How to remove RestoroSafeMode.exe

RestoroSafeMode.exe

The module RestoroSafeMode.exe has been detected as PUP.Restoro

RestoroSafeMode.exe
Remove RestoroSafeMode.exe

File Details

Product Name:

Restoro Safe Mode
Company Name:

Restoro
MD5: 58a0034a46abfbfbc3c4664293d4a23e
Size: 573 KB
First Published: 2020-06-02 10:55:00 (4 years ago)
Latest Published: 2025-04-06 23:01:28 (a month ago)
Status: PUP.Restoro (on last analysis)
Analysis Date: 2025-04-06 23:01:28 (a month ago)

Overview

Signed By: Restoro Ltd
Status: Valid

Common Places:

%programfiles%
%programfiles%
%programfiles%
%programfiles%
%programfiles%
%programfiles%
%programfiles%
%programfiles%
%programfiles%
%programfiles%

Geography:

8.6%
8.3%
8.0%
7.0%
3.2%
2.9%
2.9%
2.7%
2.7%
2.1%
2.1%
1.9%
1.9%
1.6%
1.6%
1.6%
1.6%
1.6%
1.3%
1.3%
1.3%
1.3%
1.3%
1.1%
1.1%
1.1%
1.1%
1.1%
1.1%
0.8%
0.8%
0.8%
0.8%
0.8%
0.8%
0.8%
0.8%
0.8%
0.8%
0.8%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.5%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%

OS Version:

Windows 10 74.3%
Windows 7 19.0%
Windows 8.1 3.5%
Windows 8 1.2%
Windows XP 0.7%
Windows Vista 0.5%
Windows Server 2012 R2 0.5%
Windows Server 2008 R2 0.2%

Analysis

Subsystem: Windows GUI
PE Type: pe
OS Bitness: 32
Image Base: 0x00400000
Entry Address: 0x000038af

PE Sections:

Name Size of data MD5
.text 29696 419d4e1be1ac35a5db9c47f553b27cea
.rdata 11264 cca1ca3fbf99570f6de9b43ce767f368
.data 512 77f0839f8ebea31040e462523e1c770e
.ndata 0 00000000000000000000000000000000
.rsrc 149504 eb51909b49df372862db7853b6396cc7
.reloc 4096 cd7258217b95b4c71b61774a365e022a

More information:

Search on Virustotal
Download GridinSoft Anti-Malware - Removal tool for RestoroSafeMode.exe
copyright for information about RestoroSafeMode.exe