home

c.exe

Baromaroro

The application c.exe, “Baromaroro Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Product:
Baromaroro

Description:
Baromaroro Setup

MD5:
69442264b45df32031207bdd6314e27e

SHA-1:
91f0093baa38c21c47b750aa4264fd99a3199c1e

SHA-256:
9a0b2449e018cd79efb1aa3b41b4e376eee94c97c5299b3e4c77942ea9031f64

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/28/2024 12:47:37 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RE11 (M)
16.5.16.11

File size:
1 MB (1,052,999 bytes)

Product version:
2.5.8

Copyright:
Fast Wizard Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\c.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:dHsXdMZjAomR9Ev5OusSFoaa9x1rk8+rzEv++0uacyC:dMtMZjAlHEvOSFodNrP+rZ+gG

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file c.exe has been seen being distributed by the following 27 URLs.

http://www.safeupdatenow.com/c?x=G1qWOBPdOVyr3wz3MRUBK m5wHfw1GhrKQND3dS0HnY=&c=piFeT0mN62fk08ZmPZAafPNk6Jl7AN6C3qL7EEL2TK/LD50XwoHZ/c YGUZ4W3Js4MwW68FtOgYiLKo6j/Y0EXM8z/2stShskWYCu1SILx3gzqKrK9Lg6Y4Q6UriJDRS&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.currentappdownloads.com/c?x=XmBCbvYrQq9JrW1u51lCEFnysdOjzb8oYWpZ1tbIvFQ=&c=NaeH8fJ/cGyzl9d7NEDfL65A9TtRmEQYUScY/FMQsBrAVLrBm3yPBn/BOsyWdov6ZknUfvmsCWBcr7EHflFl0Z HCFySFVeooNdeCDo3W8ugZtZSaTS9bOAxvuwiXuee&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.hostgiftuniverse.com/c?x=GNkC7uZHuQc Ikm2tIZMNtjI5oAjo1vKBKCQrg4khl0=&c=1nJFN6rDLysjvuvBIwhGBfaxi5WZteQX2zybSsyjHhw/pvavewvvR93WQwOUBaxUEbMhjbAp90N2lHkNzq6sZYv9WJPLPXO2nDS/CUuwKAT6s2A11DOHuipQVChs/Hru&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.applicationflashpresent.com/c?x=T8iD2nVn2DgXGnjwaoMhf/n5vWFPKfiBIlWY9SA9uTQ=&c=RVXuZ3iZYGEU1XtU1c5lU/E/fN0rxF0Hq4JN61PXwstzBfDhIhzjYwkwZVtztXA6z4a3s AR 6HkowHA7m1jLYhJ1s2 cC /kBSou9yCII74nYpdknvMH1UEjyQ54xcT&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.bulktodaypresent.com/c?x=0GUVAC7VPCj35PRRH9baz287YDE2LynrL9 nm9G/PRA=&c=B/f6U645RJ6OOzlBPfqwFfgX/cOg24MT6N4xxrMkSKxDkZHAfjZmOQ IJ0gsY z5iFFed6Eih3LKBKV4c 0M16z7TuTTChcvPm6Mr9tMbjcx1A7P2v0qGsjZzqQQeZBa&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.dlpresenttours.com/c?x=av61sGb EQ/lt6sT3ok7fzEZpgGQh7SHTelMy0Z0 MI=&c=PTD jmu2/u42nleVf1kcyeAQmE zQUOOyM7T1BSv0fv4JLFMlJVrEWVYGrK1VtSz2aZxVQbBSN3fud4h6lyQGjqEKY XdcZqWDWKFSgBMppVSjhpOnQ7oSFvhbp/4GBJ&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.chucklebodybits.com/c?x=5Y/DxrzZt9NO6R7UVlPc TgmM/AXEnp2OXpE4z84SuQ=&c=JLL6qX60Ea1Y2fRc41NLXvZL/Zc3GK5axzazGBzYDzHSM O/4H6ESlxBSgFaHoh5grN7/lF9OhH8g1 LdGGJQAnl78wHbejAalgxs49kOl1STIBYCHgboXYuDlEGqbCE&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.worldbundlegift.com/c?x=13zmHQmbx7p5Krtt XZbSf6qiOc5SOdQZM7rZIOBceg=&c=8nSEk2nxKa8hxGG0CmeqcqIYXo0c uFE7vz8ridwFY6HlxPn3kzmqww3IyvUonMVWxk2mSHHTBmBFxixTIVIGcGT2T8d89zIGEFc8F8zFPIg3TxDJVbfYDdczcG7pVa8&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.hostgiftuniverse.com/c?x=3 o vDsF uBLtM7/0/NK9Z2g7whvKej4lAn1a2SkJYY=&c=/J8l4Fu38OguA5rUXVRimJMQh9UdGIzXyRUJFVlj ZFAzeXPoCPXHIQxq2uNcYY/tSB0OI0leODXUZ6jAyP2CM yctTAmH5b082UbWoNf6TyNIQTKQAky/3twSAyGP1Y&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.currentappdownloads.com/c?x=FOcjng12SUym9XdjaAA7x330bqIUmasqLWL1f6Q7ySk=&c=04d/eY1Y lQjbfbFYfv3/cPC1QX9HnfRdm2R8FZ46Q4R/Kb3W8ONSXR/a3AstfY3OzCfIFAWLEBRIdqnHKFA2E1koZt1gJwF5okEJ33RInzm2ILE4CNi1avGTWKv3wIJ&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.townflashranch.com/c?x=0QZ/LjWIeGzQ/iH5/lqwBSloQZolULgcY8P9BTscePc=&c=1NO8pA4vG7oDDt4rZROTefW5CJZ6sRBg/AQuweCjamrqf3cvBhxf5aA1f28WNrXSuVnUpVc6qpb4G9uFq1vnEvKoHMVylKTkNGvSMPUzzrBWp54rDutfOMANUEVDKQeC&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.conecptmegadelivery.com/c?x=3rulSx/VxznWhJNawbtvNh uZ8ET t8s3D 3M rNh7Y=&c=3LwV66bCWXjBg059QhfU30vY3dlBpREA AqvQ7sr6m0eXYGngXMd18xJ6xeffSF8vLjtld xj3VLTJInZyLRrky duYUe6lfX15yFtB5CMdlmjQfK5 UDz8/dl35J54&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.bestsharehead.com/c?x=nPSLmRGob3XOVDwyGUset/E9u0LRq2s/9kWulhQA/7g=&c=B6NnmnUe8umhxWrpdSC1Se/gFsyOY/07pJbQfzU4 z1WuYC6EINQdzgrUHFv67FkmWyH7nT sFsCoU5L yW11ovFABxyDpAF9AV9EMAIsQFx/GgZL1KVE1bCObovIanF&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.flashtourslaboratory.com/c?x=ONIz1Nslz6ePk2Hzkd9ZIlYZ J9582zcJAYVSrqIGow=&c=UCtvKXjpfg8P2vSWXWiDn3Rfx9c6UzKrPzR7d0KkgXp xIdjE7aG5OpBculn8Lzd12kOxlexE/MjRT5MP7vHx/9zODM86kn7Vu4TRnP1V3U3jNWjMRtBNizORCms1AEL&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.appsapplicationshare.com/c?x=FnTS7 5CZC1xFebmASVIajAscW4PCI1Lva7xZtV/xoA=&c=P4YTtLDEpsQOiySAVXhHimUmXz6qXjRGi GkNeNWnYPNmjEXxzOt/ixtAww8B7j310ovgsXnwLpHeqz2zd28VdI2GkLunIctolfvuDFeCEGR6qp 8XoS9SrxIESSME9E&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.apptownnow.com/c?x=1jw42VAKMBwwUhVhAv3GYstIahLRHT/L/J9JWyCl8T8=&c=r ZoE/Jb9PAgKoVYWiZw OxeINExgz9Ss4d14afG9hmYDQD2wnqt3pb6l2sl6Z0gDHpygSI6nV7kx63SB mJ 9A9mTbSzcb0tFXPjw2UWAFIOfaeHd5L2eQgwKWdJ8f5&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.currentappdownloads.com/c?x=eb40PwGkdwBAv25awKA7oKvGgv fn22njPeQsv4MoF4=&c=hU/YRLMX2YAxHIE9g Zefa9cc2VBtrE/ulJPb/AreddluTM8z1FsMSLzo9NrwNYwldE9dElPS0DI ZihCIFenHYld8MjBcUSNDMfg/HU3zDjifLsUNJBajbwBKQFEKm/&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.worldbundlegift.com/c?x=dOVsDQ9Ehi6dsmrxrnVlIT04xNcPPEfm h2zy22kirg=&c=nf5 NT3KIpPp 6Xvej6w5xu/VTAhq5P4KHpiAUkOacsfn8/ZFzZTUDKGexLBrVOgA2q18BNTeNduLQ9tAXIc5gZhnEVFszBCVxB7ixIqCDmWt0GsiqGo 4s0zNsgengT&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.bodytowersquick.com/c?x=FEMT4Nzqwin/CQesFM54jb6 WJdPmZT9a F2wzMlUIo=&c=VOuInw83ixk6moqy2X/4f2xCFOAQoyVw8pB0R5JBF 9TkfWVS18klFH6/wpGF5ZzjGGr7I9FClgIECDbj4zdSgLmAdjp7j2EEc1t3BBftoa5BdlVtVWngH24QtqaxYno&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.quickchuckledl.com/c?x=Kyqej3sntmoIRtcxjorPrWCHcrbu1bzH9LQ9ofLlskU=&c=dsFVWoVzhPdcfnRix0VBFiWHFh6c7nl2frfZEdfV4q066uMvdyWfJuayLoM9eUTYUFPMNhU2lGgJpwP08Lzy4lwPaQ9T9gWXR8XsC0cYOZBaNYl7uQGNVc3ulCZJ7QQQ&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.flashtourslaboratory.com/c?x=6VO94X2tvti/DN9HP2rpgj I78XzZlNh4Nq3M5VYV3Q=&c=SGJscJT66J1ccfCZMM9EYwE3kGLWJbLemBjQgI3qk/5wVOuqePZWr7wCUrNyg6LTrfGIW5PSN4Vd9MlWqOxHAz4o5kjkKOYjXb6jNrMFXN9W8j2Ho0llGO hWzgAAUG3&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.apptownnow.com/c?x=9yjcUfHXLXt7q56GhulfO/mLIq0zyiBMJUtq0UjuQU4=&c=6 WYyJeLqF3FpZvlTks0pXS/ZdzU00lPOwAp/G444ySgdodRBhIMtFH2LzBoTGrl576dR/2t2v8sN7t/1yomo3QgE6QEOvHfXXvHS/7w 8r0pXishUj6MYCv4hxiPinF&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.ranchtourhosting.com/c?x=3vMA15sVSG9rgiJOgBHejNt7UnsRkwJzq72r4lnyPXc=&c=gEU oG uNPIUkoz6r8mpwvVmTuhjtuUmVHtmC5JaMuZpkyyNYxSSUtP9TRtgNeAIdMZKN9DOVIuuUKCGqBf6gVE5Hbo5GMdNPXMF3KVpn0rCg/uYPi0Cc21oMOmK04eI&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.softwarecapitalfarm.com/c?x=33PX9Wrx Vy8 9l2odrncfmNT7Am8aFpDQuW8LLCXOc=&c=nZ72OQXFA2Y1KifyJxf1m1tRrswjdXq/MGSgaGXBo9OstIJXHys3gXVGp4bj9FJpN8phPtZrkMI2rfCPBN22P7G0zLrl0Eg6yIBGFajOxz4KpKEB2P/jsAkH0eSaBqHR&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.softwarecapitalfarm.com/c?x=p/aj3naWGu/bxVft5JZ4 PmsTD1qIl/p8LmtDrWMP6I=&c=LhHDVDAPp8FjC7FgM1 8Wns2TNWkfHdjqlzr7mtkxSGhqp9Ohqh3D/bmh5Vf 4egd4lZkgDePAzJMuyKpAFfLZzeiOzVap4v8P4qqxA3RC/6oAKkIPja kj/s 2WXt4n&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.bodytowersquick.com/c?x=/KXu9268EV2UhEyMLbDgXhuFBwT0aFa45kxc ycLb7w=&c=hhQDFfCsd/pc5HzaJ9a/RsYJp3eAcxpKTFT6CtWcBrDiIVw4TDO6AxjzKvrr7b4a5 QlhNeRSPr4gFM2KeMVKEiRGuDtS2PAxA0rcAVhOFxMQ08y9AzqjSIgu60hEozw&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

http://www.appsapplicationshare.com/c?x=udbnnclg4Sew2TX3rtPpjD6wfA0mXx251AIWH9ZMMyY=&c=me1IV4oF6QKyZJNslfOIxWaIBFtcK8xRqz xnIqlDipJocuO5mDWwoVa5CUNsHupKlNXjvDDQNYLmjyMNMQHSh7DO2OVpsxvd JVktH5qgm7L6D1y8MceZwFBYwuA75a&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe

Remove c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.