| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Mar-28 12:04:21 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
| Debug artifacts |
d:\dbs\el\omr\target\x86\ship\click2run\en-us\SetupBootstrapper.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft 365 and Office |
| FileVersion | 16.0.19822.20142 |
| InternalName | Bootstrapper.exe |
| LegalTrademarks1 | Microsoft® is a registered trademark of Microsoft Corporation. |
| LegalTrademarks2 | Windows® is a registered trademark of Microsoft Corporation. |
| OriginalFilename | Bootstrapper.exe |
| ProductName | Microsoft Office |
| ProductVersion | 16.0.19822.20142 |
| Info | Matching compiler(s): |
Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 6.0 - 8.0 MASM/TASM - sig2(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses constants related to Blowfish Uses known Mersenne Twister constants |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Microsoft Corporation
Issuer: Microsoft Windows Code Signing PCA 2024 |
| Safe | VirusTotal score: 0/72 (Scanned on 2026-04-07 09:57:40) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x128 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-Mar-28 12:04:21 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x46ac00 |
| SizeOfInitializedData | 0x29a200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x003F3A6C (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x476000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.2 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x709000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x70cdb2 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| OLEAUT32.dll |
GetErrorInfo
SysStringLen SysAllocString VariantClear VariantInit SysFreeString SetErrorInfo |
|---|---|
| KERNEL32.dll |
SetWaitableTimerEx
VirtualQuery WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetStdHandle CompareStringW VirtualProtect EnumSystemLocalesW GetOEMCP ExitProcess CloseHandle GetLastError GetModuleHandleW GetProcAddress LoadLibraryW SetLastError GetModuleFileNameW OutputDebugStringA CompareStringEx LocalFree HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId FreeLibrary CreateThread GetCurrentThreadId GetExitCodeThread SetProcessMitigationPolicy CreateEventExW WriteFile DeleteFileW WideCharToMultiByte IsWow64Process GetModuleHandleExW ExpandEnvironmentStringsW GlobalFree MultiByteToWideChar InitializeCriticalSectionEx DeleteCriticalSection DecodePointer CreateMutexW GetNativeSystemInfo VerSetConditionMask VerifyVersionInfoW GetUserDefaultLocaleName FlsFree FlsAlloc LocaleNameToLCID AttachConsole AllocConsole GetStdHandle FreeConsole FindClose UnmapViewOfFile CreateFileA GetFileSize CreateFileMappingW MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LoadLibraryA LCMapStringW FormatMessageA GetSystemTimeAsFileTime GetTickCount64 K32GetProcessMemoryInfo GlobalMemoryStatusEx OpenProcess RaiseException IsValidCodePage GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetCPInfoExW GetSystemDirectoryW GetTempPathW CreateDirectoryW GetFileAttributesExW SetFileAttributesW GetExitCodeProcess GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW LoadLibraryExW FindResourceW SizeofResource LoadResource ReleaseSemaphore WaitForSingleObjectEx SetEvent CreateEventW WaitForSingleObject AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork TlsAlloc TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue ResetEvent EnterCriticalSection LeaveCriticalSection GetVersionExW GetDiskFreeSpaceExW CreateFileW DeviceIoControl SetErrorMode GetComputerNameW MulDiv FormatMessageW GetLogicalProcessorInformation HeapAlloc OpenEventW CreateMutexExW OpenMutexW ReleaseMutex GetLongPathNameW GetFinalPathNameByHandleW TzSpecificLocalTimeToSystemTime QueryUnbiasedInterruptTime IsDebuggerPresent FindFirstFileExW MoveFileExW FindNextFileW RemoveDirectoryW ReadFile SetFilePointerEx SetEndOfFile GetFileSizeEx FlushFileBuffers LockFileEx UnlockFileEx GetFileInformationByHandleEx GetCurrentDirectoryW GetTempFileNameW CopyFileExW GetVolumePathNamesForVolumeNameW SetFileInformationByHandle WaitForMultipleObjects K32EnumProcessModulesEx RtlCaptureStackBackTrace GetFileType SetFilePointer GetOverlappedResult GetFileAttributesW GetFileTime QueryPerformanceCounter QueryPerformanceFrequency GlobalAlloc SetFileTime CancelIoEx GetProcessAffinityMask CreateWaitableTimerW CancelWaitableTimer QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList GetTickCount InitOnceExecuteOnce GetSystemPowerStatus GetTimeZoneInformation AreFileApisANSI HeapCreate GetFullPathNameW GetDiskFreeSpaceW LockFile InitializeCriticalSection GetFullPathNameA HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile DeleteFileA HeapReAlloc GetSystemInfo HeapCompact HeapDestroy UnlockFile GetCurrentThread OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus GetStartupInfoW CreateMemoryResourceNotification QueryProcessCycleTime OpenThread QueryThreadCycleTime IsSystemResumeAutomatic InitializeCriticalSectionAndSpinCount FindFirstFileW GetThreadLocale lstrcmpW CopyFileW ProcessIdToSessionId GetCommandLineW SetEnvironmentVariableW PeekNamedPipe GetConsoleMode SetConsoleMode CreatePipe SetHandleInformation GetPriorityClass K32EnumProcesses IsValidLocale GetSystemDefaultLocaleName GetUserGeoID GetLocaleInfoEx LCIDToLocaleName LCMapStringEx GetSystemDefaultLCID EnumSystemLocalesEx LoadLibraryExA LockResource GetLocaleInfoW GetUserPreferredUILanguages GetACP GetPhysicallyInstalledSystemMemory GetProductInfo GetConsoleOutputCP ReadConsoleW GetDriveTypeW GetTimeFormatW GetDateFormatW GetSystemPreferredUILanguages K32GetProcessImageFileNameW TryAcquireSRWLockExclusive GetStringTypeW GetFileInformationByHandle CreateSymbolicLinkW InitOnceBeginInitialize InitOnceComplete SwitchToThread IsProcessorFeaturePresent EncodePointer GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter RtlUnwind CreateTimerQueueTimer DeleteTimerQueueTimer GetThreadTimes FreeLibraryAndExitThread ExitThread GetLocalTime |
| credui.dll (delay-loaded) |
CredUIPromptForCredentialsW
|
| Attributes | 0x1 |
|---|---|
| Name | credui.dll |
| ModuleHandle | 0x689f8c |
| DelayImportAddressTable | 0x666000 |
| DelayImportNameTable | 0x66194c |
| BoundDelayImportTable | 0 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
| _scenario_roaming_culture_en-us_lcid_1033_platform_x86_productreleaseid_none_ |
| Close |
| Minimize |
| Continuing could be expensive |
| You're connected to a network that limits downloads every month. |
| We need to stream some large files over your network connection to install Microsoft 365 and Office, so we recommend installing while connected to an unrestricted network. |
| If you are sure you won't be charged or exceed your limits by dowloading a large amount, you can choose Continue to download and install. Otherwise, you should Close and install when connected to a different network. |
| Administrative Privileges Required |
| Installation requires administrative privileges to make changes to your computer. |
| Please retry installing this product and give the required permission when prompted. |
| If you cannot give these permissions to install, ask your system administrator to help you. |
| Couldn't install |
| We're sorry, we had a problem installing your Microsoft 365 and Office program(s). |
| Is your internet connection working? Do you have enough free space on your main hard drive? |
| Please try installing again after you've checked the above. |
| Microsoft 365 and Office need a newer version of Windows |
| We're sorry, we couldn't install your Microsoft 365 and Office product because you don't have a modern Windows operating system. |
| You need Microsoft Windows 7 (or newer) to install this product. |
| Couldn't Install Microsoft 365 and Office |
| We're sorry, Microsoft 365 and Office couldn't be installed. |
| Please save the file you used to start this installation to a place you can find easily. Then use Windows Explorer to view that location and try installing Microsoft 365 and Office again. |
| We found a problem! |
| We found a pre-release or Beta version of a Microsoft 365 and Office product on your computer and can't install because of it. |
| Please Uninstall any pre-release Microsoft 365 and Office software using the Programs and Features item in your Control Panel and try installing again. |
| We're sorry, but we can't verify the signature of files required to install your Microsoft 365 and Office product. |
| We need to verify these signatures to keep your computer safe. |
| Please retry installing your product or, if installation continues to fail, try re-downloading your installer if you got it online. Make sure you only download Microsoft 365 and Office products from a trusted source. |
| We found a problem! |
| We're sorry, Microsoft 365 and Office do not work with Windows 8 Consumer Preview. |
| You need the full version of Windows 8. |
| We're sorry, Microsoft 365 and Office (64-bit) couldn't be installed because you have these 32-bit programs installed on your computer: |
| %s |
| 64-bit and 32-bit versions of Microsoft 365 and Office programs don't get along, so you can only have one type installed at a time. Please try installing the 32-bit version instead, or uninstall your other 32-bit Microsoft 365 and Office programs and try this installation again. |
| We're sorry, Microsoft 365 and Office (32-bit) couldn't be installed because you have these 64-bit programs installed on your computer: |
| %s |
| 32-bit and 64-bit versions of Microsoft 365 and Office programs don't get along, so you can only have one type installed at a time. Please try installing the 64-bit version instead, or uninstall your other 64-bit Microsoft 365 and Office programs and try this installation again. |
| We're sorry, we can't continue because we weren't able to download a required file. Please make sure you're connected to the internet or connect to a different network, then try again. |
| Please free up some disk space |
| We're sorry, we couldn't start installing Microsoft 365 and Office because available disk space is too low. |
| Couldn't start Microsoft 365 and Office installation |
| We're sorry, but we could not successfully start your Microsoft 365 and Office installation. Please try again later. |
| Setup Failed |
| A newer version of Setup is required to install this product |
| We're sorry, but we could not start your Microsoft 365 and Office installation. Another installation is in progress. Please try again later. |
| &Close |
| %s |
| <a href="%s">Go online for additional help.</a> |
| Invalid product %s specified. |
| Error configuring products! |
| We're getting things ready... |
| We need to remove some older products |
| Some older products don’t work with Microsoft 365 and Office. Before installing the new Microsoft 365 and Office, we need to remove: |
| %s |
| Important: Once we’ve removed these products, you won’t be able to install the old version again. |
| Remove and Continue |
| &Cancel |
| Couldn't Install Microsoft 365 and Office |
| We are sorry, but we could not complete the installation. |
| We hit an issue trying to uninstall your previous Microsoft 365 and Office version. |
| <a href="%s">Go online for additional help.</a> |
| https://support.microsoft.com/kb/2739501 |
| Save your work before continuing |
| We need to close the following apps: |
| C&ontinue |
| &Cancel |
| Couldn't Install Microsoft 365 and Office |
| We're sorry, Microsoft 365 and Office (64-bit) couldn't be installed because your computer does not support 64-bit applications. Please try installing the 32-bit version of Microsoft 365 and Office instead. |
| We're sorry, we had a problem installing your Microsoft 365 and Office program(s). |
| Please make sure the Microsoft 365 and Office installation disk is inserted. Do you have enough free space on your main hard drive? |
| Please try installing again after you've checked the above. |
| We found a problem! |
| We're sorry, Microsoft 365 and Office Click-to-Run installer encountered a problem because you have these Windows Installer based Office programs installed on your computer: |
| %s |
| Click-to-Run and Windows Installer editions of Office programs don't get along for this version, so you can only have one type installed at a time. Please try installing the Windows Installer edition of Office instead, or uninstall your other Windows Installer based Office programs and try this installation again. |
| Microsoft 365 and Office |
| %s |
| <a href="%s">Go online for additional help.</a> |
| Error Code: %s |
| Client update needed. |
| We are sorry, but we could not complete the installation. Please try again later. |
| https://go.microsoft.com/fwlink/?LinkId=613501 |
| <a href="%s">Learn more</a> |
| This installation requires a compatible Microsoft 365 and Office program installed on your computer. |
| Command not supported |
| We're sorry, but the current command isn't supported on your device architecture. |
| Stop, you should wait to install Microsoft 365 and Office |
| You won't be able to receive mail from a current mailbox. |
| %s You may want to contact your mailbox provider or system administrator about this issue. |
| <a href="%s">Learn why</a> |
| Business Contact Manager will no longer work. |
| %s |
| <a href="%s">Learn why</a> |
| You won't be able to receive mail from a current mailbox. Business Contact Manager won't work. |
| %s You may want to contact your mailbox provider about these issues. |
| <a href="%s">Learn why</a> |
| Outlook 2016 is not compatible with Exchange 2007. |
| Outlook 2016 requires access to the AutoDiscover service for your Exchange service. |
| Business Contact Manager is not compatible with Outlook 2016. |
| &Install 32-bit |
| &Install 64-bit |
| This installation is for the 64-bit version of Microsoft 365 and Office, but the following 32-bit applications are already installed on this computer: |
| %s |
| Want to install 32-bit Microsoft 365 and Office, which will work with your 32-bit applications? Select "Install 32-bit". If you want the 64-bit version, select "Cancel", uninstall your 32-bit Microsoft 365 and Office applications, and start this 64-bit installation again. |
| This installation is for the 32-bit version of Microsoft 365 and Office, but the following 64-bit applications are already installed on this computer: |
| %s |
| Want to install 64-bit Microsoft 365 and Office, which will work with your 64-bit applications? Select "Install 64-bit". If you want the 32-bit version, select "Cancel", uninstall your 64-bit Microsoft 365 and Office applications, and start this 32-bit installation again. |
| Sorry, 64-bit and 32-bit Microsoft 365 and Office can’t be installed together |
| %s |
| <a href="%s">Help: Installing 64-bit or 32-bit.</a> |
| Please Wait |
| Microsoft 365 and Office are already being installed. |
| For install status, check the Microsoft 365 and Office notification in the Windows taskbar. |
| We can't install |
| The following product(s) can’t be installed at the same time: |
| %s |
| We can't install |
| To install this product, first uninstall the following product(s) and try again. |
| %s |
| You need Windows 10 or newer to continue |
| This Office product requires Windows 10 or newer. Please upgrade Windows and try installing Office again. |
| %s |
| <a href="%s">Help: Upgrading Windows</a> |
| We can't install |
| This product can't be installed on the selected update channel. Please contact your system administrator and try again. |
| We can't install |
| This product can't be installed on the selected update channel. Please contact your system administrator and try again. |
| We can't install |
| This product can't be installed on the selected update channel. Please contact your system administrator and try again. |
| Couldn't stream Microsoft 365 and Office |
| Sorry, we can't find a required file. Please check that the installation source is reachable, then try again. |
| We found a problem! |
| We found an Office 2013 product on your computer and can't install because of it. |
| Please uninstall any Office 2013 products using the Programs and Features item in your Control Panel and try installing again. |
| Can't install this version of Microsoft 365 and Office |
| Windows 10 in S mode doesn't support this version of Microsoft 365 and Office. |
| Use Microsoft 365 and Office Version 1902 or later, or switch out of S mode. |
| Can't install this version of Microsoft 365 and Office |
| This version of Microsoft 365 and Office requires a newer version of Windows. |
| We recommend you move to Windows 10. |
| %s |
| <a href="%s">Learn more</a> |
| Can't install this version of Microsoft 365 and Office |
| This version of 64-bit Microsoft 365 and Office can’t install on ARM64 devices. |
| Use Microsoft 365 and Office Version 2105 or later, or switch to 32-bit Microsoft 365 and Office |
| We couldn’t find the specified configuration file. Check the file path and file name. |
| The configuration file wasn't specified. |
| Language not available |
| This language is not available for the selected product. |
| Microsoft 365 and Office need a newer version of Windows |
| We're sorry, we couldn't install your Microsoft 365 and Office product because you don't have a modern Windows operating system. |
| You need Microsoft Windows 11 (or newer) to install this product. |
| %s |
| <a href="%s">Help: Upgrading Windows</a> |
| &Report |
| %s |
| You can report this with Feedback Hub. This will collect and upload diagnostic data to help make Microsoft 365 apps better. |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 16.0.19822.20142 |
| ProductVersion | 16.0.19822.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft 365 and Office |
| FileVersion (#2) | 16.0.19822.20142 |
| InternalName | Bootstrapper.exe |
| LegalTrademarks1 | Microsoft® is a registered trademark of Microsoft Corporation. |
| LegalTrademarks2 | Windows® is a registered trademark of Microsoft Corporation. |
| OriginalFilename | Bootstrapper.exe |
| ProductName | Microsoft Office |
| ProductVersion (#2) | 16.0.19822.20142 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Mar-28 12:04:21 |
| Version | 0.0 |
| SizeofData | 280 |
| AddressOfRawData | 0x665190 |
| PointerToRawData | 0x664190 |
| Referenced File | d:\dbs\el\omr\target\x86\ship\click2run\en-us\SetupBootstrapper.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Mar-28 12:04:21 |
| Version | 576.35719 |
| SizeofData | 4 |
| AddressOfRawData | 0x6652a8 |
| PointerToRawData | 0x6642a8 |
| StartAddressOfRawData | 0xa1cbe8 |
|---|---|
| EndAddressOfRawData | 0xa1cd23 |
| AddressOfIndex | 0xa8a8d8 |
| AddressOfCallbacks | 0x86ccd4 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x007F43C8
0x007F444D |
| Size | 0xc0 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0x800 |
| EditList | 0 |
| SecurityCookie | 0xa66780 |
| SEHandlerTable | 0xa17aec |
| SEHandlerCount | 3674 |
| XOR Key | 0x549179ec |
|---|---|
| Unmarked objects | 0 |
| ASM objects (33136) | 28 |
| C++ objects (33136) | 215 |
| C objects (35207) | 20 |
| ASM objects (35207) | 28 |
| C objects (41204) | 7 |
| ASM objects (41204) | 2 |
| C objects (CVTCIL) (33136) | 1 |
| C objects (33136) | 49 |
| Imports (33136) | 5 |
| Total imports | 1001 |
| C++ objects (35207) | 153 |
| C++ objects (LTCG) (35214) | 2412 |
| Resource objects (35214) | 1 |
| 151 | 1 |
| Linker (35214) | 1 |
No comments yet.