home

setup.exe

Curse, Inc.

Publisher:
Curse, Inc.  (signed and verified)

Description:
Setup

Version:
9.0.30729.1 built by: SP

MD5:
6fd45e17311a3daf0f173f7dea77162e

SHA-1:
10588cb403c6994ab3fcff7598b2f55618defe12

SHA-256:
841b8915eb4bd5c942158aed852c0b61d62636c1b01d0133f685a764bf0cb436

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/20/2024 1:54:51 AM UTC  (today)

File size:
392.3 KB (401,760 bytes)

Product version:
9.0.30729.1

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Curse, Inc.

Authority:
VeriSign, Inc.

Valid from:
6/29/2009 6:00:00 PM

Valid to:
6/23/2012 5:59:59 PM

Subject:
CN="Curse, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Curse, Inc.", L=San Francisco, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0B06F7B42E377845287AF766559BB8DB

File PE Metadata
Compilation timestamp:
7/29/2008 7:45:50 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:OXaNjt6LuPHmLyiBvuJiFkJ+2Qw+MMq6FlOUeKJ6qja0ojDuUlu1AM:mYYuUx65QwDMq6TOUdeDuUlAAM

Entry address:
0x28EE8

Entry point:
E8, 94, 4B, 00, 00, E9, 73, FE, FF, FF, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 5D, E9, 75, 11, 00, 00, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 56, 8B, 75, 14, 57, 33, FF, 3B, F7, 75, 04, 33, C0, EB, 65, 39, 7D, 08, 75, 1B, E8, 3E, 4C, 00, 00, 6A, 16, 5E, 89, 30, 57, 57, 57, 57, 57, E8, 17, 13, 00, 00, 83, C4, 14, 8B, C6, EB, 45, 39, 7D, 10, 74, 16, 39, 75, 0C, 72, 11, 56, FF, 75, 10, FF, 75, 08, E8, 0F, 1F, 00, 00, 83, C4, 0C, EB, C1, FF, 75, 0C, 57, FF, 75, 08, E8, CE, 0B, 00, 00, 83, C4, 0C, 39, 7D, 10...
 
[+]

Entropy:
6.3516

Code size:
291 KB (297,984 bytes)

The file setup.exe has been seen being distributed by the following 28 URLs.

http://www.ranchsignbundle.com/Ble9sIY4tp9FGGkncWzoVRCGFt4z5UCJRk58khrsDIPnlc4QKNj_bT2rOJ0j2AXVselXHF9Xl8k7zHPMkMByxSOeW7baZ7glc8dJcVYTJUU4ArH3fU2iDeMt0cutjN57XJwBurIq0PshIJ3tTyLyj8ynnWCRe5OubmMI7 ovw4nYJm9UunY=-Ow==

http://www.shareworldpackage.com/8AfrKXQESs4ZL_pXekWhaqzpILNe0w5zE2J80tck91Nhjsw_h5QtraCh7pteK_glm5s8TIqQCxJnqI_8bDbpj9bUe9f9ElouPOHVBVyhLQKAyBNvMKMh89h8RQ ZfD4p3rCug69CagbWFDwzNVCXOPeqQDx88_LnN85yPT7oGkQ30y_JhB6eiKrYYNVgxaJKveCBfZfI6oJJ7ZVpfevde3T4w 9yRA==-G1cAAGRwXkyT8lIlTtiAA6dsWmdZZZBhY x8QXJGjZcjrtAnBD3fMTcMQea4Nda3wPO7EIIvNKwLYYGIppQLbJB9zuVty37c0P8e

http://106.187.35.246/.../setup.exe

http://www.youtubebyclick.com/ExternalSetup/.../setup.exe

http://www.capitalvaultsbits.com/POIXhfKUdsFyUF0NWWcueaAJSX3FEb92tFYuvwxjgQfNLGP6Rq qLwyLhDZH_eLMJMqxTLQFEpg_0ZqEkTdsfHc9ka IWFwSyfaUUb7UOkOjM8R hT3obAQRRm0ujlans6ShXSmCGiG_VbShP0i5KBllAxtNjJDdEFYAsqxMNH59du0r9u_TCVcjPlOosuTwP2cCRFB3zrNHb2Ks5qYiABfbPVxxfw==-Gy8AAMRTFhtBjGbzdOCQA_ZvjwKKNNgYO1cwopdrTPiBneDnmU cRsxObh0=

http://www.capitalvaultsbits.com/mjv6OccnyMyM65Li7_tjcnjCIcbEsmMp6pgFqUQMH3hiI85mPec llQ0 s4HCpnx5Tl4XlZVKw_Zg3ZocLsxXkCLIAeS8iv1Y5NaW p3mALtjsMPhXljaV8Fageg8izatJhrtx8tyY bHzFUYRj4EljdgVcTrJEVg7YpCZH498SYTpsiJjGDw1mtLZqHAYbEuAvPK087KNQfpONlrBlwrOKlD 7OqA==-Gy8AAMRTFhtBjGbzdOCQA_ZvjwKKNNgYO1cwopdrTPiBneDnmU cRsxObh0=

http://www.capitalvaultsbits.com/rpF CfpWV X34sl s8dMP3HiLcP9H8A1mAPMhUo1Cgf58e2MvWSZapG_fsFVDRo0iOJXAeV18G3mKapBWxbrmp8Sl0rsykIZOclMJjonWouL60FhXQyLEiQBs0atyKq3g20VV cgTznWwAmCTP7vLhT eRG2FHvfrXI0ZwwA3WejdFShkvoYXM3YGS 2oLRpycYioD17bKV9Rwxf3YvaZuKWnHeqxA==-Gy8AAMRTFhtBjGbzdOCQA_ZvjwKKNNgYO1cwopdrTPiBneDnmU cRsxObh0=

http://www.capitalvaultsbits.com/QwpePpX35unLk8wmsCWSxZOrWVpYZxoK0VZH0o9QDjuAVDk8KTyz9Wx6TUcJlFMsDura8ZRu eynjKf0R_uMNw1vzaQu91c2G4sObJtSqaVeL6dIw1SN36rwpOBU81ikpifMRLh0vsGZARmuiodfU tRsDsqKaijUXT0HBH9JqTISb4WaMzWh4 q2JBK5iPIm9faSPMWS lxTnd1_jZp46XSwTKiOw==-Gy8AAMRTFhtBjGbzdOCQA_ZvjwKKNNgYO1cwopdrTPiBneDnmU cRsxObh0=

http://www.quickbitsdownloads.com/CqF pt VA76AnpHJinBe5yxMLKeqPfnqzO9cjbaT05v57SCjvwNLxamOgCkUxwY4ZH6eh20QnQHtGMe PzgS3_StaFv77vXJ72yoIKeiFoRJgOMBCm3s_NHNjCItECq7ZI5gIwdje8uZ5jcTUgX0hEAT90IOYYUlWkVeO4rCDx5LmJ5zTtX0Gl15Ibywv V eFskM7oAfiZS4J7aAcFKvJeOCh96YA==-G1cAAGRwXkyT8lIlTtiAA6dsWmdZZZBhY x8QXJGjZcjrtAnBD3fMTcMQea4Nda3wPO7EIIvNKwLYYGIppQLbJB9zuVty37c0P8e

http://img.tvb.com/octoshape/208/.../Setup.exe

http://www.capitalvaultsbits.com/LKWiSprIv vth5H zW8zUFOWp6IodKZen4WBvWcO4lM1zKXkqX5AYUVN_I5RFVq pTfzVMmrZzEgsGcBa WI9eO2NNj9XwmfA6scD26lJ1WMBbEKf9qENjn8aed9UQcP6VjIdGJyCHQrHCeFsSL0jZzlT6xtOzeFrHuZXQQL5 R8FREsu7Zu9KxYUr8SSMIXm1FCwqz_DyWY_bUiRq3HjuWZ npUeA==-Gy8AAMRTFhtBjGbzdOCQA_ZvjwKKNNgYO1cwopdrTPiBneDnmU cRsxObh0=

http://www.capitalvaultsbits.com/sGy5V VAkb_XhRRGA_gpf3dHV64KcPHLCLurBMuoNmYW64bOZ T7VUZe1Sgki5cdx9tKWgI2U_rXe8x mkBqQ6Bx5ifw8kCP 2SZ3Ps2gPYV_pjarHR3G5YDVDBd P9NIvBNCi27GNA0Ll HF1E4m9GRvyOdUlqXG7LntE7e7OKGa0sPwVjV8SW4prnFuPft_WdLeB60FhZSVjiR5uKRJQAPEN4Xig==-Gy8AAMRTFhtBjGbzdOCQA_ZvjwKKNNgYO1cwopdrTPiBneDnmU cRsxObh0=

http://www.ranchsignbundle.com/sRx5vMqZ8eQc1ccwNMUeVi k9sjH1GNohwWKx_iEHiSunQD tyjAJ3tb_02QdKwi8CJPBkOmuNFbN4sIHjt2zB8TSTyxmGNZftG6 V8yMK2zMOVFKvYvLps9LVggWAnVenPUNsoPBVbh4vJ1lN8GXX1SxuKslpq3gyURWPkJvUDCCDxGEfI=-Ow==

http://www.quickbitsdownloads.com/BlvxtM8knd etrQ0r6DnHMc8V1Wxbm38pXdu14p6JJCVRSxEO6Jp1KC4Cx7hL0cguBfNaROftToVG47QmEGzg 4wHU_vhPqI7b8qKLtguhA5quWTIyIS6_52sKzwKoTj61LNUq aFpCjKoim1TWmN9DeZ8IRJKaB8PX_NK0S7SxhZ6NYdRZexn9zeNvlO9vV2uFwRJ7XQA7jqlKTf9Fj_PhoD Miag==-GzUAAETdFtsfHuJTehhcEBE3UdiAA5cSehoMh42xc0WD1tK RBm2WeoxCAth1_MeIufAkuED

http://assets-pc.between.us/.../setup.exe

http://www.capitalvaultsbits.com/c?x=ts8isZQVr8YaGdYHasE82E9d6K0nt2MbMXa89wy7H/c=&c=MGfqyWFN4P5cYTJq1QTTbOUdJSxuD4xG1x1Q47F5V65lPWFpHNqfXRug4Dik2RTiRgT05/JxHbC5kHBz5uoG1PSoPvLxrpen11mNex8y3E8oKjJPorbAFMMPYr7ikECyyUZVOYSJdmlSQxTwaV4XvyefKuRZn 2jAb8B9lfJRcI=&e=0&downloadAs=Curse Client Setup.exe&fallback_url=http://www.downloadfree8.com/ic/.../index.php

http://www.capitalvaultsbits.com/c?x=RuOKYAPU5i oyYgLyitGsdjEOVfYc6OyEpyONaKH2UI=&c=j1pMGOA934sLJHhch58f6Wx3Mhrcjp/o5zOR0owvNvuZ9ABRKR4 d2fUdtZrcJ0L7WOX5kK6ME3xvUAMt8E47QXkHCaeg9la0vn6nIWYqlbw/QFXVM3luvQ7 pU8PCamPuftygv tHGgV64s3fXBATGQk7CvjvPz/d9ZJ5Nruhk=&e=0&downloadAs=Curse Client Setup.exe&fallback_url=http://www.downloadfree8.com/ic/.../index.php

http://mstiteli-rm.ru/.../0-0-1-1-20

http://www.cleansignsnew.com/c?x=vhRF/6QIDZuwubtq9kH1mmxmHHw3oEycUOnisaZrAao=&c=io q k4urmdzaau4vR/NQqTPNivLNdRTn0qBo3nSxjlqwa cjjA3Mb7ShC2J3q7A0RTcNgwwCX8uLOCOVt4neScV9RIcuxGKe/ASTJ1WPcQQ XMUyNbHDngbfzYtPgHpx57Td46FUQaGoHO283dFjZArobEWFlZjHC1tbZ0BET4=&e=0&fallback_url=https://secure.innodl.com/.../curse-client.exe

http://www.capitalvaultsbits.com/WVl6OTRQWFZxZEhNeGVHbzNjbms0Vm1aMGFIZDBkMk5IUkU4M2R6WlZUbFJzTkVKblozRndZbXBZVEVGT2VtOGxNMFFtWXoxTVpsQnNlV2RHVm5OSmJWaFpiR2xWU21Jd2IwRjVPVVZUUWtrd1Qwa3phSE5yVEdGdVR6Slpla05GTTFCUGRXczVRVEZ1TjJsM1pFZ3dPRUZUVVdkb1FtUkRRVlJ0TTA5cVMyNTJSV3N5Um5KdFJWcDVkV1lsTWtacU1XVkdhRzU1T0VjbE1rSlpOV295TVhwQmNtNXFWSEJVVEhSNWJUVmFPR2hQU2tVNVZuSkVjMmNtWkc5M2JteHZZV1JCY3oxRGRYSnpaU3REYkdsbGJuUXJVMlYwZFhBdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdkM2QzTG1SdmQyNXNiMkZrWm5KbFpUWXVZMjl0SlRKR2JHRnVaR1Z5Y3lVeVJtTjFjbk5sWTJ4cFpXNTBKVEpHWkc5M2JteHZZV1F1Y0dodw==

http://www.capitalvaultsbits.com/WVl6OTRQVTV3Tm1SRmQza2xNa0p0YjA5MmNUaHRXR3BpUm1sNFQxRmhNa2wwUkdsTEpUSkNiMVZCY0hGdGJFMWpWR2MwSlRORUptTTliamQwZDBONVl6SjJPR3REYTA1M2NsUlJiVXMyU2tGMldFa2xNa0pwYUc5YWFHWWxNa1pLUVdRMlRpVXlSbUkyVTNSMFdFZ3hiVzVFVW1KNE1HbFFiR2d6UW5CTFRHaDFTRTlXSlRKR1pYZzRObUZRYTJvMk9XTTVjRlZKTVhGNlZ6TTNTRWx1ZEUwMmRqRlFOVWhrYVZGYVRqbG1ZMHR1TTFaT09YcDJNbFpyUzFWeWFIbFdhaVprYjNkdWJHOWhaRUZ6UFVOMWNuTmxLME5zYVdWdWRDdFRaWFIxY0M1bGVHVW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWjNkM2N1Wkc5M2JteHZZV1JtY21WbE55NWpiMjBsTWtacFl5VXlSbU4xY25ObFkyeHBaVzUwSlRKR2FXNWtaWGd1Y0dodw==

http://www.capitalvaultsbits.com/WVl6OTRQVU5wYVVSUGVuQnFTRVJNYVhCb1JXRTFVbUpqUjFoQmVtTmpSV3MxUld4YVNuWklkRzVxYkhGeFJsa2xNMFFtWXoxWFdFVmtUbFJCU0ZCbUpUSkNlbGhxUVhWc2VESmhjVzFQZWtwSmRuRnNjVGRHVURCS1UzZFJkV1poWld4SmJXOTJRVXhVYm0wd1JUVnNKVEpDYjNRNE5sY3pWbU5vUjNkSlpYWjFkMHhNTTBKdGRVRkNlRFl5ZGxwcmNIbzVXVlJ1Y0Vwc2VVMXhSVWd3VGtwRk0yVkJSRmR5TkVVemEyNVdNWFZZT0dOcGQzcFJTMWttWkc5M2JteHZZV1JCY3oxRGRYSnpaU3REYkdsbGJuUXJVMlYwZFhBdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdkM2QzTG1SdmQyNXNiMkZrWm5KbFpUWXVZMjl0SlRKR2JHRnVaR1Z5Y3lVeVJtTjFjbk5sWTJ4cFpXNTBKVEpHWkc5M2JteHZZV1F1Y0dodw==

http://www.heartcontentvault.com/c?x=nnntVATsGnsRYqZ02ZnKWYzHRXcTAH8QAjjIkNMi9pw=&c=QOjmC/LhU4sinG4KQYPO8xpF7GtRnSUUK QLkr48MsT /bnqiaE6VSgl5O0iemkyu00bSZFU07qUoY2a5i7QSHgA2PbSoJnXlGNcHO4/s3JcVp16MfLOEDR9/cjzLz3y4/x2YS7sTOcnCinfFLQj5OrhBqlp3AwX5Sy6I/AYd5c=&e=0&downloadAs=Curse Client Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://clientupdate-v5.curse.com/setup.exe

http://www.downtoad.com/.../curseclient.exe

http://www.onedownloader.com/.../curseclient.exe

http://cdn.airdlr.com/downloads/bundles/ads/new/.../setup.exe

http://clientupdate.curse.com/setup.exe

Scan setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.