home

torchlight2_fullinstall.exe

Runic Games, Inc.

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
Runic Games, Inc.  (signed and verified)

MD5:
870cdf861e19757f4982bb997af2e7eb

SHA-1:
6014ea3dd84c91fec19879e6fdd197fa992bff1f

SHA-256:
1b27265a8c091cabb3aa0b11d2ee8b7c48206da0c6c3205fc9de31ad3db6078f

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/26/2024 4:48:09 AM UTC  (today)

File size:
1.3 GB (1,418,842,792 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\torchlight2_fullinstall.exe

Digital Signature
Signed by:
Runic Games, Inc.

Authority:
Thawte, Inc.

Valid from:
6/28/2012 2:00:00 AM

Valid to:
9/15/2014 1:59:59 AM

Subject:
CN="Runic Games, Inc.", OU=Secure Application Development, O="Runic Games, Inc.", L=Seattle, S=Washington, C=US

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
154484703B460409779C0F0C462653B1

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
25165824:ZH1CvoP9CyqAR151QLIOg/UoBK3QyHmru32Vgd0uHGfS5eYJIvgNiTzQC1qUN76q:ZVjFR1rOqcoBK3fHIumVgd07fS5eYugw

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file torchlight2_fullinstall.exe has been seen being distributed by the following 9 URLs.

http://gsf-cf.softonic.com/601/4ea/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353726&instance=softonic_en&type=PROGRAM&Expires=1480169339&Signature=aU7mm35kDk-EMlnXbyyCopfTSdcVxO33DFTEGDlcJeL5W9KRt0eBSCsvzMuT7KbnBS8mg3ttiN8DHyidut0ralC9uLLVOuiC8WKwy4Dyw5LnwA-Iae8fnfp1ct3y5iDDLI2Rb~jDvBfZmBYxhrBGfmXKGuNPpzMsppDQfgknHmk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Torchlight2_FullInstall.exe

http://gsf-cf.softonic.com/601/4ea/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353726&instance=softonic_fr&type=PROGRAM&Expires=1439003446&Signature=XAfwV1CzFHojS~5x0hmN5J6AGi6Z-KBYZxX0kmOsPwvk7kb4yzcjwsukl1yv9OS60NJoUbBbxIwOG54dQ~unqiJDRBJ952lplFj6bFCHKN9uOz4JZhCzpo7dbc0QgNunYCSQJn5A6ocNMb2eiFgjY6auitp~shJGLeBI-TjlFtw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Torchlight2_FullInstall.exe

http://gsf-cf.softonic.com/601/4ea/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353726&instance=softonic_en&type=PROGRAM&Expires=1462036980&Signature=CUmq87NerL~YsdXtNfHrMLtxqnRetJhTvKWgcacrwDQsiYOWTmaLktv3zzzSK0tscvtLFGrgb0EWShYmJkLCLLV2zzVr7fJPzIPMsMhrnXcftTXnVAIYgZW6zWvC523Ro0o-0ULrSLw6-3HMbFBnSAPTdSgFlN4Gg0n-BhZBJb4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Torchlight2_FullInstall.exe

http://gsf-cf.softonic.com/601/4ea/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353726&instance=softonic_en&type=PROGRAM&Expires=1467192339&Signature=HBeyNBvbdClMCj-BR-IPzu-ZJuZ24gouYMxJ4FuY3Jx9Sy1a2lI236Lmf3EYxxPEEr-f81bPp2yILvd4251R~x8jHsgQInXt5bdKQBSsts21XaM9foeVSZmdxb3eoHFCgPA8KZMczaeZDfJq0EzE1EEXhUCOnuMBYA7VM7kDWBc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Torchlight2_FullInstall.exe

http://download.runicgames.com/.../Torchlight2_FullInstall.exe

http://torchlight-ii.en.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAOLEf/JLddIgeHAwy4WgrejnvbTN5/6DNyGnWvQhbQC7NB6LY230QPmQ3RYCaEdHo/C7TIiCh/Fj1ZmesUeLQEe/31 lLV QTHt2nAn/1seLMeKMk5B/.../rehEPHVQXvbEHGEVd7XsG5AJoEpOHQY60qA==

http://gsf-cf.softonic.com/601/4ea/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353726&instance=softonic_en&type=PROGRAM&Expires=1459217444&Signature=BHcE~HFU3OUgKgZ759bgwBRxOkGs3bxmet~gW28ztiKAyIigh0Hh9~JtrYXqcUiQUatqF8vDXR7Bh0Ip-ETLFS5ZM6WkXSlrSDMfJIViCy1ktOVrRxXV-G8c2IG~M~FgZh08KdmaIIKbFuOcdugHMreV1Ovc0SnwglMr~3xZGuk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Torchlight2_FullInstall.exe

http://torchlight-ii.fr.softonic.com/download-tracker?th=1/6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAOLEf/JLddIgeHAwy4WgrejnvbTN5/6DNyGnWvQhbQC7NB6LY230QPmQ3RYCaEdHo/C7TIiCh/Fj1ZmesUeLQEe/31 lLV QTHt2nAn/1seLMeKMk5B/.../rehEPHVQXvbEHGEVd7XsG5AJoEpOHQY60qA==

http://gsf-cf.softonic.com/601/4ea/.../file?SD_used=0&channel=WEB&fdh=no&id_file=3353726&instance=softonic_en&type=PROGRAM&Expires=1450498707&Signature=HOT1HiP8AK7tkqE3hVLwsitxIZ5wPkIwnrW6IWa9Y8ZBkvwYtvIS5~MB43CScZtw5-Ey5h9RS2tpT3WCb98WiUU8JDYvvaNwoTVYyoOxKbQAaSltGevcUVQmhRgxVAM2FUVNdLtH7G~XgJ6n0cLMLay0QXvfG5mJZmMDzjPjoxY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=Torchlight2_FullInstall.exe

Scan torchlight2_fullinstall.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.