The tool is often found within the payload of the SaRA installation.
First, let’s decode the name. The executable setupprodoffscrubexe is not a random string of characters. It follows Microsoft's internal naming conventions: setupprodoffscrubexe top