home

c0c951f6-8408-4993-a102-da728bcf6bb4.exe

WinToUSB

The EasyUEFI Development Team.

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
Publisher:
The EasyUEFI Development Team.

Product:
WinToUSB

Description:
WinToUSB Setup

MD5:
87e361e8515c7a3fc7717ff130c0e3ce

SHA-1:
8b31a005ccc199a64816f86812deef644383d271

SHA-256:
811c8f93d803c1a48936d3050a27f1767e05b9f9e8d683fad3318459c870f9ff

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 5:00:33 PM UTC  (today)

File size:
5.2 MB (5,465,205 bytes)

Product version:
2.7

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\c0c951f6-8408-4993-a102-da728bcf6bb4.exe

File PE Metadata
Compilation timestamp:
3/17/2011 3:22:54 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:445xLF4nqju+7OHFmTsnYHn4bx8eqq46596NCmP/NwlTnN/jW5:D6LqC0gna4qel5iCmqb6

Entry address:
0x16478

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, B0, 52, 41, 00, E8, AC, 03, FF, FF, 33, C0, 55, 68, 45, 6B, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 01, 6B, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, AB, 41, 00, E8, 4E, EC, FF, FF, E8, F5, E7, FF, FF, 8D, 55, EC, 33, C0, E8, 7F, 84, FF, FF, 8B, 55, EC, B8, AC, D6, 41, 00, E8, E2, E9, FE, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, AC, D6, 41, 00, B2, 01...
 
[+]

Entropy:
7.9914

Developed / compiled with:
Microsoft Visual C++

Code size:
84 KB (86,016 bytes)

The file c0c951f6-8408-4993-a102-da728bcf6bb4.exe has been seen being distributed by the following 10 URLs.

http://dw.uptodown.com/dwn/ud1Jt0Y-GT9PbCynr4ip9CqItSHyhY0ji--mTey9G85hfmERUsgJWr9qpuFFaYia_FCew1G-S3esbKwP0YD4FXHPlGGDwfi_jKps9wFckbyAm3C5RVxpV8Z_8KWXe5BM/jDFQP3adehL9L3WHXcVpxr9JaWYBKOHLOd8hcZH09zj5DyKk_3OqLRHCW4Jr8iqmGVNLpRsBXPWW2SMeSNdN9d1QBvknOoRjObAHB0qnK3sEl5fNfJX5ECzA51h-UwV1/.../

http://dw.uptodown.com/dwn/caO-LzQZAdjr_wiWdvDodk92sJp0R3_tU0TiKtXlg8DmE6eie0YKUo5trvvgRoxM0mttP9miunkfLafjW-euUtN596u34zy__yCw1Mp7S9PatOgfHjANKwHwsWrfhmsa/WrZyHUXXO8xcMQkXcNUfBS6AnmXpEtfZ5o9a7Cc7gNcb_SJCvrk3IGMlRVW88dB5sa3I5Fqh46PE2x8FbU6eETB7D1xMz5Al7PjS4omJs210nDwnugdBV_YlfAfJ7ku-/.../

http://dw.uptodown.com/dwn/cPioEOwMYpdqOMN5I86pxW_9edF729wgePHBlU741gNJIoqTwAItQm0oJIyktfcV8kVV9ULLUiKGGgzCejKJNoVGs4E97StTfuSsvI2jlIsJq6l6CB4IOQcSyZJTgSCu/o359lZtIL_79oBp8gZmlDnf5VCHoPBLdxdLpbnjoPSR9fxr0WvKOdt_HylRbNbUs7oBi6npGOMRawTrqb6mmVhJQyOOWEt4gSHDFM-OPrK4LH1CG5-s4eWaDcOxAWxoT/.../

http://filehippo.com/download/file/.../

http://dw.uptodown.com/dwn/rf757JNWzILE8dLO6exCXdDbS3_voewwlT1jldN8g3X6zGciaVEIHNXr-676ibKsMNMk6jhpS3hVLD0lk_OkaQKkHJNCsncQ864oNyfQLEq1ifBXUNN9PwUX_QNe_4KG/s4giK2QBTG2iTL4ea-YSijhODb9hyT8KXrvbcZ8feTHs1IxJXwgpy-iU_JuFHB9T4oEq04PHmXAcUFuvC8ItQwAeEZPWgvCnT5thPPVnV7OFPrxmFMpdoh8-6w9RR6WA/.../

http://wintousb.software.informer.com/.../

http://dw.uptodown.com/dwn/TTAa1SpPE5-pmavO2m6K2F9hnWesoJGzHCI3G7cDOgzu_vEhhIg1XqUkaQBQQJmirOmxo21WdDRHaxakhOI88QTaR7bCDI-r2angKNmwDIV6PmJyKXbGp42QlUTgAQWN/Icz_UFO5FgJCjP1HBgnUUp77TYTbRvk6U8FtMbRee5P9S3AaND-k5kdTjQxoQ-RVGwZOrmfHTDGYdORlm7s5VxO_XtdGQSkhrCa8ccpkdkhQ7Bkk4GPBQAoXfRGN3ZVq/.../

http://dw.uptodown.com/dwn/fBs1RsScJ733DsIa0ppcwuMhid3E3Q4d0HVEZ6LknRVuJz0-vtykOzgHda5YPIFGtdokyeK5UczNp43DKgIXPQH76EeEtlX-i1bfuCO3qS02Lp3QWPmZzyEepWTMbu_3/YOnAtdpTkA9_o8j62W2yvDlre_qbx7FyVL1Wnd5wTx9m66jLowKDQURDfzOgRP9M5d-E_wlKb8jgvEb0oNJ9WM8xdeOw7g7tGj3wkGppM7XcedgV7RbLZepfsqa7iIGK/.../

http://dw.uptodown.com/dwn/LPSoyx8CkSbCh-znPAw_2fq5AO2wbg_3ufMP236B4KpbTXfLTcYisq3O10iSPJIsifc8WhEiRkSflI09IUZvEzJbqEtYCQ3TWAlPUCIvZujxOc_RCP4JbWgcYLucn9Ks/Njp-KUp81QNVbJD7jRfI4OdN4daaOGRXtpHRRis-H73Bsq8fk-ExI3GFIDDJ8D5Zu7NlrbsEUeIz0We8tN2_ZxpTMmNXVsFAWwsLPjyQVhcICzKmGkPvOL1L5uFp_M67/.../

http://www.easyuefi.com/wintousb/.../WinToUSB_Setup.exe

Scan c0c951f6-8408-4993-a102-da728bcf6bb4.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.