home

oawTray.exe

officeatwork System Tray

officeatwork Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘officeatwork’.
Publisher:
officeatwork AG  (signed by officeatwork Ltd.)

Product:
officeatwork System Tray

Version:
4.00.1325

MD5:
0872a0f62885790b31672b4b5add76d9

SHA-1:
94806e1a5f77994c042ff096719d1f7d53be25cb

SHA-256:
4f50774bded0fab8ace5c83ff1cb1284b931f3331fd0f193092e99ac82269e66

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/4/2024 10:27:41 PM UTC  (today)

File size:
149.4 KB (152,960 bytes)

Product version:
4.00.1325

Copyright:
© 1999 - 2012 officeatwork AG

Trademarks:
All rights reserved.

Original file name:
oawTray.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\officeatwork\common\oawtray.exe

Digital Signature
Signed by:
officeatwork Ltd.

Authority:
VeriSign, Inc.

Valid from:
1/4/2010 1:00:00 AM

Valid to:
1/5/2013 12:59:59 AM

Subject:
CN=officeatwork Ltd., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=officeatwork Ltd., L=Zug, S=Zug, C=CH

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0D223A63164EE9D8C04D5BC2412F5C5B

File PE Metadata
Compilation timestamp:
7/4/2012 11:35:23 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:QttY9CBDEWvhvonPim3C63j0sSQpgucsL7fL:QU9F9C6z3SQpgucsvfL

Entry address:
0x229C

Entry point:
68, 60, 24, 40, 00, E8, F0, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 58, 00, 00, 00, 38, 00, 00, 00, 9F, 43, 09, 38, D6, 35, 4B, 44, BF, A3, FA, 50, 8E, 44, 97, 1E, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 3D, 20, 20, 20, 36, 31, 6F, 61, 77, 54, 72, 61, 79, 00, 6F, 66, 66, 69, 63, 65, 61, 74, 77, 6F, 72, 6B, 20, 53, 79, 73, 74, 65, 6D, 20, 54, 72, 61, 79, 00, 20, 20, 20, 20, 20, 20, 54, 00, 00, 00, 00, 01, 00, 05, 00, 9C, 3D, 40, 00, 00, 00, 00, 00, FF, FF, FF, FF, FF, FF, FF, FF, 00, 00, 00, 00...
 
[+]

Entropy:
5.7917

Developed / compiled with:
Microsoft Visual Basic v5.0/v6.0

Code size:
128 KB (131,072 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
officeatwork

Command:
C:\Program Files\officeatwork\common\oawtray.exe


Scan oawTray.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.