home

upgmsd_fr_366.exe

L Agence Exclusive

This is part of the Eorezo downloader which may bundle additional offers on the PC, mostly adware and other potentially unwanted software. The application upgmsd_fr_366.exe by L Agence Exclusive has been detected as adware by 22 anti-malware scanners.
Publisher:
L Agence Exclusive  (signed and verified)

MD5:
d1984efeb32782e736f335ae5d4297aa

SHA-1:
83df36c9eb11de80065e033070d973ba05f70661

SHA-256:
a8dbbf3b2cec39727766eb6a0f334f9ed728887bc17821584da0bfff45014f09

Scanner detections:
22 / 68

Status:
Adware

Analysis date:
5/10/2024 9:17:51 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Eorezo.CF
580

AhnLab V3 Security
PUP/Win32.Eorezo
2015.03.31

avast!
Win32:Eorezo-DQ [PUP]
2014.9-150705

AVG
Generic
2016.0.3154

Baidu Antivirus
Adware.Win32.EoRezo
4.0.3.15331

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
Application.Win32.EoRezo.AJ
21597

Dr.Web
Adware.Downware.10715, Adware.Eorezo.643
9.0.1.0186

Emsisoft Anti-Malware
Adware.Eorezo.CF
8.15.07.05.01

ESET NOD32
Win32/Adware.EoRezo.AJ application
7.0.302.0

F-Prot
W32/S-c61ac5f0
v6.4.7.1.166

F-Secure
Adware.Eorezo.CF
11.2015-05-07_1

herdProtect (fuzzy)
variant of upgmsd_br_366.exe (Adware)
2015.7.5.1

MicroWorld eScan
Adware.Eorezo.CF
16.0.0.558

NANO AntiVirus
Riskware.Win32.Eorezo.dpuaud
0.30.8.659

Norman
Adware.Eorezo.CF
11.20150705

nProtect
Adware.Eorezo.CF
15.06.10.02

Panda Antivirus
Generic Suspicious
15.03.31.05

Quick Heal
Adware.Eorezo.S5
3.15.14.00

Reason Heuristics
PUP.Eorezo
15.3.31.4

Rising Antivirus
PE:Adware.EoRezo!6.2072
23.00.65.15329

Sophos
PUA 'EoRezo Adware' (of type Adware)
5.15

File size:
3.2 MB (3,309,200 bytes)

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\gmsd_fr_366\upgmsd_fr_366.exe

Digital Signature
Signed by:
L Agence Exclusive

Authority:
GlobalSign nv-sa

Valid from:
10/31/2014 4:00:28 PM

Valid to:
11/1/2015 4:00:28 PM

Subject:
CN=L Agence Exclusive, O=L Agence Exclusive, L=Paris, S=Ile-De-France, C=FR

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121EC7FDD0BA7F42544161419B65E557A40

File PE Metadata
Compilation timestamp:
3/30/2015 1:01:57 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:oP4gJavGYo1eECGAV2ESLuXweszTMM6CRAMLQljvW54q39iKYR:oAfobeTMPFSe54q39g

Entry address:
0x1F040F

Entry point:
E8, A2, BA, 00, 00, E9, 89, FE, FF, FF, 3B, 0D, 30, 83, 6E, 00, 75, 02, F3, C3, E9, 29, BB, 00, 00, 8B, C1, 83, 60, 04, 00, C7, 00, 50, 08, 69, 00, C6, 40, 08, 00, C3, 8B, FF, 55, 8B, EC, 8B, C1, 8B, 4D, 08, C7, 00, 50, 08, 69, 00, 8B, 09, 89, 48, 04, C6, 40, 08, 00, 5D, C2, 08, 00, 8B, 41, 04, 85, C0, 75, 05, B8, 58, 08, 69, 00, C3, 8B, FF, 55, 8B, EC, 83, 7D, 08, 00, 57, 8B, F9, 74, 2D, 56, FF, 75, 08, E8, A6, 33, 00, 00, 8D, 70, 01, 56, E8, 33, 0F, 00, 00, 59, 59, 89, 47, 04, 85, C0, 74, 11, FF, 75, 08...
 
[+]

Code size:
2.3 MB (2,401,280 bytes)

Remove upgmsd_fr_366.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.