12ad6c3b_stp.exe

WavePad

NCH Software

This is a setup program which is used to install the application. This is installed with WavePad Sound Editor. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
Publisher:
NCH Software  (signed and verified)

Product:
WavePad

Description:
WavePad Sound Editor

Version:
6.38

MD5:
015e6c745569e569c1ef4d2f7ebc8d2d

SHA-1:
8e80d4ad7706c4dbcb09d3e655af145f03585cc7

SHA-256:
8819095465833bd87faa19b10fb9e98c6a3cbb22a5be26b25d810b70a074eb19

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/26/2024 5:10:03 PM UTC  (today)

File size:
1 MB (1,100,504 bytes)

Product version:
6.38

Copyright:
NCH Software

Original file name:
WavePad.exe

File type:
Executable application (Win32 EXE)

Language:
English (Australia)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\12ad6c3b_stp.exe

Digital Signature
Signed by:

Authority:
Thawte, Inc.

Valid from:
7/6/2015 2:00:00 AM

Valid to:
8/7/2017 1:59:59 AM

Subject:
CN=NCH Software, O=NCH Software, L=Canberra, S=Australian Capital Territory, C=AU

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
58D9B9D38780932DD1CBC58A2AD28B1C

File PE Metadata
Compilation timestamp:
1/25/2016 12:09:42 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:/bt3qu546SWGRsRmIHaeqsjlIeUFkhpi85P4mG9RHxbYQw:DJ546S+J9We8khpZ5E3RbY9

Entry address:
0x11D4

Entry point:
55, 8B, EC, 83, E4, F8, 81, EC, FC, 16, 00, 00, 53, 56, 57, E8, 03, FF, FF, FF, 33, DB, 3B, C3, 89, 44, 24, 14, 0F, 85, DF, 03, 00, 00, 6A, 06, 53, FF, 15, 8C, 20, 40, 00, FF, 15, 48, 20, 40, 00, 68, 6C, 24, 40, 00, 8B, F0, E8, CB, 03, 00, 00, 85, C0, 74, 10, 68, 7C, 24, 40, 00, 68, 80, 24, 40, 00, FF, 15, 50, 20, 40, 00, 68, 90, 24, 40, 00, 8B, C6, E8, AB, 03, 00, 00, 3B, C3, 74, 49, 83, C0, 0E, EB, 08, 66, 83, F9, 20, 75, 0A, 40, 40, 0F, B7, 08, 66, 3B, CB, 75, F0, 0F, B7, 08, 33, F6, 66, 3B, CB, 74, 20...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
2 KB (2,048 bytes)

The file 12ad6c3b_stp.exe has been discovered within the following programs.

WavePad Sound Editor  by NCH Software
The software may bundle additional potentially unwanted toolbars. - "During installation of this download you will be given the option to install closely related programs from the NCH Software suite.
www.nchsoftware.com
24% remove it
 
Powered by Should I Remove It?

The file 12ad6c3b_stp.exe has been seen being distributed by the following 30 URLs.

http://dw.uptodown.com/dwn/psY_s1K7UsygPlsIQ68stpqfg9BKkYrbV8Rp2q2NNh9yIK1iR7lXEkfcroYnfovPkfkssf8URhPUE231nhrCJiif362DDUgtL5xqmeiRoN_3smqdlXmjowUwFHlTuVg1/pCba9hnAg_dkoMCFvppmZQevFPOSc-XIZMPsShgZAylt-tB90GSPRIJExmw1-MyvyiR4PmnhbnnPDm4qsQi_nFvOPcClWSSIkLXCKJnZHYK8Y9AOBzYr2j50GaEVFXU2/.../

http://dw.uptodown.com/dwn/ofm_iUxyUoLHyNFBpgoH7NY4EZo7leFxXtQBwzkkXu7rlRvV_Nn8EQUlWiX2qo4Kw7PGYj3xC5qDIQ0NFzuXsIf7CkInB-tfvntkeGhKcxvMUKa3J81JdCV13gxlmSUV/K522dXZ83ar7eWIGRElL83bwU0GBaWP-0Tc_0NUzNaGHt1OJ1JOw1aZZtauwT-jYa6gZ5wdinQXnofC1htlOd48TrK6ZpGZcJgmQam4mmjTepW77337s0mdWfGsj_16R/.../

http://dw.uptodown.com/dwn/6qUohNUJNsb8xDiyMsZM2I34scHt7jToa81bTaMf6gLHaZNVnkw0fHyW7jhvNdM3p6P7x1LwL7Chj0pN-sYbc7Rzfp9nhwTETWrdKKgA-djecQx7kDZfAPtHy76LNEvU/pnQy1jcSywvQjgLyVPiFEJ4TyRGO3aKQzQDQYmouCX6SQAMvjd96l_PwW1hVbOhqxzVEPM2iRDOp_XEj9WPCwwzdHgZ_xeWmpHXtB7M-VZahSXr0XqnzXfd6y8K_E3jv/.../

http://dw.uptodown.com/dwn/oD7k4LJ8FQvurLBjUPnHtHSA4j6mfTt2QDCzZ08PvO0dl3L9Nm7QBM8N9mATA_CQNHR-Phg4xHkm4sd7c2RH2IkcJfgEg6XlK0OiaiYvt4r_6WjN-TXuJ1E1KdKPEboS/L5LvAzih9nG3ZPNoFfqB9gmlGGiZYIP3qnWfunEuTZR-v0VeJKaMEvlsqjIs-vgAYhVMECHfPM69YgOdU6VnGsPyFjRy5TnAum3xCuo20EJjclUPUmOZr5AYShRwPrNs/.../

http://dw.uptodown.com/dwn/vBW0YiaHv-5iRt7mRy969HIS1n70h_HmxKQyUjOSvjGQVY_Lxkvpt2sBnuiKejfoWHtaXwdNKFKMD4wutiYo7WrDujXeneP3mJL05Yp4aRDL-Kc2E1Fd4UM9VvIQ3PJr/azM0DtpEO4XXCKMdtRlgaZaJU7e0w1V5MpBJyXWbCc-jUfjWuRj7BhXnv74GEsT7vfC_Sr8Xy-AZChQuvzZPNjlhizR-Run3WmHA1zunOQ-ZrBgT0KU8Nt9MRUaVsGtH/.../

http://gsf-cf.softonic.com/fe8/4ec/.../wpsetup.exe

Latest 30 of 30 download URLs

Scan 12ad6c3b_stp.exe - Powered by Reason Core Security