08beea06a063d6d8f3c92f8b712b50b1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

08beea06a063d6d8f3c92f8b712b50b1_JaffaCakes118
Size

2.4MB
MD5

08beea06a063d6d8f3c92f8b712b50b1
SHA1

a8e9253d0edf59f4caf2bfd5dd7e5077b4cbe49f
SHA256

59d700fdfaacd3fffce926579e7e96c4214d0fe11e903bcd19708d015e7f059e
SHA512

de27a2f096971c270c52fe6c270cf9ddfe856022621e63a0e26c7f86255948b3064d6d80d92ebff35bd611c1c8729e47552ecbc65a3d694d59e348b047451f6d
SSDEEP

49152:ARrJdmq00HwRiDg6RuulVzme8Xq5dqwT2YME8n6cms8BDjr0RdvlK/3rLJ7qCLFT:ApmqbQRik6RuySETuXE8mjY2/3r9tL7Z

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/Aktivator Microsoft Office 2010/Resources/KMSKG/Keygen.exe	upx

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Aktivator Microsoft Office 2010/O2ACK1.3.exe
unpack002/Aktivator Microsoft Office 2010/Resources/KMSAct/KMSAct.exe
unpack002/Aktivator Microsoft Office 2010/Resources/KMSKG/Keygen.exe
unpack003/out.upx
unpack002/Aktivator Microsoft Office 2010/Resources/KeyCheck/Checker.exe
unpack002/Aktivator Microsoft Office 2010/Resources/StartX/StartX.exe
unpack002/Aktivator Microsoft Office 2010/Resources/Token/tokens.exe

Files

08beea06a063d6d8f3c92f8b712b50b1_JaffaCakes118
.rar
Activator StradaHacker/Aktivator 2010.rar
.rar
Aktivator Microsoft Office 2010/O2ACK1.3.exe
.exe windows:4 windows x86 arch:x86

1d43cd5e399f31c49a6f934c29809b5a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExA

user32

GetKeyboardType

Sections

.text
Size: 58KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Aktivator Microsoft Office 2010/PDL.nfo
Aktivator Microsoft Office 2010/Raz0r.nfo
Aktivator Microsoft Office 2010/Resources/KMSAct/KMSAct.exe
.exe windows:5 windows x86 arch:x86

9402b48d966c911f0785b076b349b5ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

Imports

comctl32

ord17

kernel32

DeleteFileA
DeleteFileW
CreateDirectoryA
CreateDirectoryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GlobalAlloc
lstrlenA
GetModuleFileNameA
FindResourceA
GetModuleHandleA
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
CompareStringA
ExitProcess
GetLocaleInfoA
GetNumberFormatA
lstrcmpiA
GetProcAddress
GetDateFormatA
GetTimeFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsA
WaitForSingleObject
SetCurrentDirectoryA
Sleep
GetTempPathA
MoveFileExA
UnmapViewOfFile
GetCommandLineA
MapViewOfFile
CreateFileMappingA
GetModuleFileNameW
SetEnvironmentVariableA
OpenFileMappingA
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
IsDBCSLeadByte
GetCPInfo
FreeLibrary
LoadLibraryA
GetCurrentDirectoryA
GetFullPathNameA
SetFileAttributesW
SetFileAttributesA
GetFileAttributesW
GetFileAttributesA
WriteFile
SetLastError
GetStdHandle
ReadFile
CreateFileW
CreateFileA
GetFileType
SetEndOfFile
SetFilePointer
MoveFileA
SetFileTime
GetCurrentProcess
CloseHandle
GetLastError
DosDateTimeToFileTime

user32

ReleaseDC
GetDC
SendMessageA
wsprintfA
SetDlgItemTextA
EndDialog
DestroyIcon
SendDlgItemMessageA
GetDlgItemTextA
DialogBoxParamA
IsWindowVisible
WaitForInputIdle
GetSysColor
PostMessageA
SetMenu
SetFocus
LoadBitmapA
LoadIconA
CharToOemA
OemToCharA
GetClassNameA
CharUpperA
GetWindowRect
GetParent
MapWindowPoints
CreateWindowExA
UpdateWindow
SetWindowTextA
LoadCursorA
RegisterClassExA
SetWindowLongA
GetWindowLongA
DefWindowProcA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetClientRect
CopyRect
IsWindow
MessageBoxA
ShowWindow
GetDlgItem
EnableWindow
FindWindowExA
wvsprintfA
CharToOemBuffA
LoadStringA
SetWindowPos
GetWindowTextA
GetWindow
GetSystemMetrics
OemToCharBuffA
DestroyWindow

gdi32

GetDeviceCaps
GetObjectA
CreateCompatibleBitmap
SelectObject
StretchBlt
CreateCompatibleDC
DeleteObject
DeleteDC

comdlg32

GetSaveFileNameA
CommDlgExtendedError
GetOpenFileNameA

advapi32

LookupPrivilegeValueA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
SetFileSecurityW
SetFileSecurityA
OpenProcessToken
AdjustTokenPrivileges

shell32

ShellExecuteExA
SHFileOperationA
SHGetFileInfoA
SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA
SHChangeNotify

ole32

CreateStreamOnHGlobal
OleInitialize
CoCreateInstance
OleUninitialize
CLSIDFromString

oleaut32

VariantInit

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Aktivator Microsoft Office 2010/Resources/KMSKG/Keygen.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 74KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Aktivator Microsoft Office 2010/Resources/KeyCheck/Checker.exe
.exe windows:5 windows x86 arch:x86

0587b0391dc7b6d2121933502057a454

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

advapi32

RegQueryValueExW

comctl32

InitializeFlatSB

gdi32

UnrealizeObject

msimg32

GradientFill

ole32

OleUninitialize

oleaut32

SafeArrayPtrOfIndex

user32

CreateWindowExW

version

VerQueryValueW

Sections

.text
Size: 176KB - Virtual size: 588KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Aktivator Microsoft Office 2010/Resources/KeyCheck/Chk.nfo
Aktivator Microsoft Office 2010/Resources/KeyCheck/pidgenx.dll
.dll windows:6 windows x86 arch:x86

d71161d27db15d49a7084b5c1def3d20

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

18:a5:44:58:7d:ff:6a:24:f3:eb:66:04:9b:c4:e9:b3:be:5d:37:12
Signer

Actual PE Digest

18:a5:44:58:7d:ff:6a:24:f3:eb:66:04:9b:c4:e9:b3:be:5d:37:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

pidgenx.pdb

Imports

msvcrt

_purecall
_wcsicmp
_onexit
_lock
__dllonexit
memmove
memcpy
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
wcschr
_vsnwprintf
_unlock
rand
srand
time
wcsncmp
_wtoi
_wcsnicmp
_ui64tow
_itow
wcsstr
memset

kernel32

CreateFileMappingW
MapViewOfFile
CreateThread
WaitForMultipleObjects
SetThreadPriority
FreeLibraryAndExitThread
InterlockedExchangeAdd
CreateEventW
CreateSemaphoreW
SystemTimeToFileTime
SetEvent
WaitForSingleObject
GetModuleFileNameW
GetCurrentThread
GetThreadPriority
GetProcessAffinityMask
RaiseException
UnmapViewOfFile
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
VirtualFree
FileTimeToSystemTime
GetSystemDefaultLangID
GetVersionExW
LoadLibraryW
FreeLibrary
GetLocalTime
InitializeCriticalSection
IsProcessorFeaturePresent
ReleaseSemaphore
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
HeapAlloc
GetProcessHeap
HeapFree
LocalFree
CloseHandle
GetLastError
GetVersionExA
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
ReadFile
GetFileSize
CreateFileW
InterlockedDecrement
SetLastError
VirtualProtect
VirtualAlloc
GetProcAddress
GetSystemInfo
VirtualQuery
GetVersion
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount

advapi32

CryptGenKey
CryptExportKey
CryptVerifySignatureA
CryptSignHashA
CryptImportKey
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGenRandom
CryptAcquireContextW
TraceEvent
CryptReleaseContext

rpcrt4

UuidToStringW
I_RpcMapWin32Status
RpcStringFreeW
UuidFromStringW

Exports

Exports

PidGenX
PidGenX2

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Aktivator Microsoft Office 2010/Resources/KeyCheck/pkeyconfig.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/OEM_ByPass.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/OEM_ByPass.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/OEM_ByPass.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/OEM_ByPass.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusAcad_Retail.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusAcad_Retail.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusAcad_Retail.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusAcad_Retail.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusMSDN_Retail.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusMSDN_Retail.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusMSDN_Retail.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusMSDN_Retail.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusMSDN_Retail2.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusMSDN_Retail2.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusMSDN_Retail2.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlusMSDN_Retail2.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_Retail.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_Retail.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_Retail.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_Retail.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_Retail2.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_Retail2.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_Retail2.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_Retail2.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_SubPrepid.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_SubPrepid.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_SubPrepid.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_Trial.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_Trial.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/ProPlus_Trial.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/Retail/ProPlus/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/Access_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/Access_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/Access_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/Access_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/Access_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/Access_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/Access_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/Access_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/Access_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Access/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/Excel_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/Excel_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/Excel_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/Excel_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/Excel_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/Excel_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/Excel_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/Excel_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/Excel_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Excel/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/Groove_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/Groove_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/Groove_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/Groove_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/Groove_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/Groove_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/Groove_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/Groove_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/Groove_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Groove/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/InfoPath_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/InfoPath_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/InfoPath_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/InfoPath_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/InfoPath_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/InfoPath_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/InfoPath_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/InfoPath_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/InfoPath_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/InfoPath/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/OneNote_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/OneNote_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/OneNote_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/OneNote_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/OneNote_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/OneNote_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/OneNote_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/OneNote_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/OneNote_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/OneNote/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/Outlook_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/Outlook_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/Outlook_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/Outlook_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/Outlook_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/Outlook_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/Outlook_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/Outlook_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/Outlook_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Outlook/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/PowerPoint_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/PowerPoint_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/PowerPoint_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/PowerPoint_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/PowerPoint_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/PowerPoint_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/PowerPoint_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/PowerPoint_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/PowerPoint_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/PowerPoint/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlusAcad_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlusAcad_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlusAcad_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlusAcad_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlus_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlus_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlus_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlus_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlus_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlus_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlus_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlus_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/ProPlus_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProPlus/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/ProjectPro_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/ProjectPro_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/ProjectPro_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/ProjectPro_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/ProjectPro_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/ProjectPro_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/ProjectPro_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/ProjectPro_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/ProjectPro_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectPro/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_MAK2.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_MAK2.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_MAK2.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/ProjectStd_MAK2.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/ProjectStd/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/Publisher_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/Publisher_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/Publisher_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/Publisher_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/Publisher_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/Publisher_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/Publisher_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/Publisher_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/Publisher_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Publisher/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/StandardAcad_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/StandardAcad_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/StandardAcad_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/StandardAcad_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/Standard_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/Standard_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/Standard_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/Standard_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/Standard_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/Standard_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/Standard_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/Standard_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Standard/Standard_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPrem_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPrem_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPrem_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPrem_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPrem_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPrem_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPrem_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPrem_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPrem_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPro_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPro_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPro_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPro_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPro_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPro_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPro_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPro_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioPro_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioStd_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioStd_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioStd_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioStd_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioStd_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioStd_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioStd_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioStd_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Visio/VisioStd_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/Registration32.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/Registration64.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/RegistrationWOW.reg
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/Word_KMS_Client.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/Word_KMS_Client.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/Word_KMS_Client.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/Word_KMS_Client.RAC_Priv.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/Word_KMS_Client.RAC_Pub.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/Word_MAK.OOB.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/Word_MAK.PHN.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/Word_MAK.PL.xrm-ms
Aktivator Microsoft Office 2010/Resources/Licenses/VL/Word/Word_MAK.PPDLIC.xrm-ms
Aktivator Microsoft Office 2010/Resources/StartX/StartX.exe
.exe windows:4 windows x86 arch:x86

1a41022d5d59450d5d918a43779faef0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
SetErrorMode
HeapAlloc
HeapFree
HeapReAlloc
VirtualAlloc
RtlUnwind
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
ExitProcess
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sleep
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
GlobalFlags
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
GetCurrentProcessId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GetModuleHandleA
GetVersionExA
FreeResource
GetCurrentThreadId
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
SetLastError
CreateProcessA
SetProcessAffinityMask
WaitForSingleObject
GetExitCodeProcess
CloseHandle
FormatMessageA
LocalFree
LoadLibraryA
GetProcAddress
FreeLibrary
FindResourceA
LoadResource
LockResource
SizeofResource
lstrlenA
CompareStringA
GetModuleFileNameA
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
UnhandledExceptionFilter
InterlockedExchange

user32

ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
LoadCursorA
GetDC
ReleaseDC
GetSysColorBrush
SetCursor
PostQuitMessage
GetWindowThreadProcessId
ShowWindow
SetWindowTextA
IsDialogMessageA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
BeginPaint
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetClientRect
GetMenu
PostMessageA
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
EnableWindow
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
UnregisterClassA
DestroyMenu
EndPaint
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
SendMessageA
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
GetDesktopWindow
SetActiveWindow
GetSystemMetrics
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
SetWindowsHookExA

gdi32

SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
DeleteObject
SetMapMode
RestoreDC
SaveDC
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey

shell32

ShellExecuteA

shlwapi

PathFindExtensionA
PathFindFileNameA

oleaut32

VariantClear
VariantChangeType
VariantInit

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Aktivator Microsoft Office 2010/Resources/Token/tokens.exe
.exe windows:5 windows x86 arch:x86

9402b48d966c911f0785b076b349b5ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

Imports

comctl32

ord17

kernel32

DeleteFileA
DeleteFileW
CreateDirectoryA
CreateDirectoryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GlobalAlloc
lstrlenA
GetModuleFileNameA
FindResourceA
GetModuleHandleA
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
CompareStringA
ExitProcess
GetLocaleInfoA
GetNumberFormatA
lstrcmpiA
GetProcAddress
GetDateFormatA
GetTimeFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsA
WaitForSingleObject
SetCurrentDirectoryA
Sleep
GetTempPathA
MoveFileExA
UnmapViewOfFile
GetCommandLineA
MapViewOfFile
CreateFileMappingA
GetModuleFileNameW
SetEnvironmentVariableA
OpenFileMappingA
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
IsDBCSLeadByte
GetCPInfo
FreeLibrary
LoadLibraryA
GetCurrentDirectoryA
GetFullPathNameA
SetFileAttributesW
SetFileAttributesA
GetFileAttributesW
GetFileAttributesA
WriteFile
SetLastError
GetStdHandle
ReadFile
CreateFileW
CreateFileA
GetFileType
SetEndOfFile
SetFilePointer
MoveFileA
SetFileTime
GetCurrentProcess
CloseHandle
GetLastError
DosDateTimeToFileTime

user32

ReleaseDC
GetDC
SendMessageA
wsprintfA
SetDlgItemTextA
EndDialog
DestroyIcon
SendDlgItemMessageA
GetDlgItemTextA
DialogBoxParamA
IsWindowVisible
WaitForInputIdle
GetSysColor
PostMessageA
SetMenu
SetFocus
LoadBitmapA
LoadIconA
CharToOemA
OemToCharA
GetClassNameA
CharUpperA
GetWindowRect
GetParent
MapWindowPoints
CreateWindowExA
UpdateWindow
SetWindowTextA
LoadCursorA
RegisterClassExA
SetWindowLongA
GetWindowLongA
DefWindowProcA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetClientRect
CopyRect
IsWindow
MessageBoxA
ShowWindow
GetDlgItem
EnableWindow
FindWindowExA
wvsprintfA
CharToOemBuffA
LoadStringA
SetWindowPos
GetWindowTextA
GetWindow
GetSystemMetrics
OemToCharBuffA
DestroyWindow

gdi32

GetDeviceCaps
GetObjectA
CreateCompatibleBitmap
SelectObject
StretchBlt
CreateCompatibleDC
DeleteObject
DeleteDC

comdlg32

GetSaveFileNameA
CommDlgExtendedError
GetOpenFileNameA

advapi32

LookupPrivilegeValueA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
SetFileSecurityW
SetFileSecurityA
OpenProcessToken
AdjustTokenPrivileges

shell32

ShellExecuteExA
SHFileOperationA
SHGetFileInfoA
SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA
SHChangeNotify

ole32

CreateStreamOnHGlobal
OleInitialize
CoCreateInstance
OleUninitialize
CLSIDFromString

oleaut32

VariantInit

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Aktivator Microsoft Office 2010/Whats New.txt

Sharing

General

Malware Config

Signatures

Files

1d43cd5e399f31c49a6f934c29809b5a

Headers

File Characteristics

Imports

kernel32

oleaut32

advapi32

user32

Sections

.text Size: 58KB - Virtual size: 168KB

.rsrc Size: 15KB - Virtual size: 16KB

9402b48d966c911f0785b076b349b5ef

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 66KB - Virtual size: 65KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 47KB

.CRT Size: 512B - Virtual size: 16B

.rsrc Size: 20KB - Virtual size: 20KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 80KB

UPX1 Size: 74KB - Virtual size: 76KB

UPX2 Size: 512B - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 96KB - Virtual size: 93KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 40KB - Virtual size: 43KB

0587b0391dc7b6d2121933502057a454

Headers

File Characteristics

Imports

kernel32

advapi32

comctl32

gdi32

msimg32

ole32

oleaut32

user32

version

Sections

.text Size: 176KB - Virtual size: 588KB

.rsrc Size: 17KB - Virtual size: 20KB

d71161d27db15d49a7084b5c1def3d20

Code Sign

61:05:f7:1e:00:00:00:00:00:32Certificate

Extended Key Usages

Key Usages

61:16:b5:29:00:00:00:00:00:10Certificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:15:08:27:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

18:a5:44:58:7d:ff:6a:24:f3:eb:66:04:9b:c4:e9:b3:be:5d:37:12Signer

.text
Size: 58KB - Virtual size: 168KB

.rsrc
Size: 15KB - Virtual size: 16KB

.text
Size: 66KB - Virtual size: 65KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 47KB

.CRT
Size: 512B - Virtual size: 16B

.rsrc
Size: 20KB - Virtual size: 20KB

UPX0
Size: - Virtual size: 80KB

UPX1
Size: 74KB - Virtual size: 76KB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 96KB - Virtual size: 93KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 40KB - Virtual size: 43KB

.text
Size: 176KB - Virtual size: 588KB

.rsrc
Size: 17KB - Virtual size: 20KB

61:05:f7:1e:00:00:00:00:00:32
Certificate

61:16:b5:29:00:00:00:00:00:10
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:15:08:27:00:00:00:00:00:0c
Certificate

18:a5:44:58:7d:ff:6a:24:f3:eb:66:04:9b:c4:e9:b3:be:5d:37:12
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 158KB - Virtual size: 157KB

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 25KB - Virtual size: 25KB

.text
Size: 140KB - Virtual size: 139KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 36KB - Virtual size: 35KB

.text
Size: 66KB - Virtual size: 65KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 47KB

.CRT
Size: 512B - Virtual size: 16B

.rsrc
Size: 16KB - Virtual size: 15KB