home

chromesetup_fr.exe

Application Installer

MICROMAX STUDIO, S.L.

The application chromesetup_fr.exe, “Application Installer Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.hosttagtours.com and multiple other hosts.
Publisher:
Application Generic   (signed by MICROMAX STUDIO, S.L.)

Product:
Application Installer

Description:
Application Installer Setup

Version:
4.0.4.1

MD5:
50f2af701b1f55f0fa6eba516341d072

SHA-1:
5ac377f97d86cbddecaa5a9d39aedad46cdce739

SHA-256:
6614afd9d3525266ff5588fcd1a21525c038d28c3c938e4f3c1a605e9dc1c4a9

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 9:02:06 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAXSTUDIO.Installer (M)
16.1.15.11

File size:
916.4 KB (938,344 bytes)

Product version:
3.6.8

Copyright:
Application Generic

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\chromesetup_fr.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:kv//uCoylpB8bnLLFKqe+PO4efJOVGykH:kv9BBSnL4kPrEcPO

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file chromesetup_fr.exe has been seen being distributed by the following 50 URLs.

http://www.hosttagtours.com/c?x=CnWy63eCUz1LUhVZrOfJmG0Xi1LexM87zhvRf/i5Y0s=&c=J7BPOWJ4wq1II8cgkITBBVsNA3Y oL4gTKIjs9y/5aRMdxw 2L85X0HxV42AOLwlM3h5frakIRCiQblXPeGR1xICbiZ9UDtmUQAFZHPCVFeLVbeoMhrlGnANulZu7T8u&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.purepackagesthread.com/c?x=6qyAw GNsny6QNxQJiFUr2tjMBKLaXBF7m6u383384k=&c=Q WciBH48ND3fdGgj50kXa50JXKMpJTbCTOdwzwNNVtc8F4V PLRR6IBzk88E4C3pVORpsDAfM6lEs9Vgs3xcFokBr681WHj6p24oo4Q14A3gtpE6VdggF0TZfLr6MzgS/Yu/taFFZLyC/E/wdZbUw==&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.toursstockclean.com/c?x=BQ1ELFAW/zy/XLFXfdTtW8eQWiBnE4sdhz3MD/rMod8=&c=Vq4WqWiReTvLzNql3LaOP6ZWpnFKyH6OpSxokVGCFLpokUM9DmMV4tSynPuznVl8Qkv/xHlhalODFfBrzRYtuqC/B3nH2dzFBdbYOvhzEwTT6lhbkIIGZGfY2DfvsEfo&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.purepackagesthread.com/c?x=Lyr4OObvHNCkTSguR9Rs xAZt3i40seQrsRaf2Tj37U=&c=5Iesi9Okd5aTGnIixo9CvH9fgNlXPKbddh99xsTGl9cujDWQtfXDCmmJxP5niiG/KGrDK0b0FcSB5UTgbB7fkTzA7SoY0g4StHhp7//uVF6uI9YZ0OCPbExtWAMUOZ j8Tz7cuQj1fIKf 3NPgYaOA==&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.tourpackagebinaries.com/c?x=9RFmWlur0DKHwZXs3m6ayRG1WgxI8VHdU D5eVhEBw0=&c=hA78JIsC4RIZXWq9WueDsa6suyJ2OtGhD9SZXqGihYgZNYOtL OFzQTO7ZaXw64OQe6rqOP1YERLW2Ew9XbgoSVgdLDGGmLE jtFbRrXGUvPHYEe/gDcM9vU0MNIQNz &fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bundlescurrentfarm.com/c?x=OKSQnrFIxd8azDLA6XOlwEVA0xcv7YKGU0j6YTLKYuY=&c=cGvSNOx1bbTsNFmBEGFYbVDzpGxV cFdKDMjZBNtjneA6Ab2KjK VGpKQRGIW8lipCHeoGkhvkifgIvZKnUnBnh1f6UExpuWk6cQlb8mvqeopucWReZlhCRXX9F7Bhze&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.deliverysoftwarecontent.com/c?x=FgFtbK5HHME1lEN5Bf0WX7VgIka6a/UmjCD4mqaILEU=&c=03d9iJTR/WpZJ0AkpcUXVHuJtIKMMz9lVzGGkRjEbnhtkRU3mgtmzaojGgeOP aWj2PnJWSgrCe7mxaclaXOyDEhMD/vnSGN tjAdp9UuvDdPG2iFwq5kkOhCTgzCd/Y&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.centersignfun.com/c?x= o4C6G3nuZoJgRdoUhXVLqL4zyV4RRW7kUpyLD6R/HI=&c=aUhTMXGUtX lBAmCvHgDi2IIEkoGVxELuGb1ZWWazJfwtSnOQCQkRQgn6IGNdMl8lKGKS4h3LQseF0s1abrLeGBog67/Lhej9QJ62sYYmFL/VXH5b6Wy9fmW9SVEhoae&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.apptoursbundle.com/c?x=jCdIqxRxMFywvju6KCAWX7nfMmX37rb9/7BcwIfLHTs=&c=qPdqziH0/5FoCh3QFxDMsl6lMT1/0vcXEwqKU6JZtcU0fbB3kvMqEekTZIjJPRt/kD5TrcvQVUPoBciEoaETRvjw7hudAxUzjgiY3ksbpRUGJl3NTYRoubTeEem1HgyQ&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.sendcurrentapp.com/c?x=4TaG2uGxqmMNI0EQxZP0aaH/5uNS6PKaj9PCHK9G5nE=&c=epPv/L3nltAuKgbm7xKH7nYyLK2k/ZVkg3MNwgJwlNPKeSqPskaZwv1uyILYkVU5LDV/NflMRwxpOXQtgNQyiSrhVSF5l8ZneIqv XKwWPyKY3h3Upvzu2KgpWrGJ4z3&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.cityheartsafe.com/c?x=DFJQBvQmFNaKxPcp70eJ7qm1KS 9KkP2vIL0jWZ1AYA=&c=UKGuyFAu9MMH0ZeJBeF042JasXZACKVAVzHvXrdGbWxCCS5NwPXlxR 3j7vVYdCwu6FZQKu0OaYNR8dJpO3Fg839k2wAhCSMzO4K2qLmdf6J0sFARjyz0CWPwvNYVTMU&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bundlescurrentfarm.com/c?x=wA 1TLEE1dLmFos7bHoHNVTOqrZhy5AUwoQOVrg5qio=&c=sadmGAyz7ZK WAVICLVFNtKoE2pKpHn7pqZ2WgRCZRL6sw5xgwDHlC0cJLFZ73kSdxC3xMVYjosbDy0/V2rY6Ga5lRSCtTFCWi8P60rok4BCvAP6za4ZwNFugIMXsJXH&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bundlescurrentfarm.com/c?x=t/BVl4CBLo hgXoVqhql1zslsGo07sj6du8iyR0ruy8=&c=iZ47H8wx2cxpEkCy9Oa2RZlNMz3nI58SCRv/lwUJLKGWlgh4cgscJTlezncsUKNB2wgvdQYFqK9gPsJUaFUlrh4fJw13 dh VVm3wU H7ub7hyol67qcpqsuhlvYot1Q&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.cityheartsafe.com/c?x=BKvgxKP97FQeVGWX1v3GhzdnyOsP tXwcQ FdpBD4j0=&c=gqLqRNEHsmjA7EfBQrZ4vdj5zH52G9oZZbfFgpWYV5/ arQVBeLRAYkanPG1m6Ko3diIvTC/6nPUpVxpAR2FTJsMrX5ad7fnpm5LvtUvh3ArPAqWPpFBXhopgRGDUjv7&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.tagfuncapital.com/c?x=uV85NHLp QQmNpz1w3fRhnXVpUZstgB/O3BXx9Iwnk0=&c=wn6sX4qbAdPRMUNTcADWVHgZ8g195sYmcPDzTdCYYKTCzNhVIzACpV1o5i8 WntCccp86WhgEX02QSuWiWv4Uz1HUhJws FEyRHQ0tNexQf0g2mdHr03NEnTJNdaGMQk&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.purepackagesthread.com/c?x=6GB9ZD3/xddHriFU6HICc0G3V8QEeh 4AgXJyh6nIgQ=&c=/1SRefWDFvy1eqc1JU0Ejqf8Z5N8NVxwZEsOF5NHghysKZ8qM5n/fv1VGLZ4hfeHJPZbfY0bxvd02tlTBY1ThSrWxBrkTCObj9 rs60pswghVI6SLnQh8XZiKo5ny8Lv&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.apptoursbundle.com/c?x=yxUFenqxx6suoiNS94bMbd4Biu0dKplNHnBcivPItRo=&c=V8eYDgayvoK8aaroV Jp0 Fhqpwzfcqp0ahqQjbD11o LOjsb9uuesRXhwX2RpSZRp9wJDKfjf2O6WDbX4S6pHfRPcL/oh5eA6qf6cVLZ/L3fZPGF5k9 2I5H31nmWma&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.laboratoryheartbest.com/c?x=KatX8b3vFLdA2dilOut8W5bSMTQYs8HrZJ7fFh5f/GU=&c=FOmOfG22SA4wEproWSh Q3X2B0j2P1sFjH2TNOUd6gW2tLiRnZJ9x3gf7i7IUH9bcbbBto6/HJxl1zb3 9rPNiO1WFqdzxLfegfhVCNjIGWbSZvn2jJfUMkif1kHVWgl&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bitsfarmnew.com/c?x=ZIRCj3HZaFR4lUijcZFrqKWpZMtSRVa4YKSuTTSiV7U=&c=HqKlTxBEdD1SCIvdX9cIjo0D7/PMNwbP fZvbSz1UhBGN6No3FzJdeZpWXeDRpZnzr2Et6dXNoqJrrBB Kjc4ikuEUroU/Fz4rkfSW5eUvJQy0g8E1QQ4XsVkeg4UJSf&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.farmcapitalmega.com/c?x=OAgAMnfLSZlSjLmdRBtoOiD9AlZxlupPS8EX66FWpVA=&c=5NKgf2RcmvovfRONc LQj38/6Eo1LNZvvlonqXJVROXPMlpJdAhc/SxiGvsdgp0qGsBBfRrTX0ykHLy0UBTNgRJ/I9EBOlbGBao4bIeWO5LHbc/vQRFL5HQR86jb q4F&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.signsdownloadschuckle.com/c?x=thl002rHgTtP Jg09K6mA0NJxhihmKKPfKKH4C63Hpc=&c=gcSKZ93O uWZhd iL29iAmnRHrXG3PvT58a 3EgRrT8cu7WOoomB35S9daAKl1DV30axxZP/FQOtKGlTZ5t93fltxeseujhe n RLCRD7dcH2Q67RYBAGXrchMRi DM/&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.hosttagtours.com/c?x=hutLBrN8lqnBqnMiXHlgW3TN2uTV6AOOWhk5zhB5D7s=&c=hfF8Xika2Umnj y6kYD/7Gfea9yOxZeM3JRXJxSFeGb888OZox vyTkUZZGaf00Gmu5nkXbr2EAPc9Z6ZD7byHe7Pxc2espDAL0SYw1 lSXiEy41ZIe911hzfHWGBpLi&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bitsfarmnew.com/c?x=zxPE0aFUlxTSnWoUBqaeozmcLeDBBqXh8MAsgij6Zvs=&c=ScRGdMIsl32snAuxypRoy88JZYH/PsjbfE0UYmLH9aEIWdkuhHKgLLEpLxa2JK5R2/rbBBjXlNQ77vOTr1t57MO1K3Lom8qpwojbT0z38paRgb8p0D4xcYoFPQD9uHkR&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.laboratoryheartbest.com/c?x=L18AdEfuR1hWT8gzWRJ9il0WCMjuiWv9ecj9KHR wBk=&c=q5zxzkGvoXytyr/UNMafaW ZAyKw4Y22iR02nkEJ4sghHlyQCn6Wmu/ToL1jtnRK3jG1wBbWvpZn0olpJYWwtWFRML5BsQVZGif0E/5lEBC1UeksyMBbCxLz2GO pcXe&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.farmcapitalmega.com/c?x=ziwVBBYwZGo3U/9Ng/ewEjWIz4MCVHa 5FkCBKMdM4Q=&c=tXQxgrz5l49qqIJpt1DufN52sPSyh2F312b8vtcNxW/OVqgk62AbJlMblxSYoRITRP9asrv2i0eb6ms0zKy3qXCXFjeibvcUtTxiNcgiUxVLrpnG74bQCBP34t7riNSF&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.tagfuncapital.com/c?x=Rwld8dCydAlFtmqRjjrlE Fhm0q0XZ8 uqcemoPXpl8=&c=bzUl5oiwbTvycbCvi50bWsxmyeHPvSCeBzzHHh0vBVTuDRSdB mhxZrNKq7pjL1IutDN1vBsIu9gzQAq3fcZ1wRTofWfVODvo3/0OrKfStkKUekjIO8oaYV PL65w9QY&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.apptoursbundle.com/c?x=/LEbkUUqBD7Le4ufMiOTgw kVl/5k SNFXXWxHbsv2Q=&c=cqXNjaMgo6n7PfjbwMP204dQuuPfc9FFzlq3k0VBsCu Jig3IFB2jrl NaQei6ro6sha0J6Kqnbp1ZiNeiPIQhP LM14jpc3AOBiEmekXi4KwHzPDIdxf3VTM8INklnC&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bundlecitybest.com/c?x=1vsefmphvwxQmgYvxrJr0EFXUr6IYFxHACI5I0Krlg0=&c=YywA KVqLOxZRWT5e70HTB9sYbJwK30OOnCEnG5GwBR/F45q9WVlgXAPOw2sAwhAakdEA7zKWwa5fkKlndFVC6evse 1h2U1ITitWWV0QpJQSTAvCB4hxXRaSj6kW6hj&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.towersworldbundles.com/c?x=q/NcNjUThit1hViO6eYByrSCuC9gVk9eCGd5Ehe1bWw=&c=NntnHOWs8u27os1Z /SmzR2NTMXSJVCCiW5d/lzJtmgNtZcYrs0mn/GD9t5JZWiRq6dBa9nCFyKOJ92HjPlQh/IPnNK/oJKno79z9uIVT8CvoBAiky5ZY5pQiqrhVyHn&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bundlesafequick.com/c?x=Mh6oKIug5a5Q8RjeSJDFy/oArA/G3it/2Wk4XMEaEXE=&c=aRo1V G2zlLc IFFz1LW3N7aLdVn2mqFD5 CQBZBltUx6sq5QhCVXTLoq8TF LN02WtHG6F1Nxp7ktSpzKW/ mu9Dm/nDBDqE2VGcWu 3YNV CDwJb37bU2ec9EwArQf&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

Latest 30 of 59 download URLs

Remove chromesetup_fr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.