home

usscvelmw2.exe

US System Care

pc speedup pro

The application usscvelmw2.exe by pc speedup pro has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.uspcworks.com and multiple other hosts.
Publisher:
uspcworks.com   (signed by pc speedup pro)

Product:
US System Care

Version:
US System Care

MD5:
4cebfa66d6edbe8164a23df283669dda

SHA-1:
fd43e1a6d59c121db54c774cdea56bb33b7c65cd

SHA-256:
380e48bba8b9fdbe44f674ebd130444dd92774b8cd7c91cfcfed18a90d97dfd4

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
1/15/2025 11:47:32 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.PCSeepdupPro.pcspeedu.Installer.Meta (L)
16.7.7.22

File size:
4.2 MB (4,391,144 bytes)

Product version:
1.0.0.5742

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\usscvelmw2.exe

Digital Signature
Signed by:
pc speedup pro

Authority:
COMODO CA Limited

Valid from:
2/28/2016 4:00:00 PM

Valid to:
2/28/2017 3:59:59 PM

Subject:
CN=pc speedup pro, OU=management, O=pc speedup pro, STREET=104 Surya Nagar, STREET=MURLIPURA, L=Jaipur, S=Rajasthan, PostalCode=302039, C=IN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
009CC01DDB723B1B1F926A2A1AEE6744B0

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:TmsUSpa8s0OQ3xKxjOOq7r3KIKmsOewhiXXaYVoMpEu8g:KT8s0OQ3s5QKmtgnnVznP

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9960

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file usscvelmw2.exe has been seen being distributed by the following 13 URLs.

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1241927&x-at=v1_7970557_235647_3o1_F093E64AB135732519415822126_-1_4331097_15sq7_536_F093E64AB135732518253685532_m_19_-2591505618113186315_874097____73_4kv3_19_

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1241927&x-at=v1_7970557_235647_3o1_B63380387E66542465471410191_-1_4331097_15sq7_536_B63380387E6654246498712369_m_19_4355794732139996713_874097___1_73_4kv3_19_

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1241927&x-at=v1_7970557_235647_3o1_713CA6C5A24935326574295928_-1_4331097_15sq7_536_713CA6C5A24935325555012860_m_19_4192165622515561523_874097___1_73_4kv3_19_

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1248227&x-at=v1_7970557_249947_3o1_D2DE9191D21271493381049222907_-1_4330177_162v3_536_D2DE9191D21271493371946387164_m_19_-2858563154570770951_895767___-1_73_4o9b_19_

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1241927&x-at=v1_7970557_197958_3o1_F2722760C8220007311900583843_-1_4330307_15sq7_533_F2722760C8220007301544163051_m_19_2006227303454451094_810158____73_487u_19_

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1241927&x-at=v1_7970557_206798_3o1_ABF69C1898368818500702983868_-1_4330207_15sq7_535_ABF69C1898368818499541326811_m_19_3483652268301893729_853367___2_73_4bri_19_

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1248257&x-at=v1_7970557_256917_3o1_738B4515D1738578121527617865_-1_4330107_16301_533_738B4515D173857811333439392_m_19_3346538650722871873_903777____73_4pk5_19_

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1248227&x-at=v1_7970557_249947_3o1_57F230EDBC974212421883798779_-1_4330177_162v3_533_57F230EDBC97421241485916428_m_19_-1612324425479631435_895767____73_4o9b_19_

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1253387&x-at=v1_7970557_266447_3o1_57F230EDBC125858291484543266_-1_4330077_1680b_533_57F230EDBC12585828759180583_m_19_-8713145026289856345_914007____73_4o9b_19_

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1253387&x-at=v1_7970557_266447_3o1_FEA1C5CA0661926721693711643_-1_4330077_1680b_536_FEA1C5CA0661926711451489701_m_19_-7696052647147102566_914007___-1_73_4o9b_19_

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1253387&x-at=v1_7970557_266447_3o1_EFC68E15A245928985443451144_-1_4330177_1680b_533_EFC68E15A245928984505983574_m_19_-604110636066096835_914007___-1_73_4o9b_19_

http://cdn.uspcworks.com/ussc/.../usscvelmw2.exe

http://www.uspcworks.com/download_ip.asp?def_utm_source=velmw2&utm_source=velmw2&utm_campaign=velmw2&pxl=VEL675_VEL661_RUNT&utm_pubid=1242797&x-at=v1_7970557_249897_3o1_9C9F281930121150346777731661_-1_4330197_15tld_534_9C9F2819301211503451089734709_m_19_-2921447149417864059_895737___-1_73_4hej_19_

Remove usscvelmw2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.