home

1867f9f5fe138744c20cbdd978be824085371fa2

Ultra Setup Manager

QUALITY SCORE SL

The file 1867f9f5fe138744c20cbdd978be824085371fa2 by QUALITY SCORE SL has been detected as adware by 4 anti-malware scanners. It is installed within the Mozilla Firefox web browser as part of an addin/plugin.
Publisher:
TIK  (signed by QUALITY SCORE SL)

Product:
Ultra Setup Manager

Version:
3.5.33.763

MD5:
29ffcc2907549d766845d54c50f913de

SHA-1:
c0befb87d4718bd3dacfa913fd71c524ceb4d318

SHA-256:
74b9a7f4623d147571142d8bd7a364b2ad9ccfc76e676fcef08f0b615e93fc3c

Scanner detections:
4 / 68

Status:
Adware

Analysis date:
12/25/2024 1:05:42 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Colooader.7
9.0.1.05190

ESET NOD32
MSIL/Adware.Colooader.F application
7.0.302.0

Reason Heuristics
PUP.QUALITYS.Installer (M)
16.3.19.1

VIPRE Antivirus
Threat.4784938
47848

File size:
346.9 KB (355,235 bytes)

Product version:
3.5.33.763

Copyright:
Copyright © 2015

Trademarks:
TIK

Original file name:
i3KC.exe

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\mozilla\firefox\profiles\{user}.default\cache2\entries\1867f9f5fe138744c20cbdd978be824085371fa2

Digital Signature
Signed by:
QUALITY SCORE SL

Authority:
COMODO CA Limited

Valid from:
1/20/2015 12:00:00 AM

Valid to:
1/20/2016 11:59:59 PM

Subject:
CN=QUALITY SCORE SL, O=QUALITY SCORE SL, STREET=CALLE SERRANO 213, L=MADRID, S=MADRID, PostalCode=28016, C=ES

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00AFDAFBF8A640E5E34B76A9CAFF494517

File PE Metadata
Compilation timestamp:
6/18/2015 5:38:55 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:JkbE04N95gfumV2BEudQ1hZEfEim5tN17kjz82APU0TWmmk0DexAqwtCWnQdcY:ip4N95gfuasEim5tN17kjz82APFTWmmg

Entry address:
0x513BE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 04, 00, 03, 00, 00, 00, 30, 00, 00, 80, 0E, 00, 00, 00, 60, 00, 00, 80, 10, 00, 00, 00, 90, 00, 00, 80, 18, 00, 00, 00, C0, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
317 KB (324,608 bytes)

Remove 1867f9f5fe138744c20cbdd978be824085371fa2 - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.