home

windows6.1-kb972813-x64-en-us_483a3e51038f1a369bc5b5cdf5fc32df3ea4ad27.exe

Language Pack Installer

Microsoft Corporation

This is a self-extracting archive and installer. The file has been seen being downloaded from s4.dosya.tc and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft® Windows® Operating System

Description:
Language Pack Installer

Version:
6.1.7234.0 (winmain_wtr_w7lp(wmbla).090720-1345)

MD5:
622c33290853deef3dbaefc6ef5a160f

SHA-1:
483a3e51038f1a369bc5b5cdf5fc32df3ea4ad27

SHA-256:
9f70252173285496da66bfbdf52cd733fe78f55799e48d0799b7db1c8f006bb6

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/19/2024 6:20:38 AM UTC  (today)

File size:
154.8 MB (162,275,112 bytes)

Product version:
6.1.7234.0

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
Windows6.1-KB972813-x64-en-US.exe

File type:
Executable application (Win64 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\windows6.1-kb972813-x64-en-us_483a3e51038f1a369bc5b5cdf5fc32df3ea4ad27.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
10/23/2008 1:41:38 AM

Valid to:
1/23/2010 1:51:38 AM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
61044C4B000000000024

File PE Metadata
Compilation timestamp:
7/20/2009 11:47:48 PM

OS version:
6.1

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3145728:tyCAWjvjsUWAXNCm0aTWt4Rn1n0zxkjL5yFy1PCxqhCN:tySjCOMQn10VODPCxqhi

Entry address:
0x1BE8

Entry point:
48, 83, EC, 28, E8, 7F, 02, 00, 00, 48, 83, C4, 28, E9, D2, FC, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 66, 66, 0F, 1F, 84, 00, 00, 00, 00, 00, 48, 3B, 0D, F9, 14, 00, 00, 75, 12, 48, C1, C1, 10, 66, F7, C1, FF, FF, 75, 03, C2, 00, 00, 48, C1, C9, 10, E9, FC, 02, 00, 00, CC, CC, CC, CC, CC, CC, FF, 25, 44, F5, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, 48, 83, EC, 28, 48, 8B, 01, 81, 38, 63, 73, 6D, E0, 75, 2C, 83, 78, 18, 04, 75, 26, 8B, 40, 20, 3D, 20, 05, 93, 19, 74, 15, 3D, 21, 05, 93, 19...
 
[+]

Entropy:
7.9991  (probably packed)

Code size:
6.5 KB (6,656 bytes)

The file windows6.1-kb972813-x64-en-us_483a3e51038f1a369bc5b5cdf5fc32df3ea4ad27.exe has been seen being distributed by the following 7 URLs.

http://s4.dosya.tc/en2.php?a=server3/.../_483a3e51038f1a369bc5b5cdf5fc32df3ea4ad27.exe&b=e46a8688391f3a9ccdc1252f0ca69e33

http://113.171.224.13/msupdate-hijack/update/software/updt/2009/.../windows6.1-kb972813-x64-en-us_483a3e51038f1a369bc5b5cdf5fc32df3ea4ad27.exe

http://jump.bdimg.com/safecheck/index?url=x Z5mMbGPAs0fPjV59o0dOMYbmePpOX2QEFfGjxir72zBMEh40nYNoH7YvaYPb3 HCaaiSE4ZDvPKZSl8MNFr04ThkIfCT3BlUsk4W8D1lDpqYqVkJLnuIdFgAd5xnE9oNnE Gbg n2p7VNxcAjqUzgWfKfM4Dn2Rrhh6uenVGbFdgIVMIWEeCUoX88DLZ R1Y4gEOk0kegzWZ 9u2V19iRaTGAFqIEIdQWhl1Lp0SoPAvRZuaepnv2vf/.../Yos0pAyqoq4osVE2fI3TSplW6JbjzwCqMdMVgNU2iqzA8Zu4mdgY0

https://realityripple.com/Repair/.../lp.php

http://www.520xiazai.com/.../?phome=DownSoft&softid=731&pathid=1&pass=e5d7477e65aff0a742b2edac9557a5ec&p=:::

https://api.viglink.com/api/click?format=go&jsonp=vglnk_146268913862911&key=15298ddd4712283d05c56b50be83b2c8&libId=iny7b3i7010107v7000DAep2mu464&loc=https://tinhte.vn/threads/chuyen-doi-ngon-ngu-tren-windown-7.1211959/&v=1&out=http://download.windowsupdate.com/msdownload/update/software/updt/2009/08/windows6.1-kb972813-x64-en-us_483a3e51038f1a369bc5b5cdf5fc32df3ea4ad27.exe&ref=https://www.google.com.vn/&title=TH? THU?T - Chuy?n d?i ngôn ng? trên windown 7 | Tinhte.vn&txt=<span style="color: #1a8bad">http://download.windowsupdate.com/.../span>

http://download.windowsupdate.com/msdownload/update/software/updt/2009/.../windows6.1-kb972813-x64-en-us_483a3e51038f1a369bc5b5cdf5fc32df3ea4ad27.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.