Should I block it?

45%

45% of PCs block this file from running.

Possible reason:

Performance resource utilization

Additional versions

3,7,0,1218	23.53%
3,7,0,1203	64.71%
3,7,0,1195	5.88%
3, 5, 0, 1128	5.88%

Relationships

Parent process

explorer.exe (Windows Explorer by Microsoft Corporation)

Related files

PE file structure

Show functions

Import table

advapi32.dll

BuildExplicitAccessWithNameW, RegCreateKeyExW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegEnumKeyExW, RegDeleteKeyW, RegDeleteValueW, RegQueryInfoKeyW, RegCreateKeyW, GetNamedSecurityInfoW, RegCloseKey, SetEntriesInAclW, SetNamedSecurityInfoW

comctl32.dll

ImageList_GetImageInfo, ImageList_GetIconSize, ImageList_ReplaceIcon, ImageList_Draw, _TrackMouseEvent, ImageList_DrawEx, ImageList_LoadImageW, ImageList_Create, ImageList_Destroy, InitCommonControlsEx, ImageList_GetImageCount, ImageList_GetIcon, ImageList_AddMasked

comdlg32.dll

GetSaveFileNameW, GetOpenFileNameW

gdi32.dll

Polyline, LPtoDP, GetClipRgn, CreateRectRgn, TextOutW, Rectangle, CreatePolygonRgn, CombineRgn, GetTextColor, IntersectClipRect, OffsetWindowOrgEx, GdiFlush, GetPixel, CreateDiscardableBitmap, SetDIBitsToDevice, FillRgn, SetStretchBltMode, CreateFontW, Polygon, MoveToEx, LineTo, GetClipBox, SetWindowOrgEx, GetObjectW, StretchBlt, BitBlt, GetDeviceCaps, DPtoLP, CreateCompatibleBitmap, SetViewportOrgEx, CreateBitmap, CreatePatternBrush, PatBlt, GetStockObject, CreateSolidBrush, CreatePen, RoundRect, RestoreDC, SaveDC, CreateFontIndirectW, SetBkColor, ExtTextOutW, GetTextMetricsW, CreateDCW, SetBkMode, SetTextColor, CreateDIBSection, GetTextExtentPoint32W, DeleteObject, DeleteDC, SelectObject, ExcludeClipRect, SelectClipRgn, CreateCompatibleDC

gdiplus.dll

GdipCreateBitmapFromFile, GdipCreateFromHDC, GdipCreatePen1, GdipDeletePen, GdipDrawImagePointsRectI, GdipFillPath, GdipSetSmoothingMode, GdipReleaseDC, GdipAddPathString, GdipCreateSolidFill, GdipGetImageHeight, GdipGetImageWidth, GdipLoadImageFromFile, GdipDeleteFontFamily, GdipCreateFontFamilyFromName, GdipDeletePath, GdipCreatePath, GdipDeleteBrush, GdipDrawImagePointRectI, GdiplusShutdown, GdipCloneImage, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromResource, GdipCreateBitmapFromStream, GdipDeleteGraphics, GdipDisposeImage, GdipAlloc, GdipFree, GdipDrawLineI

kernel32.dll

DllMain

msimg32.dll

GradientFill, AlphaBlend, TransparentBlt

ole32.dll

StringFromGUID2, CoGetObject, CoTaskMemRealloc, CoTaskMemFree, OleCreate, OleSetContainedObject, OleDraw, CoTaskMemAlloc, CLSIDFromString, CLSIDFromProgID, CoGetClassObject, OleLockRunning, RevokeDragDrop, OleUninitialize, OleInitialize, CoUninitialize, CoInitialize, CreateStreamOnHGlobal, RegisterDragDrop, CoCreateInstance, OleDuplicateData, ReleaseStgMedium, DoDragDrop

shell32.dll

DragFinish, ShellExecuteExW, Shell_NotifyIconW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetSpecialFolderPathW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation, SHChangeNotify, DragQueryFileW, CommandLineToArgvW, SHGetFileInfoW, ExtractIconW, DragAcceptFiles

shlwapi.dll

PathFileExistsW, PathIsDirectoryW, PathRemoveFileSpecW, PathCombineW, PathFindFileNameW, PathFindExtensionW, PathRemoveExtensionW

urlmon.dll

URLDownloadToFileW

user32.dll

DllMain

version.dll

GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW

wininet.dll

DeleteUrlCacheEntryW, InternetSetCookieW, InternetCloseHandle, InternetReadFile, HttpQueryInfoW, InternetOpenUrlW, InternetOpenW, HttpEndRequestW, InternetWriteFile, HttpSendRequestExW, HttpAddRequestHeadersW, HttpOpenRequestW, InternetConnectW

winmm.dll

PlaySoundW

ws2_32.dll

getaddrinfo, WSASocketW, WSACreateEvent, WSASetEvent, WSAEventSelect, WSARecv, WSAResetEvent, WSASend, WSAGetOverlappedResult, WSAConnect, WSAEnumNetworkEvents, WSACloseEvent, freeaddrinfo

FlashGet3.exe

FlashGet3 by Trend Media Corporation Limited (Signed)

Remove FlashGet3.exe

Version:	3,7,0,1203
MD5:	d87513fd03ad624907dc35caa8b78e30
SHA1:	942d2d3de16ea9a425ee5579f58bdbef3ac2107e
SHA256:	13b11ec80c3ad1b5f9f91cc4abf4f11b61c04ef5dd9b47d0540bf83278137706

Overview

flashget3.exe executes as a process with the local user's privileges usually within the context of Windows Explorer. It is set to be run when the PC boots and the user logs into Windows (added to the Run registry key for the current user). It has been configured with a firewall exception which allows both inbound and outbound network communication without being blocked. It is installed with a couple of know programs including FlashGet3.7 published by Trend Media Corporation Limited, FlashGet 3.3 from Trend Media Corporation Limited and FlashGet 3.3 by Trend Media Corporation Limited.

Details

File name:	flashget3.exe
Publisher:	Trend Media Corporation Limited
Product name:	FlashGet3
Typical file path:	C:\Program Files\flashget network\flashget 3\flashget3.exe
File version:	3,7,0,1203
Product version:	3,7,0,1200
Size:	2.95 MB (3,090,056 bytes)
Certificate
Issued to:	Trend Media Corporation Limited
Authority (CA):	VeriSign
Effective date:	Thursday, April 21, 2011
Expiration date:	Sunday, July 21, 2013
Digital DNA
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

FlashGet

Trend Media Corporation Limited

68% remove

FlashGet is a freeware download manager for Microsoft Windows. It was originally available in either paid or ad-supported versions, the latter of which included an Internet Explorer Browser Helper Object (BHO). There is also some concern about FlashGet downloading every file indicated by its FGUpdate3.ini file that is downloaded from the developer every time FlashGet is started. A malicious FGUpdate3.ini modified for exploit and introd...

Behaviors

Startup files (user) run

Runs under the registry key 'HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

'FlashGet 3' → "C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe" -minimize

Windows firewall allowed programs

Exceptions allow programs to access to the Internet through an outbound connections

Firewall exception for 'C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe'
Firewall exception for 'C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe'
Firewall exception for 'C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe'

Network connections

Access through an approved Windows firewall exception

[TCP] 177.17.23.40.static.host.gvt.net.br (177.17.23.40:64424)

[UDP] listens on port 1133

[UDP] listens on port 63276

[UDP] listens on port 57570

[UDP] listens on port 60282

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00108213%	0.028634%
Kernel CPU:	0.00063203%	0.013761%
User CPU:	0.00045010%	0.014873%
Kernel CPU time:	31,570 ms/min	100,923,805ms/min
CPU cycles:	7,607,270/sec	17,470,203/sec
Context switches:	1,064/sec	284/sec
Memory
Private memory:	59.53 MB	21.59 MB
Private (maximum):	76.21 MB
Private (minimum):	30.98 MB
Non-paged memory:	59.53 MB	21.59 MB
Virtual memory:	287.8 MB	140.96 MB
Virtual memory (peak):	338.26 MB	169.69 MB
Working set:	43.11 MB	18.61 MB
Working set (peak):	77.36 MB	37.95 MB
Page faults:	225,322/min	2,039/min
I/O
I/O read transfer:	5.07 MB/sec	1.02 MB/min
I/O read operations:	52/sec	343/min
I/O write transfer:	2.42 MB/sec	274.99 KB/min
I/O write operations:	8/sec	227/min
I/O other transfer:	111.33 KB/sec	448.09 KB/min
I/O other operations:	8,386/sec	1,671/min
Resource allocations
Threads:	37	12
Handles:	618	600
GUI GDI count:	482	103
GUI GDI peak:	510	142
GUI USER count:	269	49
GUI USER peak:	297	71

Process properties

Integrety level:	Undefined
Platform:	64-bit
Command line:	"C:\Program Files\flashget network\flashget 3\flashget3.exe" -minimize
Owner:	User
Parent process:	Explorer.EXE (Windows Explorer by Microsoft)

Threads

Averages

corestat.dll (corestat by FLASHGET)
Total CPU:	0.04070192%	0.272967%
Kernel CPU:	0.02979213%	0.107585%
User CPU:	0.01090979%	0.165382%
Context switches:	21/sec	79/sec
Memory:	456 KB	1.16 MB
Flashget3.exe (main module)
Total CPU:	0.01854189%
Kernel CPU:	0.00532842%
User CPU:	0.01321347%
CPU cycles:	1,871,494/sec
Context switches:	34/sec
Memory:	2.95 MB
libem.dll (eMule by http://www.emule-project.net)
Total CPU:	0.01722051%
Kernel CPU:	0.00693017%
User CPU:	0.01029034%
Context switches:	284/sec
Memory:	4.48 MB
fnsstatistics.dll (fnsStatistics.dll by Trend Media Limited)
Total CPU:	0.00338106%
Kernel CPU:	0.00285277%
User CPU:	0.00052829%
Context switches:	10/sec
Memory:	260 KB
btcoreu.dll (BTCore by FLASHGET)
Total CPU:	0.00195976%
Kernel CPU:	0.00104988%
User CPU:	0.00090989%
Context switches:	6/sec
Memory:	1.14 MB
p2pcore.dll (by FlashGet.com)
Total CPU:	0.00167975%
Kernel CPU:	0.00094486%
User CPU:	0.00073489%
Context switches:	32/sec
Memory:	364 KB
ckcore.dll
Total CPU:	0.00021130%
Kernel CPU:	0.00021130%
User CPU:	0.00000000%
Memory:	264 KB
wow64win.dll
Total CPU:	0.00008081%
Kernel CPU:	0.00000000%
User CPU:	0.00008081%
CPU cycles:	594/sec
Memory:	360 KB
wow64.dll
Total CPU:	0.00002316%
Kernel CPU:	0.00000000%
User CPU:	0.00002316%
CPU cycles:	962/sec
Memory:	252 KB
fnsscheduler.dll (fnsScheduler.dll by Trend Media Limited)
Total CPU:	0.00000006%
Kernel CPU:	0.00000002%
User CPU:	0.00000004%
Memory:	300 KB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Distribution by Windows OS

OS version	distribution
Windows 7 Ultimate	47.06%
Microsoft Windows XP	23.53%
Windows 8 Pro	17.65%
Windows 7 Home Premium	5.88%
Windows 7 Professional	5.88%

Distribution by country

United States installs about 23.53% of FlashGet3.

Distribution by PC manufacturer

PC Manufacturer	distribution
Acer	100.00%

Remove Adware and Spyware Programs, FREE Download!