home

setup_online0630.exe

Chromium

Fuyuan Zhou

The application setup_online0630.exe, “Chromium Installer” by Fuyuan Zhou has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. It is also typically executed from the user's temporary directory.
Publisher:
Fuyuan Zhou  (signed and verified)

Product:
Chromium

Description:
Chromium Installer

Version:
1.0.0.1

MD5:
c127f477495ed05c6e007959a4779da5

SHA-1:
3f4a93f84977997a6297acf21bf7805f2447bc6a

SHA-256:
22ec4d4856b25fc4e8b4d502e93d00f7189d31855fc749ae1c5182d849da580f

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
6/17/2025 10:44:27 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.FuyuanZh.Installer (M)
16.7.12.12

File size:
436.4 KB (446,848 bytes)

Product version:
51.0.2704.66

Copyright:
Copyright (C) 2016 Chromium Authors

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\setup_online0630.exe

Digital Signature
Signed by:
Fuyuan Zhou

Authority:
thawte, Inc.

Valid from:
6/29/2016 9:00:00 PM

Valid to:
6/21/2017 8:59:59 PM

Subject:
CN=Fuyuan Zhou, OU=Individual Developer, O=No Organization Affiliation, L=Beijing, S=Beijing, C=CN

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
694E0B4980507DB9D7F34C8B076D2070

File PE Metadata
Compilation timestamp:
6/30/2016 1:12:48 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
14.0

CTPH (ssdeep):
6144:o1R2bTfRwYMboYIlh21qqXAm9rsZjvU8b/K8rUBd2OvqEfenyyxhYbMFfp5fpvjo:ov2bT57M8rqP9C8ITrcdiF7YbM9uv

Entry address:
0x30E9E

Entry point:
A0, 0E, 7F, 00, 00, AE, C8, 88, 88, B0, AB, 62, DC, 65, 32, 00, DF, 0A, BC, 12, FE, 42, 00, 00, 00, 00, 2E, 10, 0B, 19, 13, FD, 92, 12, 05, B5, 8B, FD, 3A, BF, 67, 8A, BA, 9E, 0D, B7, AB, B8, BA, 9F, AD, B0, AB, B8, C3, 3B, 9B, 7C, 99, B5, A0, 1F, 8F, B0, AB, B5, A1, BF, 88, B0, AB, 17, 2C, 89, 42, 00, 00, 00, 00, FB, 33, 6B, 58, 6C, 2C, 52, 7B, 1C, 02, 10, C1, 5E, FC, A7, F5, FB, 39, 30, 00, 7C, 91, 17, B7, 03, 8B, 88, 11, BB, B7, 89, 88, B0, D9, 02, BC, 12, D4, 00, 00, 00, 00, 84, B4, 1F, 30, B8, 7D, 00...
 
[+]

Code size:
317.5 KB (325,120 bytes)

Remove setup_online0630.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.