home

fishlose.exe

Zhiming Yuan

The application fishlose.exe by Zhiming Yuan has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Protect Service(FishloseP)”.
Publisher:
Zhiming Yuan  (signed and verified)

MD5:
e2d542547ad87295e6d19695ca17bfb4

SHA-1:
ba5fe7a5494737a8ba4898fa8318bd2f53558675

SHA-256:
e37bd142b544c3e73a5abdf95227310fef0485fcaf051cf0e14259c14e73fe20

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/16/2024 1:45:37 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Elex (M)
16.9.21.10

File size:
448.7 KB (459,512 bytes)

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\ProgramData\fishlose\fishlose.exe

Digital Signature
Signed by:
Zhiming Yuan

Authority:
thawte, Inc.

Valid from:
9/21/2016 2:00:00 AM

Valid to:
6/14/2017 1:59:59 AM

Subject:
CN=Zhiming Yuan, OU=Individual Developer, O=No Organization Affiliation, L=Beijing, S=Beijing, C=CN

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
0C8088A269975EEFD69FC51652E874F6

File PE Metadata
Compilation timestamp:
9/21/2016 11:51:55 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
14.0

CTPH (ssdeep):
12288:9Y2/xKMwcvUZIh6Nlf9vBoM5LQzz6GJXX2QS:96MRv94xokXCXGQS

Entry address:
0x2D556

Entry point:
E8, FA, 07, 00, 00, E9, 8E, FE, FF, FF, FF, 25, 60, 03, 45, 00, 8B, 4D, F4, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F, 5E, 5B, 8B, E5, 5D, 51, F2, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, 70, 90, 46, 00, 33, C5, 50, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, F2, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, 70, 90, 46, 00, 33, C5, 50, 89, 65, F0, FF, 75, FC, C7, 45...
 
[+]

Code size:
315 KB (322,560 bytes)

Service
Display name:
Protect Service(FishloseP)

Service name:
FishloseP

Description:
To ensure your Fishlose software integrity. If this service is disabled or stopped, your Fishlose software will not be kept integrity check. This service uninstalls itself when there is no Fishlose so

Type:
Win32OwnProcess

Depends on:
RpcSs


Remove fishlose.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.