» kingthink
Digital Signature
Analysis
Files (1,513)
Related (54)

kingthink

Publisher Information

kingthink is a brand of the Sambreel/Yontoo group, a web advertising company located in Carlsbad, CA. The company is a primary distributor of unwanted software. It is part of the Yontoo/Sambreel group and distributes web browser add-ons, typically potentially unwanted and adware in nature, that are designed to modify a user's typical search beahvior as well as display context and popup advertising.

Authority:

VeriSign, Inc.

Valid from:

8/4/2014 9:00:00 PM

Valid to:

8/5/2015 8:59:59 PM

Subject:

CN=kingthink, O=kingthink, L=Santa Monica, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

460c442b73452ace582f3f3040efeb0b

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Yontoo (M), Adware.Yontoo (M)

100.00%

1 / 68 (Adware)

maintainer.exe (78df6103afec29fc247cde0237f7e5b8)

1 / 68 (Adware)

maintainer.bak (4edeaaa5da88076138d24344c7e7d6d1)

1 / 68 (Adware)

kingthink.expextdll.dll (122ebc5e93f4a958a47c0140f76a013e)

1 / 68 (Adware)

kingthink.expext.exe (1795364a6b46d2a6785e0ac5a935ab58)

1 / 68 (Adware)

updater (055aa29dc90dfbe9a4a5b87ff6689d78)

1 / 68 (Adware)

maintainer.exe.555a8a43 (a344e64181d5f4f57a1b72bb633ed1d7)

1 / 68 (Adware)

maintainer.bak (e98fd06b12cfa21deb3e748ca16a1b22)

1 / 68 (Adware)

{593ee51e-9e6d-4a1a-8401-fba94782daa4}w64.sys (StdLib) (637bdaec597bfad25174938fdb71ef96)

1 / 68 (Adware)

{5a2fcd43-caf7-47c2-8ccb-c53ac62c13be}w64.sys (StdLib) (f8a7b2d421c13a5623facca1eb2d72f1)

1 / 68 (Adware)

{561f4797-060f-4fba-9b80-34912556a086}w.sys (StdLib) (0ca97547eb7088d2d0bffc14691ef9c2)

1 / 68 (Adware)

{43925862-ec89-4231-9dfe-7e8c4a7a4b55}w.sys (StdLib) (44c48fdc3fe00196c76fdac48e4a7b6b)

1 / 68 (Adware)

{3ce9188b-efee-4289-8d41-e84723467d22}w.sys (StdLib) (e5fd973a1de949e370bfe4ea369ef5e4)

1 / 68 (Adware)

maintainer.exe (7b24b8181d80acea376168cd42cd4d57)

1 / 68 (Adware)

{5ea9c9f7-f39f-4f8d-8bea-527251f93f46}w.sys (StdLib) (4ab832e5d996f8b466cc68c0b7e810bd)

1 / 68 (Adware)

{1fc70cdb-ca26-4b7f-ab29-387a5b194527}w.sys (StdLib) (1b2ac289b1b9dab842f507212f240046)

1 / 68 (Adware)

{43925862-ec89-4231-9dfe-7e8c4a7a4b55}.dll (XVRNT by TODO: <Company name>) (7b5b8f9a16790c38ab98fc0275c2e361)

1 / 68 (Adware)

kingthink.browseradapter64.exe (4afc4a6854d54491cd7a7449066848fe)

1 / 68 (Adware)

kingthink.browseradapter.exe (df0ac3d8e5ede8eef80b5caf5ea4899c)

1 / 68 (Adware)

43925862ec8942319dfe64.dll (68faf1adadff1f937f08701970f99ef2)

1 / 68 (Adware)

43925862ec8942319dfe.dll (da1b9ce4979112728175e473caf190d2)

1 / 68 (Adware)

{3de163bf-68d3-4d9c-97cc-fa2f97f06da0}w64.sys (StdLib) (742dd550f8793cc4cb125160363b45f8)

1 / 68 (Adware)

{43925862-ec89-4231-9dfe-7e8c4a7a4b55}w64.sys (StdLib) (942d61a431b5f05573cddf44276da8f3)

1 / 68 (Adware)

{eb9b4ba1-0afc-4be0-ab98-bac24aca3aa2}w64.sys (3de892b057b14d963092c457a8c088df)

1 / 68 (Adware)

{43925862-ec89-4231-9dfe-7e8c4a7a4b55}w64.sys (523efe456b11cfcefee0141d4bb41649)

1 / 68 (Adware)

{43925862-ec89-4231-9dfe-7e8c4a7a4b55}w64.sys (StdLib) (1192fe258f63d8af9f76912fef8fb5f2)

1 / 68 (Adware)

{43925862-ec89-4231-9dfe-7e8c4a7a4b55}t.sys (StdLib) (080dd88fe5d234b3c726735230cfd8f9)

1 / 68 (Adware)

kingthink.PurBrowse.dll (6c99fbe51192bebe2393d5465995a073)

1 / 68 (Adware)

kingthink.Msvcmon.dll (aecc1f8655a27ae4093e7093e39cd60e)

1 / 68 (Adware)

kingthink.GCUpdate.dll (86d00f610c2d0cdbdc7407b6ba6a2269)

1 / 68 (Adware)

kingthink.DspSvc.dll (0752969911a9fa6c5f5ef3c033b59f06)

Latest 30 of 1,513 files

The following publishers (by Authenticode signature organization name) are related.

30 of 54 publishers

* Note, the details and description above are based on the code signing digital signature issued to kingthink by VeriSign, Inc. on August 04, 2014 with the serial number '460c442b73452ace582f3f3040efeb0b'.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.