home

eie11_en-us_wol_win764.exe

EIE11_EN-US_WOL_WIN764.EXE

Microsoft Corporation

This is a setup program which is used to install the application. The file has been seen being downloaded from www.flashlaboratoryapp.com and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
EIE11_EN-US_WOL_WIN764.EXE

Version:
11.0.0.6

MD5:
7dd651b163c00765521962e04417729c

SHA-1:
4bacb9255d9cafddc1bb09de50636225c8d4db85

SHA-256:
9a5975ed6df9dc155002480ef96f46260543d7180fca6770742c91ec60a703bf

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
11/27/2024 5:48:17 AM UTC  (today)

File size:
55.4 MB (58,130,592 bytes)

Product version:
11.0.0.6

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
WEXTRACT.EXE .MUI

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\eie11_en-us_wol_win764.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
4/22/2014 1:39:00 PM

Valid to:
7/22/2015 1:39:00 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
33000000CA6CD5321235C4E1550001000000CA

File PE Metadata
Compilation timestamp:
7/13/2009 7:42:43 PM

OS version:
6.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
1572864:Nwp/tZQbIHR7okazaupdqEQyQIu6uLWNxEecjkMdOEx:yp/tZll/1uru6uL6KehMYa

Entry address:
0x6AF8

Entry point:
E8, 1C, 06, 00, 00, E9, 4D, FD, FF, FF, CC, CC, CC, CC, CC, 3B, 0D, C4, C2, 00, 01, 75, 03, C2, 00, 00, E9, 98, 06, 00, 00, CC, CC, CC, CC, CC, FF, 25, 74, 12, 00, 01, CC, CC, CC, CC, CC, CC, FF, 25, 70, 12, 00, 01, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 51, 8D, 4C, 24, 04, 2B, C8, 1B, C0, F7, D0, 23, C8, 8B, C4, 25, 00, F0, FF, FF, 3B, C8, 72, 0A, 8B, C1, 59, 94, 8B, 00, 89, 04, 24, C3, 2D, 00, 10, 00, 00, 85, 00, EB, E9, CC, CC, CC, CC, CC, 53, 56, 57, 8B, 54, 24, 10, 8B...
 
[+]

Entropy:
7.9998  (probably packed)

Code size:
43 KB (44,032 bytes)

The file eie11_en-us_wol_win764.exe has been seen being distributed by the following 21 URLs.

http://www.flashlaboratoryapp.com/c?x=OUk3Vd2PM9WcMfaGzJ6FNbQ BCkG3QzxJDBckWRcvNM=&c=TG7Wm/JiGnk4bbaanb2fLQxYhmMeL5hPvLSPeosDm2/59H1jnP5/2rjD6gmoY Jn1Q4jNCRNOJ7U4pUy/KO1GNrCSqSAwnrmIBU8SJgZ2ODmRh8MLk/hxkBJQdd26H1eE41ANZDKGUr/TI8Iw4zobesa0 CVCUCdPLkMflQ2zN0=&e=0&downloadAs=Internet Explorer Setup.exe&fallback_url=http://cdn.downtoad.com/.../internetexplorer.exe

http://www.packagequicksafe.com/c?x=n G8aqOkxkT7V2dHEA6ZE0D3fgB8TJJshRFDpNjrT6g=&c=FDX5Q1uwmtG0IceVmug fw4ygM5AnW6oF6q2ZH/24olFzXvd359UfVM9WG Xiyj6wLyulVU1KoQdrF ILL//59Gr6BYjrKiYD4 1cfBf6fWILKCdwVuJWB/FCHjwyoizlrnG485E2n 0D7ILDgh1wpFuvLZWUI5qit0mcgn9zzU=&e=0&downloadAs=Internet Explorer Setup.exe&fallback_url=http://cdn.downtoad.com/.../internetexplorer.exe

http://www.flashlaboratoryapp.com/WVl6OTRQVkpvZDBoNE9VSnFOM05XUjAxc09EUk1kVWhGZHlVeVFrMGxNa0owZWpZM2JFRkNjRkkwWVRGNFlXVkpNRWd3SlRORUptTTlSR0ZGU21sd1dEZENXSFJ3SlRKQ1kxZ3lXRkl4VEhwbVUydFphbWRTZFd0aEpUSkdhV1ZvVVhaRlJsUjVia3czTUdaQ01FZGxOQ1V5Um1odWRHd2xNa1pKWmtRM2JrcEViemxFUTFOM05EUlRKVEpDVDJrMVQxQXphRXhtWkdwMmNsUjRPR2xVUTJOTVkwbFZiRTV2Y2pSSlUyTXdZMUpIVG5SQ2NUVTVaWGR6VFVnM1NIVWxNa0puYldnbVpHOTNibXh2WVdSQmN6MUpiblJsY201bGRDdEZlSEJzYjNKbGNpdFRaWFIxY0M1bGVHVW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWmpaRzR1Wkc5M2JuUnZZV1F1WTI5dEpUSkdNV1J2ZDI1c2IyRmtabWxzWlhNbE1rWnBiblJsY201bGRHVjRjR3h2Y21WeUxtVjRaUT09

http://www.flashlaboratoryapp.com/c?x=MVLQY7G0WXutHuX9TMCAan0wnicy2fkrAQxoANeTaBM=&c=saz1l48PGtNHWBbDY s8EIJt50DRVBibarm0R0T lZso16C2THoC0CKfice6YLnCjOCEmbhchJalwZxKuKiolpj4ld12b10uNdR6RAJ6yilE6jpL2S0ROF7SbLp/LNrdjI9F/PiipHu8sWTeGqLsf8hCYOobpVp/ZfwqcM8be5U=&e=0&downloadAs=Internet Explorer Setup.exe&fallback_url=http://cdn.downtoad.com/.../internetexplorer.exe

http://www.capitalvaultsbits.com/WVl6OTRQVTFNVlVOQlluVjNKVEpHY2xvMFVERlJNSFpPY0Vvek5UaEpUWFJEVTNrbE1rSWxNa0ozUlRCTVZFWXdPVmxKUzJzbE0wUW1ZejF4VjBzMkpUSkdaRlp2T0RKUWFUbHNlbUl4U1d4c1VUUmthRTVPUW05NlpYUkJNVVZaY1d0S05rRnBiME5IVFhVelZETldKVEpHWWxaeU4yTkVVR1V5VWxaTlZHeExPRkppVFRGT04yVklTamx4YWxacVYyeDNRM1p0TTFWRE5tMXVaRk5SVEcwNVJWbHRKVEpDYWxvNFdWbG5Za1JPZUc4emFsbE5RV3hLUVd4TWRYSnFSU1prYjNkdWJHOWhaRUZ6UFVsdWRHVnlibVYwSzBWNGNHeHZjbVZ5SzFObGRIVndMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um1Oa2JpNWtiM2R1ZEc5aFpDNWpiMjBsTWtZeFpHOTNibXh2WVdSbWFXeGxjeVV5Um1sdWRHVnlibVYwWlhod2JHOXlaWEl1WlhobA==

http://www.todaysendsoftware.com/c?x=k8V5lQK0eA7LmqIztGNoWnqu5zxHZ5O7CVpQMlroGbo=&c=FMdgHgrYq1egS3rzg5AZNRb39pjC5sGrqg4wWlUfBTCaOgJV8Em8nZuHYzmxe rz43fWywzQDDBRZ8FwwZwrdjY6ScKCFRF 3Ax3LYbziOgkh lHZm3I20iE3wpCeG96kleXL6mBvNsM9EYZkM07vrpABwkfb7n1vy0ghHNKa1w=&e=0&downloadAs=Internet Explorer Setup.exe&fallback_url=http://cdn.downtoad.com/.../internetexplorer.exe

http://www.flashlaboratoryapp.com/WVl6OTRQVlJMUmtOU2QzRlJVWFpHYlU1aVdGVlhaR0YwUTNsWGJDVXlSbEoxVVdOV1ZuRmlhVlZuYTBoVWFIcGtkeVV6UkNaalBXaDZNWFIyVUVsVFNGWkJUa2hoVFRSU1dGWktKVEpHYlV4elVuSnljalZWZVVwdFEyZEViamx3TkRoUlVWWnlUSFp5Tkc1Q2NUbG5iRWRvYWxGVFUyUkJlRkEwYjBNMlVWWXlRMWRQZW5GTFVWY3hSQ1V5UWpGbFIwSnVNR2xyYkVKcVNUVmllSFV4WmxaTVptSlVTamg0Y2tFMlkwNTNlR1V3SlRKQ1dqWklUV2szYjNNd0ptUnZkMjVzYjJGa1FYTTlTVzUwWlhKdVpYUXJSWGh3Ykc5eVpYSXJVMlYwZFhBdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdZMlJ1TG1SdmQyNTBiMkZrTG1OdmJTVXlSakZrYjNkdWJHOWhaR1pwYkdWekpUSkdhVzUwWlhKdVpYUmxlSEJzYjNKbGNpNWxlR1U9

http://www.flashlaboratoryapp.com/c?x=okuOzvbjxCjzNgtJKhOd/9V8XNAsAVEY1/VM8AFObnE=&c=h7p5pYvp9evIHMm3RVl81a5F/4rQKmI3Kr5hwNC5nhDNIo7 pYScPq3fxpZoynbeD7EHIbeHkhH93lVn9YAqU81SZDbHHWKSsWdoBbQ0DQYkjakejrIBAugqtitWxfK6hwCbNnx/dixdSoZ85amaEoh8FibVQlvRJ3pKpu/mpO4=&e=0&downloadAs=Internet Explorer Setup.exe&fallback_url=http://cdn.downtoad.com/.../internetexplorer.exe

http://www.flashlaboratoryapp.com/c?x=qSJikaryAhSwMEu1Q6AvztazCsx6HYc8hBF4zAIr54A=&c=1ZH9EnFfaRzPhKiVXWRL3kltPXQhktDgMsXuRL9PLzbA5szVY6lj28uvN837ooMJAMR3ePtTO7h7UVaOg91oP2QCS8WoQIOjA3LL4KAffKzNN0ZMugrnv1LOvm8uS/53G0AMzzUbvXI2XO3lGdUpsFNlNbxbqSG1uB/88dCEzMg=&e=0&downloadAs=Internet Explorer Setup.exe&fallback_url=http://cdn.downtoad.com/.../internetexplorer.exe

http://www.flashlaboratoryapp.com/WVl6OTRQWGhJV1V4QmVFbENiVEo1Wkc4MGFXTlRWMnhJWnpRNGJYUjBkbmRSVlZSVE9YbHRSM1J4U2lVeVFraElVU1V6UkNaalBVWlhPRXhTVGtaQ1NtVmtXRlJYUmtobk1XVTFSVWhGVURKR1lpVXlSbEJtY25KMlRYQnNTU1V5Um1GdFpYaHdRMVZ1Ukc5V2JqSnlWVTFYZWxkd1dtbDVOMVpIVVd0YWRGaFliSHA2UTBkbEpUSkdjbWcwTTIxNU5EWnhkMUJRZUV0RE0ySm5jbkpZZUhkaE9YRkxhRlppTlVwcFVHZFlXSFo2U3pVMk5VdHFPSEVsTWtaQ1Z6UW1aRzkzYm14dllXUkJjejFKYm5SbGNtNWxkQ3RGZUhCc2IzSmxjaXRUWlhSMWNDNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1pqWkc0dVpHOTNiblJ2WVdRdVkyOXRKVEpHTVdSdmQyNXNiMkZrWm1sc1pYTWxNa1pwYm5SbGNtNWxkR1Y0Y0d4dmNtVnlMbVY0WlE9PQ==

http://www.flashlaboratoryapp.com/WVl6OTRQVkZuWWsxUE1UQnhhek53WjFGcVlVbzBjakFsTWtZMk9FWndPU1V5Um1WWmN6UnFRMlJ3TkdSQk1qTkJSRGswSlRORUptTTlUbmx6Y21ob2JucENOV2t5TlVOSk5rOVJhemdsTWtaWmVWTm1VVkYwUkUxTldFVnNWVk0yY0UxV2IzUTJSazlSZWtoTUpUSkdRVFZIVkZOelozSm9iVmRPY2tSWGJrWm9PWEV3Y0ZKRGRGcFliamhSZDJscVJFZFpRemxZVTFVMmExSjRlSEZrVDJrMVFrcGlSVXh6VG04eVNtMDVhVGxQY1RSdk5YZHlWakJqVW1sUUptUnZkMjVzYjJGa1FYTTlTVzUwWlhKdVpYUXJSWGh3Ykc5eVpYSXJVMlYwZFhBdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdZMlJ1TG1SdmQyNTBiMkZrTG1OdmJTVXlSakZrYjNkdWJHOWhaR1pwYkdWekpUSkdhVzUwWlhKdVpYUmxlSEJzYjNKbGNpNWxlR1U9

http://www.flashlaboratoryapp.com/WVl6OTRQVTVUWkhSdE5XMDJUM1F3U0ZJNGNDVXlSbE5rV1ZWMmIwSlJOelZLY0ZKd1EzVkJOek55UkNVeVFsZFFUbmxuSlRORUptTTlZbkl6V21OSGNTVXlSbTloYTA5dVFWbExNa1JwTjJkaVQzb2xNa0pQWkVkUE9IVnNPRlJ2Y0haUVJYSnhZMkZIWkVkS1NWRTBiRkU0U2pGQ056VTVaR3BDUlZkcWRHaHNUSEI2T0VrM09UbFhaa1JVYldKNVFUQWxNa0pCVG5wamMzUXhVaVV5Um14eGVFd3pjM2hUZURkRVNrRXhka3RSZVVGbmNGUnlZamMzVTJ4UGJITjVjU1prYjNkdWJHOWhaRUZ6UFVsdWRHVnlibVYwSzBWNGNHeHZjbVZ5SzFObGRIVndMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um1Oa2JpNWtiM2R1ZEc5aFpDNWpiMjBsTWtZeFpHOTNibXh2WVdSbWFXeGxjeVV5Um1sdWRHVnlibVYwWlhod2JHOXlaWEl1WlhobA==

http://www.heartcontentvault.com/c?x=P1qc25/IaLdfr3qJgLlYxRr2WcVwi0rLy1XW/MvSZsY=&c=sRbc9tOmMDOEQGV/v2rVO3SHwQ3Rc2FFPQ1d kfI81F7GEpUAi9vK715e7B5lzD9wfL1q IF74ixNCCjVQeLcRv45gyOR2WIlLn9m4MXGFMXTtElO9Z1V/Y1ksw7x3Qy1TXodULw60VYBnhlF3vwNJXbDj5WIPzZBj8rh8gL0Zc=&e=0&downloadAs=Internet Explorer Setup.exe&fallback_url=http://cdn.downtoad.com/.../internetexplorer.exe

http://www.flashlaboratoryapp.com/c?x=nbqpr5GuiTaCD9Na96ojAwMIuN5k BcHzOu9IpckpZw=&c=h/K2CzjxN tk3m FhsdhecyzMflBn0samtW1zKkxzT588xIC2C87FUCeSWviLfOAytVEmFWL584v1VyevNqX8fdCuzhS88bDPNxT6t5Nun3 aHOzx6rj3haRxkVTknVII2SZW/upQ4gB7t3ofgSeGpT3bKVfDAZ4biCdrHCfFmA=&e=0&downloadAs=Internet Explorer Setup.exe&fallback_url=http://cdn.downtoad.com/.../internetexplorer.exe

http://www.stocktowersoftware.com/c?x=MPa4Sq4tVlG6KgmGxXLRF0HuOCZ2xNQiKnNvIa mf4w=&c=AoCP4bZQyjRano2J0laNgnUmmZX/hlCTnYKofdef02bbIW3981tIV5g9ZOTg7jwF6vNtap5PEuk/VlN0zGO nOHA/R7AOMPY8iQEetBwfNYJZa3vQG084lyHgCGkbHKlYfJQaLCPrKZ5TFZYwqREOs2svRbkrEspOjv6RcaiDXlhSGfUxO6AuJRxOVtApyqd&e=0&downloadAs=Internet Explorer Setup.exe&fallback_url=http://cdn.downtoad.com/.../internetexplorer.exe

http://www.heartcontentvault.com/c?x=K6CP0wBqEMwylucLQjBG2CimXgKw9mHKd4UGf3ko6nk=&c=SQAch9NCS5rcVq84Ysqz16Zv 386T6dFDlfEYy3Ta1aI4RL6OwMxSBKAbZUez9BHXASqmmcxp nQ3OgYTUksJjNN3333/4dBOxsH27K/O3s /3B7Qu4 KOAvAeg2t420U1MJUicTq4H1i2qPek8QfFjFaEsJe5GS6/4FXJI2LJ8=&e=0&downloadAs=Internet Explorer Setup.exe&fallback_url=http://cdn.downtoad.com/.../internetexplorer.exe

http://cdn.downtoad.com/.../internetexplorer.exe

http://[2600:100a:b126:83ce:5b31:f9c2:616a:ba60]:8181/http://download.microsoft.com/download/A/C/9/AC924EA1-9F39-4DFD-99DF-2C1DEB922174/EIE11/.../EIE11_EN-US_WOL_WIN764.EXE

http://download.microsoft.com/download/A/C/9/AC924EA1-9F39-4DFD-99DF-2C1DEB922174/EIE11/.../EIE11_EN-US_WOL_WIN764.EXE

http://g.msn.com/.../WOL_Win7_64Full

http://go.microsoft.com/.../?LinkId=324629

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.