home

crescendosetup.exe

Crescendo

NCH Software

This is a setup and installation application. This is installed with Crescendo Music Notation Editor. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
NCH Software  (signed and verified)

Product:
Crescendo

Description:
Crescendo Music Notation Editor

Version:
1.66

MD5:
ccd312a2db0a5082bbcd768d29e60797

SHA-1:
11db88720064a83f1c6c57fd83433bb7071c4262

SHA-256:
36964148c080ee9dbf84c23fe5f45943d51a95f313820818d88090e4829f8475

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/26/2024 2:15:16 AM UTC  (today)

File size:
669.3 KB (685,320 bytes)

Product version:
1.66

Copyright:
NCH Software

Original file name:
Crescendo.exe

File type:
Executable application (Win32 EXE)

Language:
English (Australia)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\crescendosetup.exe

Digital Signature
Signed by:
NCH Software

Authority:
Thawte, Inc.

Valid from:
7/6/2015 1:00:00 AM

Valid to:
8/7/2017 12:59:59 AM

Subject:
CN=NCH Software, O=NCH Software, L=Canberra, S=Australian Capital Territory, C=AU

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
58D9B9D38780932DD1CBC58A2AD28B1C

File PE Metadata
Compilation timestamp:
1/24/2016 11:09:42 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
12288:6dbjSnj0jVsa7t9fWlbV0n3tBMKJjckWqbCKMYFFUkkehkohgmlO:ejgjSkVqdKWaqbCKbFFJrkJj

Entry address:
0x11D4

Entry point:
55, 8B, EC, 83, E4, F8, 81, EC, FC, 16, 00, 00, 53, 56, 57, E8, 03, FF, FF, FF, 33, DB, 3B, C3, 89, 44, 24, 14, 0F, 85, DF, 03, 00, 00, 6A, 06, 53, FF, 15, 8C, 20, 40, 00, FF, 15, 48, 20, 40, 00, 68, 6C, 24, 40, 00, 8B, F0, E8, CB, 03, 00, 00, 85, C0, 74, 10, 68, 7C, 24, 40, 00, 68, 80, 24, 40, 00, FF, 15, 50, 20, 40, 00, 68, 90, 24, 40, 00, 8B, C6, E8, AB, 03, 00, 00, 3B, C3, 74, 49, 83, C0, 0E, EB, 08, 66, 83, F9, 20, 75, 0A, 40, 40, 0F, B7, 08, 66, 3B, CB, 75, F0, 0F, B7, 08, 33, F6, 66, 3B, CB, 74, 20...
 
[+]

Entropy:
7.9878

Developed / compiled with:
Microsoft Visual C++

Code size:
2 KB (2,048 bytes)

The file crescendosetup.exe has been discovered within the following program.

Crescendo Music Notation Editor  by NCH Software
During installation the program will offer the user to install the NCH Toolbar, an ad-supported web browser toolbar.
www.nch.com.au/index.html
22% remove it
 
Powered by Should I Remove It?

The file crescendosetup.exe has been seen being distributed by the following 7 URLs.

http://gsf-cf.softonic.com/11d/b88/.../crescendosetup.exe

http://cts.vresp.com/c/?NCHSoftware/018a7977b5/.../a8d70a89d1

http://www.nch.com.au/.../crescendosetup.exe

http://www.audioware.com.br/baixar_soft.php?id=1344&arq=http://www.nch.com.au/.../crescendosetup.exe

http://crescendo-music-notation.softonic.com/download-tracker?th=8yS3 KGEYLiw7GKMHzA/trmsvRChbxdrflJq3ZIylWtYBgkfBSGVUfFEc9RcKaBZW0TYDv06/trKymKL uRJPsE965AUmEt 5jnFUdNWA/.../QwrEVJsy5rtXM2AM01gNt5 QAZ8rS0pCLTtQ7t5gLhv0FJALNtrVD6Y30=

http://software.thaiware.com/download_url.php?id=16364

http://www.nch.com.au/.../crescendosetup.exe

Scan crescendosetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.