» wlsetup-web.exe
Overview
Analysis
File Details
Downloads (16)

wlsetup-web.exe

Windows Movie Maker

RICH MEDIA SYSTEMS INC.

The application wlsetup-web.exe by RICH MEDIA SYSTEMS INC has been detected as a potentially unwanted program by 18 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from windows-movie-maker.pt.1800download.com and multiple other hosts.

File name:

wlsetup-web.exe

Publisher:

RICH MEDIA SYSTEMS INC. (signed and verified)

Product:

Windows Movie Maker

Version:

1.0.0.0

MD5:

2d16ad524a4047ba391abc73e8e821d0

SHA-1:

6c2e2fa6b427dba1e63f538f94b0226f23db382b

SHA-256:

a20a85bd3d3bcb73ef2996c75964d40153fbaf650bff5af77b4f6803e0d59072

Scanner detections:

18 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

10/15/2025 6:27:56 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.OpenCandy

2015.04.22

AVG

OpenCandy

2016.0.3131

Baidu Antivirus

Adware.Win32.OpenCandy

4.0.3.15423

Clam AntiVirus

Win.Trojan.Agent-855157

0.98/21511

Dr.Web

Adware.Downware.10304

9.0.1.0113

ESET NOD32

Win32/OpenCandy.C potentially unsafe (variant)

9.11512

Fortinet FortiGate

Riskware/OpenCandy

4/23/2015

G Data

Win32.Adware.OpenCandy

15.4.25

K7 AntiVirus

Trojan

13.203.15666

Malwarebytes

PUP.Optional.OpenCandy

v2015.04.23.06

McAfee

Artemis!2D16AD524A40

5600.6787

Panda Antivirus

PUP/OpenCandy

15.04.23.06

Qihoo 360 Security

HEUR/QVM42.0.Malware.Gen

1.0.0.1015

Reason Heuristics

PUP.Installer.RICHMEDIASYSTEMS

15.5.8.23

Sophos

OpenCandy

4.98

Trend Micro House Call

Suspicious_GEN.F47V0413

7.2.113

VIPRE Antivirus

Sevas-S Installer

39562

File size:

415.7 KB (425,648 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Common path:

C:\users\{user}\downloads\wlsetup-web.exe

Digital Signature

Signed by:

RICH MEDIA SYSTEMS INC.

Authority:

Symantec Corporation

Valid from:

2/17/2015 3:00:00 AM

Valid to:

2/18/2016 2:59:59 AM

Subject:

CN=RICH MEDIA SYSTEMS INC., O=RICH MEDIA SYSTEMS INC., L=HENDERSON, S=Nevada, C=US

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

3F87144C25AF8BCF29F29C5A1FEEF4BA

File PE Metadata

Compilation timestamp:

5/20/2013 2:53:00 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

6144:QiucV61t6kp5nKz2LRkZ5h0WA0uE+a0MY909UEshS6F01st2HbLkK0z3Yidpi9ZB:QiulskpIz6kpDWHjh8f710TYidY+P4

Entry address:

0x331C

Entry point:

81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00... 
[+]

Entropy:

7.7910

Packer / compiler:

Nullsoft install system v2.x

Code size:

24 KB (24,576 bytes)

The file wlsetup-web.exe has been seen being distributed by the following 16 URLs.

http://windows-movie-maker.pt.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylERjxZdXVvOh152b0sCsrn8kFdE3mYLC/NXK8ykYMayDMR7juXfdr0bIjzseUDR7WpnGsUwG0pSbgzayEs4SJyjYJs55ziVdIRinkGDU2nsQj7GyjBDfGB/9Ow4TrMT0VPuZue01NIaS0XHl1as/HIQkpz6vnGDR8IdHg2q4/.../C9UwJ6GYmz9DRTPg7c=

http://windows-movie-maker.pt.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GRH1cteQv A8/yOn9np5iNEIJ1Xlar74N3quyxdSM2OGCb3 W/VrkvAlhpqPDE b/ibyHgGu5i/gzLbM84aeyDZW/MRr1hdQXzWtCDRny4A79WjwXWmLB UCnJimdCUMK7M2JQpZavOiRHE8cs/LLAll0OKxVmNlZcKng/NgRjyouRnFn/V XcvpYsntZXNWzcK D JnlR8f/.../hS20CIxX7c2pACC9oZrJkC0obPVJRo4veSZ3ounkFx9rnBO53t9EASeiDAv5sc sh1Zna2DP4WAV2dvaMnOtTEnbg7c=

http://windows-movie-maker.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzadbB8rpouTq54XUvlJ1XeFq6OeCpfWG3g15bOHHPQr21E w9wrFrh8yfDR7OvD3zT0zwsmn40quF8Z6bg2gIq5Y6kQwbAGSsSTR3ntEq/TnxGWmaSq4ckZPzPHQNbbMgKhEGMa/lXTl1fsTcc1Ni1eOxAC18coT20 U8DW29t1/E3/VvDoD7KZa8ZDJW2cuvH shmxUc/.../rBQfhopPj1QRmNHDOqi5Qz9KQOnOiV0DPg7c=

http://windows-movie-maker.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylERn6Y9TTtuh152b0sCgrn8kFbk3iYqn5Nnq wEZTcWmOEfv4W6c8gLNnztTaXlLFoGi7Hk20sn21maOO8o2N03FA4p8ziUdDXXG1AX1/l8k7uHKuSGjaSrpW2sXjMjMPYas5bBIOM6XlAiM8OJKfb15g0LPvUSwkcY/glrRrWjb98UeSw7k1UY/gIZn7LWNXnMu/F/.../C9UwJ6GYmz9DRTPg7c=

http://windows-movie-maker.pt.1800download.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmV89fDKhEgqnKJyK97Yk5jz0o2xwwtoKKkLja7C/NXG20gsbIGjPEe6tCvJune0/g4WPDE b/CXqSh jqnD8gfPbvNvalGdDqIc7wF9DVHy1Xmc21J94t264BnGSA7Zdwc3zcG5ZPOZ1bAVSbOmuA2ciKZWbZAkpz6vnGDRlIdHg2q4/C2Oot1PGnv9 D9G3dMi8OSgAitO2XuMlmhcHqtS 2By9Lrcywn64VocI/Mz4SX/.../5sZnn1QRmNHDOqi5Qz9KQOnOiV0DPg7c=

http://windows-movie-maker.it.1800download.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzadbB8rpouTq54XUvlJ1XeFq6OeCpfWG3g15bOHHMQr21E/Y9xrNywc UBQyD9GzyCkzl7iTj36CTvNKbm2BBs5Q5hEdJF3yjACwjzZ987CC5UGKcSq4blIS0c3JHdf5nfQZae/rlXTl1fsTcc1Ni1eOxAC18coT20 QzDWi ulPE3/VvDoDkKZa8ZDJW3cuvHuo2lF4f7oLvzgGsfKEsnS2uCIxX7M2pBz37uNKamyYyZqRIBo4/.../CsXhBmhAT3joMQTGuiFAawqZnu1Ul8amDP 2AS18vRMnesTUjPg7c=

http://windows-movie-maker.1800download.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjylERv0aNTQteh152b0sDErn8kFbk3lYqn/PGG3g15eOHHaRLXzTfclyPpqx8yPBgWW7SS7BkT9qiT8mf6SpN7SgyQS/8FvxBZQXzWtCTRn15p97CCjUGKRS/.../t9tKx1QRmNHDOqi5Qz9KQOnOiV0DPg7c=

http://windows-movie-maker.es.1800download.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsnV0kOjGuGhjga5/ZtukkqzyqsGMxwd0EP0Xlbb/0NmG3g15eOHHaRLXzTfclyPpqx8yPBgWW7SS7BkX9qjjm3 fa99PZmWgIq5M6kQAKFC/.../9yUirv9h Pgbg5VozoOJe8ZDJW3cuvQqo2lF4f6oLvygGmOvUy1D6tQMVc7s2pFyCq883B02liO6RIBo48MHUx97v5SUUmzQvtiJsdRjG8V1am4YjvhAUmNGCd4T4G1prZMni6RkLPg7c=?_ga=1.24090426.1630245641.1429399836

http://1800dcdn.blob.core.windows.net/dir195/wi/18/33/1/.../wlsetup-web.exe

http://windows-movie-maker.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklYzNSrgRFunJJmTqKRjv3ur6j1gwJgELk31MeKoLXj/ylZSIGCPCeLkErY90fk5kNSWRAaU9T39BU/1uGm0yP/SpMueyDdZqtY6hV9QVnSiDjZ8hshq9CnwSCfdUrcfwsbrJTYVY/o4KRIdZfCrAi89asWNLBgonqDtFTQuO4/02/9gRinj8A/dl6ZmBZa/ecOtb3Bd1sr F oujV5MuZr21FL5ZqE2nS6sEZAe/Mz4SX7jodbJxHh/IPVRTsc3OH8porb Xlo931/.../rBwT5sd29mVt6eTHZ5TVShIzObSPzEAPPg7c=

http://windows-movie-maker.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklYzNSrgRFunJJmTqKRjv3ur6j1gwJgEK031PuSgayb 0l8bOGCGCeiuH6c8gLNjztTEXliD9GzyDkzlu3itgLbbrNPKziBZqtY6hF9QEy/5XmEy19EivSH8UHHMCPwFipLzPG4Nab0xLh8HMan3VHE8cs3ENF172LPvUSwjcpfw0 gxBmCouRnFn/V R8vpYsn3ZXBU1IK3HuM230RB/4O h13yfK98ni6mEcQe5MWxUT2toZrTkC0qdbdRTsc3OH8porb Xlo931/.../rBwT5sd29mVt6eTHZ5TVShIzObSPzEAPPg7c=

http://go.microsoft.com/fwlink/.../?LinkID=255475

http://windows-movie-maker.pt.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GRH1cteQv I253eq ysyl4pHaAW7erC/NXK1ykYfaz3YRK7kBehoheA12ZvMXFnT7SS7BkX9qjjm3 fa99PZmWgIq5E6kQMbCCO1AX1/lcYj7GymGTbdBfxBj5KzKWJPPas5bBINOb2zEmh0O8TPLAkjnqqnGCQvatqxw Z2BG6woB2WwqszQ9Gve4GkbHtOmZjpD JnlRsf/4r/.../44JDnzR1lZybWsyke2NPBNXuhR0HPg7c=

http://windows-movie-maker.es.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklYzNSrgRFunJJmTqKRjv3ur6j1gwJgELEfteu lfDPgkR0dcD eEKqtGbw90f45mpLCQE MonC VRPq5Srk3rfDpZrSkmlZ58xkkV4BXnCtGDx3kcch9znxGWmaSq4ckZPzPHQNbbMgKhEGMa/lXTl1fsTccER 2PSmAC1mcob4w w8CXux8VDMlu01Xcave4GkbXtO3MKvFqoumRcHuMC91BqtfKEsnS2iAcZe6c6/.../i8JuSkD5kI6RIBo48M20iounkFxlrnFXpg89PSibgDgawqZju1VBmLHmHsm0ez56Kbib3AgLPg7c=

http://windows-movie-maker.1800download.com/get_azure_file/wUiS4WnYccXBwj zXP7oQkEsml0kPDu1E1v4ZtbB47xquTC8sGMxwdgEP0bub6n3fHm/ykYYazeeEKqtHb8lxrBpxsaPDE b/SXqUwXlszi1jP/D6YCGxTwM4oc7wF9DVHy1Xmc21J94t264BnGSA7Zdwc3zcG5ZPOZ1bAVSbOmuA2ciKZWbZAkpz6vgGDRzIdmnw Z2BGi/.../hS6kBstV59WwAHPquYPTw3gybO9JRIw2enUluvDyVVo4zEOi3IROEijjDwjxqpLswwRmNHDOqi5Qz9KQOnOiV0DPg7c=

http://windows-movie-maker.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv U8/zOh/jwnickFbk3kYqn9NnSuyxdSMWmeW7DzCr50ybxq1sOUDg6R7SS7BkX9qiLm3 fa7dPam3FIooc7wF9GXmTxU2Ighshq9Cr/UHHeHP8JjIKhKnBSOqdnZ00dOOz9VXBtO5eaNBB7hqDsGWUvfo/ghKV1VyvvoFGWlv5oBpu9ccWnaHdXnMu/F/tg2w8eroL8h0r5fKE2nS sEYkEutWwAHPvuYOSmCkkb79RTsc3OH8porb Xlo931/.../rBwT5sd29mVt6eTHZ5TVShIzObSPzEAPPg7c=

Remove wlsetup-web.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.