home

wlsetup-web.exe

Windows Live

Microsoft Corporation

This is a self-extracting archive and installer. The file has been seen being downloaded from download.microsoft.com and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Windows Live

Description:
Windows Live Installer

Version:
15.4.3555.0308

MD5:
157e07c74f1b5c70a24f284340d6b9a0

SHA-1:
3841a1a8613b3f7cebb9233f955bd66c9cf6cdc4

SHA-256:
68da11fda9bb67b1115342403c9657afbf6f46268997bcee84328ae442951621

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
4/25/2024 9:00:24 PM UTC  (today)

File size:
1.2 MB (1,291,112 bytes)

Product version:
15.4.3555.0308

Copyright:
© Microsoft Corporation. Tutti i diritti riservati.

Original file name:
wlsres.dll.mui

File type:
Executable application (Win32 EXE)

Language:
Italian (Italy)

Common path:
C:\users\{user}\downloads\wlsetup-web.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
2/21/2011 9:53:12 PM

Valid to:
5/21/2012 10:53:12 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
6101B29B000000000015

File PE Metadata
Compilation timestamp:
3/9/2012 3:14:00 AM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:7wa2WRC3X9ovTzB4uOG6A4Sgt8G0+j4OHISDWhb5IsEX0crGz9:8Q8X9Szd76A4S68o31DcmXrGR

Entry address:
0x34ED9

Entry point:
E8, 4A, 38, 00, 00, E9, 74, FE, FF, FF, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 5D, E9, 5E, 03, 00, 00, CC, CC, CC, CC, CC, 8B, FF, 51, C7, 01, 28, 4F, 40, 00, E8, BD, 38, 00, 00, 59, C3, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 56, 8B, F1, E8, DE, FF, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, C2, FF, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 8B, 45, 08, 83, C1, 09, 51, 83, C0, 09, 50, E8, F8, 38, 00, 00, F7, D8, 59, 1B, C0, 59, 40, 5D, C2, 04, 00, CC, CC, CC, CC, CC, 8B...
 
[+]

Code size:
923 KB (945,152 bytes)

The file wlsetup-web.exe has been seen being distributed by the following 15 URLs.

https://download.microsoft.com/download/B/2/5/.../wlsetup-web.exe

http://gsf-cf.softonic.com/384/1a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=94627&instance=softonic_it&type=PROGRAM&Expires=1460177026&Signature=B8WNiILWuBjWAE46C0ruJvOACLdYTUt6cWTbqbdPN6Pc5dVQwFSuZlPRMXp651b60W3aQ1RssAL3iZwVXReg-dT1NLyx8wRBv63CEhAq7nIjvvYj05tuyTSRo6eMRrTreXrs5Bo5jIDyEcVR1JhF668qT2P1cyhp~qoiBw6xGyo_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=wlsetup-web-2011.exe

http://download.microsoft.com/download/C/4/1/.../wlsetup-web.exe

http://g.live.com/1rewlive4-web/.../wlsetup-web.exe

http://gsf-cf.softonic.com/384/1a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=94627&instance=softonic_it&type=PROGRAM&Expires=1459248459&Signature=Q2ximopjwG1jD8hTnc8Y4JkpNvjIz-vTsL0ZAjusH0oPW-9JZPQ-GZ4ewgchkB1R-X9-VknKf6RwFklu7Nbu~UV502sBIza0cCy8u3Y9XkWJmY6bddrW2BGtjDHOCmDnEwuwJ9jD31VEcF6W9Z1FhxJ-tFZDemgMEVll5MsMi90_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=wlsetup-web-2011.exe

https://download.microsoft.com/download/3/D/3/.../wlsetup-web.exe

http://gsf-cf.softonic.com/384/1a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=94627&instance=softonic_it&type=PROGRAM&Expires=1440404605&Signature=av2wWKE0hm6BoMHnY6guDDDhteqLtlcxZyWukqjpv5e7yGH9fmRoAyhYxbjBkB-S9V4khr0XqxxxbYeBoGDzPmMn-qahGnJ7nCIlQRQqdP0HOHlbMC~70W1QFHT5y6LK96I86huCM0XZRSba7~4KdO4R~7nLVhX233TzlxPrHOE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=wlsetup-web-2011.exe

http://gsf-cf.softonic.com/384/1a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=94627&instance=softonic_it&type=PROGRAM&Expires=1440101951&Signature=YMXoqSGETkCCVbEzScNuQpCOQEtPT0FT4Zvc91N2KHeXjO2l1jXdqjAS7vr5BYd4kyLHOPrxxT68hbGPuuxYmOldlSfohTz5MAjhFHryaPUbbE74dDuiIng~OeHwkv~79Uba1gEURp2XtPVXpVYs~vhiiPIgcvEPEQNSTpHprs4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=wlsetup-web-2011.exe

http://gsf-cf.softonic.com/384/1a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=94627&instance=softonic_it&type=PROGRAM&Expires=1462792604&Signature=JvN0b-RfHvDbZ9XkRFVHSPkNzsZLaMrHjOERqHWwJJzBwE44LLGpmhu14xN1y7Ov2y9BbDu5cE~yVdW-Ubd36~Y8Aq~hMkTK6O9zKcKb7HPUnm6TaO6nr2Z1X-xazbTnKzZlptBN~y8ggFJJawpmXruy69DGRSu1KfaMBPsCM4o_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=wlsetup-web-2011.exe

http://gsf-cf.softonic.com/384/1a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=94627&instance=softonic_it&type=PROGRAM&Expires=1441422252&Signature=BovrR0aky2kyfKU-GCewfvWQRnEPa-lFMleFCITHlvvfdy8qRb1NTLg8njNIfzZQSe5QB1hv7x27rGzl9yo8HZ4hytb6ZNeUHTZ~1xGGBi6wwmFZxpfLBoaapxvkDLSi6Gck~ABguoFDSC0FNZObdN1hhdYAdN-EzjuZjgNvncU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=wlsetup-web-2011.exe

http://gsf-cf.softonic.com/384/1a1/.../file?SD_used=0&channel=WEB&fdh=no&id_file=94627&instance=softonic_it&type=PROGRAM&Expires=1459058749&Signature=H1N2xq2DOE4cUlko~~K5vHrv7AvR2DzshuG-U70zRRQynY~VwMMj9t9kZnyvcWCp-gvY2fqRomsSQ0fdrZbLpDCgfysLQyrTpxS~Z5HSSr8PBJh4uE3Pr4xsHNpfz9EN6nXmrjpv80dcE8ABRZZNY83IbonerR8qtKap-Y5f81k_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=wlsetup-web-2011.exe

http://server3.xnavigation.net/dl/MJG4C/1243/11940/it/.../windows-live-messenger

http://go.microsoft.com/.../?LinkID=255474

http://download.microsoft.com/download/B/2/5/.../wlsetup-web.exe

http://wl.dlservice.microsoft.com/download/C/4/1/C416580D-A4B7-4D3B-B94C-46A757C9963C/.../wlsetup-web.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.