What is NExtCoup?

NExtCoup is software application developed by InstalleRex-WebPick. It is most commonly found on computers running Windows 7 with nearly 63.27% of installations running this operating system. NExtCoup's installer is typically 683.00 KB in size and installs around 47 files. The most common release is 2.1.0.1195 with 18.37% of all installations currently using this version.

NExtCoup is most popular in the United States with 32.59% of installations residing in this country.

About NExtCoup?

NextCoup is a robust web browser extension developed by JustPlug.It and distributed through the WebPick (InstalleRex) download and install manager. This cross-browser extension contains various parts including a Windows service, an auto-starting component, and a browser toolbar/plugin. Its primary function is to deliver advertisements in the form of banner ads, hyper-text links, and popups to the browser. It is important to note that some versions of NextCoup may also interfere with existing advertising on websites and inject affiliate codes into links as coupon offers. These advertisements can range from deceptive malvertising ads for supposed updates of common programs to unwanted pop-up ads. Downloading NextCoup may result in the installation of bundled adware utilities and additional browser extensions, as well as modifications to the browser's default security settings. Therefore, users should exercise caution when considering the installation of the NextCoup browser extension.

Multiple virus scanners have detected malware in NExtCoup.

7U.exe (MD5: 18c75d6e6235019d9d92dd51ff43cc3b) has been flagged by 14 scanners:

Scanner Software	Version	Result
AhnLab-V3	None	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:Dropper-gen [Drp]
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
Dr.Web	7.00.9.04080	Trojan.Crossrider.5139
McAfee	6.0.4.564	Artemis!18C75D6E6235
McAfee-GW-Edition	2013	Artemis!18C75D6E6235
Symantec	20131.1.5.61	WS.Reputation.1
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0317
VIPRE Antivirus	28488	JustPlugIt (fs)
Malwarebytes	1.75.0001	PUP.Optional.Multiplug
ViRobot	2011.4.7.4223	Adware.Agent.695808
Baidu-International	3.5.1.41473	Adware.Win32.BHO.77
AVG	14.0.0.3955	Generic5.AVLQ
ESET-NOD32	9924	a variant of Win32/AdWare.MultiPlug.Y

IOza74Zg9U.exe (MD5: 028c1a42ac6ff8fc1798d94718ed480f) has been flagged by 25 scanners:

Scanner Software	Version	Result
Lavasoft Ad-Aware	12.0.163.0	Application.Generic.621135
AhnLab-V3	None	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:MultiPlug-AD [PUP]
AVG	13.0.0.3169	Generic_r.JW
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.45
Bitdefender	7.2	Application.Generic.621135
Comodo Security	18122	ApplicUnwnt
ESET-NOD32	9691	a variant of Win32/AdWare.MultiPlug.T
G Data	24	Application.Generic.621135
K7GW	9.176.11799	Adware ( 004976341 )
Malwarebytes	1.75.0001	PUP.Optional.MultiPlug.A
MicroWorld-eScan	12.0.250.0	Application.Generic.621135
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0416
VIPRE Antivirus	28332	Trojan.Win32.Generic!BT
Emsisoft Anti-Malware	3.0.0.600	Gen:Variant.Adware.Graftor.146103 (B)
F-Secure	11.0.19100.45	Gen:Variant.Adware.Graftor.146103
IKARUS anti.virus	T3.1.6.1.0	PUA.Generic
Panda Antivirus	10.0.3.5	Trj/Genetic.gen
Avira AntiVir	7.11.169.90	TR/Crypt.EPACK.Gen2
McAfee	6.0.4.564	Artemis!B1F78E265F3F
McAfee-GW-Edition	2013	Heuristic.BehavesLike.Win32.Suspicious.H
Symantec	20131.1.5.61	WS.Reputation.1
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
Dr.Web	7.00.9.04080	Trojan.Crossrider.5139
ViRobot	2011.4.7.4223	Adware.Agent.695808

oD9mTf4.exe (MD5: dc0ac7dbdcbbb8b2561ba9b8ccab3d37) has been flagged by 9 scanners:

Scanner Software	Version	Result
AhnLab-V3	2014.05.28.00	Dropper/Win32.Preloader
Malwarebytes	1.75.0001	PUP.Optional.Multiplug
McAfee-GW-Edition	2013	Heuristic.BehavesLike.Win32.Suspicious.H
Symantec	20131.1.5.61	WS.Reputation.1
ViRobot	2011.4.7.4223	Adware.Agent.695808
Baidu-International	3.5.1.41473	Adware.Win32.BHO.77
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0519
AVG	14.0.0.3955	Generic5.AVLQ
ESET-NOD32	9924	a variant of Win32/AdWare.MultiPlug.Y

D0zcx5rxUN.exe (MD5: a6786c28986b3261f026078a4c098436) has been flagged by 22 scanners:

Scanner Software	Version	Result
Lavasoft Ad-Aware	12.0.163.0	Gen:Variant.Adware.61989
AhnLab-V3	2014.08.27.00	Trojan/Win32.Preloader
Avira AntiVir	7.11.169.90	TR/Crypt.EPACK.Gen2
Baidu-International	3.5.1.41473	Trojan.Win32.a.bgen
Bitdefender	7.2	Gen:Variant.Adware.61989
Emsisoft Anti-Malware	3.0.0.600	Gen:Variant.Adware.61989 (B)
ESET-NOD32	10319	a variant of Win32/AdWare.MultiPlug.AG
F-Secure	11.0.19100.45	Gen:Variant.Adware.61989
G Data	24	Gen:Variant.Adware.61989
Malwarebytes	1.75.0.1	PUP.Optional.MultiPlug
MicroWorld-eScan	12.0.250.0	Gen:Variant.Adware.61989
AVG	13.0.0.3169	Generic5.AQUI
Comodo Security	18148	Application.Win32.MultiPlug.SJ
McAfee	6.0.4.564	Artemis!B1F78E265F3F
McAfee-GW-Edition	2013	Heuristic.BehavesLike.Win32.Suspicious.H
Symantec	20131.1.5.61	WS.Reputation.1
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0402
VIPRE Antivirus	28486	Trojan.Win32.Generic!BT
avast!	8.0.1489.320	Win32:Dropper-gen [Drp]
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
Dr.Web	7.00.9.04080	Trojan.Crossrider.5139
ViRobot	2011.4.7.4223	Adware.Agent.695808

5bIvfXqFT.exe (MD5: 548e90ec0f1c80a218e085bdcdc8035e) has been flagged by 33 scanners:

Scanner Software	Version	Result
Lavasoft Ad-Aware	12.0.163.0	Application.Generic.678619
Agnitum Outpost	5.5.1.3	PUA.MultiPlug!
AhnLab-V3	2014.07.25.00	Trojan/Win32.Preloader
avast!	8.0.1489.320	Win32:Dropper-gen [Drp]
AVG	14.0.0.3986	Generic5.AZDH
Baidu-International	3.5.1.41473	PUA.Win32.CRXDrop.77
Bitdefender	7.2	Application.Generic.678619
Bkav FE	1.3.0.4959	W32.CureivantLTAS.Adware
Comodo Security	18965	ApplicUnwnt
ESET-NOD32	10151	a variant of Win32/AdWare.MultiPlug.AG
Fortinet FortiGate	5.1.152.0	Riskware/MultiPlug
F-Secure	11.0.19100.45	Application.Generic.678619
G Data	24	Application.Generic.678619
K7 AntiVirus	9.181.12834	Adware ( 0049c94b1 )
K7GW	9.181.12835	Adware ( 0049c94b1 )
Malwarebytes	1.75.0.1	PUP.Optional.MultiPlug
McAfee	6.0.4.564	RDN/Generic.bfr!ho
McAfee-GW-Edition	2013	RDN/Generic.bfr!ho
MicroWorld-eScan	12.0.250.0	Application.Generic.678619
Panda Antivirus	10.0.3.5	Trj/CI.A
Sophos	4.98.0	Generic PUA EH
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.R0CBH06GJ14
VIPRE Antivirus	31582	Trojan.Win32.Generic!BT
Qihoo-360	1.0.0.1015	Win32/Trojan.Dropper.c9f
Symantec	20131.1.5.61	WS.Reputation.1
Avira AntiVir	7.11.144.176	SPR/Tool.461312.1
Antiy-AVL	0.1.0.1	Trojan/Win32.SGeneric
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
IKARUS anti.virus	T3.1.6.1.0	Win32.SuspectCrc
AVware	1.5.0.16	Trojan.Win32.Generic!BT
Emsisoft Anti-Malware	3.0.0.600	Gen:Variant.Adware.Graftor.146103 (B)
Dr.Web	7.00.9.04080	Trojan.Crossrider.5139
ViRobot	2011.4.7.4223	Adware.Agent.695808

Software Details

URL:

https://nextcoup.info

Support:

–

Installation path:

C:\ProgramData\nextcoup

Uninstaller:

"C:\ProgramData\NExtCoup\JKHq.exe" /s /n /C:"ExecuteCommands;UninstallCommands" ""

Size:

683.00 KB

Language:

English

NExtCoup Executable Details

Primary executable:

JKHq.exe

Name:

NExtCoup

Path:

C:\ProgramData\nextcoup\JKHq.exe

MD5:

815b3303270ea4ce5a226f0e011f1bd5

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

EXE

dr.exe

90403d362277231c8ece1c4da79cb667

EXE

tB.exe

5b288612fe43837c7a6b439eaed297d8

EXE

7U.exe

Adware

18c75d6e6235019d9d92dd51ff43cc3b

EXE

IOza74Zg9U.exe

Adware

028c1a42ac6ff8fc1798d94718ed480f

EXE

Xlv8KP.exe

dc0ac7dbdcbbb8b2561ba9b8ccab3d37

EXE

SSLGHPsLz.exe

dc0ac7dbdcbbb8b2561ba9b8ccab3d37

EXE

oD9mTf4.exe

Adware

dc0ac7dbdcbbb8b2561ba9b8ccab3d37

EXE

D0zcx5rxUN.exe

Adware

a6786c28986b3261f026078a4c098436

EXE

5bIvfXqFT.exe

Adware

548e90ec0f1c80a218e085bdcdc8035e

EXE

mO01EahIRd.exe

be5c16f6998f6d7473150524c8338c62

NExtCoup

What is NExtCoup?

About NExtCoup?

Multiple virus scanners have detected malware in NExtCoup.

Software Details

NExtCoup Executable Details