home

levelqualitywatcher64.exe

Savingsbull

This browser add-on is developed and distributed by AdPeak, Inc. The application levelqualitywatcher64.exe by Savingsbull has been detected as adware by 4 anti-malware scanners. It runs as a separate (within the context of its own process) windows Service named “Level Quality Watcher”. This file is typically installed with the program Level Quality Watcher by Adpeak, Inc. which is a potentially unwanted software program. While running, it connects to the Internet address server-54-230-203-84.fra50.r.cloudfront.net on port 80 using the HTTP protocol.
Publisher:
Savingsbull  (signed and verified)

MD5:
9b1e1e505b29a8f4324854da9561fbff

SHA-1:
408e4906c3f215c0e44282d24b340daf03d014a4

SHA-256:
0f3afecd3199d907ab6f6997614350e81708869279d19394855c193b1cd74034

Scanner detections:
4 / 68

Status:
Adware

Explanation:
Injects advertisements in the web browser in the form or banner ads and popups.

Analysis date:
4/18/2024 6:45:55 AM UTC  (today)

Scan engine
Detection
Engine version

Boost by Reason
Optional.Service.Savingsbull.V
188163

ESET NOD32
Win64/Adware.Adpeak (variant)
8.9409

Malwarebytes
PUP.Optional.Savingsbull
v2014.02.12.10

Reason Heuristics
PUP.Service.Savingsbull.V
14.2.12.10

File size:
694.3 KB (710,976 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\Program Files\level quality watcher\v1.01\levelqualitywatcher64.exe

Digital Signature
Signed by:
Savingsbull

Authority:
GoDaddy.com, Inc.

Valid from:
1/16/2014 2:47:15 PM

Valid to:
1/16/2015 2:47:15 PM

Subject:
CN=Savingsbull, O=Savingsbull, L=Sarasota, S=Florida, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
0428C93A073E5E

File PE Metadata
Compilation timestamp:
1/27/2014 3:44:52 PM

OS version:
5.1

OS bitness:
Win64

Subsystem:
Windows Console

Linker version:
11.0

CTPH (ssdeep):
12288:+U9jJ+/rcsq3Cms4uw8978y900E4x9oS6wp:7jevq3Cms/uy9Rr

Entry address:
0x60064

Entry point:
48, 83, EC, 28, E8, 07, 0F, 01, 00, 48, 83, C4, 28, E9, 42, FE, FF, FF, CC, CC, 48, 89, 5C, 24, 08, 57, 48, 83, EC, 20, 48, 63, D9, 48, 8D, 3D, E4, 33, 04, 00, 48, 03, DB, 48, 83, 3C, DF, 00, 75, 11, E8, A9, 00, 00, 00, 85, C0, 75, 08, 8D, 48, 11, E8, 51, 86, FF, FF, 48, 8B, 0C, DF, 48, 8B, 5C, 24, 30, 48, 83, C4, 20, 5F, 48, FF, 25, 3C, E4, 01, 00, 48, 89, 5C, 24, 08, 48, 89, 6C, 24, 10, 48, 89, 74, 24, 18, 57, 48, 83, EC, 20, BF, 24, 00, 00, 00, 48, 8D, 1D, 94, 33, 04, 00, 8B, EF, 48, 8B, 33, 48, 85, F6...
 
[+]

Entropy:
6.0697

Code size:
499.5 KB (511,488 bytes)

Service
Display name:
Level Quality Watcher

Type:
Win32OwnProcess


The file levelqualitywatcher64.exe has been discovered within the following program.

Level Quality Watcher  by Adpeak, Inc.
This is a potentially unwanted application (detected by a number of anti-malware products). This Windows Service is typically installed along side various web browser extensions by Adpeak such as the ScorpianSaver toolbar.
www.adpeak.com
80% remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to server-54-230-204-59.atl50.r.cloudfront.net  (54.230.204.59:80)

TCP (HTTP):
Connects to server-54-230-203-84.fra50.r.cloudfront.net  (54.230.203.84:80)

TCP (HTTP):
Connects to server-216-137-39-147.stl2.r.cloudfront.net  (216.137.39.147:80)

TCP (HTTP):
Connects to ec2-54-221-132-220.compute-1.amazonaws.com  (54.221.132.220:80)

Remove levelqualitywatcher64.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.