home

6241.exe

City Center Games (Extreme White Limited)

The application 6241.exe by City Center Games (Extreme White Limited) has been detected as adware by 11 anti-malware scanners. This is a setup program which is used to install the application. This file is typically installed with the program Crossbrowse by CLARALABSOFTWARE which is a potentially unwanted software program. It is built using the Crossrider cross-browser extension toolkit. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from dl.ourstaticdatastorage.com.
Publisher:
City Center Games (Extreme White Limited)  (signed and verified)

Version:
105.0.0.0

MD5:
b5932ba42510ec3f2f363a9353c06809

SHA-1:
b56a47780b08932a62df930e1edc94bb23401d31

SHA-256:
5b2bd9062eb5025d4c073f25db92bfc235c763b57428bab56459497ade9283a6

Scanner detections:
11 / 68

Status:
Adware

Explanation:
The software may change the browser's home page and search provider settings as well as display advertisements.

Analysis date:
11/23/2024 8:06:48 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Win32/DH{gRITfWUDICIlZABXTg}
2016.0.3115

Dr.Web
Trojan.Crossrider1.29569
9.0.1.05190

ESET NOD32
Win32/Toolbar.CrossRider.CN potentially unwanted application
9.7.0.302.0

herdProtect (fuzzy)
variant of 1421.exe (Adware)
2015.8.6.23

Kaspersky
HEUR:Trojan-Downloader.Win32.Generic
14.0.0.2069

Malwarebytes
PUP.Optional.CrossBrowse
v2015.05.14.08

McAfee
Trojan.Artemis!B5932BA42510
17.6.569.0

Reason Heuristics
PUP.installCore.CityCenterGamesExtremeWhiteLimited
15.5.9.6

Sophos
PUA 'AppRider' (of type Adware)
5.14

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.3

VIPRE Antivirus
Threat.4789396
39486

File size:
1.8 MB (1,895,512 bytes)

Product version:
105.0.0.0

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\6241.exe

Digital Signature
Signed by:
City Center Games (Extreme White Limited)

Authority:
COMODO CA Limited

Valid from:
4/15/2015 2:00:00 AM

Valid to:
4/15/2016 1:59:59 AM

Subject:
CN=City Center Games (Extreme White Limited), O=City Center Games (Extreme White Limited), STREET=Tassou Papadopulu 6 (flat/office 22), L=Nicosia, S=Agios Dometios, PostalCode=2373, C=CY

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00808728FFBF020E8929813B59AA2EC529

File PE Metadata
Compilation timestamp:
5/7/2015 12:23:45 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:KSIsw/tPyw3nXqyDRpzeT/pSdtuFyBXL3O6HOzN46o:tvw/gAnX9DRdBlj

Entry address:
0x122EEE

Entry point:
E8, 48, 11, 01, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, C4, 9D, 5B, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 48, DE, 5A, 00, 01, 0F, 82, DA, 04, 00, 00, 0F, BA, 25, C4, 9D, 5B, 00, 00, 0F, 83, A7, 01, 00, 00, F7, C7, 03, 00, 00, 00, 0F, 85, B8, 01...
 
[+]

Code size:
1.3 MB (1,367,040 bytes)

The file 6241.exe has been discovered within the following program.

Crossbrowse  by CLARALABSOFTWARE
87% remove it
 
Powered by Should I Remove It?

The file 6241.exe has been seen being distributed by the following URL.

http://dl.ourstaticdatastorage.com/69/all/cp/.../setup.exe

Remove 6241.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.