home

ie11-windows6.1.exe

Internet Explorer

RICH MEDIA SYSTEMS INC.

The application ie11-windows6.1.exe by RICH MEDIA SYSTEMS INC has been detected as a potentially unwanted program by 12 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from internet-explorer-11.1800download.com and multiple other hosts.
Publisher:
RICH MEDIA SYSTEMS INC.  (signed and verified)

Product:
Internet Explorer

Version:
1.0.0.0

MD5:
9eb527ddb9393cd3e0402786bc0696e3

SHA-1:
da3e61032f6db7ce79fa2941fe32eba8aecde81b

SHA-256:
898a0b4aec7570d090f954c5f46d53ede18e35f97903559a73de3f7eb6033688

Scanner detections:
12 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
10/11/2025 10:14:26 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
OpenCandy
2016.0.3137

Dr.Web
Adware.Downware.10304
9.0.1.05190

ESET NOD32
Win32/OpenCandy.C potentially unsafe application
7.0.302.0

G Data
Win32.Adware.OpenCandy
15.4.25

K7 AntiVirus
Trojan
13.202.15623

Malwarebytes
PUP.Optional.OpenCandy
v2015.04.17.06

McAfee
Trojan.Artemis!C7A93E97B9B2
16.8.708.2

Panda Antivirus
PUP/OpenCandy
15.04.17.06

Reason Heuristics
PUP.Installer.RICHMEDIASYSTEMS
15.5.8.23

Sophos
PUA 'OpenCandy'
5.13

Trend Micro House Call
Suspici.40242376
7.2.107

VIPRE Antivirus
Threat.4847482
38882

File size:
415.7 KB (425,664 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\ie11-windows6.1.exe

Digital Signature
Signed by:
RICH MEDIA SYSTEMS INC.

Authority:
Symantec Corporation

Valid from:
2/16/2015 6:00:00 PM

Valid to:
2/17/2016 5:59:59 PM

Subject:
CN=RICH MEDIA SYSTEMS INC., O=RICH MEDIA SYSTEMS INC., L=HENDERSON, S=Nevada, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3F87144C25AF8BCF29F29C5A1FEEF4BA

File PE Metadata
Compilation timestamp:
5/19/2013 6:53:00 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:MiuMlGUM1+jWd3GHc1YEN1u7f1hMV3fR7Dt5:Qyti+je3G8vMfzEp7

Entry address:
0x331C

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, 98, 92, 42, 00, E8, A8, 2E, 00, 00, A3, E4, 91, 42, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, 90, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, E0, 81, 42, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8327

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file ie11-windows6.1.exe has been seen being distributed by the following 5 URLs.

http://internet-explorer-11.1800download.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv A8/zyn9np5iNEMJ1Xka6n3fHm/ykYYazeeEKqtG78lwbpo1s3eDQ b7WyhWFT84XG g/6SpN3SgzUS/cAiiBZIVX tGGcglcI0uXKkDjzeA7pCydm0f2IVY/o4LhgFIfuuFTojKYeLZEcwh LuECYvatyslbh3UDz rw H3KMzRsf/bcOvfXof1ce3D797w0lAr5r2zlL7ZLh0lyy0CIxX6M2pFjGp6tPFiCd5bbdHR40 P3YltOKsXhBjhAT0k89PUCbgDB/.../1tYk8=

http://internet-explorer-11.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklY/NSr TRnzfZuK67dpqib4vGlsnpNbP0ykYrn2LSz/0l8bOGSGCa7 RuFohPpyz4WXBAaDv3asHk20sni1mffSpsvT0mlJq4d0x0dJF3ymACx0hshq9CjwSCDAFK5Xkc3gPzxEYro4PUFWZ738FXB9ctzNJQkpz6viGDRwMMWrk7gnBTCws17NlfplAJq d8ntZXJWzYfkSfsv3BcT55r/.../JPiADm14tjV2HAybPVJR4Q3KyZ99LflQ08lk0P4l4EbUXmjGwzysZGnzQkvLCSb5D5Bn8vYc3irT1PciPptYk8=

http://internet-explorer-11.1800download.com/get_azure_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GRjycteQv c8/zOn/.../1tYk8=

http://internet-explorer-11.1800download.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklY/NSr TRnzfZuK67dpqib4vGlsnpNbP0ykYrj2LTDllEZTa2mNE LkErY90f85kNSWRAaX9T36DkPzv3ytgLbbr9nSgzcS4tVs0hwHFiq1AX1/lsMj7HKkHjbbHukY1ZKpd2tYKuxwMhkOIaS0XHx1apiRek93zrPvUSwmcpfz0e0nBSqwtFDdybcsXdDoYsn3ZXBY3ci/G 0jnRseroL/h0q8Krh 1CanCd1c/Mz4SXrjodHJzj4rJLxAT5Y/.../kxdYHGS7rFA7wsZGnzQ0vLC2HqmFX197ZIjXxGxWCz7ltYk8=

http://1800dcdn.blob.core.windows.net/dir195/wi/18/33/1/.../ie11-windows6.1.exe

Remove ie11-windows6.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.