» cwsetup-ie.exe
Overview
Analysis
File Details
Programs (1)

cwsetup-ie.exe

Cartwheel Shopping

Cartwheel Inc

The application cwsetup-ie.exe, “Cartwheel Shopping Setup ” by Cartwheel Inc has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. This file is typically installed with the program Cartwheel Qwiklink Combo Installer by Cartwheel, Inc. which is a potentially unwanted software program.

File name:

cwsetup-ie.exe

Publisher:

Cartwheel, Inc. (signed by Cartwheel Inc)

Product:

Cartwheel Shopping

Description:

Cartwheel Shopping Setup

Version:

1.10.0.2222

MD5:

c2c037e570386ed18755226c135a79f6

SHA-1:

d4f4f61715b6ca6c611649a519c6ff3c32333ba7

SHA-256:

0b0c6cd3c652129b29e6e3b7de9e52c85a275750ef9d457e3e1f74dcb5d38b4f

Scanner detections:

2 / 68

Status:

Potentially unwanted

Analysis date:

5/8/2024 10:33:58 AM UTC (today)

Scan engine

Detection

Engine version

Malwarebytes

PUP.Optional.CartWheelShopping.A

v2015.04.14.05

Reason Heuristics

PUP.Cartwheel (M)

16.10.17.11

File size:

3.6 MB (3,727,040 bytes)

Product version:

1.10.0.2222

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\roaming\cartwheel qwiklinx combo installer\cwsetup-ie.exe

Digital Signature

Signed by:

Cartwheel Inc

Authority:

Thawte, Inc.

Valid from:

9/5/2012 5:00:00 PM

Valid to:

9/6/2014 4:59:59 PM

Subject:

CN=Cartwheel Inc, O=Cartwheel Inc, L=Littleton, S=Colorado, C=US

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

5BC7C44E86B0D415E9FA94880EF2899D

File PE Metadata

Compilation timestamp:

10/30/2010 1:54:54 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

98304:RSDyoiVMdfv0RzDc9Dgawf8rk09dI3ChQ2:AD6Wfvf0580Sh9

Entry address:

0x16478

Entry point:

55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, B0, 52, 41, 00, E8, AC, 03, FF, FF, 33, C0, 55, 68, 45, 6B, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 01, 6B, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, AB, 41, 00, E8, 4E, EC, FF, FF, E8, F5, E7, FF, FF, 8D, 55, EC, 33, C0, E8, 7F, 84, FF, FF, 8B, 55, EC, B8, AC, D6, 41, 00, E8, E2, E9, FE, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, AC, D6, 41, 00, B2, 01... 
[+]

Entropy:

7.9880

Developed / compiled with:

Microsoft Visual C++

Code size:

84 KB (86,016 bytes)

The file cwsetup-ie.exe has been discovered within the following program.

Cartwheel Qwiklink Combo Installer by Cartwheel, Inc.

The Cartwheel Qwiklink Combo Installer installs both the Cartwheel Shopping and Qwiklink web browser extensions.

www.cartwheelshopping.com

86% remove it

Remove cwsetup-ie.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.