home

icreinstall_ares setup.exe

Galegi

Gasepi

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_ares setup.exe, “Galegi Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Gasepi

Product:
Galegi

Description:
Galegi Setup

MD5:
1b88e2989ab8b3c510c4066291f34dc0

SHA-1:
8ecd0677e8599d7fbafb33fd115cf3459e160f12

SHA-256:
52cfd2ba5b7860cf5625c9fcf2e89b42d2ee0c45fcab6307f899efe3249e3a75

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 9:45:49 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Gasepi.Installer.Meta (M)
16.3.24.17

File size:
1003.8 KB (1,027,909 bytes)

Product version:
5.8

Copyright:
Lite Internet

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_ares setup.exe

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Caxoz0ahG60bMpKJMuKnv3+jms2EdnOH5tgP0CzynE2T:C1wZb6KyvsVOZtreynE4

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_ares setup.exe has been seen being distributed by the following 25 URLs.

http://www.downloadsbundlebyte.com/c?x=RR8XmESUR1SNNztOaDAOCHI 8vzOyewXweq pMlRqzk=&c=Pxhdi5AoL1B4z0jL/.../gL81B W1Kpxk5EcJUbBqH8O3yI8qfA2LFXlGXHDDgIZvZZhQxYArbd0vs64Nospd00f5mAZIZ4k0JguMOZuTDf4FWxKpjQn6QvVd5Umhg03XTjRIpIhP0Dmp0oWXkdRG E1PaszW5vxgiOUVqZScb0lByLxp1njFED&e=0&downloadAs=Ares Setup.exe

http://www.heartcontentvault.com/c?x=8ZePaszK9gai wfJMS1BW8TSPmaDbnuW2Y3sfFt6KQ4=&c=6fV4 V75qqDA2B7O1qSYhrjPVjj3 YQgFT5amtjGWajOQ7hUuw0p/x7fzYr/yEQBIL4Y6pzk9hsKdxhdcR9Zn4/.../rlsOYS38u 2rlvmPTq3PFtFJleGfmy 1VxYyk0R08RzQwOXDsZWJssns4fOCiW 2Q D9&e=0&downloadAs=Ares Setup.exe

http://www.hostgifthead.com/c?x=NaPlLjGcbH33dAw9M5lOh861MP3Mp2zMecjavBfVe30=&c=V49D5ks82n hLS6XyobiP MfVV/.../OTGeO9&e=0&downloadAs=Ares Setup.exe

http://www.downloadsbundlebyte.com/c?x=1Hfu4LX6n7 QoKvRmnG2kwXFQbpJ97 rxgBiob8Y7p0=&c=PaPT vOlgN28Av9l exwlxkmHSkYk4CyQagDiqNTtwQLG6AY9zttoYfWVWp9KHxfhq6l7S9TZqSHp5mywiBoLqisnvbJyJUaHBcY7S5N5sH5J5qclfsV8wxlnhiD2lAoBzJZHn3mWoCkXCTfpmi3tK2G/.../UNIJqEySCCAw1IeoIvc&e=0&downloadAs=Ares Setup.exe

http://www.heartcontentvault.com/c?x=xevWrvA6uzfiEZ8PZXjLWiDWmJUWSint61Yx1 zuBkU=&c=zmEwUK9W2NnFNbCQ IMJq4YW8DgVI2LP JkHafRTlNlmjTXEwGRfoxm9A4oN14QhozhVcnGZHVpq8rlYeJYEOI2L2F6rnAPUBPjCFyKdPfu35/DccMBtVlqAHqxbwyobZexrNlIurRVRbOFFGQ/.../SFiYY&e=0&downloadAs=Ares Setup.exe

http://www.downloadsbundlebyte.com/c?x=vM0NFEHOmD2wvr1O5LhPT6O9EKBiwY1P4NejCccOlmw=&c=xep2aWcr9AY0X3VWquRLV6xnxNwZW/pCHyHnTJgBGfcdkzyLgoXGTTvkqDqe70ViRwOD7ubZpx9bF/.../upQ00C1hSAaWMZnJETNl2JzGhzqAblM&e=0&downloadAs=Ares Setup.exe

http://www.hostgifthead.com/c?x=HoXseO/.../wiJwJ YGeRcfpxy j5KxtEGSMRsW2o30CzqQ4XSMHOgBVbmEtMcixdDbC2GPTRhDwtGqpdpnEG4SRFRYkYEMaBKW&e=0&downloadAs=Ares Setup.exe

http://www.heartcontentvault.com/c?x=0PzG66PXIwrf8I LpI1BeH/8zzh9CAwGY5dTVKDUuRo=&c=SIWL1bQ91tK8Y7rGF3R3peHa2l3EA3yX3cmIBRUn9NKoPsj1rk5hOoPvW5eVB1im F7uGvU4HHYvQZOokbVfq6jwr9ew8DW SPrkb9cuW7rj/.../B&e=0&downloadAs=Ares Setup.exe

http://www.heartcontentvault.com/c?x=FnMyYD9ZsMOY1h5dkV2aGsB/.../TvKN5je23Qy3D4es5pRKV625 I5KyOzYITgRrjNqbmcY9OC9XKnNgqGXlrWcR29Hp O0TEzKvznY02vlp2fjuRRBo3gTUfjCes9RmDqoS0F2g38LpTNeTpcTYcRRRH6wLWd7QTA&e=0&downloadAs=Ares Setup.exe

http://www.heartcontentvault.com/c?x=Jzwpw8N8NSDMEvBh4dTdb9Pqj784DXPs09Ggvh fHng=&c=mCHUiRB1gPqV0JPY4cofO4j eOB5x2UPFyM/MUlRu0A4u6e9BPfSDW nwIBb R33egItq590OdJoXm3mkzOZE8QK6dmjvfxyGXTSvJFMwjyBUTIdAza0 Vhxtb/lMaQ//azjXyRwBypPK4C1xScyR0LAZhmDf88Md2Y7arx1yx9KtDgYPn2AocONKET22bT&e=0&downloadAs=Ares Setup.exe

http://www.hostgifthead.com/c?x=btFlZU 1nmirWyuew7HZ59NKHlQWaNQofj65zIt8tzI=&c=hlQI7HGjoqGgROU8IPxIpazAEIMQLf3to/nLjOumSPI8U8wUVGqXer73zIe4eflBKkQY3YNzMrVXjo2VntOTskuz5CbN/56yHrY1oIZB1aVCVJbIums3eWByDou2svdKEpmK9e3OF97/.../7DDIgIHB5b60bY sXw&e=0&downloadAs=Ares Setup.exe

http://www.downloadsbundlebyte.com/c?x=ykUwokm9XpQ1m3Orb ksA52CJIUp00a5v91c4QdwHxA=&c=RD vBNQ58tvLL5ji4D2We2KCLsPFY5R2Wo12uh1HuDGOi90mfb0nTuJ5Cdkm9nIFnqjTSdbSftycmgjgktSU/gDCkhqH7uYNTomVYPJ5ssAETnR3PxbCjkophktgwQ4SIFoFIskA9PHeoDvH1/.../0hreppjmGvm5cJk3sX&e=0&downloadAs=Ares Setup.exe

http://www.downloadsbundlebyte.com/c?x=8q7/ExlE9GxuH4Z2Kb9NTBD/Bpp4tpOkzZSZkrKNLAk=&c=e3vJOqkvn 5QanHfxu Wq8aIVW/Nn/pr50bDtiSgiyqu/lEs44H1FEItDTnczKprcRGAfDovlEpj/.../6PM4fahFeM2G5av5G9mqv3s4l2ljloHzuSZdbv0Ye93n yvbpiVeRzcKiu5E5LkHYZzGC dHMe2724y2Jr6SNPKNNFu7GoIz18F1&e=0&downloadAs=Ares Setup.exe

http://www.heartcontentvault.com/c?x=Qam/.../k0G9EHY0AMl2UKBbGG40DXgPUqQV29l L izACc T&e=0&downloadAs=Ares Setup.exe

http://www.hostgifthead.com/c?x=ExHdyNIMvRnebCz4 Gpk9MZdixP8iZ72Wv/Qry9KrxI=&c=OFjKnVOLZuhbHiKD83/HBDiakDtlWURZy VLh2iPTzwjd4BNgRhSGSTdp8ABsleJiSIvGL9VPcYjObIU7HlLknddbrKZX/.../22sRGrnxsVLyAnzQrfHllssZKdNpBJ9AbT4I3VxQhNrqdezGnM1Si0WnJP6mJcfzR0N6jcJfVY5R&e=0&downloadAs=Ares Setup.exe

http://www.heartcontentvault.com/c?x=5hiA9mgeU2EYKrLVnfChzbWSiljVYSfe7p8iwyet4Vk=&c=NceWbASzJPoQPXYg8lCFy2EFjsNSwb/Fs/sz5laBFdObhjWJ9GRN8uwY/N2Jbbs8d2kJQY4Glqdw0Br1KtwhulYeW6r4UwmHP6cJ zKeX0W/gDdz/.../BP4wvwV8k8Wi5axdPVF4VuMN1tVh6hCiO7VtAPg0zYj2uU6&e=0&downloadAs=Ares Setup.exe

http://www.hostgifthead.com/c?x=fZSXg6uLw5kuPjVbF5/a7sgkQwKO74OWuliAxLnED5o=&c=3YxmTnWr9M7rWjskL9UZyIswv93CJC7v7hVOL4l47dFb9Mmkeh5yViQStWVPsf7mp0EvirHDGhgcF QPtF5ZgZDwuxOD9Dlq4WFsNx/7yPTlW3WGS7mx9/.../zt4VFv9xliZe&e=0&downloadAs=Ares Setup.exe

http://www.heartcontentvault.com/c?x=V0stHAmuEEKdgptFC PzXR7Yf5BjIfPgS0ICUZrOxSg=&c=tmGykS9OBX9ueSuQ2S1qDJvd5wTZ1BZf8nZ4YFNIA/.../fHSFA8iIWbkNrpSe0hCCn61rk&e=0&downloadAs=Ares Setup.exe

http://www.hostgifthead.com/c?x=A9l0Lsrbj07HTBy6n/.../OXuahVcCINlk1K9Czw0SO2bDbHef0Qb Gd5aJkPNWrRMSo4m1ZyjghpzRnxZHAEoDFhwqdNRZkZrzY4L cO5PwFFAwyy9lXLNDZ9EiGZsJhgkwpAnReRp1czdrkaZCq8myC9nX1w1FcZHU0BlGCGZX9gvc&e=0&downloadAs=Ares Setup.exe

http://www.downloadsbundlebyte.com/c?x=7d8hVoxBI2suI4TNvhm11W8gxt9nXBQkqcMVv7bQEVk=&c=Oms h1BsS6B6GptkeZAScBR1c2xTh9dced34e8C5eU2KIDhsTchVskC1y8RIpAsbYer1/C5tBXvfxXgKoEt1yJPWdy9BfNeFs18YzJc26/AFnsqDHYDuDQu/.../cDKpj8CBUQ &e=0&downloadAs=Ares Setup.exe

http://www.hostgifthead.com/c?x=rJt4qy73UukTAHfUShR7fUcAKnUPHj3np5HBh1RObh8=&c=gLmJpO6EV62AChtb8nact0G3dNvsTV84dgAzODbEEpq8JvpemswakarjMeBQGvEmaVXg2tpF/ZoNRbRX4k ZMHkWfh k iuf/.../AKeJrhGRaIzofpdHaZF&e=0&downloadAs=Ares Setup.exe

http://www.stocktowersoftware.com/.../8WtuCbVk 83T15nY1IGIBSeuGCfl52fXiP4rIXg4XXM2m5HnoJcwLlxTk8HuarBmIAxYyac1Vn83nDLQvCrbEKKYsD6YaT1gq1y3uTXmv2VqeZIjJ wuIG0YJv2LQTe9OqZajo&e=0&downloadAs=Ares Setup.exe

http://www.hostgifthead.com/c?x=Tv0yyFvh/tWmwaFOkX5QbU6n2lVZP2JaVxWXrfuD2ns=&c=Mblnsb/x0kM9BPUbaAEcJn2Z83T3asaV6dbkPWyiozK4LVIIQge94OWfPB8XYdTpFZtmJkJFdCSx6vIDuqKSD/2XTOKkPeeuY b3yUnk6qLvdA/X8Y85wsCsjmbzVWKOtCbnWH5N/.../u3E mM6swgTTGn6 j&e=0&downloadAs=Ares Setup.exe

http://www.heartcontentvault.com/c?x=nE2t7aXmSN/V82T5eulu6EjEdP1CNRSdzNN4BSlfWE8=&c=JdwQQa Cz K92UO0MTT9INoLQReVbbY3iiSoKA8Etvm1XQpzlK61Zyf9P RlpLLuS25Jsa0H2WUMpLVhEOqgq9ryCi/wpDDAXwsN2Y VyDoGiMaomsu/0B rQz18dPirD1I/.../mdlx483mCRX727MAyhODKGAq35qp0KC0kns&e=0&downloadAs=Ares Setup.exe

http://www.downloadsbundlebyte.com/c?x=npvOhAIOLdhPTWDkg3tW5PJsB4j6daPMXfHn8/7WV84=&c=SKSG69fydFKHbLgTcT5OmGJAIak13iBEtkIzJI7tB99nreMHIYnpzi5Xz 10h83oalz1nyv3/jZ3c6aYSsnvRZJ UoYUhIlVWKH/.../YcmCPMJmYf4Z1YMLQ PylP3qloknUqgUAOSDfKqLllmwLi5ZRue0eP19Oo7Wgudp1HVtHAevaKn7lwV mOAQ0V1f&e=0&downloadAs=Ares Setup.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_ares setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.