home

microsoft-powerpoint-2010.exe

Gulusul

SpeedyPrompt (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application microsoft-powerpoint-2010.exe, “Gulusul Setup ” by SpeedyPrompt (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
SpeedyPrompt (Fried Cookie Ltd)  (signed and verified)

Product:
Gulusul

Description:
Gulusul Setup

Version:
1.2.2.6

MD5:
ba8007d39e0f1fe952232b7a223cdae0

SHA-1:
3623774d768012f958b71776de1ec050c4850b39

SHA-256:
b484b38e9c10165830922754c534d963d2258d6a6ef5bc655f909ecc03b59863

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
1/6/2025 11:42:00 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.5.16.14

File size:
1002.1 KB (1,026,120 bytes)

Product version:
2.6.3

Copyright:
Lite Program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\microsoft-powerpoint-2010.exe

Digital Signature
Signed by:
SpeedyPrompt (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 3:03:52 PM

Valid to:
5/20/2016 6:07:50 PM

Subject:
CN=SpeedyPrompt (Fried Cookie Ltd), O=SpeedyPrompt (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121D77437A5B286B055B435AA59CB4BA265

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:PQiZ4Cee716maCIJPMWb2L5z7NuvJKKJDQ76Yafb:P9R6iIu2c5z7Nuv82DQ76Y6

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file microsoft-powerpoint-2010.exe has been seen being distributed by the following 38 URLs.

http://www.vaulthostinglaboratory.com/c?x=tg0g lDjMpDs At1J4TnRgalNBQblzOWhVLFYYq0FvI=&c=uJiQQUoPRlxqxwGzHAwU8tRWOKxxrgjwwAVMnI0lCdEhncUXsBcP4U4YAqi6QdfFBXMccb3wp0XmbRxQX2zdH6icSVmZ7MYguUKu5z5Iyyu7IHqeAwZerMgc/UYFJhl1qO8u0b/r5z8xLfXAj5IWnEW8YSix60FpVvPaUU/cocB4mTq1OEKe pPsIGp1Y/Pb&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=QY34D37QnM9eBVU9WrLGyUc2dDoI9nXN1jjRFU12vpQ=&c=mwzN pL5l/lmLh3QCTP5HNSk3v49MRQ4Be0Cd7DKCBCVZ vr5F/hkj/3o/ERtA/NbZWfeuUK0sv2qqQRqdyA3JiSQ2sZBrRJWddN8Hux1f/isiC9PTpCycGq1Gieso8jfUgf358cOz8ZJDTKXPZ6/Sf767MPkL/5ZbN5o04NSkhFRas6YDoiTKnkC1PsP2st&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=MAJcwJk7Q9t2B7CaEp6IlyA8MDMfvAjRO7fDRMgl2I4=&c=hP73mgcz16uurHwPrIYLZb5gNei N36PSrsHrGv5nnZOOEoKIwI8LyLvhGVw3uNRhX6Lsn97sAPNw8CCoujb3mfIPE9bbVJ5rQwFeG8t5CngBt116RYvm4z/m6LgrQivTaBY5jCBvAKhr3dpbimqIPlWIIs4ameL/4raxp0o46Q=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=9aZw2ZTYTuUT91y3WUiPrNScE/fSa P/ubBYvorGd5Q=&c=eGi82zsir3rkuoYCF9zQQPJep9d8Ho0eRG5oTi7QktdHaBwiCtR7Bk8D2t tXWEdUFmzQfAH3nJ YjxNuWuYVUhfKdfisxqTSdRvNqgsD7nqHljzK7O/VoXRefkV69jF7Vz40BPL5nw2/8ceVHIk9LKjCOJCV5Q3t5fIyocSQNw=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=KgJiWPu7o3KJKS8d33aGw1oDh8VP4t A0 pmyFc1/9M=&c=VvVN3RMHtO9G22GZOEQWVBGRY1wscZyqXu8NZK LGySj3BZAGIML6sN cfjJqAt/BGe3kEE5VgrOIoxNSo3OamS5KW6E37waVrL2GYoRxDloF31dVwogACFl8Eo8jQyZj/eneaqEcBIyp3jc7px0gIjrGY785CFVHm/FuSaB72A=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.applicationcycletag.com/c?x=GGoRnPbxzZbaQQ30Q8GvUtErQ1LjHuSbpcVSB6/Wka0=&c=BhKPsnFsB9YtWzNo5jZQ8JRstw 05PdiNwT B GtFr3T5cyOMCPDorVBcHm0LMc3NFrSb7H3XYqzxtpmvPA5qKM5ZsXBrez2UU6/6hU/UM/YGuppbrnG sXf5Mw p 5C 1VXlu6DtemKaCGspYX1FZvFBS2SLL58B/PFO6Sn9GQ=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=m2ZGXJR2BvQlvzHY18CYYnTvRb6WObg2ZplTqg dXlg=&c=j3pAwsIK5MidB08WxYtkXP4jB FG2zyGVeTME2fTh2sKrfoFnykbR4eHSG8dNjMj5IT5tw299572VPIVLpH4xH7xWy0oA 26qAhISMx2tjXjG9sc26UH3dyTUrOylMvkjIWqkXmHCPwmFxuZd20oTmXx1iLPWG2ELPTg0EriYFKRUfkwdHGEy/MATFvWUlwa&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=R/oSR/00fkkwyNEyzkUfUfPKQL8ORqAMJ6/wJhkv1HM=&c=lN9r22uOss6I1mpt/dVLqabz2OgieO6n1IjE9Tx2PjKtIdCWnzIDw1My3iwJu5JA5g9Cd2 8RlVfP3T5/tir 8n2m1tkQjWGFqZrXhJa9JWeKTThUJHYCq2Ojmhu9UfSWNg2t2q7F9cA7cscbwf8WxY91OdEu9Kg1WcjqG/y0pB4f9Lvmw1jPcYD fhipL1T&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=vE4oV7c3J998/e5d9hgjo3R9vPif0M/ppMC2S7nzgkA=&c=xa VupiZhv4IgasdKPu0RXzpjMdZeUcRwrugDtIaiBZcrNacg6m5uK57MUPubSnsZCSLP m8w4Jhf8zXHHqAYV2kDJRMrL9PVVD masNOrcD5wxSevsDPbgTPQOLyAs7QnC4vplGBYX8NzhjPbd4SMz56jczFBuYV4H5anxFlZHt12DsB2YEJA0PxgxD8nf9&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=j1XEh0fOWQJOvpfxKvrtDjGaq5xQZ8YJMsiZ9xchH1E=&c=DlT /R8i7Zse0VWZxj0wlK sXr08iLRMdjWqwVBXoWap1iwp9LRi3TXKuNWsQ3XLqyqgS jCxOlGfMRUw0Tb0L9akfq MmN4nIpJT1JX7Kpp3YYeSPqSI/sWMgUFRpiSDCOp74U2SsX6Svmw9U4tjwxjM9hVOT8OZ78qENbymZRq PV1tsnFNZ Nl0aUSJjI&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=WuA4dwuXdZRQr2qwNYEzkTxqugw9YbjwCBpPXPrUq1o=&c=hGAiSjhEjexxt4Q k/R3Z6Bp4NW1wyhCPjicuh79mc7p6OKvJjwkHjL8XUn9rzeMyVllZ0c2zQYO3WCSUDLFTYapKob0cdtRleus2TFQavYtETk9/laCVUVu9/5sMv/Bb7UaQWyy7whr0jLtotCe1DZyf8Z44SsmAgDitIBgttA=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=b2c//1KVrKbnpmq uVQx2H5PHgDKKRBNkKsMIc5WVv0=&c=BmFFgwYYo2bBlC2Q9jn06izmn4v /wRiudTPjk4m/N9ktbWQjVYAO4HXY W8e2v1s977u5W2OsQbFBy3g Aou 7waePRtv1ze3 jDDocYDAs4nrGOgQiXpLcjwu6wAYp1pjEg4eoYehwuSFOC5hDBrtV17UYkhRrwyHXVBF7kC6OeMD0BhQ1jrK0AP BA3XZ&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=Y7Z4FaV /QRxLxzUJK5s6mZ35pkpJxcGwH3WftnB1wY=&c=WvMHeLq84oISXVjXhRUq4gGDFTO9LYba 38Z1ZEFq/1RVX2WpNi852p/CGwGF0qlY32ASQWTQF3kQYFwpUKuMZ5HUyzJsG4hvQG0NdfLZWY43F6vBBbQ4wL3vl/UOYKu tZ5MjyPVf74tAl6H6cYhHlPhCKpYJAXMsBd1Z9EUaM=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=B/ezhUCChGOrWsiFb6H7nWTOTqR83qqjBJeUf10Y6bE=&c=hNLru9Ryd5NuCTjdYkbysCsp7vp3jSeHYtobmi5bIGKYclN00 fwFC6QeqOpa2LyBEbnYlVGKdA04MQwVEDZr206SIs8it45XBYLrW/UIC2nkEKapnqidS0Objdui1W3lNDcq8GrduiTR7q7Ew4bDvelshbg5iO DZtMfEEEvRg=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=XoRfckKWi85GEntHCpEDQXtHZ04SJXuXZ86ncRcu7RA=&c=HwElFjyOHtR 7fSmXUcq5ylwYE87uRT4oU6egoDCk9l5bv8M7qChgRS7swJLRZ3uh97aLU82zpslhe9Ak64RQ8KrlZ9kTPHU1GgyojTyywgvzR299fYeE6nE4QmMQrYP2Mh5F7pu4BRKLWMec3gxHKbUz5Po60ar0xIbVuhiN1E=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=yNAoFWn2/QRBjTKoUcdUGGt3FQg8ic LVk SkUgDUfQ=&c=Zqy7WFY9SXvX0ZBHLGjCuxOdxKthhFex3I 4NPrgttxe2SYFt0UnZF4AKYfJeuIqVnDiJuKofIJ5E5Q4SBTtN/gc/nPgvhuuTkFA8F6mK3eTtkiJ qeI/CceBhfg2g/KG4pSi fL KjdjkPVBi4g3zFG6UU6cA614ncmchp6gHx44Vx0f8szZJS85 Dn yDh&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=WBQJxM8Nf7AtXUj5cR0P62yO0EjDKf8ka58Q91m9GFQ=&c=8IuGzzFZ6tnjWlOf4/P7IK7b1t8fYX6qN4ug/YvDRjNACtMDN2QFi96a0xzLppNZxBqcoUoOQFtDWImR8V1b V2ausiCLJmuAtozxSzYg5a9M2Y/t4kneu/nhtqveL38wnffiUryzL/hfl6pLJez0HUAcIG615aJ0kOhhXkHVSwOo/KFSdMyMduCkYANVB60&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=XqzyI kEEM56cEdd3fzMYTAABUINdaCa8BXH fgXsAE=&c=9zzS6VBqVAFLF7sAI1orSDGbjYwQhNqau5RsE5MC3x0exXYXltPc9IZl38eOwZFY/wG3Pi/W1Zo0i3ew9rJJk1n/X/dqNxEVnG2L cWjmPFhE80O1kxfB1tMJHaBlVJmksYU rpkUAW7rYTExmxzulVRfIT6sfeMz0mWvA7TcDm7F9fqDnM7yMN44hGJML3k&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=5ZKCjMeTgxqEZqKksGPQ3oE46aZZexG7oNKqWKGgZ14=&c=SML2i8DS5EgCg5ArwdHSOelARV7YvOGL/ghb jKdaRsqOjTJN/I0E B LMChUdyIergCDhkgDXJ3s/F/mGF2pK8aU91hIs0RGK3eRP1ocOmFv5mRz2h1COxcXYX0dIwV/qXYTgYTKe0eGJ0i /c46l5nnitVUgV 1TaC/HrcIDg9rzdqpZqt miZ1sSQ0T3Q&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=sZcGKktm12S/nO989z48 bw48wyS13bpaVEBaS0fH9k=&c=o9xsisWjNxhGZI0enZlyNKv0b3rXdbksEd84GmeIRZNw1UTIue1VdNNariD374l4QmIpVvdIEZOmZp3U/THWzfK0lm/K 6gKauiRMWS X6aWMdxhCXM20CG/oiBMWp3ylC0DyBEwfWdrHrICg iHeFIwiQItwfqRiNqdNahYPlDadp5aZB7vtsbNfuBXacoq&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=M0QwqSS 9BtWlbEw6JJ8BY5uax4aLO/K74Zqv3TY9BY=&c=8GXp9CATOgK2rtAqNSsHPepUtcawC4r35sFCtscq6LLnCYodDj75Er2JI2j EsBdnNWUT2mp46I0nAmj6t7s 2iYyEfq5xO/7wjWYML3 MLHZOd4I1wUpdPRErn6KXDfIEqwwjZaYFF0l05m3Si5NL1I2VRqkGDzggXpZ7Hay/Q=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=vU9Lh041fVBrh/KJjwISkgjQkEU66C5HJoNXjzHudTQ=&c=s0r sqpJcRw79wA7WY7Kmc0FSicQJ1kbL8aBoFPGY05PW9MykWU0m4NGl8vnNiAJAqS43AdYxBuf2s9Z9cpZqR9sIBRG8yOAE8oUPvV8 uA adWBCSio8Z3QGLeQvcJSLXJLHZDn0BJzKG0K395dn mZmQHSxWmj H23vKrmqZk=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=XVPM5Jt2G01NyaJ8x9rv4AvQImwi2qhOdzW47Kkn5Do=&c=RcM9idDkhvFswzDa0eJ t5HwsRxQSGf2lDXCZtG1pk6/gutPKiY7/QsDLLaNpzWvAMUSQWaPV8LWWKBMkk9T45dB7iH QqKWoWH/qdJqBYlRxJBsB3HQfq4UqqmgMKD3Csd8TOw EmCcdbA5Z/RjBFIUCehuA faX3XpNwHs Yc=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=1Uhtyu3kk17qOyDlcbEblGEngKYw3BdQ0GK1XoU6LQs=&c=ZhmdIU9xdzms7sTxr8l6C04h1ZovA e0uTuQnDj1YybYVwmB3HN0WulDC01mxsHfStPEUmp 8Y32m7e wSEg S8/0RMpAXcg2xXSF4qk7REvU3eKf1nqGYwCWNgs/G PTiVsy28HK Xi/ZClM7t/9NlX7NdaAZjC8bO8J9oY2Iq1rINPf TDKwGkvcDb6VUg&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=MV4QhiE4PlWt8zZF194X0bci9FbCfkNqFeioQVd0oq4=&c=4Xyc4lZu91YpIqb9TzaYxOlyGvKg aMKVBH0hGytH JCMSkv98YB LknwCRgkF 5TTuDTymXV90jf3bHn7nBuyWJzuxGdJUlgPvxHWehota0cJvcT3LhVQ3l4VaDr1wd9HdydiSePekNAQQI LkNEIQPVRmVwIFin/Jy7y4k6IAktO8dsHniaZjG5WtSVlhc&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=rjcm9Bd7iGNc3ZJB0qJroZJpHLSDJMVm8jSZcfPBfSo=&c=qpHHijE/4LKMhrcbsVbqdHpwlh8auOCk B/4gbzVDOEw30RvASoKY jvjJ8C//qA9WyN5sSRW3Bq/GtftG/cKfMQpfFEP0NGf/gSB2beXcvjIy0R10QuXTaHmgm3A9l7Klrdg6nuXBmnpYJoppXcup3Zr0 NHu12MDcVPrjxj7U=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=3lIxE7O3MMklxjHuENdQfSZuRwTpZrxtvVPEg2XTOG4=&c=0QNh6JOKb/m7Fv3unS9/9b5GXQwmMT91QY/ JKCbwpWn2cR 9qUwJ9L7J IxX6Nv0gAYXd VWZeGViHxQxFxhouWgewgpy5Al6T0yoiDKs CiGIOIRI1YCwar5U8Hd2nfqKcxH922ni9e XxcPbT87xzTiLGrwCPEUfV8d9VF2s=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=fHzD3dCf0kfKhjum7ou3nzbY17BQohqLsGR j30LiJo=&c=v6VfvQj08PqS4r4LNjz24NbeYq UTahrS 0AvSoZfHXBW68E2LoZl7LSJMwS3btajpALI0pnaL5QIQ83gL//zMdnIUKG2QA5sesfqIdF4EHLaR7ldm3n0wnZHpSppbOU6J/V1dWAWodOZWfiYABOJTwqbxbAI132yiwCLec4suI=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=O4Av31aXWi9C3CQrKRl NBkSu9LOaxYksl MXQkw4Uc=&c=mxdnhsL1hSDLvPtwS7xwoDsnlKqPH0Zi0NjXpP8t3yxDaXlYA90WIeEEPNRma9S150LL6ZIQMfVwYCMEsLiGhFntoTmhh33dyWvy6FR5S4u6EmN0zg0ngnFeUYSLI7xmYwgPZ/GgbBg csE49G6zShmpETR5WLNG1zsYxme8TkSTI7rsVWZS3cmOnAqyq6L7&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

http://www.vaulthostinglaboratory.com/c?x=Iz562YIMVPpbrcKwFzBHTpEzZ9arJirnkMhsd8jAElw=&c=PzjIgR1ohYT84dsOog/PTBYiE4cNE EZpndPZsFBBqDId1UerL/Bk0UZ3V8NJ7A/Kgm5SCbO7MsmE43wZxqqmHlAG5/qxzlMy1KSTyfG69P4Lipnky1FgKz9o6ZyqCzmSHV5of2yO2sDd9RoIuK/fkP/O 0DvFrR7xxwfP9 YXK3lKT5sN Ry0WjJQ2OZ1YQ&e=0&fallback_url=https://secure.inndl.com/.../microsoft-powerpoint-2010.exe

Latest 30 of 38 download URLs

Remove microsoft-powerpoint-2010.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.