MSOUC.EXE
Microsoft Office Upload Center file version info
Program on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real MSOUC.EXE?
Installed in
C:\Program Files (x86)\Microsoft Office\root\Office16\C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\Signed byMicrosoft Corporation
ProductMicrosoft Office, Microsoft Corporation
DescriptionMicrosoft Office Upload Center
2 known copies
16.0.12527.20482 · C:\Program Files (x86)\Microsoft Office\root\Office16\MSOUC.EXE · signed by Microsoft Corporation
dc5d840d0805ae1610acbfcee38059a20f2b3b921939e107218162052ab044d816.0.12527.20458 · C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\msouc.exe · signed by Microsoft Corporation
ebc8419ab10034a2e5bd7feea9eabd0f4bc612a12a10e042e8a3df4317f2325dFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.