home

preinstallchecker_google.exe

The application preinstallchecker_google.exe has been detected as a potentially unwanted program by 6 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from d890t4wyanc8w.cloudfront.net.
Version:
1.0.0.0

MD5:
41cdcc1fd1507624fe7ef72d0d7c0756

SHA-1:
0717bf0809d2eb82bc3ceda0646dbcf7a5b85ee4

SHA-256:
031847bb8464bf4b936abb54176192a79d1c860e5ebc3f4685dca7e5bd47289d

Scanner detections:
6 / 68

Status:
Potentially unwanted

Analysis date:
8/5/2025 3:55:41 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.1509813
1107

Bitdefender
Trojan.GenericKD.1509813
1.0.20.115

Dr.Web
Adware.Downware.1747
9.0.1.058

Emsisoft Anti-Malware
Trojan.GenericKD.1509813
8.14.01.23.01

G Data
Trojan.GenericKD.1509813
14.1.24

MicroWorld eScan
Trojan.GenericKD.1509813
15.0.0.69

File size:
1.5 MB (1,585,664 bytes)

Product version:
1.0.0.0

Original file name:
PreInstallChecker.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\preinstallchecker_google.exe

File PE Metadata
Compilation timestamp:
1/20/2014 10:29:05 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:cILMkCR0jImQQo5fEnoJnq0tqz7mpT7TJ+9MNFIu2AmhNJVsa:LMkhQQo5ioAPzITJPwLJVf

Entry address:
0x18465E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
1.5 MB (1,583,104 bytes)

The file preinstallchecker_google.exe has been seen being distributed by the following URL.

http://d890t4wyanc8w.cloudfront.net/.../preinstallchecker_Google.exe

Remove preinstallchecker_google.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.