home

defiancesetup.exe

DEFIANCE

Trion Worlds Inc.

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
Publisher:
Trion Worlds, Inc.   (signed by Trion Worlds Inc.)

Product:
DEFIANCE

Description:
DEFIANCE Setup

MD5:
d930daa0e9725380cbf227a4d561d0e3

SHA-1:
28bcd7e0f59022f3d575ef9fb7ea8e676c9f4b3a

SHA-256:
4905df403368f745499846386bd9d9b9531155deef4f233bb4b1c7dc1a416628

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/18/2024 11:29:01 PM UTC  (a few moments ago)

File size:
10.2 MB (10,688,760 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\defiancesetup.exe

Digital Signature
Signed by:
Trion Worlds Inc.

Authority:
Entrust, Inc.

Valid from:
2/25/2013 12:22:03 PM

Valid to:
2/25/2014 1:49:35 PM

Subject:
CN=Trion Worlds Inc., O=Trion Worlds Inc., L=Redwood City, S=California, C=US

Issuer:
CN=Entrust Code Signing Certification Authority - L1D, OU="(c) 2009 Entrust, Inc.", OU=www.entrust.net/rpa is incorporated by reference, O="Entrust, Inc.", C=US

Serial number:
4C173DAE

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
196608:j0CsHL9eSxLpSPHJeB0qVlyrMf+eI0EzLpYBAGCdXi+bj8uVhAcq:j0CspeAMHBqVlIVcX28MC

Entry address:
0x9B24

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, A2, 95, FF, FF, E8, A9, A7, FF, FF, E8, D4, C9, FF, FF, E8, 1B, CA, FF, FF, E8, 0E, F3, FF, FF, E8, 75, F4, FF, FF, 33, C0, 55, 68, DB, A1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, A4, A1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 9B, FE, FF, FF, E8, 02, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 04, D0, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 53, 96, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD, 40, 00, B2, 01, B8...
 
[+]

Entropy:
7.9855

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file defiancesetup.exe has been seen being distributed by the following 6 URLs.

http://dw.uptodown.com/dwn/-pedgs-P7P7XkLf3EFLfyDJqWZs5QAdK5gJEToiQDS36Xgq5mTTBQG1ddkM3cTpi3qzhMsyEKeUDw-ECaAUQFJxkJ5NMnN6RH4j4nnzL1r3p2p-Wf1sk5d8y4n8dgjnw/hmTiHRbPR0QBDKSD7Z55n6zM3M8IE2Krfdipysuu4LmaxonBzhHZcnAT_yNeqaYK1aATmDDVja-piZ7ZyiugsuxjFwK5X_MI3naHPJvkqP-cIMvQa2SZ1dmOwSrhHf6y/.../

http://dw2.uptodown.com/dl/1417035556/.../defiance-es-en-br-fr-de-it-win.exe

http://dw.uptodown.com/dwn/0wrGRX6FyZTVWtUT1yfG6gd6yJ19baAj_KiUSt06An7B54PHgyBZH0Ea-81GusEfr6FNoZhyrHNY61Mx8acGMmOdmT_5oGhrOIW7z4VTgnHmsCOdjpzOS2h3kXuiIDBc/QU8qpz0E5V3xt96oFaMh2CDkqVbqmGbgUPQRnrp-ABYn-IAY_ZbLFzJY5oiBT7rF-LDdDS1mWh0-LGNAdMiorK3LZT1SbVw_AaLWniwTBq0sEc6QstkDsBNiHQvckGNK/.../

http://dw4.uptodown.com/dwn/AsWZQq7wulSzZIy4ZG4qpi2ZxUnaEquHjMXhXY6ng7oSAEZnE53NqhYwBF0fiKhmasiGlapxOc26Cq9LxZ_WtehSsXDUwqN9RgOBltwwzb5-ckXjC083aU7RARuAVdOf/vPjA5oiPuqHPU3a8pR3RHIGWY4yvCZdhWSvqEltm7X60mq3AjGFQl41YyH2gFNWTMcgJyjuL98atXomNQ_gNtp4g0JXuV1pnOHm7zf7FJpC8GUU3oP18l27jc8jv5XQ5/.../defiance-es-en-br-fr-de-it-win.exe

https://defiancepc.trionworlds.com/account/.../record-first-client-download!execute.action?struts.token.name=token&token=XEDLPCOW5O97M1XD9WV3U65CLXUGGCZ

http://update03.triongames.com/ch3-installer/public/.../DefianceSetup.exe

Scan defiancesetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.