home

sqlexpr_x64_enu.exe

Microsoft SQL Server 2012 Express Edition

Microsoft Corporation

This is a setup program which is used to install the application. This is installed with Microsoft Lync Server 2013, Bootstrapper Prerequisites Installer Package. The file has been seen being downloaded from www.confmonit.com and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft SQL Server 2012 Express Edition

Version:
11.0.2100.60

MD5:
9437810c7090fcfdb0801f24963d814c

SHA-1:
e4561d5caa761a5d1daa0d305f4fecedc6a0d39c

SHA-256:
7f5e3d40b85fba2da5093e3621435c209c4ac90d34219bab8878e93a787cf29f

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/20/2024 3:03:54 AM UTC  (today)

File size:
132.3 MB (138,757,208 bytes)

Product version:
11.0.2100.60

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
SFXCAB.EXE

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\microsoft team foundation server 11.0\tools\sqlexpr_x64_enu.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
11/2/2011 5:39:17 AM

Valid to:
2/2/2013 5:49:17 AM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
611AF5EA00000000006A

File PE Metadata
Compilation timestamp:
6/28/2005 11:55:01 PM

OS version:
5.2

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
3145728:ktlvaVpEbkPhDFaKpqaZXrqdIPBetecRusVBKu2rafsJJ5:kHSXPphtpfq+Je8cR2F5J5

Entry address:
0x5A45

Entry point:
E9, 13, FA, FF, FF, 8B, 44, 24, 04, EB, 17, 80, F9, 3B, 75, 0C, 84, C9, 74, 14, 40, 8A, 08, 80, F9, 0A, 75, F4, 80, 38, 20, 7F, 09, 40, 8A, 08, 84, C9, 75, E3, 33, C0, C2, 04, 00, 8B, 4C, 24, 04, EB, 05, 84, C0, 74, 11, 41, 8A, 01, 3C, 0A, 75, F5, 41, 51, E8, C0, FF, FF, FF, C2, 04, 00, 33, C0, EB, F9, 53, 8B, 5C, 24, 0C, 56, 8B, 74, 24, 0C, 57, C6, 03, 00, EB, 0C, 56, E8, CB, FF, FF, FF, 8B, F0, 85, F6, 74, 2D, 80, 3E, 5B, 75, EF, 8D, 46, 01, EB, 0A, 84, C9, 74, 1F, 80, F9, 20, 7E, 0A, 40, 8A, 08, 80, F9...
 
[+]

Packer / compiler:
tElock 0.99 - 1.0 private

Code size:
30.5 KB (31,232 bytes)

The file sqlexpr_x64_enu.exe has been discovered within the following program.

Microsoft Lync Server 2013, Bootstrapper Prerequisites Installer Package  by Microsoft Corporation
www.microsoft.com
8% remove it
 
Powered by Should I Remove It?

The file sqlexpr_x64_enu.exe has been seen being distributed by the following 16 URLs.

http://www.confmonit.com/.../SQLEXPR_x64_ENU.exe

http://www.mymarketron.com/.../Download.aspx?fileID=768&fileType=0

ftp://ftpclient.mobileye.com/AWS/technical_files/AWS Setup Wizard/.../SQLEXPR_x64_ENU.exe

http://www.dasl.pl/download/.../SQL2012_x64.exe

http://software-files-a.cnet.com/s/software/11/90/83/.../SQLEXPR_x64_ENU.exe

https://www.dropbox.com/s/.../SQLEXPR_x64_ENU.exe

http://www.grupomodulos.com.br/painel/grupos/.../2012_SQLEXPR_x64_ENU.exe

https://download.microsoft.com/download/0/4/B/.../SQLEXPR_x64_ENU.exe

ftp://programas.mnprogram.net/soportemn/24 SQL SERVER/SQL_SERVER_INSTALADORES_SOPORTE/.../SQLEXPR_x64_ENU (2012_inglés_para_64_bits).exe

https://download.microsoft.com/download/c/2/8/.../SQLEXPR_x64_ENU.exe

http://care.dlservice.microsoft.com//dl/download/8/D/D/8DD7BDBA-CEF7-4D8E-8C16-D9F69527F909/ENU/.../SQLEXPR_x64_ENU.exe

https://download.microsoft.com/download/0/1/E/.../SQLEXPR_x64_ENU.exe

http://www.almsysinc.com/soft/files/.../SQLEXPR_x64_ENU_2012.exe

https://download.microsoft.com/download/E/A/E/EAE6F7FC-767A-4038-A954-49B8B05D04EB/.../SQLEXPR_x64_ENU.exe

https://download.microsoft.com/download/8/D/D/8DD7BDBA-CEF7-4D8E-8C16-D9F69527F909/ENU/.../SQLEXPR_x64_ENU.exe

http://download.microsoft.com/download/8/D/D/8DD7BDBA-CEF7-4D8E-8C16-D9F69527F909/ENU/.../SQLEXPR_x64_ENU.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.