home

hqghumeaylnlf.exe

Optimizer Pro v3.2

PC Utilities Software Limited

Part of the Optimizer Pro / Driver 'PC optimizer' product lines marketed by Adsology and distributed through various bundled software (PPI and commission) channels. The application hqghumeaylnlf.exe, “OptimizerPro – Clean up your PC” by PC Utilities Software Limited has been detected as a potentially unwanted program by 33 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from cdn2.chironexfleckerisilver.com.
Publisher:
PC Utilities Software Limited  (signed and verified)

Product:
Optimizer Pro v3.2

Description:
OptimizerPro – Clean up your PC

Version:
3.2.0.3

MD5:
ecfd9b7abfc010b466e10e9731381e44

SHA-1:
d2df3e61ba726677bc3f21cf1c1d911b2dc4ec25

SHA-256:
2a3e00b7bf1eef7105e04a9febb2b22f8f1f5104cf1824594b9b518ad9708c04

Scanner detections:
33 / 68

Status:
Potentially unwanted

Explanation:
Installed with the Optimizer Pro software which is bundled by 3rd-party monetization programs.

Analysis date:
11/26/2024 5:41:05 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Generic.1265567
638

Agnitum Outpost
Riskware.SpeedingUpMyPC
7.1.1

AhnLab V3 Security
PUP/Win32.OptimizerPro
2015.04.16

avast!
Win32:OptimizerPro-G [PUP]
2014.9-150508

AVG
Generic
2016.0.3116

Baidu Antivirus
PUA.Win32.Rezimitpo
4.0.3.1558

Bitdefender
Gen:Variant.Mikey.11354
1.0.20.640

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
Application.Win32.OptimizerPro.FY
22030

Dr.Web
Program.Unwanted.295
9.0.1.0128

Emsisoft Anti-Malware
Gen:Variant.Adware.Mikey.11354
8.15.05.08.02

ESET NOD32
Win32/Adware.SpeedingUpMyPC.AA (variant)
9.11590

Fortinet FortiGate
Riskware/ArchSMS
5/8/2015

F-Secure
Gen:Variant.Adware.Mikey
11.2015-08-05_6

G Data
Win32.Application.OptimizerPro
15.5.25

herdProtect (fuzzy)
variant of setup.exe (PUP)
2015.8.6.2

IKARUS anti.virus
PUA.SpeedingUpMyPC
t3scan.1.8.9.0

K7 AntiVirus
Adware
13.203.15875

Kaspersky
Hoax.Win32.ArchSMS
14.0.0.2074

Malwarebytes
PUP.Optional.OptimizerPro
v2015.05.08.02

McAfee
Artemis!ECFD9B7ABFC0
5600.6772

MicroWorld eScan
Application.Generic.1266142
16.0.0.384

NANO AntiVirus
Riskware.Win32.Unwanted.dqmtwu
0.30.24.1357

Panda Antivirus
Trj/Genetic.gen
15.05.08.02

Qihoo 360 Security
HEUR/QVM41.1.Malware.Gen
1.0.0.1015

Quick Heal
PUA.Pcutilitie.Gen
5.15.14.00

Reason Heuristics
PUP.PC Utilities.PCUtilities
15.5.7.22

Rising Antivirus
PE:Trojan.Win32.SpeedingUpMyPC.a!1075357520
23.00.65.15506

Sophos
Generic PUA AO
4.98

Trend Micro House Call
Suspicious_GEN.F47V0506
7.2.128

Trend Micro
TROJ_GEN.R08NC0OD515
10.465.08

VIPRE Antivirus
OptimizerPro
40028

Zillya! Antivirus
Trojan.ArchSMS.Win32.29014
2.0.0.2174

File size:
5.7 MB (5,986,912 bytes)

Product version:
3.2.0.3

Copyright:
PC Utilities Software Limited

Original file name:
Optimizer Pro

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\ProgramData\application data\{60c7a524-eafa-678b-60c7-7a524eaf9493}\hqghumeaylnlf.exe

Digital Signature
Signed by:
PC Utilities Software Limited

Authority:
COMODO CA Limited

Valid from:
11/20/2014 7:00:00 PM

Valid to:
11/21/2015 6:59:59 PM

Subject:
CN=PC Utilities Software Limited, O=PC Utilities Software Limited, STREET=78 York Street, L=London, PostalCode=W1H 1DP, C=GB

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00F10854548D47F74C920D7091D9057D6E

File PE Metadata
Compilation timestamp:
5/5/2015 4:41:30 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:ylipjGpAxXQbCgv8z11llT0dupjkE+wnDLe11fFLg8TK/MakY7TaLsa2F/vf/K5A:88qqXQzmblId+TDg3EkK/sY78s5F3K55

Entry address:
0x143B6

Entry point:
E8, 87, 7D, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 30, 65, 42, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 20, 61, 42, 00, C9, C2, 08, 00, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00...
 
[+]

Entropy:
7.9737  (probably packed)

Code size:
148 KB (151,552 bytes)

The file hqghumeaylnlf.exe has been seen being distributed by the following URL.

http://cdn2.chironexfleckerisilver.com/downloads/offers/.../OptimizerPro9.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to ec2-54-72-9-115.eu-west-1.compute.amazonaws.com  (54.72.9.115:80)

Remove hqghumeaylnlf.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.