home

google chrome.exe

Installer

Setup Quality (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application google chrome.exe, “Installer Setup ” by Setup Quality (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download Google's Chrome web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Setup Quality (Fried Cookie Ltd.)  (signed and verified)

Product:
Installer

Description:
Installer Setup

Version:
2.0.3.3

MD5:
a0e2fb6dd6a4dbd981ca025b908bda98

SHA-1:
4101c3cb1e695a80f0a7f193d886162768a605a3

SHA-256:
e46e94fbbb7e2aa9cfd1bd41163df6c311b7a31b3076e7da41507a696628efc1

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/5/2024 2:53:13 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.30.9

File size:
960.3 KB (983,368 bytes)

Product version:
3.0.2

Copyright:
Web program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\google chrome.exe

Digital Signature
Signed by:
Setup Quality (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:53:08 PM

Valid to:
6/29/2016 8:02:29 PM

Subject:
CN=Setup Quality (Fried Cookie Ltd.), O=Setup Quality (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121734671448CB8540659135FEB5A8E8573

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:QmiOa0eOFSiIgFA9q0QgiFg/ORnYhoBXa+R6cPiFjT:QHaexiIRqFgTONYh6KcyV

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9307

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file google chrome.exe has been seen being distributed by the following 35 URLs.

http://www.apptowerstag.com/c?x=HgmEyeZgBg3be1uvFJwOoaDBQFbpW8xucWptFUOguWE=&c=v9dpucsODuDY7 P2mNid6ewwLXK0Qwt6eUhaUWCMjn fqnEIDpt7aMbd9FcJP11MovXMvvp0q0hDWipE1/.../IA26LwzlMewGvsINj&downloadAs=Google Chrome.exe

http://www.apptowerstag.com/c?x=pRyjGy055gDhTzCwRTOkeQzmc9ZGSpkWPo2PXOznEmU=&c=YE5inJaflHf7mX2RosEI5F7odxl DdF66633BoCOcKA8/.../5lQI8MaLr65cizs5Epci0DsPmfYrzF2 1V&downloadAs=Google Chrome.exe

http://www.apptowerstag.com/c?x=KNcY eVyhMMvPnpXYFQUCmzqzxJOuTAxJ3wVlBiR3ig=&c=CVMaUWUKmFsX3SHdfZg/Rmp8j2EJ1iS/.../V1cmAjIhHr4JtZXm4KGKPwxgO&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/.../bCiIyHQ2jUFMeqDsnQrH8T71GIojaE=&c=teRR4tmMoCvx5vBCFlJ3QAwVk5YmIrhXUv0weC6wGGi2SwJZQ4PdAQSkjNyRM5zfW6XhPcPw6j2DD7ChiiEljtaVLfWJcA3MuM8sJeTnL167xdFyyYlewmPZf7ak4LRS&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=AphejN/hhJmoq9/ 6/K7y60jWfcmPypErvDfhODU6js=&c=mq1OSBlDt212lbY1dUv4dk0Ny2EiniRSUZD3aQb33Lgui70Mn6C7bgt7PpYuT/.../dpbziJVXjO 0ewUqXlHcJnE1ihUFAIUyA&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/.../L17UbJK86YmFoP06lDt82H AeNQ3wPjteBw=&c=iLFClOj1B8RsSDxFN4zyfgGN47 LzuPjEee3M1i4BFspcgwQmjiiKQupA2soErie03Ypsui3cvkJCW0CuXeXI1zVfAuTAO6 WEdfLkjIqMrslz0UD95Zusfr3ePbCOVz&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=RQuO y t/.../kkRToLwqm0PGT7BM8G7vN5yNtDAPRLZWSOExvTV0L gGor3 J97KN9K Y Qrj3hQqk&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=AZQIMKbRM7f2xlhSEyLI9NHeTWv LCRbBxRvutcgSD4=&c=yZIgSGK77UPd0IIf1p7Mvmsdla8f3G6zA6anDDao 8ZQNsonXVrM0i6zfNTh8Gpowzk4qn5Yxt9C/.../SGTU21v0b5obBCwGoAdbexUkOU6R4w IJ1VxC659 BJe&downloadAs=Google Chrome.exe

http://www.apptowerstag.com/.../IueRCLS9t0IhUN7hvQostEW p0Q7UjW07DVqLPZTLjTFaBVdAurGr09gQxnGHNpvR1gUt72PGWhOVe0za7MO &downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=tHbaNvsMwlK2TdVG4InoO/SuXMQngmDD3XMHghs4v5Q=&c=txN5LGdxPOXGWS4 OU3wgJoK1AzQnLdQcmYXiZfKGQmCGIFZs 0zpB0Co9My90NxJfBqBkZBC/.../pVd5p8FlX o8Z S9Y2cDtk48 krbZiQ81BYJQk2t47g&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/c?x=w9DBQiBgF7wWZ09sjwWZK rZ37xgi7A79rXzXZHmZl4=&c=HixhqWxQCtLVAnU6 dd6OCrdgjOk/OiascoQWa1bc8E8g9d4XeTZfyWojQxNaHZlCneEfIjfVhPi/4v/.../toiUPr4LNcOrU0&downloadAs=Google Chrome.exe

http://www.laboratoryfactorygift.com/c?x=AqyRYV5NnhP6/.../w4KTu6Q7mFbtJbe3cPBawBW3DlJdKkghmJ8e9YoGnU5WvCrXBLQq9wXZ knocIw8zqnnx2QxVg7vgc 1Ic3jH4AoxpF8c1J3flRUwx45oqkW&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/.../aYKi7lP57wzv5BlNRB2V4rIbblHec6lzE2PP uyDz&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x= gH9BRLvDs4vY7EPGmZrWcvRYs2wyG jEgKGbWut4Wg=&c=69wrKVLyJFCEPcG5 cuNBQKG556iB5WI6WZo noaD0jnoXQ3/KlRZiXK3 6UVAm6D5LI/Lg25sNtLd7HRjDwZmjCSv6jb6Vin0UB/.../RZEz8V dEqhwXmkQyHCH1Xfb8&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=xia7AWXoSTvQETDbyoUw11mDyQ3xbapCUzZ1Mac43Qw=&c=86YdMyTCWqcuriIhPsFuyCvo5xXuPS5CVVMYohDEq35jcc7P5uUBxJ1GmItJZXvABV3ef537FegG2SQRClPW38VesbSrbkTFbn9WaiUu66G9ro20RBkOCOBY7NyEcbqW&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=Wa1rTBY1CBfx3FkJmnp 3RCkTRCKkzdNLSjrpkKi/bw=&c=CiKFEy9jSEPd/.../igeS6zG6Bk2FJcB26YUhQ7WJ&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/c?x=a/JV6S4URNCOJY ZqJUkScnO/.../mneQcGU6RGyHPXOuZA4iW hUGHxVu0clnhysKY54zmUpumnD8K gPlayAZlK054adPdF8tyqpxaSCbDvvSdW7QZRRieHaFCLLrnzAUUZ&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=CRxp343cNsNP/3OWWYrVBMi2NrBlPWoiNj24XAoUMFU=&c=17Y4qbVRwIig6GepN08wh48dK4dmP/tcUs68ed bjQnfTCBPrO6HV/KxjeiAjL16 /.../GgUoNvlNvyrmfFyIoCAMdolOtWlTMkfzqyBbywbdWSDecX1byDZEDYaj2To&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x= J4QfTUXWt/ k8GPmpHqqYUDlpvOKV96wC6CGG9h2C4=&c=/8G0iVsQ0DWeskfKxf2/.../5ZVMJx6GrnxF5gT8HyS1P5 Aqh8UqlZjxrYb32iX1w7NAo16Dz0dseEPr9OwC7IqoXHheInVoc72lTiTX&downloadAs=Google Chrome.exe

http://www.apptowerstag.com/.../l9mVs CYg5gftQxxc3rqsnLntqeRZsjw8Lg=&c=o4A80JR8GZnY9fLW76UDIbta7rgKRuctKK9 2hrzP1DnDVaLpMS8WJsQ6RcGRpUo0n2gvDUL1hpA0EAkGfL3u6WuynBw9pjB7eHh8Ff2ozbsRt03Zvy4jg5 3 WOrccg&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=Zs8ozKJu1mL/.../xTG8=&c=DkSruOUH9 ipNJEMvWgdUQ1AeiUetH6hswqzQXeLw7eDxCU2mWwFztUBJBgYFCfdRNuNiD W8g3wV2kxxIsQJem2EMZ8g8z7YIJIEw4VT7W5h 8uKl9VXPgmj56sbAh7&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=kV37YU2B XYjmTn8yYHVua6aHsjMBozbOlB op0LyNc=&c=f2lxeGRYwu2QLTGNWK2bGVLptzVZvv QW4R9k/.../jfAGR&downloadAs=Google Chrome.exe

http://www.bitsranchcontent.com/.../ohL&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/.../s7HUd55gq j235xblXIlUjkKkqgWeBrl6D641ANV3HjpDqTJvW7g60QI7B7XMkKre4hxbd8meDbLLABg22ckC3gkS57&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/c?x=53svHktMO/.../HuCMInwM=&c=VWcDVzQEpiKPXggWU938OzUdFEAiluGF82kOFnPwqXfHwlctyDWE kJbyFBlmuguQYqaB3z2Ff0db6hiaQgyNdyuOXRBaWetvpU7sL40x5fE9SQGjH0Z2xZanwaNkPqL&downloadAs=Google Chrome.exe

http://www.apptowerstag.com/.../iV3j3pAOjpJlbNd218Kr MCkYYJLRIn71&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/.../DPsfTr3DIAYoLr7&downloadAs=Google Chrome.exe

http://www.contentbestsend.com/c?x=dKDLA4X5wxO76uAOIoSm5k0vZT8/.../3IlgdG9W3KTeugz 3Qi8DRW8ZpkU0q31tezEYctdJ6b2uUd28SOk0Zim6zSpPzfc &downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=M3mISnGWc3VJPEaRhk9f9Gu0CjsipByzfld5ppBpHcQ=&c=iHGiDfzMx/.../5ULXEUtnYnzaePMmgzxmfloXxHizz3aWXpSM76Dx6lK3jGO89dtBer3CpP78MC13c1toDdSlfi9A7eI8vUPyIiVxC6cfm93B9Poi3g&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/.../ot0WXB4Kf xGPQO9yGWRWSoLFXGBV42WjtcqSiVEZBckfL91b91C4zcfcwQ ZRlUPyqkDb2qRi&downloadAs=Google Chrome.exe

Latest 30 of 35 download URLs

Remove google chrome.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.