home

microsoft-office-starter-2010_microsoft_office_starter_2010_francais_403434.exe

Microsoft Office 2010

Microsoft Corporation

It runs as a scheduled task under the Windows Task Scheduler. The file has been seen being downloaded from lb.cdn.m6web.fr and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft Office 2010

Description:
Programme d’amorçage de Microsoft Office « Démarrer en un clic »

Version:
14.0.6009

MD5:
415f1e1221b4a63dca4893efdaead707

SHA-1:
7c0ceb970d126a77da4c32ab76cdb52f64daef84

SHA-256:
645882111d3ec453c0c5fbafefd01abee9adc98897cc6c94362ce716353047b9

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
11/15/2024 3:36:15 PM UTC  (today)

File size:
1.6 MB (1,632,696 bytes)

Product version:
14.0.6009

Copyright:
© 2010 Microsoft Corporation. Tous droits réservés.

Original file name:
TP.exe

File type:
Executable application (Win32 EXE)

Language:
French (France)

Common path:
C:\users\{user}\downloads\programs\microsoft-office-starter-2010_microsoft_office_starter_2010_francais_403434.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
2/21/2011 8:53:12 PM

Valid to:
5/21/2012 9:53:12 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
6101B29B000000000015

File PE Metadata
Compilation timestamp:
10/20/2010 4:00:32 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:G1BaerGmg8eVIumedji4AMibLHkJEWXhKo7/QP:aGfVIVedu4kDivMP

Entry address:
0x465A6

Entry point:
E8, 87, 30, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, 0D, 31, 00, 00, 8B, FF, 55, 8B, EC, 56, 8B, 75, 14, 57, 33, FF, 3B, F7, 75, 04, 33, C0, EB, 65, 39, 7D, 08, 75, 1B, E8, BF, 31, 00, 00, 6A, 16, 5E, 89, 30, 57, 57, 57, 57, 57, E8, 6D, 0C, 00, 00, 83, C4, 14, 8B, C6, EB, 45, 39, 7D, 10, 74, 16, 39, 75, 0C, 72, 11, 56, FF, 75, 10, FF, 75, 08, E8, 67, 0F, 00, 00, 83, C4, 0C, EB, C1, FF, 75, 0C, 57, FF, 75, 08, E8, 59, 0E, 00, 00, 83, C4, 0C, 39, 7D, 10, 74, B6, 39, 75, 0C, 73, 0E, E8, 70, 31...
 
[+]

Entropy:
6.9939

Code size:
845 KB (865,280 bytes)

Scheduled Task
Task name:
{D497D1DB-FD9E-44C4-B479-6ACB336C1F0E}

Trigger:
Registration (Runs on registration)


The file microsoft-office-starter-2010_microsoft_office_starter_2010_francais_403434.exe has been seen being distributed by the following 50 URLs.

http://lb.cdn.m6web.fr/d/c/a/c23976b1eab1c7796e1f5b1dccf4dbf7/56b0a8fd/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://telechargement1.pcastuces.com/temp6bs2/.../microsoft_office_starter_2010.exe

http://telechargement2.pcastuces.com/temp6bs2/.../microsoft_office_starter_2010.exe

http://telechargement2.pcastuces.com/temp6bs2/.../microsoft_office_starter_2010.exe

http://lb.cdn.m6web.fr/d/c/a/aaf72cf4c49f1f34649005d426415db4/560ac81e/soft/.../microsoft-office-starter_2010_fr_403434.exe

https://www.olitech.fr/.../microsoft-office-starter_v2010.exe

http://lb.cdn.m6web.fr/d/c/a/d7501d2834a2c2482bb89f3f98bdcb73/5651a9e6/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/f0a501b3f6abb3fc0c24e0c04a9a4e6f/56dddc7f/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/bcad01473b88096771153a82b58c3200/5670aece/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/30401070df3594949596253e5a3573e1/56b34e34/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/89cabf126a37bf295d13f73714be7cac/563e65ae/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/e6b691b40248855aa26fab6d3c51cc89/55fbb075/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://soft.archive2.clubic.com/files/a95e371fb47390e227280ba050f55fa9/52bd5b37/.../microsoft-office-starter-2010_microsoft_office_starter_2010_francais_403434.exe

http://lb.cdn.m6web.fr/d/c/a/1b31c03379a33ae4cbdbb62d6ae35992/54d9ec51/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://telechargement1.pcastuces.com/temp6bs2/.../microsoft_office_starter_2010.exe

http://telechargement2.pcastuces.com/temp6bs2/.../microsoft_office_starter_2010.exe

http://telechargement2.pcastuces.com/temp6bs2/.../microsoft_office_starter_2010.exe

http://lb.cdn.m6web.fr/d/c/a/b464e72be6e7ab5673f6a7bf0a8a5dd3/56be4c50/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/47d4bce2a49bb4f3ee4286c1e33c6499/559faaf1/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://telechargement2.pcastuces.com/temp6bs2/.../microsoft_office_starter_2010.exe

http://lb.cdn.m6web.fr/d/c/a/38e222ddd836a66706f206c1e2f5330c/56b2390d/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/17a53b05568357c53e9ae11111955b44/5697a197/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/6fb1c9c2e0f05a8bd5f8121986248a92/56ce2d23/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/e544e05c580c8ede54517e84e7bdcee7/5631370c/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/b245dc6c7165d76aa37ca2fbe4ec6b4d/55fd1d19/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/b6e45b7fe4dbcfa6bc048945b4d9bced/550b2488/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/c6efa81c7f1cc4ef3b160c4465f2632d/5486d641/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/5308ab400b724146f59b221f3bc81324/566d59fc/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/617bf57500bc3cd3e438a6a62e99c06c/55fa7bef/soft/.../microsoft-office-starter_2010_fr_403434.exe

http://lb.cdn.m6web.fr/d/c/a/4df0dde68ffea659e6318e5101d9ee49/55336be7/soft/.../microsoft-office-starter_2010_fr_403434.exe

Latest 30 of 318 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.