» cwsetup-ie.exe
Overview
Analysis
File Details
Programs (1)

cwsetup-ie.exe

Cartwheel Shopping

Cartwheel Inc

The application cwsetup-ie.exe, “Cartwheel Shopping Setup ” by Cartwheel Inc has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. This file is typically installed with the program Cartwheel Qwiklink Combo Installer by Cartwheel, Inc. which is a potentially unwanted software program.

File name:

cwsetup-ie.exe

Publisher:

Cartwheel, Inc. (signed by Cartwheel Inc)

Product:

Cartwheel Shopping

Description:

Cartwheel Shopping Setup

Version:

1.5.0.1904

MD5:

f32bb46e1a8ed8c58b59925b42805c58

SHA-1:

ba145a5f0c9e1bda2f3a647bd2af4187969ac24e

SHA-256:

2ea1f0d855402d7febab4179a4c5b79b6062122a163d3ceb3b14e1fda748fd98

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

4/19/2025 12:02:44 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Cartwheel (M)

16.10.17.11

File size:

3.7 MB (3,924,880 bytes)

Product version:

1.5.0.1904

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\roaming\cartwheel qwiklinx combo installer\cwsetup-ie.exe

Digital Signature

Signed by:

Cartwheel Inc

Authority:

Thawte, Inc.

Valid from:

9/5/2012 8:00:00 PM

Valid to:

9/6/2014 7:59:59 PM

Subject:

CN=Cartwheel Inc, O=Cartwheel Inc, L=Littleton, S=Colorado, C=US

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

5BC7C44E86B0D415E9FA94880EF2899D

File PE Metadata

Compilation timestamp:

10/30/2010 4:54:54 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

98304:PRQ+ZSRV7jy5jlnSiMqlnPGy8xcMPocfjm3ChQA:P9eVUZSiBln+yBYf6Sh7

Entry address:

0x16478

Entry point:

55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, B0, 52, 41, 00, E8, AC, 03, FF, FF, 33, C0, 55, 68, 45, 6B, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 01, 6B, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, AB, 41, 00, E8, 4E, EC, FF, FF, E8, F5, E7, FF, FF, 8D, 55, EC, 33, C0, E8, 7F, 84, FF, FF, 8B, 55, EC, B8, AC, D6, 41, 00, E8, E2, E9, FE, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, AC, D6, 41, 00, B2, 01... 
[+]

Entropy:

7.9888

Developed / compiled with:

Microsoft Visual C++

Code size:

84 KB (86,016 bytes)

The file cwsetup-ie.exe has been discovered within the following program.

Cartwheel Qwiklink Combo Installer by Cartwheel, Inc.

The Cartwheel Qwiklink Combo Installer installs both the Cartwheel Shopping and Qwiklink web browser extensions.

www.cartwheelshopping.com

86% remove it

Remove cwsetup-ie.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.