home

icaredrs.exe

iCare Data Recovery

iCare Software

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
iCare Software

Product:
iCare Data Recovery

Description:
iCare Data Recovery Setup

Version:
5.1

MD5:
5c6966aa542708d4743990b00b7166bd

SHA-1:
0d922bd952311ac1a7109191201fd3741297cdc3

SHA-256:
20f0f74dca8e016c7c2b2d6cf6af0e545d071cb44041e5219300d93ccacc80e7

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 9:21:53 PM UTC  (today)

File size:
3.5 MB (3,680,866 bytes)

Product version:
5.1

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\icaredrs.exe

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:Ws9bUaonz/VLsZCzpyv524bBVofJX6dFpToLR:59b3on7VLsgyFeJqd3U

Entry address:
0x9B60

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 66, 95, FF, FF, E8, 6D, A7, FF, FF, E8, 98, C9, FF, FF, E8, DF, C9, FF, FF, E8, 0E, F3, FF, FF, E8, 75, F4, FF, FF, 33, C0, 55, 68, 17, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, E0, A1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 9B, FE, FF, FF, E8, 02, FA, FF, FF, 8D, 55, F0, 33, C0, E8, C8, CF, FF, FF, 8B, 55, F0, B8, F0, CD, 40, 00, E8, 17, 96, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, F0, CD, 40, 00, B2, 01, B8...
 
[+]

Entropy:
7.9979

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icaredrs.exe has been seen being distributed by the following 25 URLs.

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1457325865&Signature=CBEAVLXM-zN6pobL~ouZEYi09Ng0l4mMP3B2Ig39nx9wnoVVhXpI9qZZ18McqIvrWa9DfrQ6QmBaFz5uVTap-qg7jH9-RUJ80hyRW-O-vBAvdhua1XqUhU-Ad1F7HjHvnnen~cifrINHcq1Yqse5fglPSdPAX8-LMkfbf9fMmHQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1478214038&Signature=GkWASooffYuEcuNLgN~jjl1R~DBlLu471r68suQhIaDsaOtPMHildFVLMnOYPEAkKbPb4Ksi9oAOnt~4SkrBeUqagwLrUpHJhJKKv6KvXk8iresvxXU5nHtQwijg91vo4XHjfLMpg3NAPX11XTNXl4Bqb3I7I6~il4KQvmL~EKE_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://icare-data-recovery-software.software.informer.com/.../

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1443562670&Signature=QDDZysKmy98MAdGW3v6mO9bTo-BIy1ZmOOA~bpKd~1aa0fZplfCu2idWRyvP3WxuoGrtB7FVJoTkBF3LIcn4~tEkuTWft~H-hd-BzvSFGZhIJrpKUID4PAobwoXN8mYAVQzlQJPCIEdwxTv7Tp8b~dWDyXJI9ClOsa4yaqRrXOw_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1477938676&Signature=ZAZzwrHpAA2pitty~GNv62bzjxp3MZZg-j0LOs3C9CTqf699M3cAcBf-t6TSAJ9X~PI38QqC-em1glnhjYsXm1yNFHC4MTpmeMs2gvdIou5vyJO2C9s3ehBvkzOdJqPbDTuuLYG3P8mtcJJCNlg9uBxu0MHae1tSBIC~1Z7shdc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1478279026&Signature=K-LGuzTJcziE3lDLkndDsiNFKSRHkJJd9I1tEKkD8h24Y9HVa4w8KiOlLwHenD1J78FCVD-wjavzqOtIep3iYLZw17OCX3YpDBN~vtlm~U3YY48ZXK8BXGqQHCN0hdS7BLeb3xUWY5b8rbzjZqGmO4CtK7UlAS7TLUwMTiQHm1o_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1436300939&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=YSr~RdAfBcM2mpA~q2w2RXkec5aeBr1gQgMpcsvhvC4ukcpU147aNtVP9LZcpBhDYeAhQgmx50uZBddeqVf2CsOPKJMRfUDnqqbNAcBD05CN4eTLjNX5HPa5MGhLK0i2kC8Sm8svZll3HX1ka9XqMUuHfY2-x-gIJ7v0Hc40WeM_&filename=icare-standard.exe

http://download668.mediafire.com/yhhpl0dfbxig/.../icare-standard.exe

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1467175736&Signature=GHY9hCHUKkaJQdzJSDQdHuqGr2D6NPLo5EgbU3a3ncJl9P43go9YJJKyz0Rch2ipw0f0xgqaiDl8XDBGb65v7rj4QHCexRpG83rjEnfaL-UjIloxbZYW65aDo~FwnbdMqL1mHitAitf-va7526rEpZYvb9due-TcSB0nOOm49~g_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1466305957&Signature=OuuEnVdq4sqKNP~XBuvGlDKy7q8vqKDLWUVI3aFwCA4rPbAyoriqUN8xsDQP5VUYRQzErQM1wEyg7EGZEhdRtm7Y1dQxuT-CdIHN2LhEVhJwkEPd1K0dEC~ufM~p99WfcKN2-Lgji4c2x4IazJKU7lqkBTkbDXDsljg3n4AQkQ0_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1443428402&Signature=GfihzEIum8HzjbexoYByA7sR1uqCclSGnggo9HAc7LNkhRyBsO1SZDesICptnc366viK3Ix9ncg907Ee4DxxPrDqDG6WNXOPjei0cRP-jSP81PTr5nQ~bJZL5bAwRibDafOl8rgVrudxJ7Ka855qCSkmoVYhPhaoMnK~t2I6Qyg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

&onid=2248&oid=3001-2248_4-75059380&rsid=cbsidownloadcomsite&sl=en&sc=us&topicguid=utilities/file-management&topicbrcrm=&pid=13752039&mfgid=10062624&merid=10062624&ctype=dm&cval=NONE&devicetype=desktop&pguid=bb025e0d173fd3517a760360&viewguid=Xm8KuEpagJuOtCDknZTbKe2TfyWCKmknnG1L&destUrl=http://software-files-a.cnet.com/s/software/13/75/20/.../icare-standard.exe

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1464526303&Signature=CikFJii6v7UzbvsELCLnU5G7W1rWikAYi6SSncRlZi-JC2yS0yUuk1XmLr6uvXBhq7Ldh-COrWl516AiruyQcFO4BpIKRXe8dk5JSkC72BuiPP3K5yvXXWj0on3L5egrx-CLn7va2AI4NJz4OQHQ3o52gB7HlYEKh6cxaDucIEQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1463263865&Signature=SdtBAyXUXDgGGQyn1v0CoEEthwn3oRyGsCcSweHvBtT6WCNVVplIpdBeeYcCq~AaGvKO~EfOby5EB151HvZpzYqVRr9LOCUPAp~0pB1Wssoas115kQkdA8w1ZEslPXLMOqSup5~u~SnJBJlJrozkIHzS6Kh8q25GPRQZ-2clco4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1446178769&Signature=NH5vKaG4~YAGyVTrL~Wli5AgNuULWHH3kQQLrhAwE75FUTJfhRdbcurzk8XfNd~MXamPHl9HIooKESfG~WcAGn~7b7XMrYzqx1EbJ5MMrPFJ~c~AgjSfiUyzJgcITP~m-OTAu4NcO6y5WRn68kOxRB66CSVS0-FRode-YdUbydY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://icare-data-recovery-software.en.softonic.com/download-tracker?th=1/.../GSJOKqz7EHRJl92GMeAhlDeSs=

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1458007657&Signature=QJAMYjFHJKxJSbzHgqYEzg86PEJlGDPo3nk43Jns0QVQah0ib5OfJbH3CUlrgpBVE9dPeruHOBgllF4dezuSWmqQksHkfnJ5uXByJL7T~kjq582jSygUUgWMwVKWpKkp1iPEuBo~fLS5GxfRsjmUOD81I2GpSpGdczh-nF0xrQQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://gsf-cf.softonic.com/0d9/22b/.../file?SD_used=0&channel=WEB&fdh=no&id_file=99762&instance=softonic_en&type=PROGRAM&Expires=1444326370&Signature=TZ9bQJzysX4mLvDYACQatcsdB-bwA5D2IVsNzJlJgqJplOx0LfPxuUe1dDpUB8kxGLtNOhBemkTIsra5mOG~vywLraBfHMGU9fqE5J7xd0vI2wIe6Pn0viM9khLca~9kYb-v~a0jFx3j~SYujoozB3p0rqkBpfD2SOuFqnFUpBs_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=icare-standard.exe

http://download.icare-recovery.com/icare-standard.exe

http://software-files-a.cnet.com/s/software/13/75/20/.../icare-standard.exe

http://www.icare-recovery.com/icaredrs.exe

&onid=2248&oid=3001-2248_4-75059380&rsid=cbsidownloadcomsite&sl=en&sc=us&pdguid=download:13752039&topicguid=utilities/file-management&topicbrcrm=windows software&pid=13752039&mfgid=10062624&merid=10062624&ctype=dm&cval=NONE&devicetype=desktop&pguid=5516c9880b2fd52bfe407cd0&viewguid=QpOgI5j-f7LzhgOtqfXO8zVQHV2RQ47tY4qh&destUrl=http://software-files-a.cnet.com/s/software/13/75/20/.../icare-standard.exe

http://download.icare-recovery.com/formatsetup.exe

http://www.rawfilesystem.com/data-recovery.exe

http://download.icare-recovery.com-go.biz/icaredrs.exe

Scan icaredrs.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.