home

debutsetup.exe

Debut

NCH Software

This is a setup and installation application. This is installed with Debut Video Capture Software. The file has been seen being downloaded from debut-video-capture.ar.softonic.com and multiple other hosts.
Publisher:
NCH Software  (signed and verified)

Product:
Debut

Description:
Debut Video Capture Software

Version:
2.16

MD5:
0b794b85d956f6deac1b8fbee062984d

SHA-1:
674070fb28a055ecf50593524c61277962a9620c

SHA-256:
fb2d12e47b258e4795a130aa2ed6b2c4a81616fd3cd66084b78b479ee88b514c

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/18/2024 5:38:29 AM UTC  (today)

File size:
1.5 MB (1,576,720 bytes)

Product version:
2.16

Copyright:
NCH Software

Original file name:
Debut.exe

File type:
Executable application (Win32 EXE)

Language:
English (Australia)

Common path:
C:\users\{user}\downloads\debutsetup.exe

Digital Signature
Signed by:
NCH Software

Authority:
Thawte, Inc.

Valid from:
7/6/2015 3:00:00 AM

Valid to:
8/7/2017 2:59:59 AM

Subject:
CN=NCH Software, O=NCH Software, L=Canberra, S=Australian Capital Territory, C=AU

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
58D9B9D38780932DD1CBC58A2AD28B1C

File PE Metadata
Compilation timestamp:
12/18/2014 2:47:27 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
49152:Oxfors/Dfx21CJXvK/AB0MD9gWk4Aox4go44b:+asrfx2AJXvKo19gWkoxj4

Entry address:
0x11D4

Entry point:
55, 8B, EC, 83, E4, F8, 81, EC, F4, 14, 00, 00, 53, 56, 57, E8, 03, FF, FF, FF, 33, DB, 3B, C3, 89, 44, 24, 14, 0F, 85, 3D, 03, 00, 00, 6A, 06, 53, FF, 15, 8C, 20, 40, 00, FF, 15, 2C, 20, 40, 00, 8B, C8, E8, 2E, 03, 00, 00, 85, C0, 74, 10, 68, 7C, 24, 40, 00, 68, 80, 24, 40, 00, FF, 15, 08, 20, 40, 00, 8D, 44, 24, 68, 50, FF, 15, 50, 20, 40, 00, F6, 84, 24, 94, 00, 00, 00, 01, 75, 0A, 66, C7, 84, 24, 98, 00, 00, 00, 01, 00, 8D, 84, 24, E0, 0C, 00, 00, 50, 68, 04, 01, 00, 00, FF, 15, 28, 20, 40, 00, 6A, 63...
 
[+]

Entropy:
7.9976

Developed / compiled with:
Microsoft Visual C++

Code size:
1.5 KB (1,536 bytes)

The file debutsetup.exe has been discovered within the following program.

Debut Video Capture Software  by NCH Software
During installation the program will offer the user to install the NCH Toolbar, an ad-supported web browser toolbar.
www.nch.com.au/index.html
20% remove it
 
Powered by Should I Remove It?

The file debutsetup.exe has been seen being distributed by the following 12 URLs.

http://debut-video-capture.ar.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmKaNn6CflZs=

http://www.softwaresharetoday.com/hz07057jbPPgNwJcxQSsVpZDkOZKBciDDKkIvUI VDkQszjlGwQgCOEl85SxS2r hGgIXHayS9A3l2HEgUJYcC BSl30e2VMsOB CiuD02aed5J8NTEue9fx9SZwrlVCS93Ssp4EDNTPrlnW6mirvhlxLiwhJ6xdEPWm8dm2uDb3tUmQLniro7prW5DpoeJqbc6wIscj-G1oAAGRgnq2tGc2K9gEbcOAS2LiN64A2bIydJ4ijWfr73ieBfqFhXbd6LnIcwg8T3SBYsCr2mzo230a bvE_P0z2bZ9lMD3l983n u9tPtCIKEEjOImQLA4=

http://debut-video-capture.ar.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmKeHo52mkpU=

http://global-shared-files-lw.softonic.com/674/070/.../debutsetup.exe

http://www.cleansignsnew.com/c?x=U1XKCcHlzUZER3MvjC048opn/ra5Tr0iA0QFB/W5/KA=&c=/GvS7Xkfe8UdkZrX ytO4cp75KpTuUe6fRkdPk76DsbLaOVU5ap5HvKL kwMZSKU6dcgn6ShqU2CqoY7Q9wWlSCJfN99Ti2NnhpkM5JFmaKmlDDffJZ66sgeITQx/mzVyWETP6Flfh6Sl88d12BPTElspb4mvHaZjxHJJcbdCfM=&e=0&fallback_url=https://secure.innodl.com/.../debut-video-capture.exe

http://debut-video-capture.ar.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fmKeQpqSklZ0=

http://www.download3k.com/DownloadLink4-NCH-Software-Debut-Video-Capture-Software.html

http://gsf-cf.softonic.com/674/070/.../debutsetup.exe

http://www.nch.com.au/.../debutsetup.exe

http://www.vins.co.il/.../Debut-Video-Capture-Software

http://software-files-a.cnet.com/s/software/14/41/53/.../debutsetup.exe

http://www.nchsoftware.com/.../debutsetup.exe

Scan debutsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.