home

winsetup64.exe

B1 Free Archiver

IT Management Group LTD

This is a bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application winsetup64.exe by IT Management Group has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the New IT Desktop Setup installer. Additionally, the file is typically installed by a number of programs including B1 Free Archiver by Catalina Group Ltd. and Improved search - B1 Toolbar by BrotherSoft.
Publisher:
b1.org  (signed by IT Management Group LTD)

Product:
B1 Free Archiver

Description:
Setup for B1

Version:
0,6,0,1167

MD5:
405917c2a3071b4a9886fb7d9994e016

SHA-1:
9090474aa7f9448405ffe9b3718d2f065cf534ec

SHA-256:
e58bcef1ce1893f065c4d421e7c9cc52de92521c8fb3389f8018b67c3dc41064

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/24/2024 7:56:51 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Installer.ITManagementGroup.K
14.9.11.21

File size:
105 KB (107,504 bytes)

Product version:
0,6,0,1167

Copyright:
Copyright (C) 2011

Original file name:
WinSetup.exe

File type:
Executable application (Win64 EXE)

Bundler/Installer:
New IT Desktop Setup

Language:
Language Neutral

Common path:
C:\Program Files\b1 free archiver\winsetup64.exe

Digital Signature
Signed by:
IT Management Group LTD

Authority:
COMODO CA Limited

Valid from:
1/18/2012 3:00:00 AM

Valid to:
1/18/2013 2:59:59 AM

Subject:
CN=IT Management Group LTD, O=IT Management Group LTD, STREET=135 Arch. Makarios III Avenue, STREET=Emelle Building 4th floor, L=Limassol, S=Limassol, PostalCode=3021, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
009F750087DD24E5BFA7394C0A178EEAD8

File PE Metadata
Compilation timestamp:
7/23/2012 6:23:50 PM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:Z2remyLfiS5/VjZ/P59PfuOVBct5L4irxd:ZCe/rVl/P5JuOvcr4i1d

Entry address:
0x5D84

Entry point:
48, 83, EC, 28, E8, DF, 4F, 00, 00, 48, 83, C4, 28, E9, 1A, FE, FF, FF, CC, CC, 48, 85, C9, 74, 37, 53, 48, 83, EC, 20, 4C, 8B, C1, 48, 8B, 0D, 64, 32, 01, 00, 33, D2, FF, 15, 1C, C3, 00, 00, 85, C0, 75, 17, E8, 57, 09, 00, 00, 48, 8B, D8, FF, 15, 62, C3, 00, 00, 8B, C8, E8, FF, 08, 00, 00, 89, 03, 48, 83, C4, 20, 5B, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 66, 66, 0F, 1F, 84, 00, 00, 00, 00, 00, 48, 8B, C1, 49, 83, F8, 08, 72, 53, 0F, B6, D2, 49, B9, 01, 01, 01, 01, 01, 01...
 
[+]

Entropy:
6.1489

Code size:
67.5 KB (69,120 bytes)

The file winsetup64.exe has been discovered within the following programs.

B1 Free Archiver  by Catalina Group Ltd.
Publisher's description - “B1 archive is an open archive format, where best proven solutions were improved even more with new original ideas. It's free and available for both personal and commercial use. B1 Archiver is extremely simple to use, you don't need comprehensive manuals or guides.”
b1.org
45% remove it
Improved search - B1 Toolbar  by BrotherSoft
The B1 Toolbar (Improved Search) is an web browser toolbar bundled with the B1 Free program.
68% remove it
 
Powered by Should I Remove It?

Remove winsetup64.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.