» lock-my-pc_4-9-5_en_59622.exe
Overview
Analysis
File Details

lock-my-pc_4-9-5_en_59622.exe

Lock My PC Free Edition

FSPro Labs

The application lock-my-pc_4-9-5_en_59622.exe, “Lock My PC Free Edition Setup ” by FSPro Labs has been detected as a potentially unwanted program by 3 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.

File name:

Publisher:

FSPro Labs (signed and verified)

Product:

Lock My PC Free Edition

Description:

Lock My PC Free Edition Setup

MD5:

ea6d16104ad5b27ce790044f00543be5

SHA-1:

0532e5e433ab4af1597b18c55e0a3cc8912ce9bb

SHA-256:

05d9fc13d2c183cc3dd236b7675399d94ee0b13a61e7243a6312f435fec39afe

Scanner detections:

3 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

4/26/2024 6:18:47 PM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/OpenCandy

10.10439

NANO AntiVirus

Riskware.Win32.OpenCandy.ddwoan

0.28.2.62151

Reason Heuristics

PUP.OpenCandy.Installer (L)

16.10.21.16

File size:

2.3 MB (2,412,616 bytes)

Product version:

4.9.5

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\programs\lock-my-pc_4-9-5_en_59622.exe

Digital Signature

Signed by:

FSPro Labs

Authority:

VeriSign, Inc.

Valid from:

1/9/2014 1:00:00 AM

Valid to:

4/10/2017 1:59:59 AM

Subject:

CN=FSPro Labs, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=FSPro Labs, L=Taganrog, S=Rostov region, C=RU

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

7B6CC6957166C29858134F621F7124F8

File PE Metadata

Compilation timestamp:

1/30/2013 3:21:56 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

49152:neA8pDWUa3twRkweFx8AgHaXCgRTyiRrM0V/P3afKMFnJXBli5e/Fm:e3D77XA97RTdrMU0Lnme/F

Entry address:

0x113BC

Entry point:

55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 2C, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 16, D8, FF, FF, E8, 65, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 2B, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 50, 86... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

63.5 KB (65,024 bytes)

Remove lock-my-pc_4-9-5_en_59622.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.