home

teamspeak setup.exe

Hoto

Darwen Marketing Inc.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application teamspeak setup.exe, “Hoto Setup ” by Darwen Marketing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.flashlaboratoryapp.com and multiple other hosts.
Publisher:
Dadebo   (signed by Darwen Marketing Inc.)

Product:
Hoto

Description:
Hoto Setup

Version:
2.8.4.7

MD5:
5babb9a51a8626785d7018008992af8c

SHA-1:
719c99684afa12a24c0be99033b15fbef26cd49a

SHA-256:
df2dde96e5b88033c3ba9aa3107e202c8970511e39b8832632f6c6e8d61402c5

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/3/2024 6:00:56 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DarwenMa.Installer (M)
16.4.3.18

File size:
1019.6 KB (1,044,080 bytes)

Product version:
5.3.3

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\teamspeak setup.exe

Digital Signature
Signed by:
Darwen Marketing Inc.

Authority:
thawte, Inc.

Valid from:
2/15/2016 7:00:00 PM

Valid to:
5/17/2017 7:59:59 PM

Subject:
CN=Darwen Marketing Inc., OU=IT, O=Darwen Marketing Inc., L=Victoria, S=British Columbia, C=CA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1F1F22B813CDB509DAAD9139C753C40F

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:TkBsNRYFVgYLNg7wMVwjy76tYrf4E5PeJaU14WrrwvmO:THrQgYeVNgQ4CW1420B

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9115

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file teamspeak setup.exe has been seen being distributed by the following 17 URLs.

http://www.flashlaboratoryapp.com/c?x=IATGYwE0F9uSqAN/XnLODfzhmsST0ujvfEoOGQ4pBWE=&c=YT3uVucViD16iTAqMGGimjN3lCI4HAEN4izCZg7 dknhqpVmgoyujmUiIukIAc34lfnc7jgQTiLewmSKBxqrPJRsAa96I9RRogm0SxOcNoTWhIzTxvktAKKqEVy7y965z3Rrk7X3UXcvQhkT2/rBWjpKpqO93JFnwL2/i2i3G5c=&e=0&downloadAs=TeamSpeak Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://www.flashlaboratoryapp.com/WVl6OTRQU1V5Um5sRmJEVmpUMUptZDNWcllsSTJTbWRKWmpWb01uSTBNMUo1V0dseU9YRk9hRVJKYjNOdWN6aHdjeVV6UkNaalBWUTNaeVV5Um01UU9WaHhWSGgyTmlVeVFtbEZTSFV6VEdORkpUSkNKVEpDWWpCSlVsbEpRVE5TWW5KeFRrbG9KVEpDUW1OUFVYTnVNRFV3UVROQldtd3djV3h2Y0dOUVdWUjBlVUpHTkZjM1FYcHNSRkkxV1RsUFoySjNaMFZhTjBWNE5sVTFNekpJT1hWbGVrVkpRVTlOY1V0QlVGbHphbWh3WmpsVGQzRXdXWGxTWW5ReFVsVkNOeVprYjNkdWJHOWhaRUZ6UFZSbFlXMVRjR1ZoYXl0VFpYUjFjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VaRzkzYm14dllXUm1jbVZsT1M1amIyMGxNa1pzWVc1a1pYSnpKVEpHZEdWaGJYTndaV0ZySlRKR1pHOTNibXh2WVdRdWNHaHc=

http://www.flashlaboratoryapp.com/c?x=1xNwxP6VBy6zw2zmDTm0wY8HLu/zadxWha69GQc2BxM=&c=JGDLTSBazboIiw0h6 o3SE/YHKMzVIcQ ap/gNC99M90RYb BcQdAjsncri0DC0V6w1Ok 4GulJKlDiZO3Ih/3UnBfjdXpbAWGFC9Be1USjmDPJcK/miGL6QujCMCFDTAIfTc3BdUKpqcUEC/JpaFwzuCrgFe2FRU1xYuXijq ujxXnTp8lc htwGBlOz481&e=0&downloadAs=TeamSpeak Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://www.flashlaboratoryapp.com/WVl6OTRQVTA1YldsMU0wbERXRko1VTI5RU5EZ3lRMFJ0UzBKSWNqQWxNa0phVDBvMU1YcGhhVTlUYWtRNGEwRkhTU1V6UkNaalBXWlBZMjFRVkNVeVFsTlRXazV4WWpBd01XUXpWMVJJUm1kaEpUSkdiRWRqWlVOQ1IxcDZWVlJhY2s1aWRrVXlPSGxMVDJ4amFDVXlSblZJYTB0Uk5sSlFha0l4T1RKVFJrWmxOMHBxZURCMk1rSnViR1phU0ZGQ01YQXhkVlZaWmxaclkzTlVSa1JQWjJSakpUSkdabEpYT1VoVFVVaFFOVkZvVlZCbWRqRkhkRlFsTWtaSWVXTTFiQ1prYjNkdWJHOWhaRUZ6UFZSbFlXMVRjR1ZoYXl0VFpYUjFjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VaRzkzYm14dllXUm1jbVZsT1M1amIyMGxNa1pzWVc1a1pYSnpKVEpHZEdWaGJYTndaV0ZySlRKR1pHOTNibXh2WVdRdWNHaHc=

http://www.flashlaboratoryapp.com/c?x=aEAKd7T8 WtmrZS dkj/2H5z WCR c9OygfkYZDhbHI=&c=TWRyxyGaMr6jNho4kGncAXk GfDXUYddO9Zz5OGZ17B28eFCo/i6wl fcv6teTIxICAZOD Ki0QrCogzo22mYLOpv19o4kuvA9ocRkJXN0UVaW 6/SM06tDqgEqs/7hBM Je30StqmboAEZGiDY6UH4cKjgoSQPFzrQrL8QPya4=&e=0&downloadAs=TeamSpeak Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://www.flashlaboratoryapp.com/WVl6OTRQWFpFZW5KUkpUSkNTRTlIY1dwbFRXRTFOWFpYTkdSR1JHcHpVemhqT0ZoUU5YbEtPRlYxWVVoSWRXdHNheVV6UkNaalBTVXlSakpzU1VaQlRrcEZaa0ZYSlRKR1drRnNVVlp1U1haVWVVeE9Ra2dsTWtKclFrcHFPRTVXTld4SGNESmpOMFZDV2twalpFOVlkR1ZqTWpGWGFIVmliRW80VFcxcU9GUlViVko1VWpSQ2EwaElja3hzYWpaYVNEbDJObkpWWkVOdGVtSkRZMmhNWVdKRFduQXdlamxrU0U5c1JtZHpjMGhFVUZaQ1N6RlJaRWh4Wm1abUptUnZkMjVzYjJGa1FYTTlWR1ZoYlZOd1pXRnJLMU5sZEhWd0xtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbmQzZHk1a2IzZHViRzloWkdaeVpXVTVMbU52YlNVeVJteGhibVJsY25NbE1rWjBaV0Z0YzNCbFlXc2xNa1prYjNkdWJHOWhaQzV3YUhBPQ==

http://www.flashlaboratoryapp.com/c?x=yrEsJTkwebZlxHdft/TcZ5RFML5eTjk1kkWZ/gaD6h8=&c=SoGLXQomkZf8OjzgqGTWWBQtAZFRq5kATbopmu9Z/r5Z9j1yaRZHE34D6Ggl8rg1wf2y6 Y3RFEUKwUXS6ssVEeCXJqdG9 T4xUHwW4bWwyu4lRjmmhbq1YLuWIJkve6 XyoZ2rHoSqKxVo2AYBWCB9khG3LWPa2HUlQE5rDNKs=&e=0&downloadAs=TeamSpeak Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://www.flashlaboratoryapp.com/WVl6OTRQVzVOVWtRbE1rWm1iVXQyTUdKbU0yTnlTWFUxVkhSeVFXWkNSbWx2TVUxTGJYSmplWE5DYkRkQlJGcEZOQ1V6UkNaalBVVklVVll6YURoYVZrcFVhVTlRUkZKNU5GVk5UWFZzYkZsd2FWZFFjR1IxTm1wU1luUjZOM2hwTm1adFMyWnZPRXBWVVdSS05XdzRhMFpHTkRKamRTVXlRazF6Y1U5VGVsQnRPVkZaWVRKT01YaHNjVk4yYlZoWWQwSlJabmsyTVRkWFpHRnhNR1ptVDJaVWFuZDFkRkI2UVhCNWNYaEphRXBXV1VKWWN6WjJRelFtWkc5M2JteHZZV1JCY3oxVVpXRnRVM0JsWVdzclUyVjBkWEF1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2QzZDNMbVJ2ZDI1c2IyRmtabkpsWlRrdVkyOXRKVEpHYkdGdVpHVnljeVV5Um5SbFlXMXpjR1ZoYXlVeVJtUnZkMjVzYjJGa0xuQm9jQT09

http://www.flashlaboratoryapp.com/c?x=bbz9FqLv gw2V9bwF/IklfX h7 OrX8jeayd/dqaDrc=&c=9V8cxjQtceqW53PPgUGfDQRrBn8RfqhQKQuH1nXrh7t8B7K/hel4lYi9uAKKO4Hbw1UYA GUEBeQIEgrSkEGiQxiGNb8VWR1wNJNE4PGq bzgjh7hZxGMqoaQHWmG3NZHEn1NCjhCe8xkInmjmtWBBkxfN3zdeXrvHXMTYaokHE=&e=0&downloadAs=TeamSpeak Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://www.flashlaboratoryapp.com/WVl6OTRQVk5zYjNaelEwTTBNMWRYY1d4MVNYY3hTalpzWm5wemIxTm5NRE16T0dSblUwZE9XR0ZEY2xGaGNuTWxNMFFtWXoxb1JuWlVhRk5qUm01VVoxZERNekYzZFZRM1ozVm9aemRhV1ZOMU9WUlVlVGRPVFVJeVUwWmlSMHhPVm1OaVEyd2xNa0pNTVdaallVOTFSMk5qUjJoMWMxWnliM1Z4UXpBeGNUbEtXVFEzU0drMlkyODBhblV5YldKWWJXOHdjRVpXTjJkRGIxTXpkVVo2VGpORVoxQnFabmt3ZERSUmEwOVNVM1pvZWxodFpWWktKbVJ2ZDI1c2IyRmtRWE05VkdWaGJWTndaV0ZySzFObGRIVndMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NWtiM2R1Ykc5aFpHWnlaV1U1TG1OdmJTVXlSbXhoYm1SbGNuTWxNa1owWldGdGMzQmxZV3NsTWtaa2IzZHViRzloWkM1d2FIQT0=

http://www.flashlaboratoryapp.com/WVl6OTRQVlJhUWtzMlpYaFlibFZLTUZaUU0waHFiWGtsTWtaeFFVRnRjVGhRUzFWdWQxaFJaVTFSV20xVlIzUkVOQ1V6UkNaalBWVTRjekpuYjFCeFNscDVkSEpvU1hOR2IwOXlkWFpqYTFOQ1JubzFkbTFJWTBzM2VYTmFXR2RrTlNVeVFuSTVjMWMwVjJGSE5uSlVTSEpUVVNVeVJrNTNhVlJUVFc1b04zVTFVSGRsWmpsU05WcEVZMGhWVlNVeVFrbGpRMjVYYVdsSU9URWxNa0pWZFhCWGEwRnNXWGhZYTFSbWJ6TndXamRaUzFaMlVXMXpVakpyTWs1UU0zY21aRzkzYm14dllXUkJjejFVWldGdFUzQmxZV3NyVTJWMGRYQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtUnZkMjVzYjJGa1puSmxaVGt1WTI5dEpUSkdiR0Z1WkdWeWN5VXlSblJsWVcxemNHVmhheVV5Um1SdmQyNXNiMkZrTG5Cb2NBPT0=

http://www.flashlaboratoryapp.com/c?x=h3QHmk52Kw mYGW8wbgu22HAhOPHGk5Jh4aqbsGSJsI=&c=37Hbv8FVmX9ncO8jCojpOQJ5vgXNvx3jeVev2vUBvQgqYLmkKdj7iwM3o0q m4kniFDNaifcPD5wtFGhFPSxqRTYOjLsF3/2swr83w NNFBcsvojqeaP5RpKUcJGImugd1muzaE/ufLL/It0FqAruXZmW93faLbx5i8oAnfM3oY=&e=0&downloadAs=TeamSpeak Setup.exe&fallback_url=http://www.downloadfree9.com/landers/.../download.php

http://www.flashlaboratoryapp.com/WVl6OTRQVUo1SlRKR1dESXpaMFJ4V0ZsbGFGUnZjMGhLTlVOelEwcEZVVU5wY1RkUU1WQkpWMHhDZWpkS09YWlFaeVV6UkNaalBXMXdaMEkwTWprMVpGbDZSMWx3Y25WVk5UVkpkMk5tZVdGSE1VODVOMlJQV25kbGRXTTRhVzVHVkRONldFNTRUa3RWUWxOaGVUa3pNV0UyU1RoU1pIQTBiMjVwVnpZMmVscDBibHBGV21FMFRGQkJkblZyUkVaeU5uaFJNVVF5WmtOQ05XOXNjWFV4Y1ZGWVExTXlNR3BTVGpsR1ZYVXdVMlUyTUZCSFFqQjNKbVJ2ZDI1c2IyRmtRWE05VkdWaGJWTndaV0ZySzFObGRIVndMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NWtiM2R1Ykc5aFpHWnlaV1U1TG1OdmJTVXlSbXhoYm1SbGNuTWxNa1owWldGdGMzQmxZV3NsTWtaa2IzZHViRzloWkM1d2FIQT0=

http://www.flashlaboratoryapp.com/WVl6OTRQVzlJY2sxaGRsRXpiVzlzZWpOSlZsVklRa3R0YVhKMmRtYzRiWFY2VTBWck1YTk1NRWdsTWtKdGJtTTBXU1V6UkNaalBVUmtkRTF0WTJOdWJHYzROVTk1Vm1FbE1rWTBVbVpaYWxOcWRXVTRObWhwYlNVeVJqQnJURkZhVEhCdVoySmlkRkppTVdSNmRVWldhMlIzYTFWaldXNTFVbEkzWXpsVmFsRWxNa1owVjI5VFNDVXlRbE4yVlRaVlpuQXdjSGQ2V2tNMVZ6WlVUbmhUYUdFMlRFUllXamxWTm5SV2FuUkRURUpaVW1WV1UyNWxSa016TUUxTWEzTW1aRzkzYm14dllXUkJjejFVWldGdFUzQmxZV3NyVTJWMGRYQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtUnZkMjVzYjJGa1puSmxaVGt1WTI5dEpUSkdiR0Z1WkdWeWN5VXlSblJsWVcxemNHVmhheVV5Um1SdmQyNXNiMkZrTG5Cb2NBPT0=

http://www.flashlaboratoryapp.com/WVl6OTRQWGhKTVZwWGFDVXlRbGROYWtSUk1EZGtSazl6VUdOYWVUWmtTVUZPUnpaVldtRjJRa1JMV0dGclQyeERNQ1V6UkNaalBUSTVUVzEyUjNNeVJuRXdKVEpHTm5oVVpqQllkekZFTlRoaU5DVXlSbWxVTW1wTU1FVlBSV1pPZVhkNGMzZExaekpIUmtoa1ltRjVWRVp2UW5OVWFVNXViMXBLZVdKTlNuZEpTRm8xWWpWb2JVMUdOM001WTNsNEpUSkdaWEZzUTA5RE1qTTNWM0pGTXpGMk9UTllhbkZ2YVZKdkpUSkdTVVJ5VTI1bmJGWmlZMDUwVVZWWU1rZ21aRzkzYm14dllXUkJjejFVWldGdFUzQmxZV3NyVTJWMGRYQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtUnZkMjVzYjJGa1puSmxaVGt1WTI5dEpUSkdiR0Z1WkdWeWN5VXlSblJsWVcxemNHVmhheVV5Um1SdmQyNXNiMkZrTG5Cb2NBPT0=

http://www.flashlaboratoryapp.com/WVl6OTRQVTlvV0hkak0yNVVRWFIxVERKd1FrVk9NWHBGZVZGWVUybEtjamhXYW1ZemFYQTRabEl5TmxKdGEyOGxNMFFtWXoxek1VWndUMGhOUWxSa1oybEhTelZwVjNSaUpUSkdaVkp1VFhsNE5UTlhjRlZXZVVoR1QyVlpRbEJIZFhWbVRGbHFhV1ZuVm1ONFlUSlhTbTV2UVVKdE1FeFpNMWwyTWxKMk1UaGpOVFJZYzNCQ2NHcGFXRUZsV201bmQxa3pXblJyUTNka1REQlVOa3RaV0hGR2VrVk1kWHBYVkZCT1lWVTRibmhxUWxsMFVqbFpKbVJ2ZDI1c2IyRmtRWE05VkdWaGJWTndaV0ZySzFObGRIVndMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NWtiM2R1Ykc5aFpHWnlaV1U1TG1OdmJTVXlSbXhoYm1SbGNuTWxNa1owWldGdGMzQmxZV3NsTWtaa2IzZHViRzloWkM1d2FIQT0=

http://www.flashlaboratoryapp.com/WVl6OTRQV05pYld0VWVISnJVSEo0TldjbE1rWkhSVnB6YTJKYVZDVXlSa0puVEhOVGVuZFBOamwxVTJoYVpEZzNTbGxySlRORUptTTlWbHB5TXlVeVFuQWxNa1l5Y0ZnbE1rSlFjVFpVUVd0R1F6QkROamt6SlRKQ2QwSkZhVkJZWlVOdFpVWjFjRlFsTWtKV1NuTWxNa0phVjFCR01WaEhWRkZNZDJOWU1IWTJSM00yV2tsc01EbElaRU14V2tsbldrMXdKVEpDYkNVeVFuRnBObTlJTVZoR1dVMVNNbkJ5U2s1RVVFczJNV3BHWlZGclVISmhiV1ZpTUdOQlJXVnlUMHhoUVVkS1dpVXlRbXNtWkc5M2JteHZZV1JCY3oxVVpXRnRVM0JsWVdzclUyVjBkWEF1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2QzZDNMbVJ2ZDI1c2IyRmtabkpsWlRrdVkyOXRKVEpHYkdGdVpHVnljeVV5Um5SbFlXMXpjR1ZoYXlVeVJtUnZkMjVzYjJGa0xuQm9jQT09

Remove teamspeak setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.