home

google_chrome.exe

Web Internet

Silver Setup (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application google_chrome.exe, “Web Internet Setup ” by Silver Setup (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Installer   (signed by Silver Setup (Fried Cookie Ltd.))

Product:
Web Internet

Description:
Web Internet Setup

Version:
2.6.3.1

MD5:
0d2add3abb4313d2d9ebd8291286437b

SHA-1:
c9975711610a60dd3414f5c9de568356ad50d887

SHA-256:
d9e9a63b7b6bf9f0e28d79d6329c89b558851ffe1eced372ac73f454e76d912f

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/28/2024 10:58:39 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.1.10

File size:
958.7 KB (981,744 bytes)

Product version:
5.6.0

Copyright:
Program Application

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Digital Signature
Signed by:
Silver Setup (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 6:43:58 PM

Valid to:
7/24/2016 8:03:54 PM

Subject:
CN=Silver Setup (Fried Cookie Ltd.), O=Silver Setup (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112140334915ED026A82D6160FD4F0BAD4D4

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:llb4OYNoBU0BYkZRDPCRx64rZ8NuQa2Fie+IfcY:l1hNS0VZdaBqc23+H

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9313

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file google_chrome.exe has been seen being distributed by the following 50 URLs.

http://www.hostsendpackage.com/.../fG2 8QBJ70VX62E8M oZE2A=&c=zctYSV7PyZWnlXKUOjvR6IBp6hviu9juSFY3XSRfOSdlrD6Mw77aNrWY XZVYFh2qJSVmJeAIrGrIzHUmWD7sF9hgXcnIIcuTPS RnllLrXGfQhlmddE1HHzrempjI3q&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=yEdgzTJ6mjI/BmO2YQY95GJ15y7z7GH8VaL8Lzciqv8=&c=ULrVVqkNmQhI3rua3JRxtHeJ4pcGtftPezqw4uRfDhbtlk5JjkOu3W3gaoChl3O4Lno6yn6Izvi/.../mbPh1PyJpyM9NsnTqFLmm6g rTAh8f3nu&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=tbXCvIV0t/dAEr7KnwJHRFDlqQ9NY7SMbbfnOcbkrcc=&c=tuM6HpZk7bxTNLr//Rosg5uIQ3B3isgmy/Q7BWKsQrbGXo/ hwMJ0//MwLMI3ZOL1YhGmJoqaBd1jzJlpZqjNk2AuHJYQuK8Q4ANVc80YwbgTnnlCLaBYmF4xlLFj9og&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=zpP TJ3Vu7ktnFwtKSseZ tGdeOJzw5n3x ad dSxI=&c=LIKpgCJLb0qZx9conAoj 92iLXTA5CZUhemQhdsxLZbCekr/.../bKUEnS8EtxTIzqIjQgnb7UfGlpVHci8Z4UcGPO&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=HfK55O61XO qR7dQ/h9xL66Z5lkZxWwW2fcZJxqKddo=&c=6UcybXyDIeMdpXYBSex/hgQdry59j 9SNy9pQjZ5x16g87ALkKkUxyZyY6PRBw4FJ 9sgU4NwZ7/.../AS2y4P9XYNAPrfkpjly5sFNIe9Np6vLruKSD3f0y &downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=c1uARg2riFwAU4DRiKb0xgr3/oFd4LvzM3ZY2g8Y1Iw=&c=zjNaipBlmxFBVL4yb0SW2h5CEmpBQkOlHUoCPpuzh cJ6lOL5zDeoAEQL16xhYMo3y6S/fnW21eQwUIBsnFU0kR0t2qbE6M4W4YXZMj6XUi/.../JOyT&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=aAJr05BGfqzr/Qp3wFbYm3UJ 2S3TALWktq0NMkNyys=&c=YN1WrpWIc/.../hMFIYgUjU0TzK92UJfwld&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=ZlRRLvDkLJmQKMYEttuio9p6/tJoJTqkOF50jarEpJw=&c=pyCrWlrqVyAIDdy09d0gIjk9l0fjvg7FYC3C91zy7vflHvzSo6omLwXESsvMUg 5LjNasSC6WkKEIN3XaWsK39lcXBDrAOvzWQkt5l QaUlsIPR/.../aMOSg&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/.../iubI3cscmyW3lfsm7StHgkZcSB2mg4aJtcNBmjPOg8frlPhavkccoEx9W5dsTbQ9JdaixPOTYKANng&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/.../alUNdX87DSp011M=&c=UKblI2H53oidGuCr7UrRlutlf7AXI3Y7fkC2MAfuOhzjpyfBHf74b0Id9xq2RBUE8bguwoExiAxy4 ylU48AxxGE7J11RPhQUMEORLTxzHGjvqSA5USbZ0wtM42lIVBc&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=S/h3oFckSqRhOBBeB7l0KYDy TirDZF5WsXzpzbLgGY=&c=Rhb38DuUUdgy4yWTMNsRP9VmVnUMcQkdljhKW9C4HVjdkLOkcf9ziO/.../K42CXLoLuGsH cGX&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=UOFqiFq0QmUo58IUu r1SewgGXmmmWSy5Ac/fVdrk0I=&c=BGwcSmX3dgpuSgMRl2902QJ9IA/.../3D2Ljhhy8C3V9gZKPRVSxy3EvOrBEo5WlxRgP974hTrXzMK aYAuUT82xcnm&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=kWpaLIY48v1CHb/.../jpp7OM9psPEIKrc&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=Bd57NhXyOdhSo6B7c7LIeHAcaJmQeM4uc7KQH48PN3o=&c=n54Pi9sp46Dhuur8tenQseAdLfcdAtyFJ7B9wDiT iGh 5wwmPyHjYHxW1VxA9lBi/.../WbREcJYDjnQP9AWqKB&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=sX4euMVeN2Ku//OQvQmA6lmTK// o0D yawLMHOYRKY=&c=OP2m5lKUQJ0u2PSQO68AdmhTeYnde/D5iC5/22mRhmLVudn48IKmGz1RXT/k/.../zYo3CSSmPUDjW0E9QFDmuldvgjdF 7 J2MkiEkw56iZwr&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=qOaanonTn2DjCgY7di1W/VLDy3UPe9Y6U0gCKXgjbPw=&c=yJEfLUp5Dsb2acBUYYPHZaLcgsee7/.../WJKQFFAkfhv7Stn1yDSduh2VY3WT9Q1 tQxt9Tm YideEsvhECrYWc&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=dKFK0AH9HuLDzo1S8lmwA7uZWCaenWpfDEn/.../vY nC43KbxO3NRslnIdwj9C78xb0XSTTya3sXsVZSDaT588CKmABDlJsLHIuf0p5KfpzDdCNIENb48pS6jtBvuLOj9zBnkWNiFiuvYdXpAxMWR1HkiqAGuUEqk&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/.../DQTNMfDuDoYTehnCZRtoLBXXD2Ylngwjwjm2au08JR0zTWtBtMtvbLe4hNfwu42tQf73M3MMEeIfTlSSJeR RQEQaQZIAWAe6Y&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x= np 0E9plcAPvm2xGYNbIQth2R6tl61cPMTc2NZdzu4=&c=fwU11Dfr4ktFANYW/PS3hwLCUJ2W87iA8sgB1/.../6XLQOj gPC sXVfyj1hG8fCxIbo3b9VlcFF6ZtYa7eBt37VeLo wvm2jivtvU&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=SVd1WvMq4OYH0DZKiew QBvzVfu7s3UNg2RWo59rN2o=&c=MKZBVBltJHjrpvtCofFvR8KGYwdGaiEoJYDZlGg88Uw1On8HfybuM1HNISwqhgkn4ynMrZsJLzzECOe/.../8EsvH1E971dflyPAm2qgr1ejahl&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=DqbeYcV1JZ0zSu 3RDBFxp5y3omo1ww717c6v94Bc/I=&c=eX mKTSHSV7ehMbKW2Q4stgBRQFCODda28kUtEJKz/v9Sdme/E3Vf64xheueTDHK3K7kgc4buVxAeOCoxwaunBE/.../4WVB4xKtBhVHJ6Ow8QiJ4OfwUK0CTPvxt3QijT&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=GLBgnKbEHDE4FCkS4L8/3UNzgpemekJf9iglr418Wbc=&c=D0NFMGCFuUoPMxJxACu/QC bZY1se ys3o8oH67feykqekR7zD4iP9w6O3VoY1g8rsUkNT8e/u dvcE0dlsbUVvEEOIyXQ27murt/.../CGZGW&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=Nh6rVb2qxj J4 vGOVua/3x0rLr4N4zyM1bE7kn40zI=&c=hOMtQp0iA0/sQ//HwM a7iIahk9Uwvla8pzC Zz8fiYwxjskX6Ap7K 024V4 fM4qNfIVS0fHXdXcZd4MaSw16VMs9ouKdn1bugjS89/.../C&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=BIgEAljOfWCtOIuAgyTWtbnwsh9jEpHq0rYvWE/suD8=&c=I7sZfMo9Sq7zZvXHg8ZP8I MmsTOyU7dPWohDgdRplPg/.../fjuv2EdGPGPjIsmyNRODUxfMLoXX5NtA56D&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/c?x=ON2tWgrga acuK0bponG6neqUzYGog7wBSa4dZnm4W8=&c=WqYUWuyyoc FB0x2IlFPLR7qIC9AywfJrKmryjClIW4aFVavkmierzxU0RjedW8grTIVs3vknEyo6Cx9Uebew4crL3 ihCQnlnQ rwMgSoesuOufj0qxaXIQlTEU7U9G&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=Mln8Xv8mlP/Cs 3pkuswjz4VxflVyHFApVR16ltqNxA=&c=xPJ3S4p/6OraUCvdoSEf0OU3JzU1uNgCbAPpSXrbjqc2I/.../M0PLR0L5DDVIuqvpBtck DZ41EQEq0BHhqFE0riZDZmmm Q1SwE9C 5R9TQdADqFusdgxn&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=KvBeVyZuj/.../a6j34L a8XFtqXN2WjW0WyBnlas1f8CIxiyF77rdoqQTYwewGDmYBb1Vpxno6mT&downloadAs=Google Chrome.exe

http://www.tagcapitalfactory.com/.../dnlOSFDvIwPlmi8mMkiGho1VYbSF1lkJsT0ldJBp6ffe8Zi8lVKG75n&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=DUMjIo1B/LbP6gpicVruhYXBK88/.../89crcgFuuAia&downloadAs=Google Chrome.exe

http://www.hostsendpackage.com/c?x=pcgGoZQViquIn3dTXrdaJd6trB5KH7jbJz8iazVdetw=&c=RLSCpmkYE 9LoEhDQfrjkW p2xkmQJs6cHvfCCbJha/K0sV mg42iiiIqOpbLco8VEFmj7M8Z/.../yyVEPlWodcuuNiNkz74jYFbbQP gJICcOkiZFKcBU5Z2SAJI1mK&downloadAs=Google Chrome.exe

Latest 30 of 54 download URLs

Remove google_chrome.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.