home

tb_free_installer.exe

EaseUS Installer

CHENGDU YIWO Tech Development Co., Ltd.

This is a setup and installation application. The file has been seen being downloaded from scf.sohu.com and multiple other hosts.
Publisher:
CHENGDU YIWO Tech Development Co., Ltd  (signed by CHENGDU YIWO Tech Development Co., Ltd.)

Product:
EaseUS Installer

Version:
1.1

MD5:
11b8f0b23a70b5bef6ceee08493cbe1e

SHA-1:
3cf2b5891df7bbf8ff6de3c04ea7f0184c9b6f44

SHA-256:
dde550e61d7f8404c1477bfa4a56b54dfea7cd0a2b5d295d3e0a58c1bca39cc4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/27/2024 5:44:03 AM UTC  (today)

File size:
569.8 KB (583,496 bytes)

Product version:
1.1

Copyright:
Copyright (C) 2005-2013 CHENGDU YIWO Tech Development Co., Ltd. All rights reserved

File type:
Executable application (Win32 EXE)

Language:
Russian (Russia)

Common path:
C:\users\{user}\downloads\tb_free_installer.exe

Digital Signature
Signed by:
CHENGDU YIWO Tech Development Co., Ltd.

Authority:
VeriSign, Inc.

Valid from:
4/23/2012 1:00:00 AM

Valid to:
9/12/2014 12:59:59 AM

Subject:
CN="CHENGDU YIWO Tech Development Co., Ltd.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="CHENGDU YIWO Tech Development Co., Ltd.", L=Chengdu, S=Sichuan, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
33C34CCA6E6816B62B677D44B06835E5

File PE Metadata
Compilation timestamp:
12/31/2012 12:38:51 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
12288:HXwOrReFWQFw9CrRCTpNPbuxMpt3wuf8JNnGytSURX+vr5zap:HXwOrRsk9+ANPcMpt3w8MnGy7Qvr5A

Entry address:
0x1942F

Entry point:
55, 8B, EC, 6A, FF, 68, 70, C4, 41, 00, 68, C0, 95, 41, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, E0, A1, 41, 00, 59, 83, 0D, E4, 2D, 42, 00, FF, 83, 0D, E8, 2D, 42, 00, FF, FF, 15, E4, A1, 41, 00, 8B, 0D, CC, 0D, 42, 00, 89, 08, FF, 15, E8, A1, 41, 00, 8B, 0D, C8, 0D, 42, 00, 89, 08, A1, EC, A1, 41, 00, 8B, 00, A3, E0, 2D, 42, 00, E8, 1D, 01, 00, 00, 39, 1D, 50, E9, 41, 00, 75, 0C, 68, B8, 95, 41, 00, FF, 15, F0, A1...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
99.5 KB (101,888 bytes)

The file tb_free_installer.exe has been seen being distributed by the following 49 URLs.

http://scf.sohu.com/.../cTrack.do?m=MTM5MzEyNzk3NTAyNF8wXzcyM18yMzMxLnNjLTEwXzEwXzEyNl8yMjEtaW5ib3VuZDAkcm9uYW5fY2hlbjIwMDJAeWFob28uY29tX3NwbGl0MjAxMl81NzE1N19zcGxpdDIwMTJfMzE3Nl9zcGxpdDIwMTJfMTM5MzEyNzk3NzEyNV9zcGxpdDIwMTJfMA==&p=be2911cfb417337970e45a474e379acc

http://scf.sohu.com/.../cTrack.do?m=MTQwNDgzMDk0NTAzMl8wXzIyOTcyXzg0OTUuc2MtMTBfMTBfMTI2XzIyMS1pbmJvdW5kMCRtYXJrbGV5d3NAZ21haWwuY29tX3NwbGl0MjAxMl81NzE1N19zcGxpdDIwMTJfMzE3Nl9zcGxpdDIwMTJfMTQwNDgzMDk0OTk1Ml9zcGxpdDIwMTJfMA==&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTM5NTA3ODkyMDQyNV8wXzE0OTk2XzM0NzQuc2MtMTBfMTBfMTI3XzIyLWluYm91bmQwJGNhbmRqQmFrZXI5OUBnbWFpbC5jb21fc3BsaXQyMDEyXzU3MTU3X3NwbGl0MjAxMl8zMTc2X3NwbGl0MjAxMl8xMzk1MDc4OTIyNjM4X3NwbGl0MjAxMl8w&p=be2911cfb417337970e45a474e379acc

http://scf.sohu.com/.../cTrack.do?m=MTM5NzQxMDQ5NTc5NV8wXzMxODU0XzI2NTQuc2MtMTBfMTBfMTI3XzIyLWluYm91bmQwJHF1aW1vYmlvbHNAZ21haWwuY29tX3NwbGl0MjAxMl81NzE1N19zcGxpdDIwMTJfMzE3Nl9zcGxpdDIwMTJfMTM5NzQxMDQ5Nzc5NF9zcGxpdDIwMTJfMA==&p=be2911cfb417337970e45a474e379acc

http://scf.sohu.com/.../cTrack.do?m=MTM5NjMyMTc0NTEzMl8wXzEyNjM1XzQzMy5zYy0xMF8xMF8xMjdfMjItaW5ib3VuZDAkc21pdGh0ZWM4MUB5YWhvby5jb21fc3BsaXQyMDEyXzU3MTU3X3NwbGl0MjAxMl8zMTc2X3NwbGl0MjAxMl8xMzk2MzIxNzUxNTgzX3NwbGl0MjAxMl8w&p=be2911cfb417337970e45a474e379acc

http://scf.sohu.com/.../cTrack.do?m=MTQwMDk3ODQ3MjM4Nl8wXzE3NDU0XzYwNDMuc2MtMTBfMTBfMTI3XzU3LWluYm91bmQwJGNhdC5maXNoLmNoZWYucGx1c0BnbWFpbC5jb21fc3BsaXQyMDEyXzU3MTU3X3NwbGl0MjAxMl8zMTc2X3NwbGl0MjAxMl8xNDAwOTc4NDc0OTc2X3NwbGl0MjAxMl8w&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTM5NDU2MzYxMDk0OV8wXzIxMTU4XzkwODAuc2MtMTBfMTBfMTI3XzUxLWluYm91bmQwJHozbmZ1bEBnbWFpbC5jb21fc3BsaXQyMDEyXzU3MTU3X3NwbGl0MjAxMl8zMTc2X3NwbGl0MjAxMl8xMzk0NTYzNjE1MDAxX3NwbGl0MjAxMl8w&p=be2911cfb417337970e45a474e379acc

http://scf.sohu.com/.../cTrack.do?m=MTQwMTEzMjk0NzkzMV8wXzIxNzM3XzU1NTguc2MtMTBfMTBfMTI3XzU3LWluYm91bmQwJHdheW5lY2hlcnlsMjNAZ21haWwuY29tX3NwbGl0MjAxMl81NzE1N19zcGxpdDIwMTJfMzE3Nl9zcGxpdDIwMTJfMTQwMTEzMjk1MzY5MF9zcGxpdDIwMTJfMA==&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTQwNDE1NTc5NTIzMV8wXzI0NjQzXzI4NTcuc2MtMTBfMTBfMTI3XzEwNS1pbmJvdW5kMCRqYmtlbm5AZ21haWwuY29tX3NwbGl0MjAxMl81NzE1N19zcGxpdDIwMTJfMzE3Nl9zcGxpdDIwMTJfMTQwNDE1NTgwMTQwNF9zcGxpdDIwMTJfMA==&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTM5ODgzNDc4ODUzM18wXzMxMTY2Xzk0MDguc2MtMTBfMTBfMTI3XzU3LWluYm91bmQwJG1vb250c2VAeWFob28uY29tX3NwbGl0MjAxMl81NzE1N19zcGxpdDIwMTJfMzE3Nl9zcGxpdDIwMTJfMTM5ODgzNDc5MDc0Ml9zcGxpdDIwMTJfMA==&p=be2911cfb417337970e45a474e379acc

http://scf.sohu.com/.../cTrack.do?m=MTM5ODAyNTg5MjA1NF8wXzEwNDJfNTU0OC5zYy0xMF8xMF8xMjdfNTctaW5ib3VuZDAkMzczMTI1MzVAb3BheXEuY29tX3NwbGl0MjAxMl81NzE1N19zcGxpdDIwMTJfMzE3Nl9zcGxpdDIwMTJfMTM5ODAyNTg5NDM4Ml9zcGxpdDIwMTJfMA==&p=be2911cfb417337970e45a474e379acc

http://scf.sohu.com/.../cTrack.do?m=MTQwMjE0NzQ4MjAwOF8wXzE3NzI1XzY2MDEuc2MtMTBfMTBfMTI3XzEwNS1pbmJvdW5kMCRhaWRhbi50b21raW5zQGdtYWlsLmNvbV9zcGxpdDIwMTJfNTcxNTdfc3BsaXQyMDEyXzMxNzZfc3BsaXQyMDEyXzE0MDIxNDc0OTI2MjRfc3BsaXQyMDEyXzA=&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTM5ODU1NjkzNDUwMF8wXzM5MjlfNTcyNi5zYy0xMF8xMF8xMjZfMjIxLWluYm91bmQwJGRlZkBtYWlsaW5hdG9yLmNvbV9zcGxpdDIwMTJfNTcxNTdfc3BsaXQyMDEyXzMxNzZfc3BsaXQyMDEyXzEzOTg1NTY5MzcwNjVfc3BsaXQyMDEyXzA=&p=be2911cfb417337970e45a474e379acc

http://go.redirectingat.com/?id=19823X771710&xs=1&url=http://scf.sohu.com/track/cTrack.do?m=MTM5ODU1NjkzNDUwMF8wXzM5MjlfNTcyNi5zYy0xMF8xMF8xMjZfMjIxLWluYm91bmQwJGRlZkBtYWlsaW5hdG9yLmNvbV9zcGxpdDIwMTJfNTcxNTdfc3BsaXQyMDEyXzMxNzZfc3BsaXQyMDEyXzEzOTg1NTY5MzcwNjVfc3BsaXQyMDEyXzA=&p=be2911cfb417337970e45a474e379acc&sref=http://www.mailinator.com

http://scf.sohu.com/.../cTrack.do?m=MTQwMTQ5ODkyNzc0NF8wXzE3NTg3XzcwNjkuc2MtMTBfMTBfMTI3XzU3LWluYm91bmQwJHJhZ25hcm9rMUBnbWFpbC5jb21fc3BsaXQyMDEyXzU3MTU3X3NwbGl0MjAxMl8zMTc2X3NwbGl0MjAxMl8xNDAxNDk4OTMwMTM5X3NwbGl0MjAxMl8w&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTQwNDg0NTQ4NjQ4OF8wXzI4Njk3XzUxMy5zYy0xMF8xMF8xMjdfMTA1LWluYm91bmQwJHZkZWxmb3NzZTFAeWFob28uZnJfc3BsaXQyMDEyXzU3MTU3X3NwbGl0MjAxMl8zMTc2X3NwbGl0MjAxMl8xNDA0ODQ1NDkwNDYwX3NwbGl0MjAxMl8w&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTQwMjAyMTY1MDI1N18wXzcyMjZfMTM4NC5zYy0xMF8xMF8xMjdfMjgtaW5ib3VuZDAka2luZHJpY2ttY2FsaXN0ZXJAZ21haWwuY29tX3NwbGl0MjAxMl81NzE1N19zcGxpdDIwMTJfMzE3Nl9zcGxpdDIwMTJfMTQwMjAyMTY1MzAyMF9zcGxpdDIwMTJfMA==&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTQwMjM5ODc4MDA5NF8wXzIwNDcwXzE1Mzcuc2MtMTBfMTBfMTI3XzIxLWluYm91bmQwJHN0aWFhbkBkc3RlY2guY28uemFfc3BsaXQyMDEyXzU3MTU3X3NwbGl0MjAxMl8zMTc2X3NwbGl0MjAxMl8xNDAyMzk4NzgwMzQ4X3NwbGl0MjAxMl8w&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTQwNDE2Mjg4MzE2Ml8wXzI1ODQ0Xzc0ODIuc2MtMTBfMTBfMTI3XzU3LWluYm91bmQwJG1pY2hhZWxibW9ycmlzQG1lLmNvbV9zcGxpdDIwMTJfNTcxNTdfc3BsaXQyMDEyXzMxNzZfc3BsaXQyMDEyXzE0MDQxNjI4ODYzMTNfc3BsaXQyMDEyXzA=&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTQwMjcwNzAzNjY4OF8wXzEwMzA5XzI2ODAuc2MtMTBfMTBfMTI2XzIyMS1pbmJvdW5kMCR1Y2FzdGlsbG83OEBnbWFpbC5jb21fc3BsaXQyMDEyXzU3MTU3X3NwbGl0MjAxMl8zMTc2X3NwbGl0MjAxMl8xNDAyNzA3MDM2ODE4X3NwbGl0MjAxMl8w&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTQwMDg2Njg1MTY4M18wXzI0NjA1XzY5ODEuc2MtMTBfMTBfMTI3XzIyLWluYm91bmQwJG1pZ3N5MTk0MEBnbWFpbC5jb21fc3BsaXQyMDEyXzU3MTU3X3NwbGl0MjAxMl8zMTc2X3NwbGl0MjAxMl8xNDAwODY2ODUzOTM3X3NwbGl0MjAxMl8w&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTQwMDg2NzExNDE2OV8wXzE3MTIyXzM4MzMuc2MtMTBfMTBfMTI3XzEwNS1pbmJvdW5kMCRkYXZpZC5zaGllbGRAZ21haWwuY29tX3NwbGl0MjAxMl81NzE1N19zcGxpdDIwMTJfMzE3Nl9zcGxpdDIwMTJfMTQwMDg2NzExNjU0OF9zcGxpdDIwMTJfMA==&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTM5OTQ4OTY3MDUzOV8wXzE3Mzc4XzMzMTQuc2MtMTBfMTBfMTI3XzU3LWluYm91bmQwJG1pa2VqdGltQGdtYWlsLmNvbV9zcGxpdDIwMTJfNTcxNTdfc3BsaXQyMDEyXzMxNzZfc3BsaXQyMDEyXzEzOTk0ODk2NzQ4MjZfc3BsaXQyMDEyXzA=&p=be2911cfb417337970e45a474e379acc

http://download.forest.impress.co.jp/pub/library/e/easeustodobu/.../tb_free_installer.exe

http://scf.sohu.com/.../cTrack.do?m=MTQwNTM3MzEzNzYyN18wXzI4NjU0XzcyMjUuc2MtMTBfMTBfMTI3XzExOS1pbmJvdW5kMCRjbGF5YnVzYmV5QGdtYWlsLmNvbV9zcGxpdDIwMTJfNTcxNTdfc3BsaXQyMDEyXzMxNzZfc3BsaXQyMDEyXzE0MDUzNzMxNDAyMDRfc3BsaXQyMDEyXzA=&p=ead8091f7ebba50ae1945463a8e92918

http://scf.sohu.com/.../cTrack.do?m=MTM4OTYxODE0MzMxOV8wXzI1OTdfMTA5MS5zYy0xMF8xMF8xMjdfNTctaW5ib3VuZDAkbWFzeWFtb3RvQGdtYWlsLmNvbV9zcGxpdDIwMTJfNTcxNTdfc3BsaXQyMDEyXzMxNzZfc3BsaXQyMDEyXzEzODk2MTgxNTA5NDhfc3BsaXQyMDEyXzA=&p=be2911cfb417337970e45a474e379acc

http://scf.sohu.com/.../cTrack.do?m=MTM4ODIzMjI4Nzk2MV8wXzE0OTkxXzUyMjEuc2MtMTBfMTBfMTI3XzExOS1pbmJvdW5kMCRnb3RoaWNzaGFkb3dAY2VudHJ1bS5za19zcGxpdDIwMTJfNTcxNTdfc3BsaXQyMDEyXzMxNzZfc3BsaXQyMDEyXzEzODgyMzIyOTIwMTNfc3BsaXQyMDEyXzA=&p=be2911cfb417337970e45a474e379acc

http://scf.sohu.com/.../cTrack.do?m=MTM5MTYyMTkyODM1NV8wXzcyM184OTAuc2MtMTBfMTBfMTI2XzIyMS1pbmJvdW5kMCRrdXRhc29AZnJlZW1haWwuaHVfc3BsaXQyMDEyXzU3MTU3X3NwbGl0MjAxMl8zMTc2X3NwbGl0MjAxMl8xMzkxNjIxOTI4NDMxX3NwbGl0MjAxMl8w&p=be2911cfb417337970e45a474e379acc

http://scf.sohu.com/.../cTrack.do?m=MTM5NjQ0NzUzNzkzNl8wXzg2NjlfMTUwNS5zYy0xMF8xMF8xMjdfMjgtaW5ib3VuZDAkamhuOXNwYW1AZ21haWwuY29tX3NwbGl0MjAxMl81NzE1N19zcGxpdDIwMTJfMzE3Nl9zcGxpdDIwMTJfMTM5NjQ0NzU0MzQ3N19zcGxpdDIwMTJfMA==&p=be2911cfb417337970e45a474e379acc

http://scf.sohu.com/.../cTrack.do?m=MTM4OTk3OTAzMjg0NV8wXzI1NTAxXzQ1NjEuc2MtMTBfMTBfMTI3XzIyLWluYm91bmQwJGJlbGVqQG1haWwucnVfc3BsaXQyMDEyXzU3MTU3X3NwbGl0MjAxMl8zMTc2X3NwbGl0MjAxMl8xMzg5OTc5MDM0ODUwX3NwbGl0MjAxMl8w&p=be2911cfb417337970e45a474e379acc

Latest 30 of 49 download URLs

Scan tb_free_installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.