/Data/vbs/OSPP.VBS
.vbs
OfficeRTool.v3.07/Data/vbs/OffScrub03.vbs
.vbs
OfficeRTool.v3.07/Data/vbs/OffScrub07.vbs
.vbs
OfficeRTool.v3.07/Data/vbs/OffScrub10.vbs
.vbs
OfficeRTool.v3.07/Data/vbs/OffScrub_O15msi.vbs
.vbs
OfficeRTool.v3.07/Data/vbs/OffScrub_O16msi.vbs
.vbs
OfficeRTool.v3.07/Data/vbs/OffScrubc2r.vbs
.vbs
OfficeRTool.v3.07/Data/vbs/SLERROR.XML
OfficeRTool.v3.07/Debug Mode.cmd
.cmd .vbs
OfficeRTool.v3.07/OfficeRTool.cmd
.cmd .vbs
OfficeRTool.v3.07/Settings.ini
OfficeRTool.v3.07/readme.pdf
.pdf

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Files

Password: infected

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 720KB

UPX1 Size: 489KB - Virtual size: 492KB

.rsrc Size: 10KB - Virtual size: 12KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 885KB - Virtual size: 885KB

.rdata Size: 120KB - Virtual size: 120KB

.data Size: 1KB - Virtual size: 34KB

.sxdata Size: 512B - Virtual size: 4B

.rsrc Size: 95KB - Virtual size: 94KB

.reloc Size: 36KB - Virtual size: 36KB

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 212KB

UPX1 Size: 145KB - Virtual size: 148KB

.rsrc Size: 2KB - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 252KB - Virtual size: 252KB

.rdata Size: 51KB - Virtual size: 50KB

.data Size: 1KB - Virtual size: 9KB

.sxdata Size: 512B - Virtual size: 4B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 15KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 120KB

UPX1 Size: 75KB - Virtual size: 76KB

.rsrc Size: 6KB - Virtual size: 8KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 129KB - Virtual size: 129KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 512B - Virtual size: 18KB

.sxdata Size: 512B - Virtual size: 4B

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 7KB - Virtual size: 6KB

f211c716e35cd0680ca49f3052caba63

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

73:1d:40:ae:3f:3a:1f:b2:bc:3d:83:95Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

UPX0
Size: - Virtual size: 720KB

UPX1
Size: 489KB - Virtual size: 492KB

.rsrc
Size: 10KB - Virtual size: 12KB

.text
Size: 885KB - Virtual size: 885KB

.rdata
Size: 120KB - Virtual size: 120KB

.data
Size: 1KB - Virtual size: 34KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 95KB - Virtual size: 94KB

.reloc
Size: 36KB - Virtual size: 36KB

UPX0
Size: - Virtual size: 212KB

UPX1
Size: 145KB - Virtual size: 148KB

.rsrc
Size: 2KB - Virtual size: 4KB

.text
Size: 252KB - Virtual size: 252KB

.rdata
Size: 51KB - Virtual size: 50KB

.data
Size: 1KB - Virtual size: 9KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB

UPX0
Size: - Virtual size: 120KB

UPX1
Size: 75KB - Virtual size: 76KB

.rsrc
Size: 6KB - Virtual size: 8KB

.text
Size: 129KB - Virtual size: 129KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 18KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 7KB - Virtual size: 6KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

73:1d:40:ae:3f:3a:1f:b2:bc:3d:83:95
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

73:1d:40:ae:3f:3a:1f:b2:bc:3d:83:95
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

74:24:7b:ae:da:dd:fd:28:af:a0:e1:08:21:48:ab:65:0b:2a:f1:9d:fe:6f:f4:d1:03:48:01:a8:cf:f2:be:a4
Signer

83:4b:6c:fe:60:80:da:99:5a:28:d9:24:f0:af:87:50:ea:6d:b9:e6
Signer

.text
Size: 287KB - Virtual size: 286KB

.rdata
Size: 46KB - Virtual size: 46KB

.data
Size: 9KB - Virtual size: 96KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 12KB - Virtual size: 11KB

UPX0
Size: - Virtual size: 24KB

UPX1
Size: 7KB - Virtual size: 8KB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

UPX0
Size: - Virtual size: 96KB

UPX1
Size: 33KB - Virtual size: 36KB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 57KB - Virtual size: 57KB

.data
Size: 512B - Virtual size: 92B

.rdata
Size: 22KB - Virtual size: 21KB

.eh_fram
Size: 1024B - Virtual size: 992B

.bss
Size: - Virtual size: 19KB

.idata
Size: 3KB - Virtual size: 3KB