home

rct3_usa_demo_1.1.exe

InstallShield

InstallShield Software Corporation

The program is a setup application that uses the InstallShield Setup installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
InstallShield Software Corporation

Product:
InstallShield (R)

Description:
InstallShield (R) Setup Launcher

Version:
7, 01, 100, 1248

MD5:
f74014420e8428a39529bd8f3be74249

SHA-1:
37eaee911d8bef568d790d913358c03478fcfee9

SHA-256:
0866b0c4996d9de9696eae2155206e06a4c1d838b87cd4d061cbb51d50b66941

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/16/2024 1:47:51 AM UTC  (today)

File size:
163.1 MB (171,042,332 bytes)

Product version:
7, 01

Copyright:
Copyright (C) 1990-2002 InstallShield Software Corporation

Original file name:
Setup.exe

File type:
Executable application (Win32 EXE)

Installer:
InstallShield Setup

Language:
English (United States)

File PE Metadata
Compilation timestamp:
12/2/2002 1:31:43 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3145728:vVx0HZDuUAvSgK1qDwgDINGEU9aUf9HC/Ub4Yhc/YWUEWvEVAkPIptQ:wHcxvSgK1rNGZ9ak9icb4ZvUD9BW

Entry address:
0xB1CC

Entry point:
55, 8B, EC, 83, EC, 44, 56, FF, 15, 44, 01, 41, 00, 8B, F0, 85, F6, 75, 08, 6A, FF, FF, 15, 40, 01, 41, 00, 8A, 06, 57, 8B, 3D, 08, 02, 41, 00, 3C, 22, 75, 1B, 56, FF, D7, 8B, F0, 8A, 06, 3C, 22, 74, 04, 84, C0, 75, F1, 80, 3E, 22, 75, 15, 56, FF, D7, 8B, F0, EB, 0E, 3C, 20, 7E, 0A, 56, FF, D7, 8B, F0, 80, 3E, 20, 7F, F6, 8A, 06, 84, C0, 74, 04, 3C, 20, 7E, E1, 83, 65, E8, 00, 8D, 45, BC, 50, FF, 15, 3C, 01, 41, 00, F6, 45, E8, 01, 5F, 74, 06, 0F, B7, 45, EC, EB, 03, 6A, 0A, 58, 50, 56, 6A, 00, 6A, 00, FF...
 
[+]

Entropy:
7.9958

Packer / compiler:
InstallShield Custom

Code size:
57.5 KB (58,880 bytes)

The file rct3_usa_demo_1.1.exe has been seen being distributed by the following 50 URLs.

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_fr&type=PROGRAM&Expires=1482228348&Signature=JQIvby5L-0cb4ZAMpt1z1hXgxO~yfS9oB0hx3FNNxM3kPSCeUlmWJcbAnnePqAWfk5Lg6pBKBV8kUZsNDWQR-mCbDfhdNouytVFNzlm3-TW6xMfV7jTxF1AnUzU~FMAoN54VjKNKZRfbot~GepgCMHSTQvKf9bnt~-v5CQ6a7EQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_fr&type=PROGRAM&Expires=1484438905&Signature=AzM2zkTiYolCcOOw276Uq7iQJI4nBFn3CJEU0eqBWk0Hbqny4VQZ~3l6Z9U9qxSPTdnjQrikKUS1iR4Fawue84xWEwlwSb5ppiq-7ZRKvek3LrtNQKMpE03F54dfwH9Fuew9l6RlGIIPmPUz647GZckP~Rfm3CnbRMGn-FOlkf8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_fr&type=PROGRAM&Expires=1483922750&Signature=eUZWb8cIDZOm11Uw3ksUgxHtWSYBMOPmY-qwOAPkIeKlpdcqw2vv1efCUF4eKwXWYkNoDc6rjxPBqKQyfAUTI3o9SgxdKzWX3UFwWxvqQNQQW1tv55c96E8dKlRYMVHhcw9rgOpbuT0t-v7bMp2tRhPSwP0sInb3rYlsJ7T0bkw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_br&type=PROGRAM&Expires=1483761423&Signature=WEBVNrwUQA6LnfaKyE1kOI9MCDIwkamfYRYNTPJoztEyiWqeNYA-umfXdUIRu2e5JliJNpzSotWof27QD8dAuq6R1wz6PR7xYAwpItyGIjCZDs0nsnrVQ1-HFRzd6QBcmwh0TOAbP0HCYGDEQ2DoXjTCABcPmlaBoeeWJxib8aM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

https://rollercoaster-tycoon-3.softonic.com.br/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAMjnGF RItUkVQgpeDAaPj5gBPLqpWVKNVAALD3NOy8ADXMKZXcLpkbjo5WiQYmRyuwHQi/.../cz3 5JlVdS7oPQ0kmNs=

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_en&type=PROGRAM&Expires=1451305995&Signature=GDSMEwobwB4NByqxre9Y1cZOJ3tH-AFHRwsBZHV2fMdVFRo066PbYD7YY-DMRJCHfbMc-30D~jpxBWBV6ElDBrttMysm25bnWK2oezUqgQFm3Cju416UCsYHpg2Zq0WvRovi-rTzfUlDqhYyjrKUrbtf2QFG1elQbry24MXODic_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_es&type=PROGRAM&Expires=1449907667&Signature=YcGJPuKEB4zVB~3bfSBfa0nfWmvuqrXZfD6wgZFTyXVVwk~pyxCWEmoyPkKbTf6zoYCyUkCvHZhd94yWwu0-ZsBsog6~FtvDOcxs0~b-D4gezWmcIm36mRHs4DjW2Fznr-k-ZrnPj53Pw2a-v03FzlVKO8rU86G0Z1e3rjegV~M_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_en&type=PROGRAM&Expires=1484564804&Signature=DYJDUzKC5bbRtrGXghYv83q7Yei48clHImBS1Y1xzFViiR0umQ9h79RoOB1aXRf9SqkvE0IbNTvd6C99zEFSF~UB3f~iWHO0EujdvvcYdN1lD8EbN7yuvIdfLZrdX~rMDvnz0GEc4YvgJqRIgz4uRvsvjZr3DjyKkMSkNdaLRiA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_en&type=PROGRAM&Expires=1487147915&Signature=bKS9Xlo5KJbinudAqa2dke3vQZsAbOLLxXZJGdP2ZMZIxZ8uTt2~Zp-avN5tIEgW~2xUtavUcl3d-bXy-9qYU4A~qvGPLT5KaFTQLfFhHMHeIySmvbmsxX2Og0kf1z6638bvoDIzp2JwBvBNtnx0m0HvsxzKw2VcEap9Lk2qbjA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_fr&type=PROGRAM&Expires=1484194778&Signature=KiEYlSZYMWy9tNEQcJvA36IO3DcwQBxqJZwIYMNlVIosWfXpWGIWS6PyYEeo5psrAQoXBu4-92AZZJK6fhX2F2aGe8Ye8gON3qBpAWKJzDyRlLsrp5EeXuXzHMQROAicsTUBxH-uWP1TRwutW42UDe2yX7o7xZkILgM28mSwUJA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_en&type=PROGRAM&Expires=1471747933&Signature=AHDvYcH6Iv1ZVxJ3HXrL8SnqoGO5eB0A~Lqd-j-oKfFJDOp~FJ7YMfGPOXupv6ec8me9~NoV38S2VqzKoxl8IbX14--mXbGRbzKOzwwe8wrS42KVt7qVKCdrs~uWLaymYKqJQkSEYbsJY5n19oLH~4F52emJz~5ppaLjBsUXm0g_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_en&type=PROGRAM&Expires=1483766186&Signature=KY4wtrpC3nTRDPuGUE8NqSeWxmIz6T7iTEEBIzvlZrYINQtftLu286ss0eW1EkMI22rHMT9AJq6aItWAel2emtyfAQ2OxvqdS~w1CBh5Lwv0WgpoUNXyw6~h5UUgVokQesFXk0sxZ7Tglw0o5KVAbJyyQrtIf6~NwQY~ZtF2Kqw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_en&type=PROGRAM&Expires=1466210950&Signature=AL5rLoxjOUB-fg26MKKUNulVdQWRcmAonmHCpyygRG4gpQiAlVL8x-kcIgcgP9g64Ie8rB2sJslpymBtMesu6N3gxH2Uv81PY4YXAmns8y6TrcgITrgSTRDI2qsnIB0aYhnsZPc6Td2gI76rmesCKIIcB2Z3~gkvaSzc0NrOQaE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_br&type=PROGRAM&Expires=1487733146&Signature=ZATnyqui9dmF4S9klUnXv37CJLMvjtjq1sxIU0aJXAdVxRPIgTzoNW5WDCmHzb9XVTMiunEOjKp0tV46ELZSiS2p~748dRZsFjqU5xGZ9MfbR9TZKj6dB09Lsw86JaOUF~RtAzQX5NveQl5k2RaHb7-212MJLuOXoE3NoMoVAQE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://i_eazel-com_rollercoaster-tycoon-3-1-1.ficgluretidas.com/crawled_soft/2/2/.../228823-667209-rollercoaster-tycoon-3.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_fr&type=PROGRAM&Expires=1485060996&Signature=UKGWuMaX5wht95BRwC6B7vUeGpfWnt2vFyttJxIFdmBg9fMqGnBBNNmph4SOZBu3bJksXBPB8hAU4kwTihEqOhhfXrQQA73IlA9Cdg2oGFOfPbKRKNr7RPRAKLdc9k9Hvpvrrl79O27b5AF2B3QrrhYeBqEyGhzrPSnuIY6PqbY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_en&type=PROGRAM&Expires=1458262488&Signature=hgsTQdrdSJDdlCsdwb2cnORX38AzP3GvTTQHh5jFRvz3qFXzqCH3fIZYWQimQhJHOMveBQMMEC1GEJLG8Jbj97QgL0L74rS8OoMECyQi77qwyh8pIwWtRc37680cqfQqj4jp0EgfOTPjSwi7ZSVxlDDEQmjQjjj4Pj9IurfxAF0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_en&type=PROGRAM&Expires=1465526599&Signature=Moc2s4Keaw2hxhyMDoqjS7tjMq2MNmyN8sXnRisLFH5OS~i059MkCuy9-ZPenpBndszMhzzAdEmRBiAqgYlrw1Y56bVIbLsEadgbybjWAWdGT4LesoD4ExFQ4Nyny91xvNHNqMlLG~oSrgr-oT4GRwQ9p~B4pfv~5Cp8L2ww6Hs_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_de&type=PROGRAM&Expires=1483865827&Signature=JnUhk3EopuNm8UxNgXXChyzcWl5GolQeFS~dsWbJ8Mb3OMSmRwRhp76PyyNXk0SyRwu~~ryMw5HF2w3CfG1A6Je1WoTrjBg3oMuIQ-2dsJg0u9r89~DjDoI0gArbUlB4xK6i6nLlzDZTDebG6Z~eQMNbT2v~Aw-8y~6y145uPb4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_br&type=PROGRAM&Expires=1440310949&Signature=Jm6XJVbabWoGMjeR3f5X4zBls8PW~By0HO2~M~~N8Eot-gFmeERBkpAhiR8lX8VsMR~UUN0Hziz~7Q0Qi9hlufMqchDJWoCOhYd08vrqwazas8C1amSJH4vHWLL1Wy~JUcQ6MhJfhjKeO9lRZ0AxnxERLP3hS-gSOeXPTrBL7sI_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_es&type=PROGRAM&Expires=1464744666&Signature=ZsR~-TjL-un946kGP~BLoUASBhcO6aa-GFichs-~aPboW4PuMWD5NoKLN8IeGPBjBuycAOxomaObyX2s6yC77-vdWxL4faTAgTG3RyVwTDTiGOkWx6BP5nDvEBvdb1FeM31Ept2AZuw6ag5zc0hO8lDuzUHvT7inJgqaKXYqG4Y_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_es&type=PROGRAM&Expires=1485424195&Signature=JqlHLOXA1-Kh6oP3U7Hju6qGMLTMxQhA0AMvxZB7YlWVeXELfSO8ZwvtH~6YFoFy5QGhh8SnWuxjVPekmyDl3J1qGnhoIb5c1qAHboeqpLvAPpHT1RiAVZqXC0xCTdGymEICj-C3yk0VwAvrayavw9q-ddFUiCBmo1tjMtsSVf8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_en&type=PROGRAM&Expires=1485312296&Signature=cxB99sYub~TavwdS-SbSR5Nt66XTvOvaGIE1F54NaRis2IqOBT3w5Otj-HI9soIClAkzNGMRP7RmQLjRCXhmmaLWqO6kc8zxCdS0qlQa8~vVKPEOoxJ0dlwl92s6Z5HI-sqfri~w-cBf-35aJDP-aM0tTI9oGhVKg0YKZxHfPII_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_es&type=PROGRAM&Expires=1472514769&Signature=CEcqKQGQqZ85eoCBfp-~T978OS2h4ojEDOSU4dBgzWwT7aSGCSIffmZn5qEOwsQZVW~GU47nLtZSHgxIuhSBqZY-FJQJuQi4HGZsUy0raDS4XCtTUrmGwAdP00lr9U23ZgULKglZDK22i2dGPO8w-m81BrwcwpIwJytby8PkudA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_pl&type=PROGRAM&Expires=1478337028&Signature=bzFtMsTFWk3bYtEJgt~X~dSva5bb50B3WrIB~Pdf8IYXpYP57tjmxj9lsLi0L9IlSA8DZqMEF8rWeI-bhGBuLq9afKkBQFSFsmUwUd-vjLb~dZifNT73NwcDX~70D8ERPXK8~Wvi9L1SMBzxHzz09tOokPY6neD9u2Y-BHq14OU_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_br&type=PROGRAM&Expires=1449922178&Signature=fEP1zY5txnL4XQWRVyyg~-rxcAo61YaU4Ko6CB47YB43J3KlZlZveOCCaNk0HePVyFoX0NKuc8NLD7XghnbLZm-OPXCh6L8bKBzbcp4BThIH-eI~BOTtJBDoM5pWjgCYv9USeFoMyQUytHrSRsotI4yc7UVNj2caFY9tGvAC8s0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_pl&type=PROGRAM&Expires=1475733394&Signature=ARKK~nQ8XpEDOZFoZQNYkAVKo6IBzOdJR9SuOyzwf6HDbGNzKDmIT8zXbQK8AdHjK3XryaY-lyuwqOwG54C89nrYmTZA1gX-FNjcnB9REnhMrOEC5HN6f0UDvJvNm1L7UyYI0cmEcaIuLA~~vjIB7FYiKvoW20iQDlfOduuqDd0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_en&type=PROGRAM&Expires=1478614707&Signature=ifR8cgobTBHwRiNZz-ysBAl4UMcK3q25NPY-JMW0VbweW-qqbncL28YStJv-jDdZAMuaS37omz6rx4jKuYMX4Og-tt9dowr-3ZyeuUtMba-LQ1kYTrlu7z2k8skgJh9gZAR5FFNu2~nYrMv0qQU~NJGuq00YuM89QWfmxvgXc2s_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_fr&type=PROGRAM&Expires=1463111678&Signature=K796b-f0EEslnu3b6nbog5-BfhjqOXjEdpclS8xZnXEWZK5JgvCAjzqEv1mb-ikDCdlG0Rh6BInoubGSf0CEsn2ey~TuMLD31dsYUfS9vQteF2cTlppG0qyj69uMcB38weZZR3sMp~k1lAixea~ZPvKsuqphfqvtkisrorDMSV0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

http://gsf-cf.softonic.com/37e/aee/.../file?SD_used=0&channel=WEB&fdh=no&id_file=36953&instance=softonic_br&type=PROGRAM&Expires=1438223202&Signature=OkbLPQVNY7lz7JkOnn~HserrmIooCG3iUcIF9kzqNA81bzWKi8FvEMT1ILNU0EnT3rI7eLwFJ2zJ5TETsS392AmHGGX8Ho-qiKvXEY6tO~tk~0f~AxFuW~nWaibBJ4VZVoIgonrckRDWeQyOcyCSs7wA7SoqFcPEGGAkOUgfQ4g_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=RCT3_USA_DEMO_1.1.exe

Latest 30 of 350 download URLs

Scan rct3_usa_demo_1.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.