home

mediacreationtoolx64.exe

Windows 10 Setup

Microsoft Corporation

Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft® Windows® Operating System

Description:
Windows 10 Setup

Version:
10.0.10240.16399 (th1.150722-1625)

MD5:
3e035e403521a9cd0fdc6f5f9423ba96

SHA-1:
bd5e295e24557d55783ab863ae96743e84a070fe

SHA-256:
24f9b09140487556a82bb8c0df2b7334a2f7a6952d8d739c6bd407cb197292d4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
11/24/2024 5:23:08 AM UTC  (today)

File size:
18.7 MB (19,646,888 bytes)

Product version:
10.0.10240.16399

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
SetupPrep.exe

File type:
Executable application (Win64 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\mediacreationtoolx64.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
6/4/2015 12:42:45 PM

Valid to:
9/4/2016 12:42:45 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
330000010A2C79AED7797BA6AC00010000010A

File PE Metadata
Compilation timestamp:
7/22/2015 9:07:08 PM

OS version:
10.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
12.10

CTPH (ssdeep):
196608:zdlTT5p1DCqsJaCbCBbZrNpCkHiGi+mVRy3hdjJDnoWj3fiI59JTNAvPGZ:znT5pRsJaECBbZviGi+/3hdVDo8PD8C

Entry address:
0x272A0

Entry point:
48, 83, EC, 28, E8, 7B, 07, 00, 00, 48, 83, C4, 28, E9, 6E, FD, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 66, 66, 0F, 1F, 84, 00, 00, 00, 00, 00, 48, 3B, 0D, 31, 9D, 01, 00, 75, 10, 48, C1, C1, 10, 66, F7, C1, FF, FF, 75, 01, C3, 48, C1, C9, 10, E9, 62, 02, 00, 00, CC, CC, CC, CC, CC, CC, 48, 89, 5C, 24, 08, 57, 48, 83, EC, 20, 48, 8B, F9, 48, 8B, 05, 08, D0, 01, 00, 48, 89, 44, 24, 38, 48, 83, F8, FF, 75, 17, 48, 8B, 1D, 2E, 2A, 00, 00, 48, 8B, CB, FF, 15, CD...
 
[+]

Entropy:
5.6431

Code size:
160 KB (163,840 bytes)

The file mediacreationtoolx64.exe has been seen being distributed by the following 50 URLs.

http://www.netzwelt.de/.../38521_2-windows-10.html?sig=0fae3ee3606fea48f063948f43a620ef

https://mega.nz/temporary/.../SxADkALI

http://www.logitheque.com/.../4d72502e.dl

http://data2.mujsoubor.cz/downloadFile.php?n=d2luZG93cy0xMF9XaW4xMDY0LWJpdC5leGU=&s=vp1fjemrktp0b5k6cotr55roc0&r=e9df1730c36b9285da8dce5de85d7537

http://dw.uptodown.com/dwn/yd97LWqeWMUwYg_ZOR2kjWRAgEijART25tlOkAWuaiLsc9KTZZp-95ORVRg3Wf0BR72PGpsX9ubVzI1zuEMBIt9GU488nC1LPmZ1ybfaPmGr9YHTI28fKa6p5n25SXei/yctI9KKcj2-WldVwwCas0wnKBzqPOLn9BWxl2i09A1-TNip8_luCsFq4G7U-nguDsAcS3zRfzNPQ4zfLoBO9BFlnv_7ATzfaWV980TpU-0yMMZcLMtZmda52zX2--zZv/RyEcVmrN40Msrlk0ZXObnNepXm8oaovkHYwqg121lZYcOQ5Hr5GEVIjOjbNzcN6lNtsT2DJAlegEsgTI1yoyfS-cp54aJZpuhKQSjk9VEK-O4U7kW8Ux9ybu4LL5xvAe/.../

http://www.bytesendclear.com/sTQ1RMgTiBCAHQqJeMTmXffLDjHlqtwXqjzUyIhMOHcpRomsHAQq zC14e5EjKYyYyj3AnWdYWgnBPLSl6Vv0xE65sxhLlw4yidY5dJ3mOlS3mPawWt4vNMDbEM8ZvC5swqhuwlwuHmeLopiCiG PNcH1W2vyWKsvXsPDq0P8lw1Dsn17m47tj72r71wM2OvCRM1dWNthNdeDr0q59hlKdRDxELFEP55 ugYos23xa7VhuqzZQKLYh4uKFJQjgzhQPtqnPCF48sMGGO6DfxEIoAlJO0DTEzvw9XXYkVwQanFae_RGqaghP_pzymdlvWBeTfppWIf4XejCPCKFqSwXkAX3lVc55FEqJdv1Ba8m9fBo00FQj27Dpqecv3Zxwdu7ewNb6LEnVE0jtkDdu_DxC70qH1PyamBpkBw61EsqIuBwRerZVvl51rPsTKNxeNpqf_EJC1uTYHTTa0PTaR_tDaCppZPVHohHu3_MCA8ldHYoVaa6wGNzDGqpwbT9yhc1_nkkMlHRJ5kmVnvUc qyrfQfat5JztDj7DAtzaI__Z2N_LsCtZIYr0HUavX8QOVe7s9YU3FUM9Yv7m2Ho7Pnp_taX6g0g==-G2UAAMRcW0y_KTwfilkshjLcIa_PbyztHePA4R4HhWuaB4_h8e9SIi uMRy5yB3kFqKz_2pvLPLBbxh1XY6QZ30T3Dfx2LdslU9olyOQZ7rNRrZKSAA=

http://soubory.instaluj.cz/dwl/f2eb6587f0b4a93df39fc1b55eb5c967/operacni-system/.../MediaCreationToolx64.exe

http://dw.uptodown.com/dwn/XiOcInmGnDnSM4SYGQUHhYzu67BTf5lTvqSladdScR2z81gmFYTpzi3Tu4EI76VWYvphieQ1GA7k_1DwxxaiJOnSPttSGljyiBdDqfMkE4xNhpnvjeKZiu3Ge2NW_rVK/yyTTVp8JgcYrttJdnv8Z_fxC4b-x6hjdWL9u2VYkWcyiUJfe-fJs8OgyGK9dArjKWjeLFm2HXZSk1deCrZspQ07BhCDReNe9pkCMEDwSb61yZha65QZ-Wilj4YE2j6xP/WPzO9lfGqWxm4Kap9lvfmGfutop196F41JmadjweE_brjEYnCTzdHkEhX1oN2lFsoe8dlNtFaUgNjuSib9XQ2rdX8gByFAzo_2HiNTe9Da55Frp--Em4xC4-jlQIj5Zy/.../

http://data2.mujsoubor.cz/downloadFile.php?n=d2luZG93cy0xMF9XaW4xMDY0LWJpdC5leGU=&s=flj1ltful982rmdqdub8e0l597&r=a73183a038bd59e93610e4275f360d8d

http://pobierz.pl/wp-content/uploads/2016/.../DirectX-12-Windows-64-bit.exe

http://tinyurl.com/nq9ut39

http://203.114.101.228/msupdate/1/C/8/.../MediaCreationToolx64.exe

https://userscloud.com/udky6cpe6sip

http://fileshare1180.depositfiles.org/auth-1472465055c048127ad8d28b7fdb44c0-181.49.93.210-2665318743-162855147-guest/.../MediaCreationToolx64.exe

http://dc228.4shared.com/download/.../instalador_windows_10.exe

http://data2.stiahnut.sk/downloadFile.php?n=d2luZG93cy0xMF9XaW4xMDY0LWJpdC5leGU=&s=lr62v24molaa9lun932ergh6u1&r=01291d78150c59906968eab203c4ce67

https://docs.google.com/uc?authuser=0&id=0B-XF0WS7F2qrT08wQzIxOXFKRk0&export=download

https://dw.uptodown.com/dwn/s1jn37C7OgLy_L91gHqrqQrTO-yeUQSl9_-fwfnsZwUFGQqVWguIt3sQxRHnkBPAG_JVE26nfVJ5yts4KO6KHSk7fTgZJ-3IUWx3GLC-VGdPGLfc0EO_3GHy2y-IkcJc/nFHxcfJPPmfj01QnvhMdz1Vz_PIagi9Ti5lQfFdmrOIUzmCrgWXfN4TyCvtGZlg96ewUQbSY1PpSD_tZh_XgxJ53jd8HP88cYXWy5i_NKEZ-t1dHbfTf-m5Qe1boGig3/z4HDd8y68SCqvb86z2ixDfgp8zTtK40ijcoWuln7XCfSYptEX1cXejZhSCe4QKYegmk0MqYBlR2U2vtjMBuoCcWTeBxj8d_jCPspLC4Vy11ChSPFOpBCWe1Ew3T7QiAO/.../

temp:instalador windows 10.exe

https://doc-0c-10-docs.googleusercontent.com/docs/securesc/jvcshc6vgt7sf12vkeqursugf02qhnnq/dsrh674kg5b2ge44f67na22gedfm352o/1438689600000/.../01911784737705543579/0B8DIOv81PXJ-NXZrMUhmTS1STUE?h=13754144378572611821&e=download

http://www.bytesendclear.com/KsW2Ilqhb yZUVARH7kSaro8YjfjooAntWpnb9qzYuXIYyEYZDPVGER79hMgDIsqQA KLsi19ClcbBrYITvYUzhD_s2IM dPtzjoBmu4po4pcoEvTb9IFtbwJ9TTlf1O1Gv77XimmWUqgLFiC Qng8ufD5mdun2i3S6HN2oZHgVA3pRNLqPQGz7nuR7ZB3TU7rW2DJRx5kjp129vdeHNvJaq0Dm3gFPk00e37RDcB76_LPNUT4wP58YThqmx1vyBfsALenrvg5AODRbpHh9LpyUvr9 okiQGP0wHuBPzggBNnfuFbjjo2Mb0FdEfI_wKT_HNc06RP6YGTeT2J4um8r9LUo9VDIic5mQqtXsDIbi0pmYBfLxkT00Gx2Aux7ESe7N PUqEPTRKG0ZhA0XePhSf0DzFIs83 wbLhqbGJ92mykIrxw5XEqILYDJe QyKABLPXLzTOSvsg8HZ8AY A IBIYx nfpM8vgy15z2u7jhMLbyVYCKCY TfBZ3syLrXR0XDs_ 4tljzfoIrsiFQYYkrqzaIYCwqZGUGs S2FtR77nrc8ku6ORyjfNe04ptG3Kxx8S0b_OPDqdXEl13Z4k9ECcEKqXhZffzvLzpCjTTR0Csq_8=-G2UAAMRcW0y_KTwfilkshjLcIa_PbyztHePA4R4HhWuaB4_h8e9SIi uMRy5yB3kFqKz_2pvLPLBbxh1XY6QZ30T3Dfx2LdslU9olyOQZ7rNRrZKSAA=-E

http://data2.stiahnut.sk/downloadFile.php?n=d2luZG93cy0xMF9XaW4xMDY0LWJpdC5leGU=&s=arsq26j5f2a6nd8binrbp32dv3&r=329790a2d47b7b7da236641887e61b17

https://wetransfer-eu1.s3.amazonaws.com/.../xVGEBvoEFol9kHI=

http://files-download.poradnikdogry.pl/SystemyOperacyjne/Windows/.../MediaCreationToolx64.exe

https://docs.google.com/uc?id=0B1XBqw_JNTsfbVBFR1VPUGFUQlk&export=download

http://dw.uptodown.com/dwn/UODjUtiJJO9BRk3FXbc5C7EKNtLWnlOq-708radvgjfn6Q5e0KLt9oE25PCWyjDh7zJg48uw6o-lZiiU9PD-HJE8JPFyhcS4lxjki8HvD6Z85cQFj-w8DLWuhyLxXsOC/OKl0ZBUI6ixhB8-1i3JW0ofZFNgzI23dz_jp7yNzuHPwTRRAiUtN-K-Wip8yd-tsBuzCylgyfTLFR3LgKU9ULs-bsgOvB58DldsuPKTrp9k7kkfgAI0GQodf0ZK5Umm1/D3n3TrDm1eJnbNHjewYVe1XPklIxmOHWaXoPWh3TWzDNO3YL_X728if4G_gOR4ZK5DKEUl-AR1XkboZU2QihvzEqaLSDnGSUp5MJjzRFIi-Ac1IvQS54cTsOLwcslZti/.../

http://fileshare1180.depositfiles.org/auth-1474394442a5375fbffe26336ac40b19-181.64.79.234-2687348866-162876868-guest/.../MediaCreationToolx64.exe

http://www.netzwelt.de/.../38521_2-windows-10.html?sig=230d1c035d9aa81d825c2d85ad719559

https://onedrive.live.com/download.aspx?cid=550A915FCA0626D2&authKey=!APVLa4kA__QvHhE&resid=550A915FCA0626D2!1596&ithint=.exe

http://go.microsoft.com/.../?LinkId=616936&tduid=(88334ccfb32146f885d8bdbcb1064ca6)(256380)(2459594)(je6NUbpObpQ-ZCz548hTbxHbzlC8FPMZKQ)()

Latest 30 of 74 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.