home

icreinstall_bandicam setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_bandicam setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
83f356d46178280c49bbfb2a22bb9e17

SHA-1:
d792d43246b5550023e3a7b41bc9eaf87bb20a13

SHA-256:
168338ba8be4dca85f30cc693e5d844bf2c49ba55ad35bf41d556bfe1b5885ca

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/27/2024 7:34:39 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.29.22

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_bandicam setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 4:25:15 AM

Valid to:
9/2/2016 3:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:X5PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:XdlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_bandicam setup.exe has been seen being distributed by the following 38 URLs.

http://www.grabpresentapplication.com/c?x=s3rHoin16 iatGDpo1hI7JPa90GPXUZeKMGlu Qj/VU=&c=/4aN76XFys3yZIjGjw3bt9jLpWjOaYKS4YFDljH1DqmnRILnnYcZMcF4 W2UZh5ht1U77PrKv4uLEcwiinjAdHqLx 56klMpcqSqOue1fbxClgqfFxFQ7zuksHomXZOJYxo8wGMEgWi4IgZTp5rH9g==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.grabpresentapplication.com/c?x=s6q8DNBRDl0G9LCjNgs3wLSg1H7beS3ESA8aBvNuS50=&c=ZUr sWZ0E6fnEWoXyUSD73Hwbr1r0H6b/LTMo3MEANsedaib9nPwV7TCRTvhwCGNiv/7MUaNhf8I73na5aBPUzNOTOK8mPSGzf 4aEnpbJ5W/pzsdpBiaaPod0VP8RKFnJ37lzyL4bJm1usI9fvRNg==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaulttowerssigns.com/c?x=zyQhODwnaMnu04dhFApHAzzcFlVLuPIaXNUNbmsxwE4=&c=8CNbYYLinOJlhMZGy/n1qPAYBegxI7WGZU08/Hwr5UBLFIuzaI4RJHcF9lsqeB vnvu1RI/2dnAGvab/UW GDZ/h60Sz55r66w9jVRPUzao77/jgLb7oy/HXop2LzQOO6gI4TfgfzuuNy1rgjRFteQ==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.grabpresentapplication.com/c?x=kd1ww9TEGAdah30VLC3jbaRHvanYiMPhTsztbVmvdBQ=&c=CiljZ2ejzyRnEJqU6UQwkMHt6aTXbs8u77EUPIy1NyZ zFoejsspQqyf3oebkMekc30qmEwPQKs9wxxNkoqPDCqNqZ9kz7wsqK9/esptNw7rpLNtZ3MyqYBdhbMOFpCFRSjuYK7PVtW0pfg6S8lFKg==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultsfilespackage.com/c?x=buB/w sikHJobJ0mhKYjPpNoTWUvMKCJiErcftWivCI=&c=XRZGl7erMC/pc35DjYHCTLpgSYfdyzHb5JQ6JJQPuTmA26EbdfVbF UzJ1MJ83sW9pPcTduW/CRGXBBdRLIrI27xp3JghyCt3qOKasV2Zov8yvND883ggZL34LnTh/KBYq2sem2fZU RNRPDvaODVQ==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.grabpresentapplication.com/c?x=eAMlccQyGYEfxDOsO9vvZvTmD3yfj1dd52Ed2lsPIAs=&c=wQRKOpkay3C8G3 31J0pUDo5ysCTHJquUBYkL6QTjLx6pABQvsytbExsrZW/zYMPAhxpwq6 ijiHOOD6HJ1ToRvYw9jovrXNU/xxXG1usfryrFPCsLDUbVgyCUfROo/epAETmnrXEv06eVCYHH3F1w==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultsfilespackage.com/c?x= kvCMStzFZ4OkHIs2hB66Jr7A5vSBHM6zDS1NGa9aGw=&c=nhXRsrjoM6R7OPr9vCfX7zdJNb7fmtMBN3nLBhwZxtSt6kMK1SF UmcDld6LgrJldzAVDiUg5DiiB623fYhWXTZWanjTvVuZCTSNmoSitwY1BBMJC3q0QrGefTg2Y48h4T3SeTtpKsftoThDLK5sdw==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filescleartag.com/c?x=i8B3GAWPKdDc4ZAIaLErcKccnidUZAFi2DLRf I8mRA=&c=CTEKUdAlDWClKFq4c6gLuuU MaWhpFoSHYECcSpPcQJ1qzMkpdqeJFB7j5K0XmDfJLM5GSMLdPsu2uZqGA0qgUlqD1bpwsqjfFf1n qXvCLbG666G7/yFsDJsnlyuQUV4ccJFyS4my 9FeXfqfEwQ==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filescleartag.com/c?x=Tnz0EKH0LGd/24yNo1mgSG1eR5hKrPcDPufA0Ck9eXw=&c=vbU2WnU3RTmH6Zl4dBXY9VcXq2Nlq7fgPMK6wTvIhIPGC0JIlonxgbm0EYgA8mue8bPwyeDoyE2Lp/zEn184OAsgBT4TxdsCFnHZ1 9Mg7XUJ6qOqJ0bfEz2vF5LZa/35XIOlUoQpvtbiHY527Je w==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.centertowernow.com/c?x=OQ83u0Cvca8/AUVLBdpH0ws7N1yLbj2OUbtieZkaZfU=&c=wIEbk8QMngSin9A8ZKEtQydBruggLXiPu5HrPJO7a0bzMYcTcrNm4cahYJGJbsNbp7 H24GzLIAXQ7LpaxZpYKS9e5dEiOueTWyYhavky6 DjeD4hJ9y5pJcwC cjkTqQjE5IeoZsWQj1NKWQtUTA==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.grabpresentapplication.com/c?x=ln/3z3B58qpR/hT9u/twF7Ormj6HuBnsvIThFwnB7m8=&c=rpbd/5V4WSv2bKP1RN4wIvK5H1Iwxn4lO8bvAnzRwQRUYnc2MfS1dsup3X6vnckB25ml1rQHMYvRdWP7NNrSs4mpOAL1EK2AAeZTLiT3JOLIcc71jp3A5QA7eEQ7hUpTjA4AtyR BHRp3UOlHqCO8g==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultsfilespackage.com/c?x=dmM7uYGL4spyQ LtTVj3Dc67XB8tnE5CPJiqnZ/xuE0=&c=ZzlT6hxOMa1bcbw6pMq0shU0s0Cs/xczkHuzR82ahiEBJ4ayhKMqLb2R XAq/R5LP8mBDRwiR1Tfdrcg8GiajorYzrJSnyaxmsKffK 50Cmu4GFusBb3iiwZNFWnpVaIVx8YqQLoXyTmEfY6LIBwtA==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filescleartag.com/c?x=vLD0D05FTJL27XoVXwgwqGa61XR6EDhjmGWBCpp9PC8=&c=pdZm6dOaWJEbpfih04W56h4aD1RNB6IV59R qXuCMGJQBfTXihnTnA8sWSXeIS 5HdM98IGljfy5OVostV0VeVugmbEqFY/2sZV/wvEdoCOps4JAJr3EE/YVSYpFVTB/0xXeZxSJaqya74cZ9oWb6A==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultsfilespackage.com/c?x=20PvrwmLmr3IlDc4hSZDfViY6/Ky6tf oXHyx3/AZrM=&c=RQn 6T15F3isSDlpIT0 N/rEniNfmeZplAcKwCCtHnLXnQmvXXtmbW1hoIIq 6f62kESMF3XQ3yNsQUE5RLu QN12xusaxFlf4 adjFdFbNinxA77GDftv981zklMmqeQlaNlKah83mxAJ7N1CvV5A==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.signssafebulk.com/c?x=aVmADkwy9vn06JID8Y7J4zoBepGrItqUPnPJlsct1uE=&c=EJVPPRV1kEvimrObOGXIGNhDX/Aazf o P6zeJixiVSf/NZGQAGyN3e74pLwNYppMV4p0/xRCtqXsBUsRyd3iqZQhG3dLhJnIa7273mjlSuLHFqa9zPuBRnsxoyxfrqFSFegjBY5p bAl29emRTaEw==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultsfilespackage.com/c?x=ODBsfFLZcXccZXdnB/L/9kvlpbNf2hUKcUhSquEt3ds=&c=pwF7Tw6JqiBxLelDEoHEZ u6OanDV50mcGQkx6R/zvWxJyiEaukD zVDPm9jjdH zfJLbeo9mfU7VC9pXvGPoXaPIVnejJ9w95fCt/ vn9o1oQyOK0cqVZBc9sSU/Yp2Cbeq5Z r74yJM cvyIO8Zw==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbundlescontent.com/c?x=bCkUTQB03HOmDNhw6K3/ sYb1bj14/GQs24Tz455C8w=&c=M6m69vnU3w1jE ik7GBExQXn5ZbzTJSIsblOE 0AqfSFO2EBQtwkXtzImsX66jCijj5fbKzVTpz2vIufALqaubiHMafKi2kQztVKk67QXPrfDbsQywhVNhxCCetkLqjs7B1/9kSDQTwLOtWItseMhA==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.chuckledownloadstag.com/c?x=SbuAMm/6sn0RfwtGjWmix6KmayCktrVIER/Pt789tqw=&c=CQLJp9RQ1ys0hdWrotB9sJ9xi7vN25KxYQlxQrITkJzPtacvtGh/XkpGX2 H12qlk NZO3n56SugIk7cyQLcv5Ebf5YiuZxWvXkRmR3IdUwe0R0K87CXbUyuWu7ej4BjoRyvQQeSnf5eUcHo0IuwDA==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.signssafebulk.com/c?x=qTDuS2PyrbjnC0SJkzbnxVKlfkiZcUA6AAy2OMvNiR0=&c=bxIXZqd5kYu BPyBfohgNInxtDLoQ mk0KpZ9GvwIjD4UDYLWeg22ObL1Wx5LAMh0DsWsV3lgyQs7fKHQUn6LlcAdK1GscBaGeKHVkqYsiDA0leGTPpgwMdaj10tnhzWYPmM WHQ 49CpBHllOGt8g==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.signssafebulk.com/c?x=Q50cPbD UaGVTt/adt 92eSEMTpCWNp1xZF4Ol8vNHc=&c=mK3UFYKjr1JZBDtbS5wIaHZFGteTr3sZeIM1vHpMKLgGQs8O0XiD4fWUIs4GQ/olKwFe83ffVRA6ha8kcBT97Rf7EwJKgIFAgNcA15qjAlZAjsCziONrk5Tyxn liIOm Yh8211Js3VMpt3AnWXg3w==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.signssafebulk.com/c?x=ZBdw1PYwmKSp2ie5VIRquvX790RsWpaescuq2skcPog=&c=2Ilr3fjuepJjDRzTq/DmCn/T9eaQSByPjOsvaEoxnepLAUWykiOhcw99hVLo13CnosB/MjN/8mTwI34yVXkKJDVUDG WD0wiElU4ygCku/fFWgHLhwSGykicQOXqM4ZGIzhpHEKf rb6xjMNaPXpIw==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.grabpresentapplication.com/c?x=ed1BOv0bqwoxcI9yhu8bJBQC3JKnT UUiBvIo9XZI2E=&c=mY7S1aINExtdtCMnUgxwU7PZYTlLKlF9Nht6rYotkfKqb ecQjk/TUEG3fK7IGGXHk1v9570M6uwJ7sJb3jP0kD8Jc0O v kdXBMyuZcBPBNkzGKuJPKe8Mz7CVloCPmjWtGTOnblxnhuXtF7dMvTQ==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.chuckledownloadstag.com/c?x=BpmZss4oOczOh31pgbYoJ9pnB06bmGUHjgaFUBFmf2Y=&c=QrjAn9dOc2v4BNYxh9mvaH6j8BfGToY4vACaw8epGpv5FGvBfTbLW/ TEXJTDWmgjoxnmiVddNEBHWxZTI2wDVT A2q6KR9wBr3kO7N8NhkUIXzPvO3BQTb1MwUzS IeLhoSIDtqWry7ilKbwYxhSQ==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.grabupdatebundles.com/c?x=8K/UvS41o3oFTqu9NPVp0Ks6z1xTQHZX1vf4BQMb/4A=&c=E/l0Sy XdOhi6TSGtroiHrrCJHGihYUUu4s/Pc8 MXWhJ2wjzC5lId66I9NqNhJNlIfHD9JFRt4YHbEZFhy3kbf7 5GDryPf TD6H2V3AOWwhdMAV2s4RfAmH2O6 YKCzF tZYcJbYUF1VVRcpJ/gw==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbundlescontent.com/c?x=Kdu8Iqb6Pbh/VQ6nBBImQymFKQMNJLF 4/EeZpHHYvA=&c=GHMjWwBUfrnKs83CBEqjKoZ3uaXGg9XxfTkn0XMgAxNuT5NrMUpS37w5fMw7JqY0ewob3EtgRHzMhFlLztr4SNNhCnBy9Jc9vGptvzTDbh5Bm46XfOL3Lw6AxgSr2XisbZT70Ogf6LVzJZaCBer5XA==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.grabpresentapplication.com/c?x=vTsMyCXgmb6NOtHalS1oAMmRsGTy4dyw JMwIFisRXw=&c=U7d7izh3p9xmDZGzj2X0IylXTKVc6SkHN7QoY6N602t8poAI6cb/kv8t/KbbFkKAgz4zbBCsXSiKblaEuClv/n40ponQ301 Po1TqvEPXhevjU4JI3G5l25iUlEwp/S9wMaPvcx506lFDXA4NBz8yg==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.centertowernow.com/c?x=OyIvuH4lpBHa/llWFJc4fB8yX71r0jvalR2KZ33NirU=&c=aNGfh 1se6G5BrIfmlKkffjbjTOQO2I2CIRkdfIzhMui1lIPY8j96/fS1B 0trNE0Dukx6TTq3C4O3RRtqVSwnMghfNvpFdLQm0yQsyj2z2G2RoPCZw2NEnjGg/O /vZ R9oNAgXwr5LV0XM5i1/IQ==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.grabpresentapplication.com/c?x=nbaxppNCg/HBv tvvoekL8hu1imXdfIUYfC0ERReiCw=&c=ONJ0/ctLHdIsUp3ky2ulvRMJdddYQJkJHP94ki7Af0loQv1IZxywcFoEVvYcIvbNU4hhIU4RuCEEWRq5qM9mHVSZMzTm s8B pi/ zeGcCBraB1SMhNO3wB034 Ngzr29oweXxvIfnk3KLLqewgUkA==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.grabpresentapplication.com/c?x=kFkeLKh SKiZcirxnHHRIkV0knzQnAQ9NEUojkPVwRg=&c=sAsJuXfUArV1yV/1h5N01nrjUoosAH5M1pGJXU9mCO1xHeHmA5eLXAQ mx3IlSCxR q3O3nc9MTSEyBd71pTEeaesO7H4gZjgjtiN7kofBK1HYpov9YYpVQ9p95YIPCZEItDaW6aDRzWnRDu/wjFHA==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.centertowernow.com/c?x=6XW5/HP8JGQLzVd/mTcO0H AaEhE38Uj9QQTFlJlPo=&c=/2w1NpXtwL18ZUScclgEhpPTTVhlf9tSQ1eGVqfSAxqxFFSzaPWbozEfjNqkI3humfGZWthIkMrdZIjRa62 zZI3BTSy1BvP 7W553gPyRz3W/z3obt qX8ejVxRNd/GvQMD0qYAXe0bMz2m8GBw0w==&downloadAs=Bandicam Setup.exe&fallback_url=http://cdn.darwendlmfilesnow.com

Latest 30 of 38 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_bandicam setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.