home

google chrome setup.exe

Lotacepab

Darwen Marketing Inc.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application google chrome setup.exe, “Lotacepab Setup ” by Darwen Marketing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Falusose   (signed by Darwen Marketing Inc.)

Product:
Lotacepab

Description:
Lotacepab Setup

Version:
3.8.4.4

MD5:
09bb1c267d4eb8887b7fecd234b2b1e1

SHA-1:
4620635fd3f1d5a9baaacf99ad14b02d0849acbd

SHA-256:
a493fdc2b2a5fbb359313a5ccc0f64367b892401461f16eb3db1165ee87d6e9d

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/27/2024 8:52:05 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DarwenMa.Installer (M)
16.3.21.12

File size:
1014.8 KB (1,039,128 bytes)

Product version:
3.3

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\google chrome setup.exe

Digital Signature
Signed by:
Darwen Marketing Inc.

Authority:
thawte, Inc.

Valid from:
2/15/2016 4:00:00 PM

Valid to:
5/17/2017 4:59:59 PM

Subject:
CN=Darwen Marketing Inc., OU=IT, O=Darwen Marketing Inc., L=Victoria, S=British Columbia, C=CA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1F1F22B813CDB509DAAD9139C753C40F

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Z1UD+IEILGTewEIKzX68O/ad5gF2SYq/6QgsyQE3Jt7tU8LwIbYwe:Ze6IEIqCnzK8sUCF2hsyb3JhtXbf

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9078

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file google chrome setup.exe has been seen being distributed by the following 15 URLs.

http://www.hostgifthead.com/c?x=nIaRuScVHYWoilg5jhtbvIPdtoWqOZuls7fnzAE1WtY=&c=8uNJVGg PTZ5WOsFYHYHILAjo7i3Q8svcZVlw6t6SrWOmBwoGop7PCo2W6dtFGJp4e8U1SZJETaxyQHCJFBFEn7Eql6usOqpJ8cDuppuWCqCdEdQ0oQ57FeomTTQ98tk&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.hostgifthead.com/c?x= 0yZpT9PIpHErICd JFRlKbfjP6vSHaPrbg/GmeORGQ=&c=yg4XmeajggoUEPwPdA5Id117d9sn12PNvknUsnchJCP3x G3ez wm/hFx3gA169HzkHyIitWRuQPEy4vhSic/HC1q8WdGzfRn2N1iUiKNdcBI DTJMcxFvtLmlJeuP0L&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.bundlessignstag.com/c?x=6t jXv1gRnRBYTOBkKkX9Yx4 70HjmKJxAsD7scy5Es=&c=EN/oIlJQcZHZZ7GyWGXMSr0i6Nh8Obn72ozRy42KyQUDHXkQQ1OQhQKWfLFoz7pjs8o4y4ba 8Z6Vsgxk4Soy1IQKvAFbFlmYbxTxcxva2NnelKsyrB3lE4EnQt1rd1y&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.stocktowersoftware.com/c?x=IRIUXIVGNVEgpHYXQqz6Hd2mNBVx9w87La1QlW0ngbI=&c=Rj8YqFeXSm/0ufkqM0tVqp p RO53GD2Gi60Jrficta2/SfjN245nD2s9U89zgAH8OK4ERZWxkEFIX3rVpCOBp1XjV D4vr9fgMKSebCTOi3N1YmoBmsunOt4q/B6nsW&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=xHr3nN/BoQL106Cv5b7C4ClrwjHNQ bJnqrOvIKiC6Y=&c=RK07HB4j/YMeYMrQwU6iml5dyRw8wWzQnmIiunC2mU9BWTp9FrY1MNO6YFHKTC7fKMqA42wvJHzHSk7YSqihfb4gdGlrEnZFJBBQzQOHN9bR2nXRnJtpMEDuWvVgya/A&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.clearmetapresent.com/c?x=SoFObuNcwUlIa8AqHOojukPbs3mZMklCVUTpt/phiFE=&c=6vnXKpmsHC/k0cAFPoeG4ZzXUpl5ZbnBwz3LJBBIZxpe8sDJQFoc0RvYQoloPO64KWUVb8MmgolRRlicocBacPeUZ0jENs 6bS0qw3u2R2h2pXuMlkrDef7XW99XEwyC&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.bytehostbulk.com/c?x=ajn5oMh E 9PL62s3W/IzqWppBwJZ2eg5IJDDv8KOWc=&c=Q5r3LKXHIVW/E7tpM6aZ99aXRm6tmOQ1SN/OvdOzt9SVJgprTbIKqjlEM6xmi9DJbo 7ZnIUeJj75qV4B5YZRQ 1hoC/fQmddOQ0kOira4iV8esJvmf1knTkRsAP79Jx&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.stocktowersoftware.com/c?x=LiuO7mxtNjsJcyQDM0uoX/gLJ1uaZmD9Sr7ixtr7wpI=&c=vmIfdqv0b5gRnv 6eJZL/LV77NvUll6XqQXjCmWrXRHvgFKn EYxKQdIiEXfpgw6CgHnaAs2fBZDOWalO8pV3G9TowpQuI3eejZcrYFjLrX7LoCIW7pC L 9MHjLbp7l&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=xmF0WcAgSYHIDrZ/ xmT00tqqR9WNqSX3xbgByCpi5w=&c=7KKu9oUN8PHmxFuIG7OFK2KCfZkaL5trbjhGPGYF cHE0z0oNyvy5QDoSX52XasejGQQbx3yuiQfNK5fImlCZrCwLWtxjZex1R7AE3Tzf94qmVeZ/k30zJWssrKT5yTh&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=8HDlP/CDmyS1Sq8fFp NF4HfLrPePTKhfPZJGSik8nA=&c=ht6dMuHo5ytS0oGoGPQfjEiPHB3H/teSUR3g4F8yMOqAaTQvg9ZjIb0nUZ oRA0LPHL0ikH64Rj hYvnpW4Giz XrNRvPwfhHNq9uMauguvreBouGSHF WQoyCVoWAYh&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=1csqrpHO3 8MIyID TtHZu4PsmuvzOnA2zCTkBTW8lE=&c=Ex6RDT4IJeZ2gBoRNWJee3rRKBh u/x 1xeaJf7AtUAqv9Yb1MfXNcHejSIB4RQ1QTG aFaJp9Fu5hxHFaDX61uzIQ3UqjYaKzVcb1DAvbgWi5qWlabBdXgJR1pl0p2&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.bytehostbulk.com/c?x=htdhjMTN4wHBbKfHYrt4qb2Ut9YPip789MTL5rLNPag=&c=0t/dab0sskGNWQhZ8JiF/Re8vt7uqpeTfcIUu5TGgZ0ZOLFDKMusDtVlzDj7AmaZoZIwqFtemcGJv8FY6VxiHvX5b1 UppI/VP/3MBrIy1LWHPkJkl6V5mchsHphyto1&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.bytehostbulk.com/c?x=aaifAfmSVDm9Umahq3mGrBXzZKLGzeEBj6FZb4OMnos=&c=LdGcNqqiv2UXqmDdLemIQmt8wFmJ91NWmNcAFkP3sEbxvoKDQTO BWB HLFxIyphWVvnjQtXDXwNyBjz0/zb0u9J9 RDNaSNCAM9h70h1/enbsZZ1jtmnXj3KaOH73aQ&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.stocktowersoftware.com/c?x=TS2stIMoA13F5/xVl9frKiYh8RY018yY2G7baOjBE4w=&c=5vkEBrJM3qIOf/6TzlrlxxMJr7hnYb5ZONmai9ZoRo5BOaY4jPcpcGLv7a3b8aMumN8U5aN0g7wdcx6w4v2UoB5M8vkO6ZYKW8GpSMBY7BBTNiQaS0wxfxUdnY5Rb37a&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.stocktowersoftware.com/c?x=gudRvzdI8HvrkR6H8CXwrO/HzfJ7HM891guYmomolzU=&c=6MbKhj92nYJBk3UkVepgNvhMjGbHkjdAfD46oNoL5kBLNHFRnd4OEv3Gc0q4O vqk7L7E3MjlzkF9nI615jxPVoVuUVjo1tZSwBz4vuO9U4y lBqfPmOvXb95s2V/hIG&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

Remove google chrome setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.