home

setup.exe

Re-Enable V2

Tangosoft

The application setup.exe, “This installer database contains the logic and data required to install Re-Enable V2.” has been detected as a potentially unwanted program by 3 anti-malware scanners. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. This file is typically installed with the program Toolwiz BSafe by ToolWiz. The file has been seen being downloaded from forum.raymond.cc and multiple other hosts.
Publisher:
Tangosoft

Product:
Re-Enable V2

Description:
This installer database contains the logic and data required to install Re-Enable V2.

Version:
2.0.1.0

MD5:
d139d9732b580f15322307e773f15c1c

SHA-1:
239ea80c441b1730f661b9e115af96bd3e19343c

SHA-256:
3e7b829ebb713af89a90c11e8b2d80be3c78141bf7cde6bf8119a732fa02a5ab

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
12/26/2024 11:52:24 AM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
AdWare.Win32.Agent
4.0.3.14129

Bkav FE
W32.Clodb92.Trojan
1.3.0.4613

Reason Heuristics
Unnamed.Threat.14
14.3.6.16

File size:
1 MB (1,093,707 bytes)

Product version:
2.0.1.0

Copyright:
Copyright (C) Tangosoft

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
3/1/2010 11:28:24 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:cupp6tQ35SBplvQmYbA7PsVV7Cv+/fb2apeZdiawdAu6Zd:cUp6tQ35M7vQmYbAzuVI+/f6au2Cd

Entry address:
0x23CFA

Entry point:
E8, F8, 5B, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 83, 65, FC, 00, 56, 8D, 45, FC, 50, FF, 75, 0C, FF, 75, 08, E8, 6F, 5C, 00, 00, 8B, F0, 83, C4, 0C, 85, F6, 75, 18, 39, 45, FC, 74, 13, E8, C5, 0E, 00, 00, 85, C0, 74, 0A, E8, BC, 0E, 00, 00, 8B, 4D, FC, 89, 08, 8B, C6, 5E, C9, C3, 8B, FF, 55, 8B, EC, 83, EC, 10, 53, 56, FF, 75, 10, 8D, 4D, F0, E8, EC, FC, FF, FF, 8B, 5D, 08, 33, F6, 3B, DE, 75, 2F, E8, 8F, 0E, 00, 00, 56, 56, 56, 56, 56, C7, 00, 16, 00, 00, 00, E8, 17, 0E, 00, 00, 83, C4, 14...
 
[+]

Code size:
197.5 KB (202,240 bytes)

The file setup.exe has been discovered within the following program.

Toolwiz BSafe  by ToolWiz
www.Toolwiz.com
About 9% of users remove it
 
Powered by Should I Remove It?

The file setup.exe has been seen being distributed by the following 7 URLs.

https://forum.raymond.cc/proxy.php?link=http://.../setup.exe&hash=d75d79b9d45a4328a1d293e8cbbf82ac

http://kyle.mxp2317.com/ZRm-Upv1qfMvD6CZDC7CgSFytB5arumblQWDYGgbonuUo23StIyy7EmrrM_583mRf2SKX4BtesNJTyFe6WlGz5ry4wdcOJPChTZZhXodFBN3pS143OOfebobLGGvad--?sbb=sKlGiNGykSjSjFGiWoSSQ5xzwt5A9APOzeNZaxsyfWkvao3gXVMDHAEBGAIXkD9sw5acaZgdSGmrGHGyAwLrPw0a7SFSAgP2XfSmsyIwFnufxEYjnQVutsPlsFHryNstQxiMHD6rScpimjE4sBzRNmkaeSIxiQZyCedmrnXCoSbJwNJ0OK95OdokR4mTxr026PArv28PC1thk1O6MBUVZgi6u61VPJQkHDcTM2tGxlxDJQTrWdeApss6pM4IWqZXXX8ZMRxhDOTHyG0LB51bU8stYrMERf35MkojsPkrNixeuCA3lUB7tMDPr6OJe0UJRy1DxOv1XlQH7EyHoIKx7ft9xqAUQYnCufzQXxYFATWWXtjiDAAuKFXKG8XAvXarJ7TjuE7lrmy1ngbqJUl9KocOpYwyEMxjZu1VWBx68lcoiL9Bli3h9bPq5YDGlBDWJDDyqnbCgrQ2mW8mlA835fGSXqB59g8yI1Bw7mf4nm4MCfBihFEAVf7a0dpIdQGWaQRtKwTPfkAz1JrJS9qMfHri5CJXQkkly4shv9GS0ISe3TEn6WlZoy4OE3ooW5dYiqHXMna9BAu4je1N8vJSdPGzUY6Soz5bfiz80f1gqGi5rBHUcapn6Xv9i6mti4O1hmTWzxbn7E93ymQqvhW3TpnbIW8dG7RT4l9gQf3rZN7uHFcCLpTQxOcW972y0pvSMBS6xuq1f6BhhN0OTh362iIVmtqc0pVBUh0JKHF1kZ9Uc6QrDUoeUhxE6tbqT9HeMdEWn94NyqqkpXRIB35FcZuFzLstWWbFmhrEzB3Ah5IyyJVzKST2HJ31wtWi2TgWDMUJ8MAI38x

http://ttb.lpmxp2113.com/download/request/.../XPK1gkLb?__tc=1408421146.329&lpsl=e3482ae015b9513216a856655fe1a80f&expire=1408507538&zt=52b1b4ba6d47cdf63d000003&PubID=52b1b4ba6d47cdf63d000003&tgu_src_lp_domain=www.newplayerupdate.com&ClickID=&n=Stream in HD&fileName=Setup

http://ttb.lpmxp2160.com/download/request/.../F5ke6yum?__tc=1410373854.828&lpsl=0fe469b8519defe169a7b721771efda5&expire=1410460234&PubID=151018&tgu_src_lp_domain=www.softddlupdate.com&ClickID=7042442291410373830&fileName=Setup

http://storagenl.info/.../?installer_file_name=setup&affiliate_id=1_exe

http://www.raymond.my/.../setup.exe

http://www.tangosoft.co.uk/setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.