home

icreinstall_c.exe

Web software

House of Life

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_c.exe, “Web software Setup ” by House of Life has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.centerfilescentral.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Software   (signed by House of Life)

Product:
Web software

Description:
Web software Setup

MD5:
7e51236e847ba69c558fddc2445e3c0a

SHA-1:
a80286fb9991b06628803eeb7651d68b22322343

SHA-256:
5b50461f1c02bf640a1f418c1c52a005f38c6b6343815c564e38492367803033

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/17/2024 9:54:40 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.HouseofLife.Installer (M)
16.1.7.7

File size:
999.5 KB (1,023,464 bytes)

Product version:
4.4

Copyright:
Web Software

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_c.exe

Digital Signature
Signed by:
House of Life

Authority:
COMODO CA Limited

Valid from:
5/13/2015 9:30:00 PM

Valid to:
5/13/2017 9:29:59 PM

Subject:
CN=House of Life, OU=Property, O=House of Life, STREET=Oelnes, L=Sogndal, S=Outside United States, PostalCode=6856, C=NO

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
7D10B220FDFA59C2BD4E1AF300EBA218

File PE Metadata
Compilation timestamp:
6/19/1992 7:52:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:VbcrD+rzlzSonFDxaTUFdF6p6v5pFgRsWVCWr:VQrA9hF1iUWVCWr

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9243

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_c.exe has been seen being distributed by the following 50 URLs.

http://www.centerfilescentral.com/c?x=5CuWUOXpLboY4NxtbMCjZxOAhp0T3N6KcjdWFL5gOTU=&c=NZzJvxqsuV4z 9DTruaq4TMCDzV7lGqdF3s1RxJfMaMBF/YvOmLrvMfmCMI/znurGcR3fczCgu5JCD1wo9144RFk1qbY8hMm5vW7pDwgf5CHoRN6 WAb2/FOT57i95H0&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=6vDW2CFsjyIRSJdFvy4PdRcHrR5s7nLOLIpRlx LP8E=&c=MKKG1ywKViNbpe1CSLkGX4k/mv4sC9IpNdVyVZzQtAgGtP7rlaIYdw5mXI7o0kPm8aQzQkcG9oZCzTZfqH/qT0cjvC0Mcg191HZloTL6d4riHPwqJIsXFxRPMf6Qpv9G&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=dwf9ebZqmPpwIOdt2znUnQf8srs25meVHvsdLzu7eGY=&c=Q4QQuMRJKH0GxunfHbw28lj2WHOFdf0qo5DfRYt7odrhW37rkWFqnT5J/GsnpaAmL0oyXViVQO1LdbiRZXF3OyAqSI3GxZrCnmFEk8YnwuF9oGxeDyhTtXt/ xCEanub&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=k1s4RhPD1T5avTte OiX0QSEXyG98aCZL3NBBYeIAoo=&c=aMezxH9iK1pMneiHDW2U1hhBKm6KxLA2nui6UiO9q5xKby4mMpEkOxXHkEAJ/QDo jg5OwFIX/ko7G2CHFbCmmBObLo4Dc7sJmti2OJyYIZFJOJsDf9oSgVOYGXvKyPv&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=iAIc ubq6EvF5 zJ36vJJrAqGzM/3GCIIopVPRKl2kE=&c=QKmVkFmp1O/eWPvDoXmLent63xcg1Rf3dUnBlgPOsOVcYnqk6BNVhpFCnpHYagEOJYJG2mvmRT bhgLCGKSYgFPWsJtzKCQiBWOkKxgBFft94oqPoqcNEE2A9tOYlsQe&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=bbAJ8xSrGaWM1sH4hgm6OHW FZDqYlrV3dPEh7z/Jok=&c=Nk2ORjKj8TwRVKCC38YVfolHA1NM6nELmI1QEvg1Cid1WdLQ3sBSTPNjj4emvbC9qgy4XDjlNFx35enXkOBn81MDc1gUiyAGE7nvHapXw2PEMAfhWS5eB9mBRENtOBSY&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=r9cf/peZsCDGKGjCgWYvFEak0gQapnkUF0B7cYmdBgk=&c=6PQtEt/TOLFbtdVL2LY7Ss4OWEmAF0vruwynmY7kFjCr6bCakDTOKfW8RWLiVGkRg0ePZx/kXqEFOxs6pRK9VxNVC3SfMpvoPKl fyNMdge4ZFdEBjZFiSuULRzVlM5N&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=VVRSwC7kKesr91X4ozMOHvqXj0o5OLqUL/aVwNbp0S4=&c=ZfrT NJGtN1ADld8g5eSY5n36IRjE2OqHO/JaNiLXLaeE/mNycW/ytw2h KKcX1knoqGAnQJBEjpWhTi53mhKXdysIWdrM1oPsZRCqQqD8ntINDlF0ZjHD3ZT 6q4pbO&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=/ANkf1IIVyt3hSrOdGO y2L/9TJ1s5iec2CKf6c05YY=&c=9IOgIK1RjtGaG74XzROmc6nDc2zwN97vPfW WSK1eURg0g506bulo/ffeKymirKuMdipVN0vuAJEPD8OyT6bNLIg4KWPlwi29Axe23NV5TKGqLEh2nmiOkk2FXPxaxvq&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=deyTtxpgHC6GXzaia1T6RmpRGuStcvrtTv4WcUSHp5w=&c=cADMg3siarXncfNgooODfjzhnBaGLxgzmR1eOFI2OOL8QQGTnSrwH0 1cRWk4cWkXMy0RLKhx8aYeIvtiJ31BE39BKD1qzuNhSMx0bnT MtVIYAGtN73WoeeUEMu4t P&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=wTRuysZboHWapkRJEqQdESLZt2O8hhvGYS IWi1Y0yU=&c=TWIAQDJGRZaSWhwDkHWW2CISZ4kJ FTpIDG4eEpsAdo9k1rV5rL4/md0D9lZhxWzA0Od2OwyokqmxxSJ6OtV3 3UnUFBK6ALFEL0y COr8WHQE2M/cbDYm05l nFTNwSIUXHbgsuC J91sa8E59XDA==&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=E4d1yVGC6/w33jDwAXJREHScwQQaYU9DVFdJbzJbmbo=&c=AJrhaIa7nCw59NObZW/xU5p2hwAFS9qAeWlVebZXDu KkJItS3v1lMzia2KrVNX /un0lCRDc8gmgGa0NlC1sySkQ6nah2TbTll/3t71MWOue1bpSiNhymWzjZTLOzzU&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=J6AfRKa/8wqqSz0gKcyYT9kU/4hpLjwHO20flNuSR2U=&c=FsZ3qB9lzBskG3CvBCnSildbbirG8CWUYsMncAHQF2GlvDeKu6bk4FyC/QJEka1YiT2EF1E1Wtnsutkm6zIzD8tVqgP7dUIHjtCQ/8hRTg5sco1r66qti99 J7MlgjRi&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=nk1bghbkdIoFuvq6A RGDxpR5S7jKTOvOJzWguuZU/0=&c= U4Tz/lT8U/5sER0E7G8rVR7mGOG7aObxax5cR2uqZFNbSimu6iO9ZO6RFkoZ5YG1wwUkAHadoNH2FK/riABqcEHatIr87LOLpMLF8XOynVvr38I8Evh5/Y9OxCiKwLp&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=3fspOcSCcQT2JT5O6Bx89kwtzSsngUJlxR5UXn0kbGA=&c=pnnDoBUrq3PDryQzglVYORvC5dgMm6 oR3HFpVcvuSLQhMylkYJIJfobLtnLLmkj/HGRKuRKFZgh5jiEXtsOIl6I7rOKplBUY30Ki0P0zPHe Q5x3s0TU5CWQ43a8mno&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=6Rz2FSCvuooicoukFguu3J2iw5kBd94pdN9k3jihH9c=&c=e6DpfvFs66q1i4 1bccV7dO0ksBsLkSvbw5iIvaJ5Gv48Tom4nE bSUHN/6vV5j9p7BL6h3EnQQwY9MoebRKbcSvL eURm08KWVbVG BA/IlywIHXc1QMDXMkdjAri41&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=GX4UntEjcbUixI6Ccsd6 TS1YiMzGGlD/a9/miqaAO8=&c=S/DETvhK2Jaa90Y1jyy/W4XDuFyEa3WPDtURI1TLHTxe7XUw1GxlBIVo7u D0axk DSFajcbw7To dcfEa7tXuzNFoVQg3wZ4SNv7OLVKBgb/e/RI350RcCajD BEN8s&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=O009OHekTHxYck6Z3ecBrfGhNfkdr6Hw bemuPvZXLw=&c=QMlmZDKtKsE91QyvKHcSNO1bhglG7t5Ho5YdX GEr10EESl23leUdFDp9Xyv9Kvda9ABSN4VvmeZoVGwAUqWSqpwH0 7JccBpwTBbfcgIX7id/A5HWB1ZdtQKGtxE9/m&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=1NCnfHchMXGvvweaKqXbqJk97ZqezX ZDme/L6MRXgw=&c=bxlSo4bVjZQfMrUtOHmrPr/ LElCVa LHId6Fc3OgeFhML4/7sozBOK13OaCEFVRP3c0JZS2Sppefa1uLuZmIuodXFGANiInK W3vtlT2IzLDpxPJF3c4UVw8VlJXz0p&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=Z1KZtsCw78wqjX/yJ1bo2U t1veN0xCpCPjYE0qF7G0=&c=bRJID5eZa8gsAeUBqYz92/rAm/ME/WnXC0WuDm64WD3btXsaD8PgogFElKPeGeBOHH3kSsSvGRDOoNHq/zS/eUgRcq4zpeQMhR9QCVTw dvn3TpJhVzPZAVatUTkE3iB&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=KUJ/eEXBr03WwZD X39rDiGU23cg3SKiRs/BT67Y5vA=&c=9FbbsfrfHgOlqwOaHFuOOZz1Bzjbr2WvYqsp/znK8PQhm6AxIV5LMrwR0s/s9Wqyylxvp2TpTm0Iu6/DTh/f2lTarOoZJyOXqY4sNV4zrSpmzF/ebp64zPdPki4XbJbJ&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=AbU9YySLYRMhzAzzA1dkEFZeiFIf811Tz4qC7T2IX0M=&c=rkhzPGt9sYnHZfkDJThtpEaBid7REKMf 8rgLaFpYxhJiTqgwnvrWyxcbsNPvpOCFut4/NRcdWlJU9v9yAnwKB2cSOWCKZFLlTt1Gj/jcZH9Trw5YZBz8d8MHIQqrBjV&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=YGJl 2uk6Jv hF IpkzfALiHbcd0hDzeQWmDcXGEaO8=&c=Nw8rg0FssjH5qXuS3xvufYK6M/uFL9VL2cRuvmwiME7LYUgcWoewY1Mvly OpvG86IBWESGC0z4w5a91fdmURFx0FDbY24wyk2iq8j3OkKQ7mEe cdjLKCQLzRkzNiMf&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=OvEQj5UIM3l44T1CMLJ9Z4O wPyvUHuirLh b5ulzTA=&c=etIM zrTMlO0LgvdcN/U3sabQw86eSJ1c2/h5dBXCipScxUXGUTZLfXkphYnbrqBprjsJJavpqup6j7ifhEjGkLyw4ecrj6mY6zu8h2GnychOHOK9BeDemSdJblozvDn&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=trHigmzbapjK1kKT0EAQwMMWm9EVvzmN0Whzq hGiNc=&c=W3FfqHEut6Cfyb YbXYqf/k8lOc3dIRjyVxGEgC7HnFDob03zJA/64AxW4vga7l3vudsrJvE6eUvz J2Im6I1xIH6o0fNDd4pI9et/Ltkyo8LcbzWFRrw5u6Y InOk5O&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=A6nVbKs6upFcmGOC VAFAYGFAUeeW oaNa83azZFXkE=&c=E8qRWDsywkSXgCjum60SQv4KUQaudD7fq/l/DD5ckHBmc4MhGT1fhAx0wU9HWMYuPH bWn23/9nttiTaLzMEMm1wyAFvZUuEHkimxN1n6Q9LEgwgUd04MUa6cKpraJbd&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=LbJASSG6WwNhHVew8FjHuEzAHDu9Axu/Ak/ 3ie7qEc=&c=tuwNZq1NfoQLOhQCkJJMLxsEhccbFwM8KO8zWyHgdq50Am98b/V25cNLMVmb26Lk1AKU7syNv86W5nejZUrTgP/Itzd4KQ8UUysn1NhiwtNlUopEDul0uAJlKv2Snrsw&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=LuPsJ0enbaZ7hd6T685UHFx2r9yr89nhNQFr/XIFeo4=&c=qG2c987lwEuC 8Jta5JsAq9/HlGVMLeR9F0e4jx8//NxArcuYZDdAQhCF9iNtgSDdNATmO2QlxMNVxoT54LG6An1Kx55MIYKUL/gR8QyySU3C54qdCZr5yrE/OgWUdGj&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=H9ugGLyp7bQ0vP5NMvcx6GWXmTLBCHbU9LmzrobgDmc=&c=8oQB DTcGw NUxh5TWjnKXvXXbQSNCYDjjlLAwozjaS8r7Yb7FHmylLXlQJ9zrqORpOQjSPz3IlZ0EU0MDcg9vyIvNbMwi AFWk2O3zBu7zUd4Kzfq5RWXvGbCDaAsvL&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

http://www.centerfilescentral.com/c?x=jM5ERV7NgDA7BsqLnVqMcSV7YzjR7sbF5FkIeQQtu M=&c=rfn36xygw1uQvMAhag93ux8sKG2frD7SF5FHbKcWBUQ2uKkQ73sP7oeFaDOqUj9vn13g Gl73s4R0/tTMw26cRcPVDaRd5NjVds2qEMiw3eXoBQk5zKpJyeLyTOPwYHu&downloadAs=BitlordSetup.exe&fallback_url=http://www.bitlord.com/.../BitLordSetup.exe

Latest 30 of 157 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.