» icreinstall_directx-12667-dp.exe
Overview
Analysis
File Details
Downloads (27)
Network (3)

icreinstall_directx-12667-dp.exe

Kisi

Mode Beta (Fried Cookie Ltd)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_directx-12667-dp.exe, “Kisi Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Sacip (signed by Mode Beta (Fried Cookie Ltd))

Product:

Kisi

Description:

Kisi Setup

Version:

3.2.2.4

MD5:

e93ba9c9d7105f578be328c343f76c58

SHA-1:

8ce4818250733278ec09a0a3d41212827da7e421

SHA-256:

58f2927cbd39f0d9bc826657524a142aa6f6b9f10d63bb0797c6076078763abb

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

11/23/2024 3:26:39 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.4.22.0

File size:

952.6 KB (975,504 bytes)

Product version:

4.4.2

File Lite

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\appdata\local\temp\icreinstall_directx-12667-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:RjJz9OiMv1hlYlmHZRY5L5H/9x7NJXH6:RlZMb/5RYRV9h36

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file icreinstall_directx-12667-dp.exe has been seen being distributed by the following 27 URLs.

http://www.citysafeapplication.com/WVl6OTRQVXgzVDFWM2RGY2xNa0o2YlRKMVZYRlRTREpGVTI5bFQyVTBUMGw1VG5aM09FMVVkM1pyYzNwdWRWWkNPQ1V6UkNaalBXaHphRTUxUW5nell6aHZSVVp3VjB4YVQxZEpaMlJoZVc1clVHbHhWVVJKU1hRbE1rWjNiMDgxTkVKM1YyZE9hbUphUVNVeVFrbzVkM2hCYlc5NE9FaDJaRlI1YUVWVFFqUjFkMk16WVUxd2QyMDJhVEJCY1Vkbk5tWk1KVEpDZVVodVdEaE5ibXBhU1dObVQzaENWblZIWTFGMFFVaHJkWEUzY20xc1RHZzBhM2w2WVVZelZHWTBiSEZUWWxKWU9HeFBTMFZGTUhWV2VsazNRU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprYjNkdWJHOWhaQzV0YVdOeWIzTnZablF1WTI5dEpUSm1aRzkzYm14dllXUWxNbVk0SlRKbU5DVXlaa0VsTW1ZNE5FRXpOVUpHTVMxRVFVWkZMVFJCUlRndE9ESkJSaTFCUkRKQlJUSXdRalpDTVRRbE1tWmthWEpsWTNSNFgwcDFiakl3TVRCZmNtVmthWE4wTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVVJwY21WamRGZ3RNVEkyTmpjdFpIQXVaWGhs

http://www.clearguardapplication.com/WVl6OTRQVE5OUW5GUFpVeHdOelZTZURsNlpIVkViVEZOZVc5MWVXZFBVMlYxV2prbE1rSkZXU1V5UWpKcGNsQjFkMWhGSlRORUptTTlTV0ZDZHpCQ1FsVWxNa1pxYmpOVFptTjVRbVI2YVhFMFNFdzRNRGRwU2tNelJtcFlibU55T1hoSldFeDFKVEpHYmt0TlNUaDNTU1V5Um5CVk5qQnZVR2RqY1hCRWJWUllZelpoY21ScE5VWWxNa1pvYUZwc2VWWnljbWxKVVVkMVJrZFNiWFpEU0ZOQ2JGUktPVFZpVFhoMlpYTlhSRkY0VUZGcloyZDZhalp4T1RWT0pUSkNKVEpHTVdZd1ptcEVPRGQ2TTJ0bldVdDBNRkYzUVVnd2IydG5KVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtMbTFwWTNKdmMyOW1kQzVqYjIwbE1tWmtiM2R1Ykc5aFpDVXlaamdsTW1ZMEpUSm1RU1V5WmpnMFFUTTFRa1l4TFVSQlJrVXRORUZGT0MwNE1rRkdMVUZFTWtGRk1qQkNOa0l4TkNVeVptUnBjbVZqZEhoZlNuVnVNakF4TUY5eVpXUnBjM1F1WlhobEptUnZkMjVzYjJGa1FYTTlSR2x5WldOMFdDMHhNalkyTnkxa2NDNWxlR1U9

http://www.sharerepositoryhosting.com/WVl6OTRQV0pxYjIxT01GQllOVTRsTWtZNFZHTTBVRzVDVjJoS1VHTlRTVVpCVVRNbE1rWnRhblJEUldobU4zWTNjRFZ2SlRORUptTTllSFEzV1c5SE5VOGxNa1p5UzB4SmJGY3lWMHBPV21kMFNHMUJjVXBLVUNVeVFteDRaamRoVjJabGIwcFpURWRHVFRVelVrWlJURGhPTVZvNU1tNGxNa1pLVjBjbE1rWm5jVlJGU2tOTk9HNDNObVZ2WWtOYVVUSjBaR0ZuVTJvek9IcFhaRFVsTWtZeVRtUkZXRGhsY1V4U1preHFiV2RzYmxkamVubFpZMUZoVURCQ1dYSXpRMHBuVmpnd2EwSnJhbmxVUVZKb1JsVjVRbmx2U1ZBd1p5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWmtiM2R1Ykc5aFpDNXRhV055YjNOdlpuUXVZMjl0SlRKbVpHOTNibXh2WVdRbE1tWTRKVEptTkNVeVprRWxNbVk0TkVFek5VSkdNUzFFUVVaRkxUUkJSVGd0T0RKQlJpMUJSREpCUlRJd1FqWkNNVFFsTW1aa2FYSmxZM1I0WDBwMWJqSXdNVEJmY21Wa2FYTjBMbVY0WlNaa2IzZHViRzloWkVGelBVUnBjbVZqZEZndE1USTJOamN0WkhBdVpYaGw=

http://www.clearguardapplication.com/WVl6OTRQVUZSUkdZMVJUQnhKVEpHYjB0WVN6bHdOSEJ6VUU4bE1rWlJRM2x1YlVSa2NtTlpKVEpDVG10SVVUZGhSazlpSlRKR1RTVXpSQ1pqUFRFMVlXZFhNV3BhUm10cmExWm5NSEJQVjNkdlUwSnJOM1JrYkdScUpUSkNkVWh6T0VJMk1YQnZWVUZvWVRWbVdWRXdaMlJSVWtkWVZIVlBOR2xrY1U5NU9VOU9OeVV5UmtKb2RsQlVjRzl6VlRoM2VWaHBOakUyY2pWaVV5VXlSa3BVVjJ0S2MySlNVa3BDYzJFMVZsazBWRlVsTWtaemNrdzFlak42TkdOSVEzTkhTVU5zT1RFbE1rSkxWMU52TWtSSFNXUnpWVE5sYzNsUVVYUXhNVkVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWkc5M2JteHZZV1F1YldsamNtOXpiMlowTG1OdmJTVXlabVJ2ZDI1c2IyRmtKVEptT0NVeVpqUWxNbVpCSlRKbU9EUkJNelZDUmpFdFJFRkdSUzAwUVVVNExUZ3lRVVl0UVVReVFVVXlNRUkyUWpFMEpUSm1aR2x5WldOMGVGOUtkVzR5TURFd1gzSmxaR2x6ZEM1bGVHVW1aRzkzYm14dllXUkJjejFFYVhKbFkzUllMVEV5TmpZM0xXUndMbVY0WlE9PQ==

http://www.farmtowntowers.com/WVl6OTRQV3BOSlRKQ2RuZzRKVEpDYmxWRk5qTjJkREE1Yld0U1kwNUVORXhRU3pKSmMzTkJhSGxhT1VKRUpUSkNibGhzVEc4bE0wUW1ZejFKU25WaGEwNXFjM2xZU1VOTllqRnJRMlpGWm1GS1FXVkRWVmxVWkZCSk5tZE1ObFZTUWxrM1JpVXlSamRPUWpGaGFXdzFNa3BUYUdwNFVXcDZWSFJVV0VkR2RESTNTRTFQZUU1TWVGcENhRmxITWpBd1ZTVXlSbmRUYkhKMU9FWnBSRFpPYzFFbE1rWnJOVmRuVTFKSVVUbEJhSGxJYkVnMWJuY2xNa1p4WjAxTmQyZDFNMHhaWm1sNk9XcDRhVTV1TTJGWlZUTllWRTFSY0dnM1VTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWmtiM2R1Ykc5aFpDNXRhV055YjNOdlpuUXVZMjl0SlRKbVpHOTNibXh2WVdRbE1tWTRKVEptTkNVeVprRWxNbVk0TkVFek5VSkdNUzFFUVVaRkxUUkJSVGd0T0RKQlJpMUJSREpCUlRJd1FqWkNNVFFsTW1aa2FYSmxZM1I0WDBwMWJqSXdNVEJmY21Wa2FYTjBMbVY0WlNaa2IzZHViRzloWkVGelBVUnBjbVZqZEZndE1USTJOamN0WkhBdVpYaGw=

http://www.capitalsoftwaredownload.com/WVl6OTRQVFZtUzFOWVYySk5NbGhJUTBjMlRIb3lUMGRuYjFFNVJWTkhNblp5T0daWE5raE5VbWh4WmtZbE1rWkZTU1V6UkNaalBWaFNlVmd6V2pkR1ptRnNjM2huY0VkT1NsWkJUalpsZDNoYU5USklhMnhvWW0wbE1rSk9NRmRVTm10MVUybFRjV2xJWjJsNGFYbHdkamhtVFVsaGNFbHNVSEUyVUZWNE9YSm5iazlSVmpjeVdtWlNTekJ5ZDA1MkpUSkNRamNsTWtKYVFUbHViMlZPY1d3bE1rWnVTRm8xVTNGaFQxTjBTSEZrTVdVbE1rSjVTVWR0TWsxS2FVZDRTQ1V5UmtaMFExQWxNa1k0SlRKQ2QweGtObFpDVDA5TE9HbGpKVEpDVVNVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aa2IzZHViRzloWkM1dGFXTnliM052Wm5RdVkyOXRKVEptWkc5M2JteHZZV1FsTW1ZNEpUSm1OQ1V5WmtFbE1tWTRORUV6TlVKR01TMUVRVVpGTFRSQlJUZ3RPREpCUmkxQlJESkJSVEl3UWpaQ01UUWxNbVprYVhKbFkzUjRYMHAxYmpJd01UQmZjbVZrYVhOMExtVjRaU1prYjNkdWJHOWhaRUZ6UFVScGNtVmpkRmd0TVRJMk5qY3RaSEF1WlhobA==

http://www.appsfunbyte.com/WVl6OTRQWFpaU2lVeVJuQnBXamMyTVZscmRsVmtVV1JOV0hoM2IycE1RelprZEhreWFXbFNiR0ZOY25GT1pVRTNWU1V6UkNaalBYbHdVazFaVVhCalFUWk9jVlp3TUNVeVJrY2xNa0p1YTBGbWRtNDFjWE5xWnpoS1NpVXlRamwxTWtZNFoxWnRPR0kzUVc4M01IZFRVa2swTm5sMFRqUjRjbmxvUmpjMU5qTm9hWEl6ZDJZeWNHeFpaek5sTTBweFJFcFVWR3g2ZFdsM2NHdzFaVXRvZDBWSlZGWWxNa1ppYlhveE5EWjZVbmRNTkRCTFdtSktOMnhVZDFFbE1rWlhTV3BIV0hCbGFrVjVkbTVGTTA5WFdFSTVTR0ZuTjJjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRdWJXbGpjbTl6YjJaMExtTnZiU1V5Wm1SdmQyNXNiMkZrSlRKbU9DVXlaalFsTW1aQkpUSm1PRFJCTXpWQ1JqRXRSRUZHUlMwMFFVVTRMVGd5UVVZdFFVUXlRVVV5TUVJMlFqRTBKVEptWkdseVpXTjBlRjlLZFc0eU1ERXdYM0psWkdsemRDNWxlR1VtWkc5M2JteHZZV1JCY3oxRWFYSmxZM1JZTFRFeU5qWTNMV1J3TG1WNFpRPT0=

http://www.clearguardapplication.com/WVl6OTRQVU5PTjNJeWJtb3laRTlXTnpCclV6WjFKVEpHY0dKek5YbzFkWGR1VjFaTVNVdDZOSEZoT1c5V1RtbG9WU1V6UkNaalBUYzFaMFJwYlhneVdHNWlNemR2VGs1SFlYRXlNRUpwYURSM2VqWnVkRkIyYW10d1NHTjRNVVJ2T0dJbE1rSmxkVTk2TVRNeVRHNHpWbkpuYzFoVWIza2xNa0pHV1hSYVJYZERSVkp3UVRKVlZHSjZOVk5YSlRKR1JrMXRNVTFrTURkVVZEbFNUMWxsYjNsdlRDVXlRbGRaY0dVMllWbGtKVEpDZVZwUWRISjVTREpLUTJKclVrbEVSV2h4ZEZObVpUazVWVkZ0WlRGTVMzZDBiVGMyVjNjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRdWJXbGpjbTl6YjJaMExtTnZiU1V5Wm1SdmQyNXNiMkZrSlRKbU9DVXlaalFsTW1aQkpUSm1PRFJCTXpWQ1JqRXRSRUZHUlMwMFFVVTRMVGd5UVVZdFFVUXlRVVV5TUVJMlFqRTBKVEptWkdseVpXTjBlRjlLZFc0eU1ERXdYM0psWkdsemRDNWxlR1VtWkc5M2JteHZZV1JCY3oxRWFYSmxZM1JZTFRFeU5qWTNMV1J3TG1WNFpRPT0=

http://www.conceptsbodysafe.com/WVl6OTRQVmhhWmxoR04xcFpjV2xFVDNnbE1rWlVUWFZXYTJGVmVDVXlSbk55UlZwdU1uUk1iVFJ4YURGQ1JsSlZNazQ0SlRORUptTTlaRGwxYTNoWmFHOURaV2hqVFhWbWRrSnhORmRFY1ZwTFdtd2xNa1pDV0dWYWFtY3dkRGh2ZEV4VU4zcERUV1pzTVdGa1RURTJlRkl5T1ZONmJVWnRVM2REYjFaVE9TVXlRbTQzUTFaWGJsQkJTMGR0VVZoWlJIaFZTSEkyZHpNNVdUaHFkbmxvVWs1cU1VeDFjWG8xWm5wck5HcFBUM1ZOWkd4NlNHbFFUakpDYVRkRE1tbE9RMWhFUXpjbE1rWmpXSEpzYlhaemFGcHFNVnBCSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1SdmQyNXNiMkZrTG0xcFkzSnZjMjltZEM1amIyMGxNbVprYjNkdWJHOWhaQ1V5WmpnbE1tWTBKVEptUVNVeVpqZzBRVE0xUWtZeExVUkJSa1V0TkVGRk9DMDRNa0ZHTFVGRU1rRkZNakJDTmtJeE5DVXlabVJwY21WamRIaGZTblZ1TWpBeE1GOXlaV1JwYzNRdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UkdseVpXTjBXQzB4TWpZMk55MWtjQzVsZUdVPQ==

http://www.capitalsoftwaredownload.com/WVl6OTRQVFk1UmxjMFdXdFVVbkJKUlUxSVduTlFhRTUyUzAxQ2F6TjBWa1V3SlRKR00wTm9jbmhEVDJWT1pWQTBTU1V6UkNaalBVVWxNa0pvUzFCU1JXSmFlRVpvT1hSRWJ6WnBiSEY2SlRKQ05tc3phSFJsVjBGeFVtVkVjWFp4TTJOeWN6TnVRMDU0UzFGVllqTktWbEJKYkVwT01tMXNaalJVVG5OSVUxWnNTMGxQTVVKM1ZFNDFTWFZKWjFCVlFpVXlSbk5uVVZsR1NFOXZZbTFpWTJSc1lURkVkVkpaWW1SbVJWVm1ka2R2SlRKQ1dFcHlkamRWU0hkeFJsbDVXRVk1YzFSQmJGVlFOM1JLYW5aak5tMXdWREpSSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1SdmQyNXNiMkZrTG0xcFkzSnZjMjltZEM1amIyMGxNbVprYjNkdWJHOWhaQ1V5WmpnbE1tWTBKVEptUVNVeVpqZzBRVE0xUWtZeExVUkJSa1V0TkVGRk9DMDRNa0ZHTFVGRU1rRkZNakJDTmtJeE5DVXlabVJwY21WamRIaGZTblZ1TWpBeE1GOXlaV1JwYzNRdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UkdseVpXTjBXQzB4TWpZMk55MWtjQzVsZUdVPQ==

http://www.capitalsoftwaredownload.com/WVl6OTRQVmhQZVdSdlYzTnFNVXRvUjJOM1FtcGtkRVJ2SlRKR2EybFljMUkxTUZFNVNtOXROVXRwUVZCSlZtTkNheVV6UkNaalBVMTNOMFUyTUcxclduWXlSMlJ3ZFVwU2VHcFVielpwSlRKQ2QzTlZWa3BUUm5Wc2JHRjJjbkZtY0hsNmVrOTBWSEJzYmxjMGRYaFRlbGREYjFKNk9IVlhSWEpWVG5KQlVrcERNa3BrUjJOWE9EZDVWWGhKUXpaQ2R5VXlSakZUVEZZeFIwNWhhVk5yTVhaUGNIUk1USEYwTm1zbE1rSkZlbUpXZDJwdlJGRm5ORE5YYlhKWFdVZzJXVkJFV2pjbE1rSlZKVEpDTUdGUGVXVk9SbVZZVmtFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRdWJXbGpjbTl6YjJaMExtTnZiU1V5Wm1SdmQyNXNiMkZrSlRKbU9DVXlaalFsTW1aQkpUSm1PRFJCTXpWQ1JqRXRSRUZHUlMwMFFVVTRMVGd5UVVZdFFVUXlRVVV5TUVJMlFqRTBKVEptWkdseVpXTjBlRjlLZFc0eU1ERXdYM0psWkdsemRDNWxlR1VtWkc5M2JteHZZV1JCY3oxRWFYSmxZM1JZTFRFeU5qWTNMV1J3TG1WNFpRPT0=

http://www.cycleupdateguard.com/c?x=v1KTsjONQCWjqsqjywsVnHptepFl7csXGbr5 l4EsZg=&c=LzY0I37O9OZyHpF9nRvVNjpbQ058qSWkyI2d97fVjREVraflPij5CX1GSnu9xIQ17Wc9OLAkUoxqtVmRANj6f7U0B0wP1Hx8EobKK81H8bCILWUyERUHZEJAtDoWcQYbUL4P3d7sLLd28S6BcSQqTb9 rA2BO0t2jFtt54p19NM=&e=0&fallback_url=http://download.microsoft.com/download/8/4/A/.../directx_Jun2010_redist.exe&downloadAs=DirectX-12667-dp.exe

http://www.citysafeapplication.com/WVl6OTRQVkEzVURoT1EwWktUVzlxWW1ZbE1rSTFSRlpTZFdaelQxUnBZVFI1ZVVoa01GSkphMGR4U25wcmFHcDRVU1V6UkNaalBVOWFOVFpuYW1GSmFDVXlRalJ6V1hWS01uSnhkSGxsT1dOS1MxcEhTbVZtTjFObmRGRlNhR2xWZDFGTWFFWTRURlV6YVVKQmVVbHRiRWRUY2xCb1pXSnNabkJLZEZoaE9WUnBjM2xtVW10MWJGQnNhVXd5Y0dSUWExUmhibmhvWjBSbk5VSldWM1JCVEhGTWVreEVVVUpaTmtSaGJGWmlla3RsUm5kelVISmlURU5vYTJKV1NVNW9WR3BLZHpCbFFrVjJWM0ZVTVdOQkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVptUnZkMjVzYjJGa0xtMXBZM0p2YzI5bWRDNWpiMjBsTW1aa2IzZHViRzloWkNVeVpqZ2xNbVkwSlRKbVFTVXlaamcwUVRNMVFrWXhMVVJCUmtVdE5FRkZPQzA0TWtGR0xVRkVNa0ZGTWpCQ05rSXhOQ1V5Wm1ScGNtVmpkSGhmU25WdU1qQXhNRjl5WldScGMzUXVaWGhsSm1SdmQyNXNiMkZrUVhNOVJHbHlaV04wV0MweE1qWTJOeTFrY0M1bGVHVT0=

http://www.sharerepositoryhosting.com/WVl6OTRQWGc1VlNVeVJrRXhObk5GV2xwMGJuWmhVR05WUmtWM1ZITnlWM1JGUVVGTWVHczRVVUZzYWxSVmQzWmtUU1V6UkNaalBTVXlRa3hOTTNSdVYxTjViak5oV1dWU1VXaHdia2RDYTFvMWN6aDNialZpU1ZoUGMwTnBUbW8yU2xFeVdIVTVlWE14TjJ4SVEyaHFkU1V5UWt3NFFsWkhSMGhZZENVeVFreGhWM2N3YlROak5FTkliRWg1TjB0dmIxVWxNa1pySlRKQ2NtaEJTMmd6WWpkcGRFdFROakZhZFZjbE1rSkthVGNsTWtaaFlXUTJlVWh5TjNOcWFFSlBSbkpuV0daQllpVXlRa1oxWVZkeFRGaHpTMG81VUVOa01sUlpUMUVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWkc5M2JteHZZV1F1YldsamNtOXpiMlowTG1OdmJTVXlabVJ2ZDI1c2IyRmtKVEptT0NVeVpqUWxNbVpCSlRKbU9EUkJNelZDUmpFdFJFRkdSUzAwUVVVNExUZ3lRVVl0UVVReVFVVXlNRUkyUWpFMEpUSm1aR2x5WldOMGVGOUtkVzR5TURFd1gzSmxaR2x6ZEM1bGVHVW1aRzkzYm14dllXUkJjejFFYVhKbFkzUllMVEV5TmpZM0xXUndMbVY0WlE9PQ==

http://www.clearguardapplication.com/WVl6OTRQVEkxUjNNMmNqUkdORFJEV25NemRVSkRKVEpHVEU4MVZWWXdaMjlLYzAxRGQwbHRObGxxU3pCMlprRTNNQ1V6UkNaalBYRmFkSFl3Y3pNd1RDVXlSblYwVUZoS1NYRkROM0p1U3pNek4zRkxSMDFVZUhCWmR6UlBTWGhJY1ROaFdWTkJlRmhuVEZCVU5EaEtSRUZNUjFSVVdtdHBlWE00VkVKMWNtdHdSSEpwZDNKVlZUUnBXVFpYZW1Vek5VeHhOVVJaVmxKamRYaElNbWxFUlVWb1pEUnlRU1V5UW1sNllXazRKVEpHTnpCb1ZXTm9ZMFYyWW1JNFkxTm5iRk51YlV0M1RHWjNhRTV5Y2pOb1JsQnJkeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprYjNkdWJHOWhaQzV0YVdOeWIzTnZablF1WTI5dEpUSm1aRzkzYm14dllXUWxNbVk0SlRKbU5DVXlaa0VsTW1ZNE5FRXpOVUpHTVMxRVFVWkZMVFJCUlRndE9ESkJSaTFCUkRKQlJUSXdRalpDTVRRbE1tWmthWEpsWTNSNFgwcDFiakl3TVRCZmNtVmthWE4wTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVVJwY21WamRGZ3RNVEkyTmpjdFpIQXVaWGhs

http://www.citysafeapplication.com/WVl6OTRQVFpCVjFSTFkwTlROVXBUV21OMVFUTmpVVVJ0V0ZsdVVEWmhOREJqVTBSSlZXSlRiazFRWlRKM2REQWxNMFFtWXoxUFlrWnRiM2xhSlRKR2NVZFpObk5GYWxKMUpUSkdiM2MxV1V3MVFWVXpNbkpKVG1Sd1FXVkVieVV5Um5sTGJYSTBNR0ZJWldsdVpIZ3lRbVJYUVZwSlVWVjFkbUZwUWtNMGJHcHBaMm9sTWtaU1ZtaDJVWEJOT1dsSEpUSkdSalJCYjA5amJuSlhTSE5EZVZSdVYxVTFObkpGTTFjeFlUaHhWemgxU1d4V1dXMXRKVEpHWkZWeWIzQXdXa3B2VVRGUGVFeE9kRU5TVTI5S1ZUbHZaazgzVUhjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRdWJXbGpjbTl6YjJaMExtTnZiU1V5Wm1SdmQyNXNiMkZrSlRKbU9DVXlaalFsTW1aQkpUSm1PRFJCTXpWQ1JqRXRSRUZHUlMwMFFVVTRMVGd5UVVZdFFVUXlRVVV5TUVJMlFqRTBKVEptWkdseVpXTjBlRjlLZFc0eU1ERXdYM0psWkdsemRDNWxlR1VtWkc5M2JteHZZV1JCY3oxRWFYSmxZM1JZTFRFeU5qWTNMV1J3TG1WNFpRPT0=

http://www.laboratorysafehead.com/WVl6OTRQV1lsTWtKV2FXeFZlakZFVm1SVldGUnpKVEpDZURSU05sUmhPV2h1ZWpGSlJuRnVaSEp4YWxKc09WQjJUaVV5Um1zbE0wUW1ZejFEU1ZKdlNFdHVhMVl6VkdSeFdtSTFUVFpGZUZsUFJpVXlRbm95UkRKcVdVTldWemRIUzNaNFFVRkVOR3ROU3pCU1ltOVVUV0l6U25BMGRHOVdOV013WmpKTVYzTlRZVmxOVlVWcWMyZFdlakJUYkdoQlFUbEtUVTEyVm14cU5GQk9kamxZVmpkVVN6SkpZbXBEUmpsSVJHbHNNRlk0V0ZvM01rY2xNa0pwTW1FME5HeE9iMFJSYkV4eFpHRmFRM05ZVTFOU00yNXdaRmRSSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1SdmQyNXNiMkZrTG0xcFkzSnZjMjltZEM1amIyMGxNbVprYjNkdWJHOWhaQ1V5WmpnbE1tWTBKVEptUVNVeVpqZzBRVE0xUWtZeExVUkJSa1V0TkVGRk9DMDRNa0ZHTFVGRU1rRkZNakJDTmtJeE5DVXlabVJwY21WamRIaGZTblZ1TWpBeE1GOXlaV1JwYzNRdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UkdseVpXTjBXQzB4TWpZMk55MWtjQzVsZUdVPQ==

http://www.capitaltoursoftware.com/WVl6OTRQWGRaU1dVbE1rWjJWemM0VWpORk9HSkpiM1ZVT0ZsSlRuWTNNa1pUUkU5dGJWRnplbmw0ZGxKWFdEUkNVU1V6UkNaalBYSkxielJGVjJaVU4wOUZKVEpDSlRKQ1JEVnZNamhUV1c1UVNpVXlRamxvVERGalNtMXZKVEpHUkVjeFMybzRPWEZCVDAxWmQxa3pTRTgzVFRCSWFHWkRTR2MyWkZZbE1rSjNSM296T1VSc2JWaGpWbU5NYlhwbVdUSmxSbUZTT1ZSS1FVWlhOV3hXVFV0blZXWXdabU01Y0dOQk5qSXdXWFYyVUU1NmNHTjRRV2hRUzJVbE1rWkJhbE5VVlVaRVJXazJKVEpHUW01RWRGZEVkV01sTWtKb2RXOGxNa0k1UVNVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aa2IzZHViRzloWkM1dGFXTnliM052Wm5RdVkyOXRKVEptWkc5M2JteHZZV1FsTW1ZNEpUSm1OQ1V5WmtFbE1tWTRORUV6TlVKR01TMUVRVVpGTFRSQlJUZ3RPREpCUmkxQlJESkJSVEl3UWpaQ01UUWxNbVprYVhKbFkzUjRYMHAxYmpJd01UQmZjbVZrYVhOMExtVjRaU1prYjNkdWJHOWhaRUZ6UFVScGNtVmpkRmd0TVRJMk5qY3RaSEF1WlhobA==

http://www.gifttownsign.com/c?x=OoLb/n4ljprBmQSnUF9gveyhN eUX4XkdNk3nYpvFe0=&c=odpWzLlwYrcy5aZIukeUb4EcTJ5/jItY1jcRipf sXkA/3ewF7PJEx3uqaH1c2v4d5/RKkA8I9oTQlrWvokIJvOZvU1aXhxSHvInYLIXSlsOLyYBtd/3uuH8bqI8A5EUQAw2YWooSZ0/RVUYYfHYbOblvzUFVt6wxNBXofgJ0QY=&e=0&fallback_url=http://download.microsoft.com/download/8/4/A/.../directx_Jun2010_redist.exe&downloadAs=DirectX-12667-dp.exe

http://www.citysafeapplication.com/c?x=Goq8RkkGXUciSAnRRCFxAEOjgJMTDSOGtAc6fRosSbY=&c=rfZoJnV4/acthk1KiODwosI3PJuP8acQxTQarZf/yeZqOY2gxVaroL8leqhSX7iYJ1dqsIICM9U1HU2Ibrtp53SsGGb7NQ8sMhOtz5FF5wlUWW592E/oJvxY3xe/r4j5FtnwlRvUiZmoFfcQ9udiQbcDf9rgvfRD5bpCO7eMlUjDNA9rPpsrAVU/dTBLkSfb&e=0&fallback_url=http://download.microsoft.com/download/8/4/A/.../directx_Jun2010_redist.exe&downloadAs=DirectX-12667-dp.exe

http://www.laboratorysafehead.com/WVl6OTRQVkExVVdSQ2JIWk5TVzF1U0VWclpqQnVNbFZQWWpkWVlWVnZieVV5UWtkd2MxZHBVVWR6YURaamIxSXlheVV6UkNaalBVNTFla1ZuTjFOd1NtRnVhRE5vY1ZSdlpUa3hZeVV5UmpNNU9FSXdiRzFHT1c5V1pqUkRlSGszUjBGU1lYQk9TM1oyUzFJelZVWnJlV0o2SlRKR2IweDNTMnB0ZEUwd1YzaFlia2xsTVRSTFF6Y3pTVEF5WnpORlNtSlFVbTkyZWs5MVEyMUJiRk0zYTBNMFMzRkJNMlpwYUhWck0wTklhVmhNU0U1T1EwZENTMDVCT0cwNWNIZ3pkWFZDYUVaWVNqRjJlak5zVjBVeU1HY2xNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1aRzkzYm14dllXUXViV2xqY205emIyWjBMbU52YlNVeVptUnZkMjVzYjJGa0pUSm1PQ1V5WmpRbE1tWkJKVEptT0RSQk16VkNSakV0UkVGR1JTMDBRVVU0TFRneVFVWXRRVVF5UVVVeU1FSTJRakUwSlRKbVpHbHlaV04wZUY5S2RXNHlNREV3WDNKbFpHbHpkQzVsZUdVbVpHOTNibXh2WVdSQmN6MUVhWEpsWTNSWUxURXlOalkzTFdSd0xtVjRaUT09

http://www.appsfunbyte.com/WVl6OTRQVFJWVUhRbE1rWkJZbmh1TlZsRmRsaG5KVEpHV1RKa1FXcE9kVGRvZFZGUlozZHdkbkp3WTAweGNYaFVPSFZ6SlRORUptTTlNREZyZUdreFkwMVlZazlzWmtaaFQyaHRaVEp4YlhaaVJXWnpNbWhPVDBSSmREaHpSVlk1ZGxnbE1rWkVibkZTVGtSdFJXOVRWMDFZZUhwM1IxbDFkRGxMVGtoUE16QWxNa0kzUjNad2FXZGtkR3hzV0dFeE1qZG9VMVJZUkhWVmNXVkxhemxxVkUxVFpYbEtkWFZTSlRKQ01VZG5lVWxYU1V4VFJtTjNjSE5FUmxsME5UQk9SRzEzVDFVME5FUWxNa1pSY0c5a2RUSllNbk5QVjNjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRdWJXbGpjbTl6YjJaMExtTnZiU1V5Wm1SdmQyNXNiMkZrSlRKbU9DVXlaalFsTW1aQkpUSm1PRFJCTXpWQ1JqRXRSRUZHUlMwMFFVVTRMVGd5UVVZdFFVUXlRVVV5TUVJMlFqRTBKVEptWkdseVpXTjBlRjlLZFc0eU1ERXdYM0psWkdsemRDNWxlR1VtWkc5M2JteHZZV1JCY3oxRWFYSmxZM1JZTFRFeU5qWTNMV1J3TG1WNFpRPT0=

http://www.capitaltoursoftware.com/WVl6OTRQVXczVlhVek1UVk1abWR5VjJoek9GQmpkVFpHVWpGbE9HTk5aMDFNU0ZrNFFqQXdKVEpDT0dsdFZYQnJWU1V6UkNaalBYbFlha05SZVZnMVNFRkZNRE5QVkVWUWVUbDJlR2hhSlRKQ1NVWnBKVEpHWVZwaGIwcG5jemx2VjBOcFpUaG5SRUUyTkdoRVNDVXlRbUZDYzJOb1NVTkNlWEZVYmxORlUwOUZTWGRaTWtodWJWcHJjVTh4VEhkYVNGbElkMmxRZDBKMGNYbE9VSGRRVFROemJsSjRhakF5YW1nNU1FTk5kREpKZEZkRVZFeDRkMGxNTjNOQmEwbElNM1YxTUUxQmF6ZFNXV1JGVkhKVmNuUnpaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprYjNkdWJHOWhaQzV0YVdOeWIzTnZablF1WTI5dEpUSm1aRzkzYm14dllXUWxNbVk0SlRKbU5DVXlaa0VsTW1ZNE5FRXpOVUpHTVMxRVFVWkZMVFJCUlRndE9ESkJSaTFCUkRKQlJUSXdRalpDTVRRbE1tWmthWEpsWTNSNFgwcDFiakl3TVRCZmNtVmthWE4wTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVVJwY21WamRGZ3RNVEkyTmpjdFpIQXVaWGhs

http://www.sharetodaysafe.com/WVl6OTRQVzFsVjJoUGRYaDNKVEpDU0VSc1RXVnpSSFZJVW5JM1dWWTNNalpOTmpFd2QyNVJXVTEwTWpsWmNsYzRVU1V6UkNaalBYTlFVbEpIYjJ4clNrbFhNMjFhV0VjMlUyUjNVVU5qU0dnNGFWaDNhMVpISlRKQ00zQTNTa3hLVm5KUlJsWkVaMEY0Y1ZsVVlsVWxNa1kzUW0xSVNITlNWMWsxWjBGMlNqUklNVmQ0TTJGNGQwTTFVRzlKUnpJMFV6UTJKVEpDVW04eU9TVXlSa054TVd4TWFqZGxUVmRqSlRKR04wbHlWVzF6WjJ0S1owNXRORm8yUkZkR01rbGpSREZZTTNwdWNHOXdjWGgxY1NVeVFsTldZM00zVUNVeVFsUkJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtMbTFwWTNKdmMyOW1kQzVqYjIwbE1tWmtiM2R1Ykc5aFpDVXlaamdsTW1ZMEpUSm1RU1V5WmpnMFFUTTFRa1l4TFVSQlJrVXRORUZGT0MwNE1rRkdMVUZFTWtGRk1qQkNOa0l4TkNVeVptUnBjbVZqZEhoZlNuVnVNakF4TUY5eVpXUnBjM1F1WlhobEptUnZkMjVzYjJGa1FYTTlSR2x5WldOMFdDMHhNalkyTnkxa2NDNWxlR1U9

http://www.laboratorysafehead.com/WVl6OTRQV1o2SlRKQ1NqaG1XVlpNTlVvbE1rSTRORVZWZUVodFNqY3lZbk5xZDI1T1VYcFhRM1pXYnpSalUwUkZTMHAzSlRORUptTTlNRE5ETm5ScFlreHplbXA0Ynpsc2QzUmFWMEZDVFZCUVN6Qm5OVzFHWm1wb0pUSkNNaVV5UmxGbE1FZHpWbkZLYW5GdmJERlFNbGxISlRKQ2VYUnNSVVJHZDNReGRUQkJlVzluZHpSWkpUSkdTell3VW5JeGIyVjBVbk5vYjBWb2FHeDZTRmN3U0hKRVYzaDRhbVZYY21KSWFVaG5WRUkyVlVsNlRscEllV1ZUZGtWQlNUSWxNa0pSV21KbU4xWjZWR2R1U2lVeVJtbDBkMGhoVEV3eWNrOVJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtMbTFwWTNKdmMyOW1kQzVqYjIwbE1tWmtiM2R1Ykc5aFpDVXlaamdsTW1ZMEpUSm1RU1V5WmpnMFFUTTFRa1l4TFVSQlJrVXRORUZGT0MwNE1rRkdMVUZFTWtGRk1qQkNOa0l4TkNVeVptUnBjbVZqZEhoZlNuVnVNakF4TUY5eVpXUnBjM1F1WlhobEptUnZkMjVzYjJGa1FYTTlSR2x5WldOMFdDMHhNalkyTnkxa2NDNWxlR1U9

http://www.sharerepositoryhosting.com/WVl6OTRQV1pUVFRWVFdFNU9XamxSYjNSUFFrbHFjRkV6U1U5d2N6TXpRazV0Ym1ORFpGWmpOSEZOVEdwcGFVMGxNMFFtWXowMGFHbHJZV3M0YURaa2NHc3hOMVpsZFhwTE1FbDBNR2xLU25Wd2IzbDJNbWxoWlZRelEzcFBKVEpHTTJscGNrSjRVMHBSVUhOUFVubHJjMlFsTWtKWlF5VXlSbmwxYUV0aGJISk9ZMHgxTXpBbE1rSlVVM0U1WW5reVprSjNKVEpHVGxaYVZHSXlWVWxGYm5Oc2VGSjBNVTlIYlRaeVVtUkhTekZ6TnlVeVFrSTBhbkp4SlRKQ1dqWkpVbkpvTTJKWlYxcGphWGRHVlZKbWRFbHFSMGR2UkdJM1p5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWmtiM2R1Ykc5aFpDNXRhV055YjNOdlpuUXVZMjl0SlRKbVpHOTNibXh2WVdRbE1tWTRKVEptTkNVeVprRWxNbVk0TkVFek5VSkdNUzFFUVVaRkxUUkJSVGd0T0RKQlJpMUJSREpCUlRJd1FqWkNNVFFsTW1aa2FYSmxZM1I0WDBwMWJqSXdNVEJmY21Wa2FYTjBMbVY0WlNaa2IzZHViRzloWkVGelBVUnBjbVZqZEZndE1USTJOamN0WkhBdVpYaGw=

http://www.capitalsoftwaredownload.com/WVl6OTRQWFZsYVd4alFsTjRjMWwyTUhoblVXcEZlU1V5UmxNNEpUSkNabmMwYWtsSlIxUXpjbXc0ZEhKaU9GazNkV3RCSlRORUptTTlVVmRGV1VSS01sZFZOR3BFV0RJME4yMXlZVUozV1RCWWR6Z3dhMHQ2YjNwMWNEZHNaSE5VSlRKQ1FYazJibWwyVG1neVRqZHpaVkpyWVVkMlluSlhkMEZtV21Fd01taFhSVzFGVkhOS2JIZE9SV3RNZVhwYVJ6VlBTekUyTUZKMWVrZzRkak16YkVsRmVqUnVaMnhXYkVsd1UzZFZVbkkyY1VGemNVTWxNa0l6YlZKelIxcEhhbU54V0RORFkxQnNiRVZXZUhCcWVuZFBVU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprYjNkdWJHOWhaQzV0YVdOeWIzTnZablF1WTI5dEpUSm1aRzkzYm14dllXUWxNbVk0SlRKbU5DVXlaa0VsTW1ZNE5FRXpOVUpHTVMxRVFVWkZMVFJCUlRndE9ESkJSaTFCUkRKQlJUSXdRalpDTVRRbE1tWmthWEpsWTNSNFgwcDFiakl3TVRCZmNtVmthWE4wTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVVJwY21WamRGZ3RNVEkyTmpjdFpIQXVaWGhs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to os.solvefile.com (207.189.109.121:80)

TCP (HTTP):

Connects to cdnus.solvefile.com (207.189.109.121:80)

TCP (HTTP):

Connects to cdneu.webfilescdn.com (65.254.40.36:80)

Remove icreinstall_directx-12667-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.