home

the-following-s03e01-polish-subtitle.exe

The application the-following-s03e01-polish-subtitle.exe has been detected as a potentially unwanted program by 25 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from aaaafs.ezdownloadpro.info and multiple other hosts a web site host known to distribute potentially unwanted software operated by Rafael Leviev.
MD5:
1271465b8e5baf7e8d82233371ca33d6

SHA-1:
010a9f448f5c8b229d636cb395aaf0859d5df187

SHA-256:
671998dcde8572d7d21f885dc90b0f14228cc92ffc835fd200be74fccce0abdf

Scanner detections:
25 / 68

Status:
Potentially unwanted

Analysis date:
6/18/2025 10:20:49 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Mikey.8516
6544504

AhnLab V3 Security
PUP/Win32.MultiPlug
2015.03.19

Avira AntiVirus
ADWARE/MultiPlug.Gen
7.11.218.100

avast!
Win32:MultiPlug-VY [PUP]
150303-0

AVG
Generic_r
2016.0.3166

Bitdefender
Gen:Variant.Adware.Mikey.8516
1.0.20.385

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
21455

Dr.Web
Trojan.DownLoader12.36925
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.8516
9.0.0.4799

ESET NOD32
Win32/Adware.MultiPlug.FK application
7.0.302.0

F-Prot
W32/MultiPlug.H.gen
v6.4.7.1.166

F-Secure
Gen:Variant.Adware.Mikey
5.13.68

G Data
Gen:Variant.Adware.Mikey.8516
15.3.25

K7 AntiVirus
Unwanted-Program
13.201.15304

Malwarebytes
PUP.Optional.Unizeto
v2015.03.18.07

McAfee
Trojan.PWS-Zbot.gen.ep
16.8.708.2

MicroWorld eScan
Gen:Variant.Adware.Mikey.8516
16.0.0.231

NANO AntiVirus
Riskware.Win32.MultiPlug.dotrhf
0.30.8.659

Panda Antivirus
Generic Suspicious
15.03.18.07

Reason Heuristics
Threat.Win.Reputation.IMP
15.3.18.19

Rising Antivirus
PE:AdWare.Win32.MultiPlug.s!1075356738
23.00.65.15316

Sophos
PUA 'MultiPlug' (of type Adware)
5.11

Vba32 AntiVirus
SScope.Adware.MultiPlug
3.12.26.3

Zillya! Antivirus
Adware.MultiPlug.Win32.227977
2.0.0.2105

File size:
1009 KB (1,033,216 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
3/10/2013 4:28:25 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:q/ob25McNHWf8ThCF0hAVRIlVtbW/aP+/PuYxoseD9AXSTwue+stBcY5N7tlZ:qQPcNHW8hIfKF2/2YmqMwB+iRb7tl

Entry address:
0xD51C2

Entry point:
E8, DF, 14, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 90, 7D, 4E, 00, E8, E8, 19, 00, 00, E8, AC, 16, 00, 00, 0F, B7, F0, 6A, 02, E8, 72, 14, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, E8, 02, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
871 KB (891,904 bytes)

The file the-following-s03e01-polish-subtitle.exe has been seen being distributed by the following 3 URLs.

http://aaaafs.ezdownloadpro.info/hp/?q=vsIqoe ue6W0VYs9/Xhb5V4YurmAFiokZr/xNg6arjxhmL1o7MRqrNfzQHo2tKZMX8ZIRP0R6 jJpgJcAH6Z7SEDHOv2cTD4Rkg2le3kYCt5LLmQeVgOzsY8C60wmJIUEAiTtSp5NY314jNURn7A8G48MfdVqLcadtahrRpxLvhKdpjji4zZSf rkZjb6mtUURTCbzZZHUBBSNYxm0rDd3UhAwG2ZYquJ0QaY4vsXYFmFfSIJ Ba9QZDBYGZ1kVXwMPOeTiSAkXrbI1wj4PgYW5SKrycGMQK/jLekEdGuC1WV53ahXYaDf98ieZ//.../B1cQ35sUYkYqoVbDURJIk8Gl2MrvWlhIaXyrWGHIcdOxG5N6QjqoItvLiRrNRKWSdy8M6b&uuid=5DdElqys0qYXlhy9Etf3HAHXVSH4Kk4i2bt122YQWp6ToaXPD3Fgkn2KJZKkmqT5B30BmZ6E2IPf7g5lHkef0UqkjLm0tosxYzUEBfBSh0Wn61fpvsuKVGZmLN8mlA87sraeNIei2oAaRAHQAFDGJSBys1StMPx6NXPyobwOsRC66gWBjXk367r7GxCng95k2ZDciyBTCMtBVLHrwZ5t1QWLTY9mpV1wUwa4oYSUSHhxvmo1HBWmKpU1GkzB343hMsPYmMdwlvif21kFHRvmE3bw1bxQxRqLXzEVZ1D1VAVO3bJdTdNe7fRPULuBQfFpUh16tvxU9Uv7eOs2sLddC00bI8w14scUWibon9hI3r6wX8SMqODjR7csaYxOsZYkUzN9VVH3Y2OFBWNtq2Cu0GyEdP1Ckr78ziRwBfKEU3dAW2LJBli0ziieAIjQIvGfOfZODTHOSBAKLZPxORPVfVBzv37UDuk22m9DvwD2gJSIjZ60NC8sn1EKrCrqHKfdKs6pDqqOjYFhYk4JnX

http://aaaafs.ezdownloadpro.info/hp/?q=a73ZVWomXVa9aABCDWPQKz62DyRVv84EEsa4QYFwoZWlxjqi9nnb ODfIzwGTZyEGAaSEK E66Mzs4MXl ilpK1Q4lIllY1qpqtQ18KcoOGIPVHbcOA18mXFSA0q/b5DGK9vT8plFXiE 2fQNJUWkHsi6UVdjPhDQg 212y4ox3xzKyp KLmYP1Ndbtyuazt5rC80kNeuQ7569cKBXW2Rc2hXcZQ36YJRuEO7i8aW2Bi7ADNS6AcerHS1rsVWUH3gocGPJ9U9fHB9XSONCfSmMDOKgu /2zIpJFsMG74dahqV8osYOhUc1KIOe8jwiwhI7BWOoeJY8coSwr/YE76LZCgtP esxq3/B6 WabVTzWZT6QR0r7pQ24zqSrX2Hg38YpHP1grSazdv0K6g/UM7z8Cbgtz0f/X6vCTDyIttVWaEsXv124woDuBamvTCRRPNkI7Cnc2nR rTzXEhp/jZv6aPjS6qQjTY2G6/5xnL90VWxyJABHD3v1H81xYt3ZlkGWEwehENk4qhMP/.../IlMaOCTcIYPElyy16C7KUgO8nUWpPmu0o85wzqPAUbAG04JKZATMU Z9Mfz7owvVvoWxEzVXG1tPmWRavIX5KsaGDAhQCsiwUocnLMpJaSgf8tpeyAiMUER5hdqbG1jJV TsQ1hfdgTZv5MVJ5wIavh&external_id=1425664609404938006&uuid=51E5AEIbs7isCsctaAiJOtPnUCUMSqSylrKGXPtlGQtf5VDUd6vLmFw4ks8FFkFc4CswpMBvq7TGwIOB9oTNTHviKGjVGuIuRtXYnCvPsZVWvNuLbC2V2zcPBHforLeF0VdsL0JB

http://aaaafs.ezdownloadpro.info/hp/?q=a73ZVWomXVa9aABCDWPQKz62DyRVv84EEsa4QYFwoZWlxjqi9nnb ODfIzwGTZyEGAaSEK E66Mzs4MXl ilpK1Q4lIllY1qpqtQ18KcoOGIPVHbcOA18mXFSA0q/b5DGK9vT8plFXiE 2fQNJUWkHsi6UVdjPhDQg 212y4ox3xzKyp KLmYP1Ndbtyuazt5rC80kNeuQ7569cKBXW2Rc2hXcZQ36YJRuEO7i8aW2Bi7ADNS6AcerHS1rsVWUH3gocGPJ9U9fHB9XSONCfSmMDOKgu /2zIpJFsMG74dahqV8osYOhUc1KIOe8jwiwhI7BWOoeJY8coSwr/YE76LZCgtP esxq3/B6 WabVTzWZT6QR0r7pQ24zqSrX2Hg38YpHP1grSazdv0K6g/UM7z8Cbgtz0f/X6vCTDyIttVWaEsXv124woDuBamvTCRRPNkI7Cnc2nR rTzXEhp/jZv6aPjS6qQjTY2G6/5xnL90VWxyJABHD3v1H81xYt3ZlkGWEwehENk4qhMP/.../IlMaOCTcIYPElyy16C7KUgO8nUWpPmu0o85wzqPAUbAG04JKZATMU Z9Mfz7owvVvoWxEzVXG1tPmWRavIX5KsaGDAhQCsiwUocnLMpJaSgf8tpeyAiMUER5hdqbG1jJV TsQ1hfdgTZv5MVJ5wIavh&external_id=1425664609404938006&uuid=51E5AEIbs7isCsctaAiJOtPnUCUMSqSylrKGXPtlGQtf5VDUd6vLmFw4ks8FFkFc4CswpMBvq7TGwIOB9oTNTHviKGjVGuIuRtXYnCvPsZVWvNuLbC2V2zcPBHforLeF0VdsL0JBophpEk6Ne7TQfKinvCo0LftmKgysgjJ0oGhnLu00Lhbzw0

Remove the-following-s03e01-polish-subtitle.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.