home

regcureprosetup_edcdfb75-9201-4924-b750-0fd0009942d1_.exe

Paretologic Inc

The application regcureprosetup_edcdfb75-9201-4924-b750-0fd0009942d1_.exe, “RegCure Pro Installer” by Paretologic Inc has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages. The file has been seen being downloaded from RevenueWire's affiliate distribution platform signup09.paretologic.revenuewire.net and multiple other hosts.
Publisher:
ParetoLogic, Inc.  (signed by Paretologic Inc)

Description:
RegCure Pro Installer

Version:
3.2.16.0

MD5:
e0a040645a9fd0434534aec8530687b3

SHA-1:
e169a2849d6ffddb6c549f00b8fa55d9d5eb357a

SHA-256:
472648949197213db25198373ab9c450428ee86878a66ddf932098f682cb8be2

Scanner detections:
3 / 68

Status:
Potentially unwanted

Explanation:
Injects advertising in the web browser in various formats.

Analysis date:
11/5/2024 2:45:00 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
riskware program Program.Unwanted.686
9.0.1.05190

F-Secure
Gen:Adware.BrowseFox.1
5.15.21

Reason Heuristics
PUP.ParetoLogic.Optional.Installer.Meta (L)
16.2.11.23

File size:
6.8 MB (7,136,072 bytes)

Copyright:
Copyright © 2015 ParetoLogic, Inc.

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\regcureprosetup_edcdfb75-9201-4924-b750-0fd0009942d1_.exe

Digital Signature
Signed by:
Paretologic Inc

Authority:
DigiCert Inc

Valid from:
3/5/2015 7:00:00 PM

Valid to:
3/10/2016 7:00:00 AM

Subject:
CN=Paretologic Inc, O=Paretologic Inc, L=Victoria, S=British Columbia, C=CA

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0546E296774DC62CEE4A6EFC92B81211

File PE Metadata
Compilation timestamp:
2/24/2012 2:19:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:hkdueZpg79icSvle7JoWWR+fcAs6b4ObUYGv9VqaX3C3k0MQ6Uo98CIaeU/vYL1Q:XeZpW9iH18g44OwY69TXysUcF5v

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Entropy:
7.9988

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file regcureprosetup_edcdfb75-9201-4924-b750-0fd0009942d1_.exe has been seen being distributed by the following 50 URLs.

http://signup09.paretologic.revenuewire.net/.../download?390499

http://signup09.paretologic.revenuewire.net/.../download?401935

http://signup09.paretologic.revenuewire.net/.../download?490300

http://repaircomputerorbuynew.com/downloadregcure.php

http://spywaresupport.net/recommends/.../m.php

http://signup09.paretologic.revenuewire.net/.../download?483617

http://windows.movie.maker.error.0x87160139.fixcomputercorruptedregistry.com/downloadregcure.php

http://signup09.paretologic.revenuewire.net/.../download?513105

http://1499.paretologic.revenuewire.net/.../download

http://regconvoy.paretologic.safecart.com/regcure-pro/.../

http://downloadsafe.paretologic.revenuewire.net/regcure-pro/.../

http://signup09.paretologic.revenuewire.net/.../download?377045

http://signup09.paretologic.revenuewire.net/.../download?563009

http://signup09.paretologic.revenuewire.net/.../download?422962

http://signup09.paretologic.revenuewire.net/.../download?527277

http://www.paretologic.com/download/.../index.php

http://installers.paretologic.com/.../

http://www.2-spyware.com/download-regcurepro-setup.exe

http://www.bestpcsavior.com/download.php

http://www.removewindowserrors.com/download-software

http://file-help.net/recommends/.../m.php

http://www.trojanremovalhelp.com/download-r.php

http://www.pcresolvers.com/.../regcure.php

http://fastfixxcomputerservices.com/download.php

http://ikoknar.paretologic.revenuewire.net/regcure-pro/.../

http://www.internet-explorer-updates.com/free-scan.php

http://spyware-scan.net/recommends/.../m.php

https://ugetfix.com/.../regcure-pro.exe

http://signup09.paretologic.revenuewire.net/.../download?529476

http://ezdownload.co/recommends/.../m.php

Latest 30 of 87 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.