home

chromodo_setup.exe

Chromodo

Comodo Security Solutions

This is a self-extracting archive and installer. The file has been seen being downloaded from files.downloadnow-2.com.
Publisher:
Comodo  (signed by Comodo Security Solutions)

Product:
Chromodo

Version:
50.14.22.468

MD5:
c0de2817df08a724d9398d397db6cf76

SHA-1:
02773de997fbe681a93ea9839b9fd0f5e85efeed

SHA-256:
7083fab0d15631015eecb45639909153a8aa19b4480e114bd97cc5eafc6b282b

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/23/2024 1:23:52 AM UTC  (today)

File size:
51.2 MB (53,661,272 bytes)

Product version:
50.14.22.468

Copyright:
Copyright (c) 2009-2016, Comodo Security Solutions, Inc.

File type:
Executable application (Win32 EXE)

Language:
English (United States d'America)

Common path:
C:\windows\temp\chromodo_setup.exe

Digital Signature
Signed by:
Comodo Security Solutions

Authority:
COMODO CA Limited

Valid from:
1/4/2016 1:00:00 AM

Valid to:
1/1/2017 12:59:59 AM

Subject:
CN=Comodo Security Solutions, O=Comodo Security Solutions, STREET=1255 Broad St., STREET=Suite 100, L=Clifton, S=New Jersey, PostalCode=07013, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
474BF5DFD0395CA926B2F2367E46DCE8

File PE Metadata
Compilation timestamp:
12/27/2015 7:25:55 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1572864:k57exjMd1uWrvgUD8J8mVMsMm2HjiDQ9Y6:ksMuWLgp8mV0Hjpu6

Entry address:
0x326A

Entry point:
81, EC, D4, 02, 00, 00, 55, 56, 6A, 20, 33, ED, 5E, 89, 6C, 24, 0C, 68, 01, 80, 00, 00, C7, 44, 24, 0C, 00, 93, 40, 00, 89, 6C, 24, 18, FF, 15, B0, 70, 40, 00, FF, 15, AC, 70, 40, 00, 66, 3D, 06, 00, 74, 11, 55, E8, 51, 31, 00, 00, 3B, C5, 74, 07, 68, 00, 0C, 00, 00, FF, D0, 53, 57, 68, F4, 92, 40, 00, E8, CE, 30, 00, 00, 68, EC, 92, 40, 00, E8, C4, 30, 00, 00, 68, E0, 92, 40, 00, E8, BA, 30, 00, 00, 6A, 09, E8, 1F, 31, 00, 00, 6A, 07, E8, 18, 31, 00, 00, A3, 24, 92, 42, 00, FF, 15, 44, 70, 40, 00, 55, FF...
 
[+]

Code size:
24 KB (24,576 bytes)

Startup File (All Users Run Once)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Name:
!CS

Command:
C:\windows\temp\chromodo_setup.exe --silent


The file chromodo_setup.exe has been seen being distributed by the following URL.

http://files.downloadnow-2.com/s/software/15/47/49/.../chromodosetup.exe

Scan chromodo_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.