home

icreinstall_installer_microsoft_powerpoint_sciagnij.exe

Prog

Dove Max (Fried Cookie Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_installer_microsoft_powerpoint_sciagnij.exe, “Prog Setup ” by Dove Max (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Soft web   (signed by Dove Max (Fried Cookie Ltd.))

Product:
Prog

Description:
Prog Setup

Version:
2.4.1.3

MD5:
e6ab2e5fa2845764565acb8751da1682

SHA-1:
e98ace0722c78cc518fdfcc53751978fa2170e5b

SHA-256:
0ccd67566b5160cfb14dd4fa102dd57258878b532788fd8c852305a593f113d2

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/23/2024 3:30:27 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.8.6

File size:
912.8 KB (934,704 bytes)

Product version:
3.2

Copyright:
Internet Generic

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_installer_microsoft_powerpoint_sciagnij.exe

Digital Signature
Signed by:
Dove Max (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:33:00 PM

Valid to:
7/24/2016 4:27:26 PM

Subject:
CN=Dove Max (Fried Cookie Ltd.), O=Dove Max (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121CE9583D2CC8D85A6A453411F33888A7F

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:QH1Cc40vhBQ0MWzwHC8y8U9hh2t0E+F0+W6a8rM6c:QVCP0JB4KHzh2tD+F0+WF51

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_installer_microsoft_powerpoint_sciagnij.exe has been seen being distributed by the following 28 URLs.

http://www.vaultbulkbits.com/c?x=KP3we3L2EnTMol8TrHBm8JheZOU1DDaEoKJan9QsP8E=&c=BjsmfA3H5cVnOpDGbXi1jm1aSn/kelQK8ExOWXcVuDw8iMN525I89F3JfuODs1Wp kxrCsD7dwCp8ockVnTqXZqxy5v3TEM0mRI/A1fhZ/J6n1/iZs3GtMOq/TUotG94&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.signsbodydownloads.com/c?x=lWdwtggX2xrCcNbE cQTJnt59ERAAWTbOPXRSoH88YQ=&c=UXbCggckxd/bXWK3FaENH3K8SiV3kXtU4qvWmQdBsVKr96I9ZwRLlgJY6r4ZiOs6p4tlF/1855g48L9d7eWc9rM DIMQ9NS2lEqewZnzJqSuVZLMUiaF4OQEXpSTeFB0&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.towerbundlesafe.com/c?x=w8FVBvLkUlDT9urZfYKjyZVCqXzCn/jCtWDC2IHGhPk=&c=CfL8IsseTTG1C0cKxH9YjyPy/7/dYpLZhfZrhHjwpK yyRsI3ntDDYy/qKgNH5oH JQGZUToRaoPXTpdNDOu5lVmhD8KEEYKV1MDZbsqJRmlN23X VIRpAe0mEsWaFkH&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.bodyhostingtour.com/c?x=sJQUVh98 YCsOssaWZ5RmYo N5P9lB3xTwgoPBDcBJk=&c=2Pk9L4dMDabr0cyJdoE7ek2LVLK6Qz TAfsvHQzR7rKPbd4hYh6KUQYR5mX8dL3eazBrp2SFhXSeR4bR1SsIdXNYvvicboqI6gaHgS2G3cD4jeCc6hLEoQNtSrL6wXLlFfVWpiITW25m6aH2jsI0LA==&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.repositorychuckleflash.com/c?x=MUpDozJmtiarKYOqV/vVTQ4jh2LXKDi4DJMguo5rXrY=&c=ZgLVjLHMJ3vLkpjag70NjworlBEBdAO3YUGe7IIUj7a/CymmmfUpeXaUW8bSFMcPyFwkmdt4xoGrr0qVjOBkcB2hmp9KBckEivDUtcpWyuKLJaz/rO8t2DQYmOk6bCKP&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.tagcitytag.com/c?x=uJsNzojko4 O8EHlvZWS9NtEzkg/UHKgh9kpv4ctjdY=&c=dznOtEvrsvt3nWg6nSFM5Y9040soSRfRx tCYGTiYQBFMTM1CkkmnFiLn/hSVyL7HDfsb5d VkQcc3dfu0wXndlG0yJKbWh0V0C4F6l4VlS82nYw03J4j4d0AemNdCp85SboeblbcG1tT98MTmigYA==&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.currentcontentconecpt.com/c?x=Kk4Nl9KqJn3YwNpkT0MAvQo1MdCP0ln0Nw4E0b3cr1c=&c=g9lM13Cp7NloNZA60em38jmvzmxVeJw1IWJtN1t KaILBkUTwkDhQRKkq7eOBCky eRTDljgo9EeSBwepe7kCzjK7QaKQwGU3Zi/ZB0FrXAFatTpDw4IZlQW7cOznwtwcYw1PREPzCCankcf19vy0AHd6tPEEdUPV y3yFgtr28=&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.signfilesmega.com/c?x=Q0WJ8TiqpxuYHDSmnst10P66GUAsHThQEORS8rn09jM=&c=R1LnoJ5B7tU/vu OSbRtmgAK R075sZX5zMKbiS4u5rDLfIwXCfcTfySKBJb03aQE/jf9F2iLNRrJwIxdPyAdKS/RXeuRuk31vJJzmv1b9sIQcZRoa7DJWr9TwW8VU8i&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.signscurrentfactory.com/c?x=E6pP5vF0SM/zpZ DgmemIjBuCf74GEMPrQOI7vaJ9OE=&c=UUp6viM2Pr8mL3Sy2epWX/UH7RJPxEBWZTckjlTpJyeN8Xnmg4EtrwLsaH3jckCsS3LoG2aDo3EIMFVQevErapeVOx4dD XzZ/sD0tu6qApuHDlBfqW0qUm/zVh4tqCK&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.centertodaytower.com/c?x=aUD/Utrn5qM1JLkXZ0aD6A IRyxsK6iMq6ser71N4XI=&c=Gtq6lxhJGq/buov4sZj/9Ha1RsbhgoeqNUrd3LaPIZZe3mTefBUPE0FtcI4SMrDa9gJHFlonDWquZVjktq0CZI8 qiHAZHhFac3zuSl18Sa2NwAGEpZH4YFnYa5xbXP1&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.laboratorypresentcycle.com/c?x=hkmavYKTrk7jo39LjZkAR0RZH4Y5ZOKqNHKpLOpKctw=&c=8 lnw5GXqczkQ3pFVAumcw0ToXwhzOT0trrGaOyPkWG3QPsPvXFLgSNsBRpQJPm5EgBNXvsSl6EY/orplEaCyr4TrbuD9W30lXq7VIsoBZikMLFMj/FRmeu6QsDxlZon&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.signfilesmega.com/c?x=k5C/WYBSNX3VV0Ahy/f14ALBkeMFeswD3XWCmH/QqGQ=&c=V1Z9ISjlIlcJp39KDsrWiurkLLpIyLx9qU LDC8zwiopR LvTWbkkGZVFiU8pQe7zAH50uxeHvEdlqXRS7JNEG1 FxBqiwck7h1RqCH2TX2p4Ra/Bkybde 3csF3Ezy3&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.signsclearcenter.com/c?x=IgjR3UGznPkbit6rTfXzKGfnfuzvazCGQJReAGXA9Fc=&c=h8tmdcRoMWrRtdnMYJbjxax4VPoPvOOttDK9dD6ENQwJnMDkOM cns9/kU1Fdh58ejdUCBaLpGnMw5HT biEiQFG44epDz1CJ6u2ZvnvaPdHEhdm27RGhcN14gFESygrAwUKSyzFka5HsUodHuOG4w==&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.contentbulkfarm.com/c?x=bW5LjUYDu64lbaOdPhqCN9/4oAxX3loPZett6ZBswUU=&c=aYafqb6WFz/GiQs41Db25NIOgSl0zOXAes7ObQoV2fQfvNEgjBXGyHCVnp UpNGe5sjcC18qXvt0Mf7oJYVcW3B7WKV bM8YoJzbgcAYwCIDmC5opWP D7jPuvI6GQ7C&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.binariescentralclean.com/c?x=VglsaYXG7rn6Jcfl2XyE1sTBDqszk7EBhpXkdbYdwiQ=&c=ExzihZxXuHJ/VQxnVehTFug6CNu R5wQdC14YrQydBv8MN1NCf 1T0Q7UmyqE8NvXmS9CTkWzkj3dSKKvfCJKLzW2tqkchEAt OD IumZ8xXUoPiP/uMrDDGC/cr60Qe&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.clearcapitalhosting.com/c?x=4HxG2kUMt8Rr96QHr86CsvWEH34HEA7K9ZIowZe9k3M=&c=OJ5wHh1DIoXVOuMJeecxq9ptR8rQzVh/5P9fo6uscvAv50z1dsCDiwGFUbL iI8Om4 VTQzOiqCkDX PMUpeY3M4cfJ97UFWgK3d9BfJuShBfajQPrAIRN9bzUYdYYt0&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.bodychucklecycle.com/c?x=BGhPvaRQAwDC32nPgZ1xQx0t3W5oox3lAS8OqrCTP20=&c=4lYkErfA4NqZoCVQJ9rxto7/kc24bBuZ3XjhCTRPaYrY5krdaDG/l8a3I2tS8oJJDXn/QRRQ7BhqNJ8FW3q 5mfJgTQ0Pz2XPI3Y dMP74xxEYqn4C4HtSPbZh5D4R3Y&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.capitalbestclean.com/c?x=qZqreSE42zab6dMRsXjfJUS6j0j3inEABMNuNFdWSSQ=&c=MHENGy71KyJ0hn2kEdkyZsbIF2IPX48BV0RPq31CqDLv4lbOi6oattI2ejP9nJjhWnP6JZcYnUupWGsnovxNiCxDNf5afMQgTdXW Cosu7C4AlHUump8vAGPzo4pjpzW&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.clearcapitalhosting.com/c?x=YpWVTw0ctosROhxMpmoH5ajfeJuZI4pjZ09U9i0p0o8=&c=msZFGQSy/cn/aPBMGlJWzpVf0DMzpcxc7UEdEFBHTmpIf3jhuHYoo dpkzaznaoAR xa0T6oXhkOAn8oFTc91foX79P2P OgF2jbCxXuQdjnF8wzg7SySSs5g3aCR3lo&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.appclearfiles.com/c?x=TY2DorIIITyclnOv65A7xcSVuOZb5mGWWSHugQtTSaw=&c=HL6k41cyObxMqjXEW8v7tdhbILMg EfxgFc4LTj62v2bRR7ZAIc3WBpc1YL4PoPfEBe3gQTkuxZbvRk0mroBtG14SMemFVD84FpaoWipd23VwveRDOwbChQRVLZcJ8TK&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.conecptbundlesranch.com/c?x=iotNyi2paj0K4/ehVq3LCaQUTqCi3H1W126OX4UHaic=&c=9iZvTqPmNz2x3bn12ZFDHBzwjo4 K04h/A0rS92jvG5SLpxG8bYSx9n0jO4J07YurprxdSgCbJr50FJnsUavsQWhKiRwHbddRkuVKk CaJwaSDVdiVUTQGNosRJGIQ25&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.signsclearcenter.com/c?x=Q8dmgrs3FwmphVaeC5rEGONlAtrMl0HdiKoVhvid/o8=&c=feExFqwNMlLWkNy/oawxeLzLBGsLGoc9OSWjnnVQJ6GvwJa087IbSgV2bym8LLS5uudUVp9SprEYoK01xvSy7fC/33wbJQf4rCjqrxABanzY 8weRqQ8 9wvES9jkKixiVwr5va7DJj/ FwVnSE4Nw==&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.updateconceptsapplication.com/c?x=XtwltLE7Ph0oM9D5eK2K2fGr/U1rboLhCXzeNot9dLU=&c=xtez04M6wCt19uYTq/tURdrRIMO1qgO9PK9pWFyc4TezFT7EY9zeVsLOLU8/tYIvTgQISusmFfGrpWneRqv6AKaiW/XLcegA843HW4DKDzimfq6iUbjswmfvF3OV5wZp&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.signsbodydownloads.com/c?x=b/EXGZTYdRfV47nnHdcuSUg3LfvkGAYsEoRYd3eb8Ew=&c=nNLZE6f/ SlUYmIGiuKBDWMRXIaBgKKxX/4 qoYRoZCIpjKkgWOFJjpwRJWOiOMYhrW8m84pBhZFxCcDpHWPjVNAygMLeCDkLvHAxJ02DQLmall/fwtqFdaBqpe0gx/U&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.conecptbitsbundle.com/c?x=J/WnSHaGEnd59m1G/T8F73y8vvYDsTJkGkabobMDBoI=&c=nSD24tbFs8c4ymNjLe99duLY2SQDiXg09JIuUpNFEm/p6Ol/CIzN26AnhxUYmfMfqEp9QNGS6KfZ GWR4uXDzyPQi1Or/tilxk/11xLy0InPbR5Vzittu40xAw1rZ41O&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.signfilesmega.com/c?x=oXGvy9VzCh90u7x9Wl2nffvPlj/pZg8ac/HlK 0AUC4=&c=VsOYwMnAmZLEIbO/7moOFAgBbA8z0CFu609vBMfxZOwiBOP10w9HPXLer4Abzsi2eqOwLQ6ymAdzc1/RK1CuZPnbRzBlugNJRNti1aTBRI6N0U bdvxGn8njNWKw4bwV&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.newtowerpackage.com/c?x=rBBfIz8awWy55TKtzsZi37D3Dg uJMH TJaXdCbvwrw=&c=vH3p08vgc9ECMEv7Yicz2t7fGy0VyUgjFWaXt7j8jESEj zllx LscikL5HtmEDSwfOrJy06aAhfYq1d6pezw/DM37hJXHJ SgntQnzr5SSsb97MInGwjXUz6YNxI76v&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

http://www.contentchucklehead.com/c?x=dHPzSP5/L0HboOSu5QpWlnXyTOF x/0FcHcdlgToqGg=&c=21SgiieyAH1lvmtl13Ybghq yB6ozGUeF3bFoIbE2ItKD7RooP/3WrHYX90SCA/quxO56Eui6D93FRXG9YvzOn qUvsUW8fZblr8B2wyeQ5YAU6mREJhQQ3IsgQIFUv0ixQFinX0/vOzAXgAMoFE1ODz2mh7gVCndiq wN6i8vk=&fallback_url=http://office.microsoft.com/pl-pl/.../bezpatna-wersja-probna-produkty-microsoft-office-i-office-365-FX102858196.aspx&downloadAs=installer_Microsoft_PowerPoint_sciagnij.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.