home

google chrome installer.exe

Ladah

Superb Alpha (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application google chrome installer.exe, “Ladah Setup ” by Superb Alpha (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download Google's Chrome web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Superb Alpha (Fried Cookie Ltd.)  (signed and verified)

Product:
Ladah

Description:
Ladah Setup

Version:
5.1.3.1

MD5:
50d739c8663529911bc2051cb96083a9

SHA-1:
65df01f43cc700fe1ea3598661168284f3704bf9

SHA-256:
a3c37b2838ead033cd5371e70051ac1b6b1a7033ed1afe87b18ef376afc12caf

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/28/2024 7:01:50 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.18.15

File size:
1.1 MB (1,113,480 bytes)

Product version:
5.7

Copyright:
Web Lite Program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\content.ie5\ynj4q33z\google chrome installer.exe

Digital Signature
Signed by:
Superb Alpha (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 1:00:57 PM

Valid to:
6/22/2016 4:48:43 PM

Subject:
CN=Superb Alpha (Fried Cookie Ltd.), O=Superb Alpha (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217F30BAAF40AF8D13BE6DB4153600593E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:AL0BH/iwl6SeF+TJusDI0NPFJ/cj3hxO/QM:AQdiwllTQsDfPF1O3hxmP

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file google chrome installer.exe has been seen being distributed by the following 22 URLs.

http://www.currentbinariescurrent.com/c?x=Se0ukYpohJF7EgNX7Gy3Y84GSbrJkYygFq0Ra7GnI0M=&c=Gw2Hqd7Ksj3Mq/LAFAx3BFgJtSqMnpEez5YFTcDNX9x2Ze1dmh6miEHtH93jIggEEtVXyDx6FUvpGMbHzx8MW3MUpBvL8FYJ0UU9Je/NUgY9z4xqSmPGkQnXd5UDRQ1c&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.townrepositorybundle.com/c?x=Yr62L0X4d6CwJLTPDz9cjE/Y9mDGpeFAbJJr0CNr8CE=&c=A4 jdpPBG3SftCNZrpayS2HxCYSc1rKFn/x8yPSDODB/hfVyef6zc97/6wtExBXZGrQEhYRanoccknsbxJBW7Etj1p tbNxz2fZbj34dEKuMbIlcH QwcJVGVcaSNLFC&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.citybestbody.com/c?x=h78U/werImoFt0JNxLfHblzTOtB5v3QTxEKY47a8sZc=&c=KZh5m4m/bxFFxX6kHVjuXdhI71pfsG8aerNhaMKrDfnSS ijZgZdACVsnDC//3ToEHoOVAt60oP2H/Q17h/57yiq48YWd AsWpHfoyzx/xTZCix3Dc4CxHKuBmd VryI&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.appsgiftgrab.com/c?x=Vy84RjYExEayVBjg6GN lNElO2/FTHr uVBItEdQWI4=&c=m QRVz1XfLnsRzKeXsHIQyBwCKyDR/ 1GFy QmqFp5Qn0T91p7CaMuAnzux64y/Xsgm8JY8X2KLLjb9jHYgPZM1ZgS1P7 kZgMtjyyChKtO5ZJbkHhiWjUZP/XXx2MjX&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=wCH8sWxtoXUo7dem0QNRNoLtD2NhdfPuOQfEDP0M8Ik=&c=IFSfclIOHmsi/CMI90DggOhhfI4wqDUNKaP0emqYTTYr KXRcRv F dPMb6Djq1RlSE8KzntOVkzmmIgXq4xfhIlP4hCiW8tHEJDieaAHBggT01Xa3Ta/YzJmFgk2siJ&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=UeKww4rwu3fMyrAjZCFot0ao5zPWl2PgaBmbXQfLoRs=&c=rHkYQ/dk78E bybSAkQIiX8lH959CTtKMal20hBHeyotUvNT4qGpxfav2YDmNx6SeJgBaRGsB1BYvGWk0pDkizsI4GoOwzeQ0LdTzxZM14sQCGkw1fOXvyCInknWn7Si&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.citybestbody.com/c?x=YvHtNdugf BixgDTQsaNaifq2Zb62xQCsQwu8LGodgM=&c=xFxAGBRJsoo99IemQ1cPzgmiOtDW q 4dTbUHGNj2rsPrSJUn9vheG9gbhajrTRHKybi2n3xujoCSrozdKvHxS6xuigk VDqhar4RfnhOqUr0tueG7NM9 RtxJtI9qsP&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.citybestbody.com/c?x=l9RTN/uOSGwk41SDJFfXLVAboQ4JyZ6k//N2LGqUeuc=&c=vyCBog1Ue9WMxvCL4lemiP752v7WI63l/Gpyw3tTPI2xX258mn1rnYvUe5/tU0M7WcvzGSxzDarS/LOv0C4NSSGNUxnbloe5lCVBF9B9E8/6RbXGHqujABswd0b 7A3q&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.citybestbody.com/c?x=wKaEle3jfFZl5SmevEVh3CrYj2CD odUdQIB9ygOGeQ=&c=YROyZTVt1UYcUdn8gE8EvEMM9qus2QfNMaNHC4phhO7lWH20XEUZxaFzBj2908FzEsPGzuFRomO8w rm2HW82LgB Cjc5T9ftxhAfo533l8RA QiA6DtMdTbJYZHmcuQ&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.townrepositorybundle.com/c?x=EA/cSYTG7da2q5o 3xRjl/IwXK91uj SJlPyPfkP1S8=&c=52N0pbeNnuq2hy8 ICBNDOTkBu7kGthOzhi3BdGGCF2/70PxraW1oK7aW rwQxwpnwp VrgZas7c7r824ClsmNBQV3/A7ymEJBU4 wqCf42AVBeWi2LwyCYArUNrTYAB&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=Jx51u5fGfsxIjO4Ed7iqhh2Ld44u/znv2XesHh6gC6M=&c=sgSDDCkjEupunGZOejMi87LdkdC92HXsxG3Z1hWqd/P40QHD3xBQK txIjCHjOjuIyu7BCzRegLnpCvaJp3p4Ji/igLlfQrc1GZXh1Zbf1jgFVZZeOd/QnxPU4aChIJg&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.citybestbody.com/c?x=iV31qM0 rA9mhXwy1z GG5QIo1EGNSkBQD8aL4BWcic=&c=h6XATdeG7o0L40tkADbqRIRmwmf3nS484FF6fZAt5bSGKx8h W/BgjCUZ9g5TucW1QNAix7Mx1tebMmT5Hhcgzx A65jlKR4Qq6f3TI/wINPX FgVH4e1cu69EZ6ITi8&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=Bs2ExMyd8SFDC1wedKwsF28z5kn2nY7c91ichFlYmBs=&c=/XPRzi9plpxlAXphUbRXwTaJx0ft5CZc pMt/xtsWYI7 FJB94r OmfcWAIU2DZwkuYamyk9QtiQ1pTs/TssCZ7dMLoOlyIRy7DG0wbQMRy/jfMgKeuDf3NAZ8o6HrVq&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.townrepositorybundle.com/c?x=CIWaO4gSv9/3nNauzC1vACEONcm76JOVIVFbqq a9yg=&c=q3X0/SGLG7jl8JDeKgR0GErtj6sFkamKAfksZEeuY2uCDbBu2 /I9QHZv0v5aAqcHKdyR5IVPTcqrZUP1dB0WB1h9oEjwTidcxAtT5cr h/2bS2FPLWEIwMI8WtZRO4e&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.townrepositorybundle.com/c?x=oXXrlNOEjFwcocHQ3tuNQUZaPVWNRaz6CWGJUKuUTMU=&c=ZjTeYK1RKfqBOZMT1ozufgmyGDtykr4X9OIS1LqmGIps dkLYa0WO4CFAR7aYXLSd9YWAMBQQB9JHKG6rTlMb9gGgNJGcxwuN3GTFUJExkEx9oQDwXybNKsT6r69rF5z&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=DxxBuPD8WApLwwZFPhguEouT7H9ieyp0FRAlOk85/tw=&c=0Q2uIyAJKBl40LKYkUPu1hBtqJUe bGEyqXirA5zftW73fnjn6/jNAjMdT3SZZrH qR/Gdmy66HlK PKA9VmSxljwOndxqG8ZsFsjOiOSAm7SEeiNOI/NSe6xr2ar0l &downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=W5GZo fCBH5hfNeXcqayS1 vvZU5YY mB0EqBEOKKZU=&c=kJFv YNsQ NhZgRH6Av7O9WxPsMaoSnUnXDOgkda50 zpj1SNXRYCsRo2f7UIlyF92aP3VM2COzPL4Cvq39rIRnhsbiqtexZMu2aTeDGJcPg/RsS3LODWNXcZ2y88Rl0&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=mMvG6TJ/XsaeuFqtH1I/km/AaGhGwVBHcC8a7vK8qok=&c=K615 PjBKcErWO8mNFOIg1I1LQ 4WG8y5EAcjvRIPHGr4tAj/ZrNHOgefIwBIrcaSK6Qzrgonng2iqAcsQKQu9VVFjI/Y6DFefu4SxnTIIGlOgz1Lm6F0uv MM2oQnB6&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.townrepositorybundle.com/c?x=MLPLGT65VifJuwoOX0 k dZhVCuqn fFeAGKezkSLMI=&c= QUT1csXmOWzY6NkZD19oDJUDrphzrhfxpJ u6IUIuT7zfx5dqCSBXf6mggFAKLs1eWZ1f0wY88fK yzdaB766PiemtXG5szUc161cbR6E8ALKJuiS/Vwg53 zZwT hM&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=wcW Z/6ji JYsxZR3FsHwyRNWO1Camc3u3kVhHvDS7g=&c=B4keBx95WQQYO0W4e8UKua2cSQCsT UFx1tvhjMB5bv EUsQHz0Djh5KY7J30X11xw5ZWqgxCu6mboJgF07G8mKlOTX/UByJrQgg 3mkTkVcacqv5PbFq9capyk1Lscs&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=wxFPzpn1j3/VpnboPOiRy9o5VY47OcrQzE7pLk66T2k=&c=GklhECrddGTgBsobRHcw2sj9ZnpqwpGjeEsWPjVSIgpwdAeI4vyyYsBApIZZjLgLGuBksv8oLtJZWKlsE57QgzPhmhKa9XEgHOQnCds9pNrLK9YXjQffOWUlo7AvuCzy&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.citybestbody.com/c?x=BW7D63Y5VRMTPA7R0WJV46Xo ZMACJU6DdS2xteRy30=&c=rjRIZVLW11R3fBKBXGAgUYSZaG/77sd3bE2N8ZtN/VdpQuZCxSnwsvPS2oAlRdeSvH3FTVAaP2yFKqph8iafkPKvcH CEssmnApOiotIB83wjI6YSDe63PSqUmkb76kr&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

Remove google chrome installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.