home

google_chrome_setup.exe

Bage

Darwen Marketing Inc.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application google_chrome_setup.exe, “Bage Setup ” by Darwen Marketing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Darwen Marketing Inc.  (signed and verified)

Product:
Bage

Description:
Bage Setup

Version:
5.5.4.3

MD5:
d7743a1effcb5f8655dbfd8e3172edd0

SHA-1:
37fbc45deaf38ed7ae5cd55789072f2b3ca4dfdb

SHA-256:
ed5d00f78d3132d89b3aa79d246e919c97d8c87a91a61cbbad297da676cc532d

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/1/2024 4:27:47 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DarwenMa.Installer (M)
16.3.13.16

File size:
1013.4 KB (1,037,688 bytes)

Product version:
3.8.4

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\google_chrome_setup.exe

Digital Signature
Signed by:
Darwen Marketing Inc.

Authority:
thawte, Inc.

Valid from:
2/16/2016 5:30:00 AM

Valid to:
5/18/2017 5:29:59 AM

Subject:
CN=Darwen Marketing Inc., OU=IT, O=Darwen Marketing Inc., L=Victoria, S=British Columbia, C=CA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1F1F22B813CDB509DAAD9139C753C40F

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:AqkRgzlGUy5dJ6zP5XvMCpBSDbF/X1IhsyPRhIT0miGNGK:AZWZGz5+zxXvVXSDpv0sM8VNG

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9096

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file google_chrome_setup.exe has been seen being distributed by the following 35 URLs.

http://www.towerbundlesmeta.com/c?x=maW4sf6IwjBTbZOWoxMon5RKMxBuqUOa2j17f/efkHM=&c=g9d1q5AIgOu1G7BzEpe8jR8M1xkwLJvc9c8l8pWTQR C5UQELmkIJqWVGXrXbHwts2ZWny2aC hjKlkGgnuxu9 xCa6tlplUD54vhy 5zAWa9aaCt4tfNBbKQuCzeW2l&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=QdxzBZugCZ2BSn14iKRHzBbiiqxIPGNHV8q5gz pXEY=&c=kdA2biKJJQol1mFXyhv302f76bQltXQVnmRRZO4DuwLRwSeZZJJrGclKnuMoF/dZ2rrpyNt5Jim0Mle3VHayUck6kuSCzCsmFI7jq2ufdg7IlOsXQ4JP8l2zunlNFVc/&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=cxJFWzZzAwTmFsV gTL0LDDu25z9vS9rxlJTPOgUf3I=&c= sclAqlNZvx 9OA5 5e Dac2dHy1fGq1H5sOeLEMagcty1TfTk6cHhQb5NTNpOZwSHhqrROsph6voxZXGRb5s4p7S5/d2 htwYmO1B20njUU liSRi2Av9lhpVIpPalQ&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=c68fX5LYnnNbyTeHl2dwlMHL4CbyfnWhVcgldTVuBfc=&c=DT3RGFDqjjzpbWFMa9s8zY/KMJCIzrvVvUZcwC8A6yojKXB7fLUcZaBTSynjaHR5BNliSYBW7z8qZWc1N66vDbcoruX/8yasmZO5xZ7wLmEX5SqN4Rw5grflDnWA2O D&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=61svJ6LZvKKhPfghKMssymoPsCLpbrEGwb3lxMKxU4w=&c=ItFumd9pt4j JsPFsnGjZozdIOMlfl ymnmIkx jS3M/Caa1hFrPMfNvYpjkvR8yQejnGsMJ KdfBYs8gU1FdlXKQSXvErbLgYMSbDmuxX3HiY34urhgcLxS2gNPq3QE&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=zkAfQaoyNrHtdwWWmpAZ6d6wzFdppiPmzkZe3zVeTXE=&c=ojxUlfVwsYjwgcQPH5qtfK453JKUBTDgh026P9pn/fpup8diJE4SEjup11PKSAl2UOMUCdySpHL3hXovblE8wjv9K7fMhtgnJcqktkyGLztLwuDcDupwv8Xpa n2wQMV&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=Lr49nDyl3acNEgWU9e7LC5PHf2DXfF5hr1tx5NtoEec=&c=FrvgbfzTbPLLSKnP5SrzUROYZxU2SH/LmyJD/VyBQsFfoFzeYkZ/NT29D QNa4E3kssdLGp4KnqHiZHYp7CLRj9KShs07vg1pOLUVFU8xo58SXX19b6sElfZOvfZeMqs&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.dltourspackage.com/c?x=KPu2e19HoTixfq/76ima5FTlRwj2ea3iV9Sv /0BS1E=&c=ehZ2CdjyWGMX6XKxbMjkBQaA DNO0L8oO6UGFfYSEM N9c1VZX8IjfimFyCnZ2cjsg7dazOlFdnvpoyu8nfkTKUSZ8TMdhUl Xmk4w1QsYCaVJ/IVFI mfsF97KAdj8A&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=LOSfavwi2hIR/DQ7QPBu eR171XSaNJWYrX4Py68Fmo=&c=Y5AhWgu1oBajvJx4aMEld/NCw7KOjLxVUnIL4DuHWsTL/Dy/KPgd34OtqOCLl9JEhzHwT2vjG02iu5A7EAVj7A2WOzEbDmfkw1uHxQIIC8QZaaDED/yI8s1YymcPH6nt&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=U/omsmtHa38tHPPzUjhVg5yJqphaDpv29tFxUiPzFNY=&c=iqZPLK151s2lq/4E1RDAeqtf3CTx7mOKZ2DIaUlCbKMVzBUqoNn2ZMA24Fvr9jVGgUB9ROPl25mNkSSFC kawLfWb2r7KZsuYZoT/R7/pL1KPsVImOfdLX6dVfPhiWh4&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=Qpm9wt4oYKIyOZgPgCVXmK84gUJPoch1QB4Mb7/GszE=&c=dBzvo6RiLSYTMGQtfxWKIc7xQoB79Haam2v507hGeGJ/363X1YkBng3IULoo036yoBrJELLUSzB0RMIZ24wm33vzszZfcpz2lrOrIIEh/C058RFghVfbIUJ4lR07NcC1&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.dltourspackage.com/c?x=K4aoAm8y/Es2O8Qa5SeXIS6/TLKfnRXHXZcOLSFTNe0=&c=3emWw/uA8jdakJCv9h9aRiKN/TczC7OsP//llXjWM72DwezJR1 mDKi2fXg5J0SfR8XSc3VijjxPYdr5KL8nl96OVapBknVfSaLq8qL6LcrST6 ydi0VACqyXMn gq Y&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.dltourspackage.com/c?x=7EZq/G7S11cRUJMIQxg4K9wiMVA692BEfLoHX1oF Wc=&c=vxjqbGaz5NAwd1VDJ5GDSMnAgfL0DWwAN8eLMTVcyXGKn8R6KlbLObyMBq/5oEewjlEOMAZ2GA9cSJqM2Me1iwu4rYnYMBTHZSR 4ccWZC5HQe1tF9EDx3nhrFASalNS&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=/24yKKJDlUFOQfFLLBazO9tq6veLbzClQUJNS0EdXMw=&c=4zmsqbBg0d/UbMuhrOENj3Zed/D09O6xbktG9xBcjMc8le2rRoR8J 4repohoOJQ2Wd5qmKR1BsGBvJOmsImvkNL/VXTxv2yFC0D6NhpNTWJtqh9rUbTng8j XOg1IgD&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.towerbundlesmeta.com/c?x=nKgj9Yb6SBtRDC2Sg9rOZ0tMx7 sCk34eimJrCKaBgY=&c=S30Iij1tVpMHn6bZA77KL4Mii6OGsCgXUfn3QkqDxUFcG/mIhOlfY8j72zFAl2zUqy3 nq1WGDhWyyP3DiC1vUeSluwBpQB99mbuosyTfunMWcQ4HgQiCSfs8U2Gy6fc&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=1GPML2zNy zIPkzJGs6ESPtNyrqkpAmZlGeeT T7EV8=&c=FPMqr7zUxEQWuINWQZhF80u5qaU7lUSUo4skNxiSA1QF0W4I91vErxy/uCVqkNKh6qaDIj6e6wK6awW15jhosPOcNbJvXUC9K/fRda9h0Ut4SaEoZYuygygBzUYl dml&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=fyNsydCNfVxu0rtcArD1p hVIZANjoMyjBabk1TZoxQ=&c=0BdA3vWHDyZC94M//eh4rN5Ud8g4Z3U7tNXn9Gjh1zmToq0QgSb8HlAJDQ88syy3Ihs2D4M/8HaHtYb1QfkXih9SM0ctMxPqHRCNQy dz3nkKMUgOdAagV2qmNlWAT2u&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=954DnsX1LR2IJmKAAgHMbdxpYwtGxXLhCy9sdB0qpjA=&c=zHW2vLZdrXVGmcTFcoE0H1zniEyZfGbDQiGmKlwmeZIggay8QJ1C6SFOGjEJsDn8h0gBw/JocEey3bME0OuoN3fO7m6xndCA5Q9ZmUFUvSQsykQ5cI7iNsw8J6bkC4g5&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=TYRHRCtlsWbjFC6ocd 8tNrtRshchy9xqSf9Evm189s=&c=Ja979gi4RzGEnsrfiiI/rfERqT17gPmQY99mDtkGfQf5GQ8E/LO6Y7EB6QW//n4QHGIzq5yteuCHalfT3ogjm41Fp1 H 051dNjtqgHmzJAkuRRt1EfAI69rQtBGk1QO&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=lPGbtzDMGqTd6r9Ihtw71NFXwBMvEAHByOurYLVMYKk=&c=TsgYuNvKHPaWNNIs3GIonaLUlsVKpkb9ZYam46w 4meP61 HB7gFjt6RQl8xo3Pbjx543OseQozm//fZm7k1dlS4SRnp1QQEjHfYxIbMG199fvFJG6cxDERrfKQBzf6l&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=GqK4gxnLW7e0jqTau/vogaSGuSNRabb3BaPX9IaLkAw=&c=5sVn/ujfmT/adNpgUD1o6jiW5CS6HYXDqqaSXxf1UWFGxsQmuFDHilcLc5smSE4VxGMDKpnU lGFnrkHJoohsoI54oHrGHjReEbgXk gi4HcuuWY7EZbPzMk8wBQvspj&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=nGTIIdQlepXzOGukOkRJAPRUFm0wSKrECo7PU/iHh0Y=&c=vDeWrvebxjIXn7pn2jGzIkHen0fH5INSi2UlMetqJFuPW93Rpwnp/JxsJesFMIqvC7EzoGJ5wDYaoiTtbtwgfh8TmOaCcEQdtczv7AKEJDw3AVJ x9x0ofYg4H2Idea4&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=Ia2KLk3dfiqnw77v1T7n9pDrwHgyh/GwqTzYkGlT8HM=&c=ih7quOmAwDX0rmsMC3rNS6lYdGQl4TsZxCU2piy 9Sw2NOl/hY9n41zvAOMOJkfze6fhGFT8otXdivRuC6luIv6 tCdQE VTPP9V3b0b1q2Fx/rMMUPtqCXAqOrhJAx2&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=/1z03uquStt7tx2cGeTP63m2YZiM7AD0Y2NS6dHcULk=&c=8ZqlmWK5ubAONnIShDZ2F7JaI5pe459YBwqn8sC4Hdx7C/KhL9vs9ChegwgwesKQmCyYRgUwlHtI2obD00UxKxiCBfU7Nwd S/a3yHSeL 4oACTxA1I8aK8tbnduH ks&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=9RJjFnoz4KYdvESmtwCqy1z2gj2AHyogcp6AySNXeM0=&c=LsKBvQAIlUSSjTZ SR0wzff/azqgI1DcyGg1PDa9hLMfynSsP7B19P/2QaX7Remd56OkYLQWYW eS2rc/ZPw1L3o9vnLLIdC9yiHlHvsMdVPlIeh/hdGQr8OXY/HBmM3&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=RmwnO3QcRgevSfQky3vZyjrMys93eWK1dtvUvgiLOy0=&c=KAhJFpL8DsGef1W5liIGAH6l73GKzErtGitM Dn8jkY65HxkoIUeUBflMHnb6TfE41t0 z2mIEV0xcZPR0l86OV3VGFtW/WV5k1VvLXup4h98I0ODhiZzh0NxPHCpc6S&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=ZZLMz6dIataubOs33f1qaLZxbG5NYyeO/6yweZ3VpkI=&c=qAvY4Vz00QDOfvl70UQNn9AeI21ne 0Qgmr5GfV4HAlTzSBVWKUcyPIMkdyhcCiUZpp7BXiPcyPMvlzw/ygaVCWARpzT0VDH0afRDekB0EXUI6AHhPjvJUVgJqtZfqEQ&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=N7J378lvRU0zhAobHw9dIeadtOR2GSt1Iw6I7G9P9XA=&c=XqIm1jSAaiexbdj4WTZXwXKwZYUSRx3scIbtM5zVA JaXNq8IUGaUqFiSrqzN9CHh179NRadjBh1EiY0MLs5fl055OED2KvapCxNJaFSXkHz6eSO7Ayt8ekHMipO2Elf&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=jsYc2ABiwwxV3F69pcKX6nQ7XjoAznKLI8oxC2Nprzs=&c=pmUnPpOMRNLhKIuQUsJlSYaQymD7ZT792TtlI9DJe2S 5XlGYZ0w0Sn0wb pFTWBZiMIIKAuhivIT7C8olnLc00uzgC3NCShk1X04YCDkIWGIT2S8Ta1y6mJ2lmvkCjY&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.quickbinariesvaults.com/c?x=4fO6fNIwxapXx8jrba5QSk USBf/AWV83ZlNouPPGCo=&c=v4bN6UvKNZAURPGh3PdCpxVij2nT2ssfc2Hb4SSv3a8Ur9mdWnGqg0xJAhxo0lMezfsV3 IhIW3VELQ8/6nHScNX//BY0gJdfjC3bunZS98VV2xLlxKH4Yg2ZhXHx2tL&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

Latest 30 of 35 download URLs

Remove google_chrome_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.