home

edainswitcherinstaller.exe

This is a setup and installation application. The file has been seen being downloaded from www.moddb.com and multiple other hosts.
MD5:
d08fa850770f2888ed1f9ab1f6831df2

SHA-1:
1bb9fc6e85e9990f0e5be2cfa21cacc4e492686a

SHA-256:
132c895f256b062b1a3149599cfd227293fb216bf22dbca2cb2b28ee4959c25c

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/30/2024 11:47:24 AM UTC  (today)

File size:
32.3 MB (33,861,042 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\electronic arts\the lord of the rings, the rise of the witch-king\downloads\edainswitcherinstaller.exe

File PE Metadata
Compilation timestamp:
4/4/2016 4:18:59 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
786432:yStfnCErV0C8G5+aeEe1Xl9fj+wkINV2BTAhu1ZFGivmcgZNx:PnCVGKEedXqNB0hqZFBu/

Entry address:
0x310F

Entry point:
81, EC, 84, 01, 00, 00, 53, 56, 57, 33, DB, 68, 01, 80, 00, 00, 89, 5C, 24, 18, C7, 44, 24, 10, 98, 91, 40, 00, 89, 5C, 24, 20, C6, 44, 24, 14, 20, FF, 15, A8, 70, 40, 00, FF, 15, A4, 70, 40, 00, 66, 3D, 06, 00, 74, 11, 53, E8, 7C, 2F, 00, 00, 3B, C3, 74, 07, 68, 00, 0C, 00, 00, FF, D0, BE, 98, 72, 40, 00, 56, E8, F8, 2E, 00, 00, 56, FF, 15, A0, 70, 40, 00, 8D, 74, 06, 01, 38, 1E, 75, EB, 55, 6A, 09, E8, 4F, 2F, 00, 00, 6A, 07, E8, 48, 2F, 00, 00, A3, 04, E4, 42, 00, FF, 15, 44, 70, 40, 00, 53, FF, 15, 88...
 
[+]

Entropy:
7.9974  (probably packed)

Code size:
24 KB (24,576 bytes)

The file edainswitcherinstaller.exe has been seen being distributed by the following 18 URLs.

http://www.moddb.com/downloads/mirror/88733/102/e1793f653fedd7e518cb915c290bff19/?referer=http://www.moddb.com/mods/.../downloads

http://www.moddb.com/downloads/mirror/88733/112/c5754e551382487fc81cd2d194e16377/?referer=http://www.moddb.com/mods/.../downloads

http://sjc3.dl.dbolical.com/dl/2015/08/.../edainlauncher1.2.0.5.exe

http://www.moddb.com/downloads/mirror/88733/102/459682ce0fc2360bf07fdca3cb915de4/?referer=http://www.moddb.com/mods/.../downloads

http://www.moddb.com/downloads/mirror/88733/.../b3ec2de4cc35e6b73271ee7121455ecf

http://modding-union.com/updates/edain2/.../edainswitcherinstaller.exe

http://www.moddb.com/downloads/mirror/88733/107/614f1551f89d8495aa49e18518bb3104/?referer=http://www.moddb.com/mods/.../downloads

http://www.moddb.com/downloads/mirror/88733/107/068f29cac4679d366d69a4d44a526f36/?referer=http://www.moddb.com/mods/.../downloads

http://www.moddb.com/downloads/mirror/88733/100/f4a05923c0e1c8db8d63acfab65c6b6b/?referer=http://www.moddb.com/mods/.../downloads

http://www.moddb.com/downloads/mirror/88733/102/1a44bbf4b391d8cd4bc6e5cd1efd3d9e/?referer=http://www.moddb.com/mods/.../downloads

http://www.moddb.com/downloads/mirror/88733/102/945629170c9fca1dd0484dd8a9184e83/?referer=http://www.moddb.com/mods/.../downloads

http://www.moddb.com/downloads/mirror/88733/100/c5754e551382487fc81cd2d194e16377/?referer=https://.../

http://www.moddb.com/downloads/mirror/88733/112/141eb548836b90673ef6d18691ad6e48/?referer=http://www.moddb.com/.../edain-mod

http://www.moddb.com/downloads/mirror/88733/.../1a44bbf4b391d8cd4bc6e5cd1efd3d9e

http://www.moddb.com/downloads/mirror/88733/.../1a44bbf4b391d8cd4bc6e5cd1efd3d9e

http://www.moddb.com/downloads/mirror/88733/.../141eb548836b90673ef6d18691ad6e48

https://modding-union.com/.../url.php?id=32

http://www.moddb.com/downloads/mirror/88733/.../945629170c9fca1dd0484dd8a9184e83

Scan edainswitcherinstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.