home

windows_live_mail.exe

Instalator Windows Live

Microsoft Corporation

This is a setup program which is used to install the application. The file has been seen being downloaded from s10568.chomikuj.pl and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Instalator Windows Live

Description:
Wykonywalny instalator Windows Live na kliencie

Version:
12.0.2000.1009

MD5:
7470c7894545c23674b5c090321cfc37

SHA-1:
b6c2313330e6ae844cacbb8d8bc8b17c686680db

SHA-256:
7dc38fdd5cfde9fffdf9fe206f898061e25aa26384876ea66bef3d40b0f26fe0

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
11/24/2024 8:23:43 AM UTC  (today)

File size:
2.3 MB (2,403,344 bytes)

Product version:
12.0.2000.1009

Copyright:
© Microsoft Corporation. Wszelkie prawa zastrzeżone.

Original file name:
WLSuite.exe

File type:
Executable application (Win32 EXE)

Language:
Polish

Common path:
C:\users\{user}\downloads\windows_live_mail.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
8/23/2007 2:23:13 AM

Valid to:
2/23/2009 1:33:13 AM

Subject:
CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
610F784D000000000003

File PE Metadata
Compilation timestamp:
10/26/2007 12:28:08 AM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
49152:h3lvdIh5Nr2z7b1I8fEcpS8hAGeUDlwY25UN5tI98SdCPJBYsE0MhmZPJBYsE0Ml:h3lvdIh5kz/zMcpFhAGjDlh25G7c8JPK

Entry address:
0x2F358

Entry point:
E8, B7, 47, 00, 00, E9, 12, FE, FF, FF, CC, CC, CC, CC, CC, E9, CE, 06, 00, 00, CC, CC, CC, CC, CC, E9, F1, FF, FF, FF, CC, CC, CC, CC, CC, 6A, 14, 68, C0, 38, 04, 01, E8, E5, 01, 00, 00, 83, 65, FC, 00, FF, 4D, 10, 78, 3A, 8B, 4D, 08, 2B, 4D, 0C, 89, 4D, 08, FF, 55, 14, EB, ED, 8B, 45, EC, 89, 45, E4, 8B, 45, E4, 8B, 00, 89, 45, E0, 8B, 45, E0, 81, 38, 63, 73, 6D, E0, 74, 0B, C7, 45, DC, 00, 00, 00, 00, 8B, 45, DC, C3, E8, E6, 47, 00, 00, 8B, 65, E8, C7, 45, FC, FE, FF, FF, FF, E8, DB, 01, 00, 00, C2, 10...
 
[+]

Code size:
275.5 KB (282,112 bytes)

The file windows_live_mail.exe has been seen being distributed by the following 2 URLs.

http://s10568.chomikuj.pl/File.aspx?e=jUQ3XlgAMGpxhufa4hwy5GxiaL1-296xDMyzKL761pfdkZb-7M2wNgceVyb1Gp9rWyKFAx5BnbrvdJaDi0RRRvwPw_KabGZmPHoUce4aKE9XtWcdknJkzNjW0-Rofk4dW3M_9NhNT9E6s7_XVwNyrg&pv=2

http://s10568.chomikuj.pl/File.aspx?e=jUQ3XlgAMGpxhufa4hwy5IICiTUll1n7wpfBCHQuEuFin_Hvaz7useBeJ_BUa1yS_sVxHird2gSI9GdIhIbEOsuXSOIF8SXxO_4kNzgJrbsAfQfDm3B_PMNbs8aPl8VXaGxOOwvDopHsawnrtHmTlQ&pv=2

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.