registry-zen-200.exe

Registry Zen

Smart PC Solutions, Inc.

The application registry-zen-200.exe, “Fix PC problems and optimize performance ” by Smart PC Solutions has been detected as a potentially unwanted program by 5 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from soft.pchelpsoft.com and multiple other hosts.
Publisher:
PC HelpSoft   (signed by Smart PC Solutions, Inc.)

Product:
Registry Zen

Description:
Fix PC problems and optimize performance

Version:
2.0

MD5:
98fb601ee8836d31c48aac0b1b4a7424

SHA-1:
880718abc819b3cc2a254c135a8824f26efaed7c

SHA-256:
cb86ecacc71bba4e554197916c0fda2ea0ced791438fb2fcae3714a53973652e

Scanner detections:
5 / 68

Status:
Potentially unwanted

Analysis date:
11/5/2024 1:33:48 PM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
riskware program Program.Unwanted.319, is riskware program Program.Unwanted.54, is riskware program
9.0.1.05190

ESET NOD32
Detection.Undefined
7.0.302.0

Reason Heuristics
PUP.PC Utilities.Installer
15.5.22.21

Trend Micro House Call
Suspicious_GEN.F47V0430
7.2.142

File size:
1.1 MB (1,121,576 bytes)

Product version:
2.0

Copyright:
PC HelpSoft

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\registry-zen-200.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
4/4/2011 9:00:00 PM

Valid to:
5/29/2014 8:59:59 PM

Subject:
CN="Smart PC Solutions, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Smart PC Solutions, Inc.", L=Alexandria, S=Virginia, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
502E76B6ACDCDE4F3336BF9286946063

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Lna730bFYfOQddVKR+D11wOyeKthIU7U1lI+2R4qkS3rJQBtUkBgs:LaYOmGdVo8DwOyeAYlI+KinXBgs

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD...
 
[+]

Entropy:
7.9839

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file registry-zen-200.exe has been seen being distributed by the following 4 URLs.

http://soft.pchelpsoft.com/HS?b=lKKQUHz7pPQhaRL-ISL-PM6t8oymYuMtJLupImxXZxjjKuuswAfqQjBOL9JnF5El&c=oTJksZLjabO-qO9WS_ApgQ

http://cdn2.pchelpsoft.com/.../registry-zen-200.exe

http://utilities.pchelpsoft.com/HS?a=ENX7CqgupO3e8SA9MKJbmkPnGHxKLTQmg_cStGb5lw8W0bBhOG5mpqVsje_HhdDbGVE6

Remove registry-zen-200.exe - Powered by Reason Core Security