home

setupproplusretail.x86.en-us.exe

Microsoft Office 2016

Microsoft Corporation

Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft Office 2016

Description:
Microsoft Office

Version:
16.0.6701.1013

MD5:
42c49b59a7f9583721c3b003354ccac7

SHA-1:
ef646291a7766ef8e2e8e7679887d927fbb2dfe5

SHA-256:
d313fa8c77c832b54f476c45c3feef5e2fa445b738526950f04473f1f1cd6ecd

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/25/2024 2:59:18 AM UTC  (today)

File size:
3.1 MB (3,286,208 bytes)

Product version:
16.0.6701.1013

Original file name:
Bootstrapper.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\setupproplusretail.x86.en-us.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
6/5/2015 3:12:45 AM

Valid to:
9/5/2016 3:12:45 AM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
330000010A2C79AED7797BA6AC00010000010A

File PE Metadata
Compilation timestamp:
3/20/2016 1:07:22 AM

OS version:
5.2

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
14.0

CTPH (ssdeep):
49152:zJrrUeImRFnYlkIEr0I6RA5ODUKsmLeRgyQg3qJTX333yjwYWlkssvNEBArud:ZUeJrnYler0XRAs4KzeRg5awY2ssd

Entry address:
0x112EEC

Entry point:
E8, B5, 12, 00, 00, E9, 80, FE, FF, FF, 55, 8B, EC, 8B, 45, 08, 56, 8B, 48, 3C, 03, C8, 0F, B7, 41, 14, 8D, 51, 18, 03, D0, 0F, B7, 41, 06, 6B, F0, 28, 03, F2, 3B, D6, 74, 19, 8B, 4D, 0C, 3B, 4A, 0C, 72, 0A, 8B, 42, 08, 03, 42, 0C, 3B, C8, 72, 0C, 83, C2, 28, 3B, D6, 75, EA, 33, C0, 5E, 5D, C3, 8B, C2, EB, F9, E8, F7, 16, 00, 00, 85, C0, 75, 03, 32, C0, C3, 64, A1, 18, 00, 00, 00, 56, BE, 80, EB, 66, 00, 8B, 50, 04, EB, 04, 3B, D0, 74, 10, 33, C0, 8B, CA, F0, 0F, B1, 0E, 85, C0, 75, F0, 32, C0, 5E, C3, B0...
 
[+]

Entropy:
6.5654

Code size:
1.5 MB (1,619,968 bytes)

The file setupproplusretail.x86.en-us.exe has been seen being distributed by the following 48 URLs.

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-GB&id=g506f64303932h37e3927c2e2f409d9c804e1256382a75&receipt_id=552520505&dname=O16.download.name.32

https://c2rsetup.officeapps.live.com/.../download.aspx?act=1&TaxRegion=PR&&Language=en-us&Platform=x86&ProductreleaseID=ProPlusRetail&version=O16GA&Source=O16VLAP&token=CXJ9N-V6YBX-3R46M-JG776-D3W3V

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303235h5d540b4abd804946a43ea3a556eb76d1&receipt_id=845006056&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303235h417d3cbebe924d1db4abd0143da5e0c0&receipt_id=845010590&local_only=true&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303931h013ea70d77da41b3b67496e05f118dff&receipt_id=477816003&local_only=true&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303235hae0e6575385648988b086956b8aecb4d&receipt_id=845008004&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-GB&id=g506f64303931h07b6b16827224d59995bf008e3627b9b&receipt_id=477770277&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303234h1b88e98b10bd4436a2b49541271a28fe&receipt_id=865892195&local_only=true&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303235h42907983d42d4c039d1364dd99ad2c47&receipt_id=845028778&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-GB&id=g506f64303234h447df4eb51474b7ab66b236777d81d4c&receipt_id=865824624&dname=O16.download.name.32

https://c2rsetup.officeapps.live.com/.../download.aspx?ProductreleaseID=ProPlusRetail&language=en-US&platform=X86&token=XQNVK-8JYDB-WJ9W3-YJ8YR-WFG99&version=O16GA&act=1

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303235h32c5bf9ad4fa45faa5055fd9686cc20e&receipt_id=845022062&local_only=true&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303235hb5676b97e0df4d4c8d4bc6c514ce5a34&receipt_id=844834445&dname=O16.download.name.32

https://c2rsetup.officeapps.live.com/.../download.aspx?act=1&TaxRegion=PR&&Language=en-us&Platform=x86&ProductreleaseID=ProPlusRetail&version=O16GA&Source=O16VLAP&token=CJBBN-HQDD3-7HF7B-KWTKQ-GF4HH

https://onedrive.live.com/download.aspx?cid=FC5991AA21BB689A&resid=FC5991AA21BB689A!658&canary=ZaszsDea4vIBgHvTTfDK96mzXtdqqAeipWped5uNYSc=0&ithint=.exe

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303234h6e6c1dd6748647059de50b7f88aaafec&receipt_id=865881304&local_only=true&dname=O16.download.name.32

https://c2rsetup.officeapps.live.com/.../download.aspx?act=1&TaxRegion=PR&&Language=en-us&Platform=x86&ProductreleaseID=ProPlusRetail&version=O16GA&Source=O16VLAP&token=3NG7B-QFKQT-8DCJ7-DHJXG-H8RHH

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-CA&id=g506f64303235h1be6a90f6a3541dfafc488d976ae7431&receipt_id=845020041&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303235h0ec50ec9177b4b94b860f19ab736e891&receipt_id=845029705&local_only=true&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303234he53db038b1694f93bebdc88426648579&receipt_id=865828871&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303234h9c0ec610b9444d3795acc3ad10fbce19&receipt_id=865857561&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303234he571511a98ef488e819937e5cbba714a&receipt_id=865879702&dname=O16.download.name.32

https://c2rsetup.officeapps.live.com/.../download.aspx?act=1&TaxRegion=PR&&Language=en-us&Platform=x86&ProductreleaseID=ProPlusRetail&version=O16GA&Source=O16VLAP&token=NVGXP-477BR-R98JB-QGWH8-DGPQV

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303235h42a601b64a474cf3b4709ee8e7b8012c&receipt_id=845017571&local_only=true&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-CA&id=g506f64303234h3b67a12ab8a74dfab2f4d131003c3aa6&receipt_id=865670918&dname=O16.download.name.32

https://c2rsetup.officeapps.live.com/.../download.aspx?TaxRegion=PR&platform=x86&ProductreleaseID=ProPlusRetail&version=O16GA&Source=O16HUP&act=1&language=en-US&token=R94N4-BC7DY-C4GWM-237YH-4C2QV

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303235h2542201be8134f92a6692e18ed1b5e1a&receipt_id=845004957&local_only=true&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303235h09cb777320c94bc9b94218e8e52d7db8&receipt_id=844766183&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-US&id=g506f64303235hf015210d9c044f2cbd32572185e99411&receipt_id=845033027&local_only=true&dname=O16.download.name.32

http://www.microsofthup.com/.../unitdownloader.aspx?culture=en-GB&id=g506f64303932hf8f4e093b3fa4213a616b67826dc1dd5&receipt_id=552518314&dname=O16.download.name.32

Latest 30 of 48 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.