home

google chrome.exe

Installer

Setup Quality (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application google chrome.exe, “Installer Setup ” by Setup Quality (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Setup Quality (Fried Cookie Ltd.)  (signed and verified)

Product:
Installer

Description:
Installer Setup

Version:
2.0.3.3

MD5:
9e86c9d91efb99d89833485681aaa912

SHA-1:
2b36c45d5c6bd229e34dc7a01e6bea56eb968ebc

SHA-256:
80cc216b103c381a3a8564b51a64ff50753690df80cafde3ad051ab4651d48f9

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/5/2024 2:31:27 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.30.18

File size:
960.3 KB (983,368 bytes)

Product version:
3.0.2

Copyright:
Web program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\programs\google chrome.exe

Digital Signature
Signed by:
Setup Quality (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:53:08 PM

Valid to:
6/29/2016 8:02:29 PM

Subject:
CN=Setup Quality (Fried Cookie Ltd.), O=Setup Quality (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121734671448CB8540659135FEB5A8E8573

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:qmiOa0eOFSiIgFA9q0QgiFg/ORnYhoBXa+R6cPiFjT:qHaexiIRqFgTONYh6KcyV

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9307

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file google chrome.exe has been seen being distributed by the following 50 URLs.

http://www.apptowerstag.com/c?x=/UPrGqgJlF76X4c8cl5yk1BoPE6PludX42RFCNk6Oyg=&c=qqm9zNcwsoM4lc3V6VDcExUSDMHtVqk5I13cuIfEYCxgqONpkcEFIvYgUS49SFlrIuq iX8gC7f9uQ6G8e7S o/.../dKOXs3JXnw8 wiJ 4jmvEwcmblOm414NwO6Z7M&downloadAs=Google Chrome.exe

http://www.bitsranchcontent.com/.../WBtkdMzj8Y9m rivDjpotH33aGr s3TPUYHCN4V4vuRqDhCFJWpxwZghSW1UbeeUBDM8uduA &downloadAs=Google Chrome.exe

http://www.apptowerstag.com/c?x=ViODWXOfatQJE tZArhJ5F1FB1XiW9 QrBzSncqinw4=&c=fUYXrtq 8gRaY Jce2bmy2bJlOJ3w9Rtcu6OVYJgYuLudMr1QNcYSdfv5lzasOmI02qN6G/.../T818XfYIaeCNVyk7tYin5RE4mkuakbz&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=hphCqbs0SWS5SA2fEDbNGkXR0TsAVJ/8wn C9qF4XLM=&c=QyTNXJ2fSlbKJC/HNBTzwOCnoXq/.../oVOxC8rvCkXZFvmiC&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=3S7V4x/tL53Oiq3TQ4O7A8cK2tudISbD7oGSacALCYw=&c=MNCqwWB8fBw4o576TE6VELtcvB6TRZKp6pNdz1LJXHO4L6ZRGrEfSzsO20CYW Px6/.../hMZEob2CvTEUIh3ZVoNSVjtnVag7Nb&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/.../137JZ12Tg4JBcQYEEWcE=&c=0iFHiZveQNHKFB5P4QDbty2fwgc2xiw7VEqXgXLZyKCUSnr1NBqBE49g4kMgzh2HNGr2DVdZrR70tyiHzXW11QN3n9zU8QGE6gRBBfcL5z5mc9twivoF0aUCRTe5e0qh&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/c?x=AQtmKpPHYLUEyKRBlCw4g/sOo4jR3kSkn8xhfjYalXg=&c=KyFGMpMr tCycO17Rj9ZLmgEKLiHDL 7FpmlU5Fwi4sfedUz6Onv0f96xr//DPs Dk4wROm9kST5ORiRYNYA17wk0oP5qOtIF69CODHndHVtgpgOgWaJioPLvUYLiEtQ&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/.../uR32uuLX6vrLt5xuwOfxYBWs4VW7qu0xRX7dPNqAtDikKHDGOzIYQZ1A2DXH1oWFrXlG 5Tyt8tOBBplpiJssiCMav 3 0n&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=Z9k/W26/.../fIY IslPuQO9fcKZ6lXNB1w 875njC2ll2 evCC6vUNyK9JKDzj&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=O9iGXRcHvy9J6eRkioxOrbfHTeRnc16eX7JuUMarCcQ=&c=/mQAETeW4RzFvCRNxWrvvZPQFXZ1H0umwOttPx8f3DVhBgCU8zhFbENHWN77t7Cx/YMcSDY0jwm//MAHr7aMcTkPVLKxFDmJUqe3mGJmDh4aEG9SkiX/.../uYNAbaJf&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=3RGUvg5Xe0l34l2cNKW52f0SlRUlcTMnUF37AxxYMFo=&c=vORq6adM1SM6w6Pxxo2AZE1C3wVlA ayuoy7dILMi9v0EjvAaDGVK8Z7IsfioFWqA/.../VmO6NmB1wbzu88QKynuU19YNj7pr&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/c?x=hIqrrhG8wBXg7kEE8vDqT1hyFM0Z2mOXod IXMLVe7E=&c=WU4/ub ejpi1/fsEJv/aThenXu1Wxon5zBYWKJ2S/.../lhX9l 2 BQmjL9Ot3dwzzYJt2mWHVOWEU809Fyd02W6VtimyV6So9qw2JFlN9SeM31Q&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/c?x=fEwmvOITdqx5KqYH Gaag0gC FrXMoOIrn3A 9qCMeE=&c=FH5uptS0PDqNRR/rnauliZRF4LyCV31i6QKfTlrTX2vTnMJvFpFtFneP8OC8r/.../YGZdIpWbJZVCzkyQyrOQiMRqNOCRZiJZ1Cb2QSZnQqR&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/c?x=61Bklso28nHmsHUV5nrrx3qGUDuS2I8odLcdriAUE4k=&c=JhWtbgEi9fZiEBJ4PUQGtZs C/.../mFrOZ zQWJ5tasLEgArBwqNI7U189k9Xaq8h i&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/.../yst M3cK1DeGBfn4piR7ZahRX240rvMj8gj6YR6M0SGDW&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=qkj78IxpjIsPp049cauUGc5DI7bNXp87LUUOGeS FLI=&c=mDxg6XVQ5KnzM9y2w 6/g0Spl5 LktASEzLC17v1HTf5dCN1iQ3IVfUDytRDXkgxKjcaxsO5Aah/.../E4&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/c?x=ebXDc/.../HkLq ozv5Sbqv6XDQsh E3Cn2oCjzc=&c=9G99PZmDJ6NJTzW5OLjrybultgu 5AU1cMYVmnWOWwdDBXcKK8iInjkzKbhCjT29A8W76gORD5Ci2muHEKTxnRSSi17TtxxU4VGAQcjfD10Kgj3pDv8LdL7CEMUw8Qas&downloadAs=Google Chrome.exe

http://www.apptowerstag.com/.../Yoz8=&c=1OMXgH E4wedH dlpIPSTPBceFomwqC6wRQqLrcPSe5RwVMmTQLgUbYunRpGERhtYap9DANs5uPs1nY5j7RMrgjAJtfhhfpXQ6 hLQTU9y1TKihPemeNQVtbZYzyEbSy&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/.../KpKxnoPSrLVHxZs7Uu9Sqq9yZK61nHW&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/.../VFWqA9OpvoxspcsfdWMGEvVt6Bw6DW6b6K9fRcXC9uEazAhZ7ha6OBc&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=4BzMn 4fJe8MV/2Rc4CjzxrdTfYYGIyqJaUQZROLMQ4=&c=iwm2alPD40uzq7QgnvU/qKHHQwxuhMXxTNbauXjYF7L EgMoUbKp6aRplsXfWHlLfq49gA SOYPTsg0cHE5EzFtOXT/.../mI5pmU&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/.../ 9t47SVXRNmRIxQCJS3fkbEQ2trCwzPaKXny0u1gB4QwBffNymwXn4eACSDk1SUUbCRTGmQE38U1a7nlyEm6cgiys&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=2gx/.../veGgw4 r7GYoLcjmdBCe53kbU20&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/.../N 1koTeB4c9QYAolTl0ys pj4qTw4eMvlBdVJA1kieKxexeQmMmpJsWNU0xVutuzt2qtTtos8O4YhSc2e1VygDATEcIUagNZQbF&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=AgoYVaaz1VSoddPRwjE73zC407x6woUHyj0uQ2OnTpo=&c=J06oxuWIqTLsM3qvtgKSIz6Bu8oWr07JH8r6LcI8JOXGi7mKsoili 0PkxFtC8B5FOm6M0UD5CI/.../1 oKKxPGz9PVr3k0ul&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=Bnq FXD 1AdfNx83aBWozd SDCOBDzfn86XK JXS038=&c=Y2VdUqR/MPMaHDTDOLXlHIxKSSFZKpUqbVYIlnBeMbtIuVJi2O4E2WzAhg7Ou/QczetdspVnXSnIyQqPSLBNN/.../Pinsi3vU&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=Zjhapqs 2ZC3gJsx8JsTLwTh 7HWY/NYPb6xdGOOpCE=&c=0E7h2wCp8Gs/UmCzMbm9bLFqKQapWFiRPU bQ81hCjjY2/.../AEtSNYU4IQu9NI7Cbe&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/c?x=J5KBGcB7M8L4Z3gVugGUUe3/QjeN60CaYXVo718ToM4=&c=uXHoDVpKRn4ZKPZI/CNsH/tkUsFu6e24MJexbkG3WYyKmfAOFtT9dnLmJG/.../HvMwiVJT qkBGoqEJTtSXEKZk6fz9ylSsft&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=NPl58xqHDsg4gfUsi8TxXPxToOdl sW/HncHTs5yTjU=&c=PIMW0tk0KGRDJt1062YOiOEHpUepKKoRkol7u6IvWszy /8CvLvahti3/.../DgmDG4avPdrpO0PZ6TiPajIDNLTTq6TT1EZkJL58EbNyN 1Ust5twBW2q75&downloadAs=Google Chrome.exe

http://www.farmupdatedownload.com/.../5lfnYispsUhm8rMrqJC9hhxhQEybV0r4nA=&c=WndrsRnj7OiGV AuVbvZifMISKQZ01vgqaj8OO6KeWkyg8ifxt6oKcHAOB6GmIK5oalsQ3KWAU2DNvQIHWHrkxK3UpqRZBe5dVQtoTdShzyTyvUbTYnTKcBsagNzXGp2&downloadAs=Google Chrome.exe

Latest 30 of 79 download URLs

Remove google chrome.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.