home

setup.exe

Installer

Stepitapp LLC

The application setup.exe by Stepitapp has been detected as adware by 10 anti-malware scanners. The file has been seen being downloaded from nym1.ib.adnxs.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
Stepitapp LLC  (signed and verified)

Product:
Installer

Version:
1.0.0.0

MD5:
43d61962bae6b1ffca6078798b0585e6

SHA-1:
d0c410612239172f8046f33cb878fbeb38bb789a

SHA-256:
06a5c8122bce7d99360f8780e05e346c65b931b32db668d7f450a345b1476cf9

Scanner detections:
10 / 68

Status:
Adware

Explanation:
Part of the Conduit/ClientConnect toolbar/extension distribution.

Analysis date:
4/18/2024 12:54:19 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Dropper-gen [Drp]
2014.9-140702

Fortinet FortiGate
Riskware/Agent
7/2/2014

Kaspersky
not-a-virus:Downloader.Win32.Agent
14.0.0.3621

McAfee
Artemis!8A2ED863690C
5600.7081

Panda Antivirus
Trj/Chgt.A
14.07.02.05

Qihoo 360 Security
HEUR/Malware.QVM03.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.Stepitapp.F
14.7.17.10

Trend Micro House Call
Suspicious_GEN.F47V0620
7.2.183

Vba32 AntiVirus
Downloader.Agent
3.12.26.3

VIPRE Antivirus
Conduit
30816

File size:
395.9 KB (405,424 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013

Original file name:
FinalInstaller.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Stepitapp LLC

Authority:
COMODO CA Limited

Valid from:
12/10/2013 6:00:00 PM

Valid to:
12/11/2014 5:59:59 PM

Subject:
CN=Stepitapp LLC, O=Stepitapp LLC, POBox=1252, STREET=9 W. 31st Street, L=Bayonne, S=New Jersey, PostalCode=07002, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EA7DEF51F4F715C2C81433CCD6B15766

File PE Metadata
Compilation timestamp:
6/29/2014 2:26:25 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:KlW02cC3ibqI59PpOPf201/z7ppmJI9ftR+l7f:KlWt3ibqI59Pk2cb7ppmJ0ftRif

Entry address:
0x610EE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1832

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
380.5 KB (389,632 bytes)

The file setup.exe has been seen being distributed by the following 35 URLs.

http://nym1.ib.adnxs.com/click?MzMzMzMz4z-rHFpkO9_fPwAAAAAAAARAqxxaZDvf3z8zMzMzMzPjP4pmzJ4Iwbk8hems_ZbpMVs2zcVTAAAAAA3pKQCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAAe7QAAgUAAQIAAJAA_iO_fgAAAAA./cnd=!KAeGQgj01IYCENfc1wcY4vsZIAA./referrer=http://wa.bearshare.com/support/password//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CIXTs-3vsvqYWxACGIrNsfaJofDcPCIMNzIuMjA5LjMyLjk5KAEwtpqXngU.&tag=2746637

http://nym1.ib.adnxs.com/click?Qku67mPi_z8QWDm0yHb6PxBYObTIdvo_0k1iEFg5C0BmZmZmZmYQQCpkvEdwi9EtTKuNthEVzE4JMLZTAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAAvasAAgUAAQIAAJIAHSXAwQAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://cdn.sharedaddomain.com/slider_anchored5_300x250_203.htm?cat=103,107,117,213,294&clientId=5eb70247-2374-4b0a-8237-f2acb0da80c3&l=http://www.animefreak.tv/watch/monster-episode-3-online&r=http://www.animefreak.tv/watch/monster-episode-2-online&kw=Monster Episode 3,Monster 3/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMzWtrSbooXmThACGKrI8b2E7uLoLSIOOTYuMjQ4LjIwMy4xMDYoATCJ4NidBQ..&tag=3087481

http://nym1.ib.adnxs.com/click?gcaZHT4o4z-Yd7LzCs3fPwAAAAAAAARAmHey8wrN3z-BxpkdPijjP6y9kOQxnJJKjkaYQU7-MBXL-cZTAAAAAA3pKQCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAA5aYAAgUAAQIAAJAA4CenJAAAAAA./cnd=!KAeGQgj01IYCENfc1wcY4vsZIAA./referrer=http://www.oceandowns.com/events.php/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CI6N4Yzkyb-YFRACGKz7wqSehqfJSiIMMTA4LjguMzIuMTY5KAEwy_ObngU.&tag=2746637

http://downloads.updatesoftnow.com/get/click/.../?uid=<<AFFSUB>>&filename=Setup

http://nym1.ib.adnxs.com/click?MzMzMzMz4z-rHFpkO9_fPzMzMzMzMwNAqxxaZDvf3z8zMzMzMzPjP44l2IFsbYZTJuOUkcev6TFVyb5TAAAAAA3pKQCTBwAAdgIAAAIAAABA7_UA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAAmq8AAgUAAQIAAJAAiSR5xgAAAAA./cnd=!EweyQQj01IYCEMDe1wcY4vsZIAA./referrer=http://www.ebay.com/itm/Other-Makes-aw-special/261526315405?_trksid=p3984.c100018.m2045/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CKbG04z5-Ov0MRACGI7L4I7IrZvDUyIMMTczLjcyLjM5Ljk3KAEw1ZL7nQU.&tag=2746637

http://nym1.ib.adnxs.com/click?hUxE-FWHxz-KOyUBuOHDPwAAAAAAAPA_ijslAbjhwz-FTET4VYfHP_8G0-regsI2NhHI1XDTmCDeHstTAAAAAEOpMAA_AQAAdgIAAAIAAABX7vUApggHAAAAAQBVU0QAVVNEACwB-gAZkwAAhuIAAgUAAQIAAJAAoCXguwAAAAA./cnd=!LwanOgilvJcCENfc1wcYppEcIAA./referrer=www.freesound.org/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CLaioK6N7rTMIBACGP-NzNbu26DhNiINOTguNzcuMTU0LjE1OCgBMN69rJ4F&tag=3189059

http://nym1.ib.adnxs.com/click?ouU1FSxr1T8p51zPRxnSP42XbhKDwOo_Kedcz0cZ0j-i5TUVLGvVP4q-BFrWpzMiVjtZN8QMuH_1IMNTAAAAAFyYMAA_AQAAdgIAAAIAAABX7vUApggHAAAAAQBVU0QAVVNEACwB-gD6lgAAe8cAAgUAAQIAAJIAZyakFQAAAAA./cnd=!WQYHPQjCzJMCENfc1wcYppEcIAE./referrer=www.addictinggames.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CNb25LrDmIPcfxACGIr9ktDl-umZIiINMTA4LjE4LjQ2LjExNSgBMPXBjJ4F&tag=3184732

http://lax1.ib.adnxs.com/click?OiKgQiwE7T-mJg8tYhXoP83MzMzMzAJApiYPLWIV6D86IqBCLATtP7qf60_GZIpLHhkQwKAl93LDhrtTAAAAAA3pKQCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAABOEAAgUAAQIAAJAAoiWudwAAAAA./cnd=!wwa9PAiysIcCENfc1wcY4vsZIAA./referrer=http://witchesofeastend.wikia.com/wiki/Freya_Beauchamp/Season_1/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CJ6ywICMtMn7chACGLq_rv_kmJnFSyIONzQuMTkzLjIyOC4xNDIoATDDje6dBQ..&tag=2746637

http://lax1.ib.adnxs.com/click?gSgJYys70T-8ZSFd4B7NP57vp8ZLN-0_vGUhXeAezT-BKAljKzvRP06B8TeUNqAnteW6yyGdMQw1jspTAAAAADupMAA_AQAAdgIAAAIAAABX7vUApggHAAAAAQBVU0QAVVNEACwB-gCWtAAAzrsAAgUAAQIAAJIAvyURvgAAAAA./cnd=!WQYHPQjCzJMCENfc1wcYppEcIAE./referrer=www.addictinggames.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CLXL692cpOeYDBACGM6Cxr_D0o3QJyINOTkuMTIyLjExMi4zNygBMLWcqp4F&tag=3189051

https://secure-ams.adnxs.com/click?9KX7rSsFoT8EZhwDwxqdPxsv3SQGgbU_BGYcA8ManT_zpfutKwWhP3LfD3wAss8WTDE7lZQPxkoMq9tTAAAAAG2QFABfAAAAdgIAAAIAAABE7_UA2n0DAAAAAQBVU0QAVVNEANgCWgDdXQAAScQAAgUAAQIAAIoAmCMO-wAAAAA./cnd=!JAeBQgiM6fsBEMTe1wcY2vsNIAA./referrer=https://dub124.mail.live.com//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CMzi7KnJ8oPjShACGPK-v-CHwOznFiINODIuMTQuMTM4LjE0NygBMIzW7p4F&tag=1347693

http://ttb.lpcloudsvr401.com/download/request/.../UD79NFnL?__tc=1390024024.01&subid=3175512084&PubID=[VALUE]&tgu_src_lp_domain=www.getsoftdll.com

https://secure-lax.adnxs.com/click?ruxzSE0w3j8AAAAAAADYPwAAAAAAANg_cChTgFlw4j9CMYfzizHnP9fma2UwVpIOwckNeP9SLC7SzdZTAAAAAEwZKgChBgAAdgIAAAIAAABN7vUABIUGAAAAAQBVU0QAVVNEANgCWgC3pQAA-dEAAgUAAQIAAJIAtSLGNAAAAAA./cnd=!GQZTOwjMt5QCEM3c1wcYhIoaIAA./referrer=http://delivery.us.myswitchads.com/adserver/hat.php?instances[0][instance_id]=0&instances[0][zone_id]=5307&instances[0][token]=T_cXtKFkWIlR&l=xGJqhYKemU&bw=728&bh=90&loc=http://general.websteroidsapp.com/.../ad-728-c.html?ac=1001&ccg=3d9136b71f194002b31eab7e86b1a8f0&ns=WBST&pid=66852&ccv=1002006053&hu=http://www.afcgroup.com/&me=NA&cv=71&inc=1&cc=US&load=4&epk=32d31532af6ec59715623548157b9830&as=servenet3&tzo=360&referer=http://general.websteroidsapp.com/.../ad-728-c.html?ac=1001&ccg=3d9136b71f194002b31eab7e86b1a8f0&ns=WBST&pid=66852&ccv=1002006053&hu=http://www.afcgroup.com/&me=NA&cv=71&inc=1&cc=US%

http://nym1.ib.adnxs.com/click?GGsCcI1Cyz_aKYd54AjHPwAAAAAAAPA_2imHeeAIxz8YawJwjULLP0b6EtFOHtwzCWl_FDf8dWJf3cpTAAAAAEOpMAA_AQAAdgIAAAIAAABX7vUApggHAAAAAQBVU0QAVVNEACwB-gAZkwAAZq8AAgUAAQIAAJAA1CFTcQAAAAA./cnd=!WQYHPQjCzJMCENfc1wcYppEcIAE./referrer=www.stpete.org/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CInS_aPxhv-6YhACGMb0y4jtyYfuMyIMNjUuMC4xMjEuMTkwKAEw37qrngU.&tag=3189059

http://nym1.ib.adnxs.com/click?AAAAAAAA8D-QwvUoXI_qP5qZmZmZmQVAkML1KFyP6j8AAAAAAADwPydw6Kv6gOI5YU6jVHLk0WsjerFTAAAAAA3pKQCTBwAAdgIAAAIAAABA7_UA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAAOqgAAgUAAQIAAJAAuCWBeQAAAAA./cnd=!rgbpOwiysIcCEMDe1wcY4vsZIAA./referrer=http://mycompass.com//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1COGcjaWljvnoaxACGKfgod-qn6DxOSINMjA4LjQ1LjIwNC44NSgBMKP0xZ0F&tag=2746637

https://secure-lax.adnxs.com/click?1yK-w7xyoD8zc4ZpJcybP3e-nxov3cQ_M3OGaSXMmz_XIr7DvHKgP7N-vBxPL_xLMfwXI0Ro83Ukv9JTAAAAAGImLgDIAQAAdgIAAAIAAABN7vUAc5kFAAAAAQBVU0QAVVNEANgCWgClXQAAJ90AAgUAAQIAAJIABigK2wAAAAA./cnd=!7QaYQQjQ9JMCEM3c1wcY87IWIAE./referrer=account.suddenlink.net/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CLH435jCiNr5dRACGLP98eXx6Yv-SyIMNzQuMTkyLjgyLjY0KAEwpP7KngU.&tag=3024482

http://nym1.ib.adnxs.com/click?Ohj1nsgE0T_nka3j9sLMP57vp8ZLN-0_55Gt4_bCzD86GPWeyATRP7_hC53EveBewLRX5RfnoBbnkspTAAAAADupMAA_AQAAdgIAAAIAAABX7vUApggHAAAAAQBVU0QAVVNEACwB-gCWtAAAaakAAgUAAQIAAJIAdy7wUQAAAAA./cnd=!WQYHPQjCzJMCENfc1wcYppEcIAE./referrer=www.whistlinggardens.ca/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMDp3qr-4rnQFhACGL_Dr-jJuK_wXiIONzYuMTgwLjIzNy4xMTMoATDnpaqeBQ..&tag=3189051

http://nym1.ib.adnxs.com/click?AyW80dT5A0AUrkfhepQAQIXrUbgehfU_mpmZmZmZAEAAAAAAAAAEQDGQ024krGh3UNJ1w8qNQ0TzwrFTAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAAJaUAAgUAAQIAAJIA0iT8lQAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://cdn.sharedaddomain.com/slider_anchored5_300x250_203.htm?cat=28&clientId=5dd461f7-12be-4491-9428-ced211416f9a&l=http://www.sonesta.com/.../index.cfm?fa=ratespackages.home&src=ppc-google-B-charlottesonesta-Charlotte_Brand-che&gclid=CKq4h-Syor8CFVQiMgodiwwAxw&r=http://www.google.com/aclk?sa=l&ai=C15MpwcKxU6CKPJPNsweN84DIC9783JwFzr-GqniGltHSqgEIABABKAJQ0bKnlfz_____AWDJzqOKpKSYEKAB9Nr87gPIAQGqBCdP0CfYqut3URnZDnvohtPr5CkYgT3LsRIArlSdjokMhrEL6nkOCYCAB_SkgxGQBwE&sig=AOD64_1hYvrpVeAO_H8y7GY2Aff-vN78Jg&rct=j&q=&ved=0CCAQ0Qw&adurl=http://www.sonesta.com/.../index.cfm?fa=ratespackages.home&src=ppc-google-B-charlottesonesta-Charlotte_Brand-che&kw=Sonesta%

http://nym1.ib.adnxs.com/click?9vuPwLGe-z_jBmMirez2P0w3iUFg5fQ_mpmZmZmZAEAAAAAAAAAEQCljkq7c_-QLP14bxkNmA3KDcLFTAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAAqrYAAgUAAQIAAJIAbCaobQAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://.../slider_anchored5_300x250_203.htm?cat=234&clientId=ae2339e1-dbe8-425e-822e-40c941a04b84&l=http://www7.buyerpricer.com/landing.aspx?slk=incredible mail&iscid=20000000&nid=2&cid=3744420842&kwid=20530407352&dmt=e&bmt=bb&dist=s&uq=incredible mail&param1=&param2=&param3=&vx=0&r=http://.../ancbanner_general_728x90_264.htm?cat=234,7870&clientId=ae2339e1-dbe8-425e-822e-40c941a04b84&l=http://installl.com/d/&r=http://www.google.com/uds/afs?q=incredible%20mail&oe=utf8&ie=utf8&adpage=1&adrep=3&type=0&r=s&client=

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CNPklqHHy_C2AxACGIeT5qufxd7zMyIMNTAuMTU0LjM0LjUwKAEw7MXangU.&tag=3198928

https://secure-nym.adnxs.com/click?pycqCNzbiz8hRbrsMJeFPwAAAAAAAPA_IUW67DCXhT-mJyoI3NuLP4eJefUpeuczU7IldFzCbQPsotZTAAAAANDPMAByBwAAdgIAAAIAAABN7vUA2vgGAAAAAQBVU0QAVVNEANgCWgDpUwAAL7EAAgUAAQIAAJIADCaNigAAAAA./cnd=!4gYkPwjCzJMCEM3c1wcY2vEbIAE./referrer=us-mg4.mail.yahoo.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CNPklqHHy_C2AxACGIeT5qufxd7zMyIMNTAuMTU0LjM0LjUwKAEw7MXangU.&tag=3198928

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CPD6tK7-yYCjBxACGKqfpJDw39XhEyILMi45OS4xMDYuODEoATCLrrWeBQ..&tag=2757877

https://secure-ams.adnxs.com/click?CeyZhvpC0D9CYOXQItvJP0Jg5dAi28k_T55ow3Q01D_0Kr_tO2rZP6oPCQL_VsMTcD3N5U8CRgcLV81TAAAAAPUUKgChBgAAdgIAAAIAAABX7vUABIUGAAAAAQBVU0QAVVNEACwB-gCjgwAAtNkAAgUAAQIAAJIATChJCwAAAAA./cnd=!RwbTPQjwt5QCENfc1wcYhIoaIAA./referrer=http://delivery.us.myswitchads.com/adserver/hat.php?instances[0][instance_id]=0&instances[0][zone_id]=5569&instances[0][token]=T_X8oRnIsaYg&l=1AGq0fTB3T&bw=300&bh=250&loc=http://general.websteroidsapp.com/.../ad-300-c.html?ccg=5ba947240cd14adb9100ad3cf2226388&ccv=1002006049&pid=66912&hu=http://www.aol.co.uk/&ns=WBST&me=NA&cv=70&cc=GB&inc=1&epk=2ea5b261f06ca771033a5fa9e22493f1&tzo=720&referer=http://general.websteroidsapp.com/.../ad-300-c.html?ccg=5ba947240cd14adb9100ad3cf2226388&ccv=1002006049&pid=66912%

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CL75ndn9zMyxEBACGOqy5fCfxoixHSINNjUuMTI5LjIzNS45MygBMM_H5Z0F&tag=3087481

http://nym1.ib.adnxs.com/click?LJJE89vi-j_iOzHrxVD2P-I7MevFUPY_2sO_VhqX_j9uz-sniG0CQGpZGf4xImIdvnwn22cyYxDPY7lTAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAAlbMAAgUAAQIAAJIAjyn3mgAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://cdn.sharedaddomain.com/slider_anchored5_300x250_203.htm?cat=99&clientId=5127a93b-0f07-4456-a5aa-ded643b8da98&l=http://www.trackfiledownload.com/lp/java2/index.html?ref=cpxi2&site_id=170839&CLICK_ID=nym1CL75ndn9zMyxEBACGImr2uvkjeipICINNjUuMTI5LjIzNS45MygBML_H5Z0F&r=http://cdn.sharedaddomain.com/slider_anchored_300x250_284.htm?cat=21,117&clientId=5127a93b-0f07-4456-a5aa-ded643b8da98&l=http://www.poptropica.com/base.php&r=http://www.poptropica.com//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CL75ndn9zMyxEBACGOqy5fCfxoixHSI

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CJeZkrr84YKmWBACGIKV4LHvv_fhECIOOTYuMjUwLjEwNS4yMjAoATC8kdmdBQ..&tag=2746637

http://nym1.ib.adnxs.com/click?-vfSFkVwBkA5tMh2vp8CQDm0yHa-nwJAIkR4AYFjA0CzsRsOIFwHQIIKOPb-3cMQl4xExw8LTFi8SLZTAAAAAA3pKQCTBwAAdgIAAAIAAABDpvoA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAAGsgAAgUAAQIAAJAAviSdeAAAAAA./cnd=!xAZCPQj1hYECEMPM6gcY4vsZIAA./referrer=http://www.doitinhebrew.com/Translate/default.aspx?kb=IL Hebrew Phonetic/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CJeZkrr84YKmWBACGIKV4LHvv_fhECIOOTYuMjUwLjEwNS4yMjAoATC8kdmdBQ..&tag=2746637

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMSwq_L4iJHvNRACGKOSqYmP-oTcNiINMTkyLjE5OC41OS4yMigBMKbMvJ4F&tag=3198953

http://nym1.ib.adnxs.com/click?EEdPS1Rf1j8T18MgrlbRPwrXo3A9Cu8_E9fDIK5W0T8QR09LVF_WPyNJKvHQE7g2RNhKjkdE3jUmJs9TAAAAAOnPMAByBwAAdgIAAAIAAABN7vUA2vgGAAAAAQBVU0QAVVNEANgCWgAG1AAAU68AAgUAAQIAAJIAXiWphwAAAAA./cnd=!EAfsQQj_uJkCEM3c1wcY2vEbIAA./referrer=www.youtube.com/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMSwq_L4iJHvNRACGKOSqYmP-oTcNiINMTkyLjE5OC41OS4yMigBMKbMvJ4F&tag=3198953

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CM3BvPD82NfEYhACGIXNp5v1gp-7QCILNzMuNTIuNjcuODIoATC_-LKeBQ..&tag=3189059

http://nym1.ib.adnxs.com/click?iFhFn7-7zD8WzE2Fm0fIP-kmMQisHO4_FsxNhZtHyD-IWEWfv7vMP4XmaVMXfHZAzSAPzsdeiWI_vMxTAAAAAEOpMAA_AQAAdgIAAAIAAABX7vUApggHAAAAAQBVU0QAVVNEACwB-gC3xgAA5qsAAgUAAQIAAJIA3ScFiQAAAAA./cnd=!WQYHPQjCzJMCENfc1wcYppEcIAE./referrer=bingapps.net/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CM3BvPD82NfEYhACGIXNp5v1gp-7QCILNzMuNTIuNjcuODIoATC_-LKeBQ..&tag=3189059

Latest 30 of 35 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.