home

google-chrome.exe

Leho

SetupSpeedy (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application google-chrome.exe, “Leho Setup ” by SetupSpeedy (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download Google's Chrome web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Sobodako   (signed by SetupSpeedy (Fried Cookie Ltd))

Product:
Leho

Description:
Leho Setup

MD5:
a4d407df99e49edfb3a9e0289f32d7ae

SHA-1:
370e8a45d5ddaa5da90b519269eb89bc1c923eb2

SHA-256:
47b189a047fbaa0446ade509e8fcf59c43b2b6878e2a7200a10e2b39db197d5d

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 8:18:58 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.3.7.20

File size:
1011.4 KB (1,035,712 bytes)

Product version:
2.2.6

Copyright:
Web Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\google-chrome.exe

Digital Signature
Signed by:
SetupSpeedy (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 6:09:36 PM

Valid to:
6/8/2016 8:12:50 PM

Subject:
CN=SetupSpeedy (Fried Cookie Ltd), O=SetupSpeedy (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121EF8B655959B1CFE34F05FAFC8D598305

File PE Metadata
Compilation timestamp:
6/20/1992 3:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:cxSG+tVxyzWedCCktHLrAaVTdbuvePvmU1BgPBU2B+AM0sLJ:cMfTcpk1wauePvmMBgP1BViJ

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9042

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file google-chrome.exe has been seen being distributed by the following 39 URLs.

http://www.bitssigncurrent.com/c?x=NPpnhYmjV6zHciV9NHCxuLEnB2yqR7H5AcrWSFQ9x5g=&c=q79zLWXKyBE3ulEdBBQkbV9mMvD/0Bgqk3QJ7m5s/wk8hJa3vIHd7Ife9XFEFdRptvAlU0Efe5JhkUdSwA6gxQ/5sHZu0Y0/KiN8ssSrA9wifcUwsyWXQeJAJVW87Zo/&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x= eIC0b7dWUtCXWxpm2duXDFaZTZ 40 XpUDX/8uugB8=&c=rIrZDlLlRH/GclUGCYCQVy6xl72waFVnq5fWG78Dkjzc3BGjDcD5wZv964Mi2rjj1FYq847XNEzmeCF7gW0lhls5O8pwRcndoJo5IadPk9mvIZkzy5o9DC4HJJq29X43&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.vaultbitscapital.com/c?x=2k3SMj/PhjGZQJ1GtgOySAq534OAiQQ4XipaT8DxUcU=&c=8ORtkrmSrYdohAALkd04P/aEwP7ZFCLQZeNJOw0Eo1WvQxWTpBmuZZKKniXmQn0ZtN/xqEZoyDu/jM8B F7Cn4TmfTrOD1gr4ResjMQ3GfP6Ce06BOpDQBzvUXhVDQ2f&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.hostsendcycle.com/c?x=pKjEyfQbaw/eLSZRHOeGdok478SIcJpU0t35Yfee/yo=&c=g9e9e8VDSsczr0rDlERfuoRNv35UNWofp1p0V K2e6WUEGhB5Nj3m VbiW78dcg6RKhOc/w4Etz88mHLP7a7 XvFULkjMjrScIR7wL3lYsPElpEelc5Hp fV93aeY6wv&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.conecptclearbest.com/c?x=MM90A70H8Om37kSuUYMtaLQJeYDUjZEeVMAVUW7xzvM=&c=mHRz9imPNFYF2gdZabAJvS12cGx20HHj2dDHH1o6i/x/ph tmM 5mEkXe4seQ07keRdKTUJffTOIwHeK/Xe4Q7dP1kUhyPLrH S5rzseflTdY1XxYJTBAOY0iHY2KcKg&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=4Zg/Uq7XkjOGfj8oukuncHQ4wAoSpXYJCpsZJrpbR9M=&c=KcWVpCcjxsBOhEcvvzkUfmEqnS3EpBngggEt2S/GLPrinhUmPTAjbZhvzskFELJ9FP0eHbe9V84yHw7uuF/p 8dzOLBMDmwtkRPftj5sCXYmmCULFmx8Z/ebOG5V8jW &fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=H1HtxGyUm Sb77Pyz1tsV1FPXypo39AV2FHX7xv5A3M=&c=Sut2hsBSb3UGpZZxsnThPs4o28fJX1SAqmKTUl9uoloRJVixTh6lSL hXhg6hNAcXqm0ngwrdKCE4OgnSExXt1 DCPiqpGmBQDo3 9NJaG0ASUZPatWtfIpWIzlisq5q&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=HKHh0KAzfIPo T7ouufNT8mb5PGfdJ6hpAUFTiGB0Gw=&c=qUS5xlFcLGp6SAb/AfkH0xCtDWSt 3rJvYI3fItsPefd tRrJczQDar36IHfFH2 qECVDxfwEWuAImWIieMLK73CC2bS cKkuV4JhZ4SezUrRIpB3r/H4Yb0vDZ7brLG&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=U7TQU3qKIx tnUV9lagXK/z6t2LibIpnN/vRP6cZH8o=&c=fa6rZrbk4B8cHDlfEplTxziXtmD0KUx4ViFdHE7UYxTx2lFWWT20b93/QH3n5 RoDzQM7bd5JNlTnXCoKgbAwteLTjXZkiEWbUGlss wDa3IsLHXVB6FmVqZVx2ltNRH&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=qQcd3VoSU48hzVqY6XFYFzbYA76e26ZFuWfpKw7LsSo=&c=xAAJV0kybwAr4 wta03O7fE5cktKlaFjoEXoBl0dM78e04LBXGzNYkEBivz6bMsQ84Ra9 /jEsYggqQGiO7iN zlfp7bLdzmROwebg66sNPdZ5O79 OzTMW9wGdncdjN&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=Xz9 mFFYMo1pxfX/9fE3FmdzLVMF6BJG8oQ9AfDYOok=&c=oZNRwya7v7eXCR58XkrIAF3TnGXFqhibhxe9IlYZSX6EVJl7cNCn72RmUTiPfbGQrtSQhc5QMrBWcRjboY9yBod95zIOb6IihNA2tK2kaAAVsW cSTLBj1B58mEBM0 K&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=In3TSGv6YhJk6rDluo/MAiw5e5aOYtoiD18VfIAaxhQ=&c=lDjuou0BeI6gviAn FGLHQJWg YyPjedoSANygvCSFHeDpE9QYCCBVUBGFRs9Hrr1VXJxjSmLDy2EW6aBGCIKC6E2w4xPp9In1T04l9P3L/JXDChBru5 2MFL8vLiXoL&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=UXhmWD3s5EkzIBEMWMly4jDCQfUZJ42WgJqm3P6TVRE=&c=tOz3FbuwN3jglT253/wyB2sM6Cnpk kW6eiS6xT8UEhX2NmW5zC3HIjnL9qNDYO7NMhuwUcWzSmaC3GHxOzgNmIsG2KsYAlpcSQXXYt4WR/qTf8GwaoZSITUOL9sItfj&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.vaultbitscapital.com/c?x=f2vcpGtGt0cZz0oZ24tSdfPR7IuZeSZNYzcEVLmqIUo=&c=9yclsEB3Fr5cvqgMwzDMBzjyPksnObUpGLy ZeSIS86nVdHts 1A OeOyBzhQ udAnzLL01zNbpuG6gTUgMf7l6v71hSpNsFOCj6HzRz3r0KqA0prABgxncSGn6S2t8y&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=sEfislvMC6mtpyv7rD90Ufknh8wGHwrP2V4n7aZP9Io=&c=OHVvcR30cu2/TtPqadxKFRIdxovl9eDgIqoSKV75sWfeWKoPiTRq8cW18eojPtf4X8s/ttF5DI8Wh6H6rVz0y3GVkaC31ReLlRVKZxNNHQDjdJ6lOzM1OBFPLo 3W2KV&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=W7eCidf2H016x1FC 4Rg02LgcT5yf2BA5d5MGk1hajQ=&c=r86hOr553XtlvCiOsyIU3VrfMRBZ1wePRhHHKOqRauRnEIhaqlbY/66ovZZ3eGDYmzQgXHXgldByNCKfUHmU2E/uZyOq/RXODY/FegZH2A8JFLySLcc YhvBEYa NEcW&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=8vujxX6 rIqd bTozcfJcqi4TeIA0vUSe7gJCfa7Vxw=&c=pVlqPGiEYv Pldee/lWeUQGr4yLiVImmzMmYSzpkPhsqIf 1g4z5 m6g3mWAroTNLOf ZtkWEJsXPy5nQZ/vqIUoFrFiNced9NC Lrbecf/BTlXVXpcsr3lLAL0sMEou&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.vaultbitscapital.com/c?x=3EKJ1a6bqCKduKACyhIx5/ 4thdhA8ZdRKElcXFVkYA=&c=x9Eu9z9G4mqiWkZiO4ze/L3yvRuukkz6c2mXR8MaDq4SQf WG2ALihGljyaCEIjb51itdLarWFo4aYfclqF/OYn6U4nW3NZ9dapPlcqbX6rvndTZYK0PGgOs8sszYD3u&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.vaultbitscapital.com/c?x=Is6r4r9BiypnACfL02M4el9EnQmgAahSHxO/s98k0U8=&c=kIvzFShMLbuwStHkxupyRiVdqXv6EdHhxBxp1HmOw6 zFyLJ4OpftJ ZuxpgsGpOp/fMPwHShtcNIlce7ilugNHpT8 fNjX8Ob0Qv md FmyZtO3tjnoRBbyVYHrHfXE&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=jx2zNXOGmTPMvBE8SbpHA0fgB8hIqXUcZgDCrb1bris=&c=EYyNElvRfw4ch2kSjP5gdI7QJ4TomSYvvM01QYrxrvUeVS5h3MHxJrjIr1H v52C9OpnGW99mSWgj7/OjrOzWWDbQ mjJvVvg54z981SsFT1JtBS2QC3HDSnr6PVuCho&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=te0gRRNyr15pfUaN1h9osSXGD2j7y7ZhZF01tvPXdDg=&c=iPaGCgigxmJORxVcoR1O /5DL0XaQOvgPuiunNz xB5qWmimaq8Hdc8Cpg4bAJUHYNGCVM5ptCzXq4HSepzdZOg99p5ZQxrKWUs A695U0FCdHcYqNlCk vvaXNnFTtm&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=JYtnIVdJPyALz0VmFiMg4wvPrnYAv7 VKp IgUNpBCA=&c=qGACt9jvvVYCgwTdKFIHP7 hTn8siZ35s216/eawB2dujq9Tp7gSsIMXCGK5yEa0ZpG EJwTkLnvjo8HQozS9cWlWHRbHXEIS6BW0Z4ndqah 3drrd1qSByovRoCu8Th&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.hostsendcycle.com/c?x=tNKz C1G3aFheS3j22FH9aTDs2CR720EpQlIW8zKiXU=&c=szcfYczxrkc4QacTctUIzAEdGO8VnqZ6hgWuyOpstNU4EH0zq2jiEU99Tl6mNpUBc0efMz7UlDUqfFioqx0wNhKSr mxu4cI8zh8kLDgGq2Mf2pc8NRmDQ/IipD L9ZD&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.vaultbitscapital.com/c?x=Xj5rIXpw74HvDbnuGbItwmdtV2w0E4F2R7F49/bHO7U=&c=QQMl/KJE4L0CubyfvIJrF6WdSTF18Hfr1Dkbr5gI4h1RVnsSvE6rlDrVUfo8Px6JKW1J418YCc mAKx651gaHXJYcGk5894tzl y3PAj4b8zVAzfpkask8NnJTydT46f&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.vaultbitscapital.com/c?x=FyBoYmqBpQw6twJZijlsJlGtnsyacDtDaBZEu6eJezA=&c=IxI4EStsDc LCoK/Y8oJgFRob2LyWLNX4eA/RVEciqVu6yZRF13skZjqlGpL9LA 0VdAjG2wXnzeAG/oPsSqQ0kze4 VkMQtYEkFzhk5qyU86yzlDhSCCnK7i1hhR7ZG&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.vaultbitscapital.com/c?x=qEM4bp1EjPmYKtIxmF2lNMbEHXhgk7R3ZH6Qs7itgRk=&c=5gaIBQhOe9L VURmVE3ZiyJVEihpaVs3UDSk0aS95Ab2fG7aaUMVSgp2D7h62LtQpSJCRMA0zwnGwF/QV9MK yG0J/0QGFn 3A/jYCiK9aKDRty6h0g Smyfpokaj2Y &fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.bitssigncurrent.com/c?x=biHBOtx4LqxzTqfplod530I8k5Ik4vcLK8NwKQtHnzU=&c=89LOwVWB2Qn1l1/9Pm90KTJYoIHxyROLIJ14T fiHgFw/t8w3xHgHH4AbzkXuLmh2y3QTqUEqB2QPxbWeOxjCSdasaxx3SaAO3iysWB7 Dh4eC512EExBMHNVeC4lEiZ&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.vaultbitscapital.com/c?x=kk2MwOJqSElTyqaafUbyfftB/EH0uyws/uhNqQK93iE=&c=E70X/BOl2MgBPe1YhW77hzIO9KaOuyeZMtT2UM4iv7xSpheFy4DNyN7WhqOFimhynsnwyklavzpcfc4KT35sTL85AA9JoEx6UCp6CopiHmaVOfVBogW jowEa8bZIzYp&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.vaultbitscapital.com/c?x=ISWyFEulUkMKO21kQ LQW6Z5xJub5RDuqxPxpRh/jTo=&c=ti99DNcN1UB1ykroKS2GL gZuVQxk8 Xr1jjolTZL9Ljfzt5/b/LvWA6pKLRPfWxsTDuQ9w xHAe862I ML2IA8n2jiOxHvS3bNDeIpcM4HhS6wz/OQVdRfEsS2EPvtt&fallback_url=https://secure.inndl.com/.../google-chrome.exe

http://www.hostsendcycle.com/c?x=7nXPVAnRKe6Y27w jfv8EPg8LZgeLH2mN3P359F5GdQ=&c=qxNFlXjJyFudrT92NeBHcRx26FUrf7viK/7lA4UVtftIgphVdzf0fPrxs6tN3MT1Orp45b uUMsqdzwkaU08U3pTGj2EG44t3bCJ2Ui3/9FsZa6FSXbnwXoKlPaE5bA5&fallback_url=https://secure.inndl.com/.../google-chrome.exe

Latest 30 of 39 download URLs

Remove google-chrome.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.