home

hpilokeygenv3.zip_downloader_be_257.exe

GoforFiles

Righway Technologies, Inc

This is the Via Advertising bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application hpilokeygenv3.zip_downloader_be_257.exe by Righway Technologies, Inc has been detected as adware by 9 anti-malware scanners. The program is a setup application that uses the YourFile Downloader installer. This file is typically installed with the program GoforFiles by Righway Technologies, Inc which is a potentially unwanted software program. It uses the ExpressFiles installer to bundle additional adware offers such as toolbars and web browser addons.
Publisher:
http://www.goforfiles.com/  (signed by Righway Technologies, Inc)

Product:
GoforFiles

Version:
1, 0, 0, 464

MD5:
df3b28428cbfbdd02d0e7956edfa3e45

SHA-1:
38d054df87991c3cf7077b3c6f79e571e45b6c06

SHA-256:
f576fffda6c50f0c9184484706423bcce2bcf8c146f4d263c1ce9f913d4c79c6

Scanner detections:
9 / 68

Status:
Adware

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/15/2024 12:46:47 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.ExpressFiles
2013.12.17

ESET NOD32
Win32/ExpressDownloader (variant)
7.9178

K7 AntiVirus
Unwanted-Program
13.174.10509

Malwarebytes
PUP.Optional.GoForFiles.A
v2013.12.18.07

McAfee
Artemis!DF3B28428CBF
5600.7278

Reason Heuristics
PUP.RighwayTechnologies.c
14.8.7.21

Sophos
Go For Files
4.96

Trend Micro House Call
TROJ_GEN.F47V0607
7.2.352

VIPRE Antivirus
ExpressFiles Installer
24420

File size:
5 MB (5,276,296 bytes)

Product version:
2,0,0,0

Copyright:
Copyright http://www.goforfiles.com/ (C) 2012

Original file name:
GoforFiles.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
YourFile Downloader

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\hpilokeygenv3.zip_downloader_be_257.exe

Digital Signature
Signed by:
Righway Technologies, Inc

Authority:
COMODO CA Limited

Valid from:
8/22/2012 2:00:00 AM

Valid to:
8/23/2015 1:59:59 AM

Subject:
CN="Righway Technologies, Inc", O="Righway Technologies, Inc", STREET="1740 H Dell Range Blvd #281", L=Cheyenne, S=Wyoming, PostalCode=82009, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0089B8C147F063769F8D685962C161E027

File PE Metadata
Compilation timestamp:
6/7/2013 1:06:44 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:xb6g3fWRTrUn0wqsNhjtjGH5xJ4jfbYayg+3pxdbvHETOuO:9/OT4n0whBjGZxJ4jTYW+fdoTO3

Entry address:
0xE8D6

Entry point:
E8, DA, 7D, 00, 00, E9, 89, FE, FF, FF, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, A4, BA, 42, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 49, 1E, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, 50, EA, 40, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF, 24, 85, 64, E9...
 
[+]

Code size:
112 KB (114,688 bytes)

The file hpilokeygenv3.zip_downloader_be_257.exe has been discovered within the following program.

GoforFiles  by Righway Technologies, Inc
GoforFiles bundles various adware toolbars including the Delta Search Toolbar (an adware toolbar that modifies the user's web browser home page, search settings and other settings).
www.goforfiles.com
70% remove it
 
Powered by Should I Remove It?

The file hpilokeygenv3.zip_downloader_be_257.exe has been seen being distributed by the following 50 URLs.

http://dn.goforfiles.com/.../xSa1ajI=

http://dn.goforfiles.com/j5GxXmferhtu1bkfZtG/Ky7KoCh8p/k5d7b7OHehhW4o/.../IVgHXyFgO0sxcAw==

http://dn.goforfiles.com/j5GMWmPesBsrlJlXb5iCK2/.../wTpMd8Q1TnPKJg==

http://dn.goforfiles.com/j5GHUmTfu14m57hReNGiJijLuC52/.../jDp68dxvGuLRfVKn0G4Z78JSH zCVgo=

http://dn.goforfiles.com/.../DaHwaZgjtPtIKhjpmNE1OikB8Qk5AGXtU3Qw3KdgIgh2QSIsk0RnjOKKU6jyi2YTctuWYxKbli

http://dn.goforfiles.com/j5GnQmvcrVh01atLJ/.../oUQE 3GUAHUyFgE3Mk=

http://dn.goforfiles.com/.../LtfDy7lDFpoYwzH nRYhbsyytZ5cBQGejMXgfSyF4=

http://dn.goforfiles.com/j5GIVEHRvFdnzetIZ9G1fjiM5mFhtbs8e625ciPx0WAn6pEkH HabBXh2W0S4ck=

http://dn.goforfiles.com/j5GmWHDVpRtixqxIKt6jJmuc9SFnrLVrYKGvPHOnj3VpoYwzH bZaACnmD1dtZgHE XMVwDY3x9F2cxcDdw0RAnbM0c=

http://dn.goforfiles.com/j5GVX2PevVRrmv8PO4v/.../oIWTKuYDlbdwFMO1sVJTps8Qg3bN0N3xDxDdQ==

http://dn.goforfiles.com/j5GNQmXf6Xxn2agfTM29Ly76pyJ34J0kYaqxIHuszyl3vMMgT7mNZhDk3nlZrZMUQ7WRWgDVzk1Cl8BeCd80QAbcMUR1

http://dn.goforfiles.com/.../sOptYam0Kyf 0WA4v5A1Vb2APxvt1WYd7dcXXeHEVAXTz1gC1sxc

http://dn.goforfiles.com/j5GkQnbfqlpilP8POo3xJXvQuWdkpas4f6uzb3u6gjt3uIA0VqWbOkr0iTpZs4UMXvqCCluExF0G19scT4p2HleIOE57wDtDYIB QnvLJrF5xCOxZTA=

http://dn.goforfiles.com/j5GjWHDXrBY3mvwROpalInyStz0g5q4mf6DgeSr7xyBrrpI6S7TUaRPjyytZ5cBQGenGUwTQyVg=

http://dn.goforfiles.com/.../fMkV1wjlKd80=

http://dn.goforfiles.com/.../ePVE2gzRKdcM5T3nOI7B6

http://dn.goforfiles.com/j5GGX2fCsFcm96JTb5j8Y0 cmC5 rLAkeOSRJn2glSA 5LYiUrWbe2KxgSpSvdEmSrWBDl2O0EsE1MxdHJ9sGlrRM0dx1noOJINgFi7FILF22mH0bzEqvGMzJb5iOxA=

http://dn.goforfiles.com/j5GuXm/.../CUgXSzFwD0A==

http://dn.goforfiles.com/j5GuXm/.../CUgXSzFwE3Q==

http://dn.goforfiles.com/j5GWWHDEoFdj06gSWdejN2fQsCB34OhrcLGxIzqpjTFrocUtS6DPLEu9iWIc6MJFXamXEF JnVYP3MRYD851AAPdNkBwyDBLcc09

http://dn.goforfiles.com/.../LCDusDR1oa0uOIK0IXukuhdrrYl5Y6WNMkmJqQluipgTAISDDlbOtDsFyp8WFJt1BkyBYAVskX8SYINgFi7FJ7N92mbyMHd04jI5JLdiOhm1Kn8YplEnGqJfLBupWw==

http://dn.goforfiles.com/j5GJVnDCsBtF1b9Tfte/.../ddvBKSaZhfn2m4e6MlbGuk=

http://dn.goforfiles.com/j5GXXmHb6Wlpx74STt20M2vO9RN6obdrRKWtb3y9jT8 rYk1V73JIU kyyhHsZVeGOzGQUGVmxxbjZlSA9A4RAvKcQR/.../SHrPJA==

http://dn.goforfiles.com/.../IVgHXzVsO1M9eAg==

http://dn.goforfiles.com/j5GnW3fCu15ilKFWZN2iZXnRvCMv9ul4MLeoLW2liDcj NVmBKSaZhfn2mob7cBWGOk=

http://dn.goforfiles.com/j5GAWXDfpxVS3KgRWdWwMXrZpjM8h6wyZeq0ITS8iTYwnoo4T/.../QjlXG6azghuW4iafxnORKkbzUUr1EnEQ==

http://dn.goforfiles.com/j5GIWHbZplVv2odQc fhdD M5XZNs7AseKG5YWChkXVpoYwzH bZaACnmD1dtZgHE 7AUBSUilYH18pcA9ozRQnV

http://dn.goforfiles.com/j5GNVmzDrFco1aNbJP jJnrZuWkg8Oh4OPXtdyq4zxFyubc2W/.../yTFDdMwrCznFILB5yC20ZTIvuQ==

http://dn.goforfiles.com/.../fNw==

http://dn.goforfiles.com/.../fMkVwwDlNcME=

Latest 30 of 57 download URLs

Remove hpilokeygenv3.zip_downloader_be_257.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.