» prmrsr.exe
Overview
Analysis
File Details
Network (1)

prmrsr.exe

PermissionResearch

TMRG Inc.

The component is part of the TMRG platform which will track various behaviors of web browsing habits including tracking sites and domains visited as well as ads clicked. The application prmrsr.exe by TMRG has been detected as adware by 15 anti-malware scanners. Part of RelevantKnowledge, a program typically installed via a software bundle (with the user's knowledge should they read the EULA) and will run in the background collecting and monitoring information about the user's behavior in order to build an extensive profile.

File name:

prmrsr.exe

Publisher:

TMRG, Inc. (signed by TMRG Inc.)

Product:

PermissionResearch

Version:

1.3.337.328 (Build 337.328)

MD5:

dc483bd52d0060ade65d1448cdb6e941

SHA-1:

de5e862eb8071c68677f49152413401c0a948f72

SHA-256:

aaa8fce65b8c4c55409db4984649b848926eb579e1bcf9844a5c2d0b52c3362f

Scanner detections:

15 / 68

Status:

Adware

Explanation:

Bundled via 3rd-party installers and monitors the user's behavior.

Analysis date:

4/24/2024 10:35:25 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Agent

7.1.1

Avira AntiVirus

ADWARE/Adware.Gen

7.11.169.232

avast!

Win32:Adware-BUG [PUP]

2014.9-140829

Baidu Antivirus

Adware.Win32.RK

4.0.3.14829

Comodo Security

ApplicUnwnt

19348

Dr.Web

DLOADER.Trojan

9.0.1.0241

ESET NOD32

Win32/Adware.RK.AE (variant)

8.10333

Fortinet FortiGate

Riskware/RK

8/29/2014

F-Prot

W32/Relevant.A.gen

v6.4.7.1.166

IKARUS anti.virus

PUA.RK

t3scan.1.7.5.0

K7 AntiVirus

Adware

13.183.13198

Reason Heuristics

PUP.TMRG.G

14.8.29.12

Sophos

Generic Proxy-OSS Application

4.98

VIPRE Antivirus

Marketscore.RelevantKnowledge

32644

Zillya! Antivirus

Adware.RK.Win32.292

2.0.0.1905

File size:

3.3 MB (3,480,856 bytes)

Product version:

1.3.337.328 (Build 337.328)

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\permissionresearch\prmrsr.exe

Digital Signature

Signed by:

TMRG Inc.

Authority:

VeriSign, Inc.

Valid from:

12/1/2013 7:00:00 PM

Valid to:

1/31/2016 6:59:59 PM

Subject:

CN=TMRG Inc., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=TMRG Inc., L=Reston, S=Virginia, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

51FEA1E74EDC6FFFF4BD5F65BD540362

File PE Metadata

Compilation timestamp:

7/14/2014 12:35:52 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

98304:aCWeuTuBQ2v0BoGix2pExS5mrPhShAswaT1LU9syf3WTwYevtXa:KQv0BoGix2pExXw1QL5s

Entry address:

0x22FAD0

Entry point:

E8, B8, 54, 01, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64, 8B, 1D, 00, 00, 00, 00, 8B, 03, 64, A3, 00, 00, 00, 00, 8B, 45, 08, 8B, 5D, 0C, 8B, 6D, FC, 8B, 63, FC, FF, E0, 5B, C9, C2, 08, 00, 58, 59, 87, 04, 24, FF, E0, 58, 59, 87, 04, 24, FF, E0, 58, 59, 87, 04, 24, FF, E0, 8B, FF, 55, 8B, EC, 51, 51, 53, 56, 57, 64, 8B, 35, 00, 00, 00, 00, 89, 75, FC, C7, 45, F8, 4C, FB, 62, 00, 6A, 00, FF, 75, 0C, FF, 75, F8, FF, 75, 08, E8, 8C, DF, 03, 00, 8B, 45, 0C, 8B... 
[+]

Entropy:

6.5582

Code size:

2.6 MB (2,711,552 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to ec2-54-208-30-101.compute-1.amazonaws.com (54.208.30.101:80)

Remove prmrsr.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.