home

aimp-12499-dp.exe

Kisi

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application aimp-12499-dp.exe, “Kisi Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Sacip   (signed by Mode Beta (Fried Cookie Ltd))

Product:
Kisi

Description:
Kisi Setup

Version:
3.2.2.4

MD5:
7fee2dd55aff9222d35ef8ba5e100bfe

SHA-1:
811a00499e6e4af2c44f89d3587e14134923dede

SHA-256:
ca3a00cc8fdef41bd842d62281c2ad11ba233e9ae3dced8e4902a22bd1127b03

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 3:33:30 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.21.22

File size:
952.6 KB (975,504 bytes)

Product version:
4.4.2

Copyright:
File Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\aimp-12499-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:pjJz9OiMv1hlYlmHZRY5L5H/9x7NJXH6:plZMb/5RYRV9h36

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file aimp-12499-dp.exe has been seen being distributed by the following 13 URLs.

http://www.gifttownsign.com/WVl6OTRQVlpPUjFBbE1rWk5WRnBCZW1kaVV5VXlRa2RzZGtGdlYwdElZMUpYT0RocE9FOUJPRmh1UldvbE1rWXdkbmgwUkdzbE0wUW1ZejB6VlhwV1lVeHRVbTB5V25RNGFXNUJiM2RhVW1KWGRXbHNaM041UmxGNE1rRjBVbWROYlRBMWNXMVlOa0oyYkU1elZtMW9TR05XZDBKRFpEbDZiRzVHYkVsalVXdE1UbWxRYUdrelN6Tk1ZVTlKYURJMFNWY2xNa1pyVGxCTFlWZE1NMDlJZVRCRFRXRjRObTVyYzFsdmRFZFBhMlZZWkVOQ2FVWlpOSFUyU0dFek5sbGxlV1ZUZEcxamVEazVkMWh5ZUdsaE5UUm1aeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVpoYVcxd0xuTjFKVEptYzNSdmNtRm5aU1V5WmpoaE5UQmhNR05oTWpjek16QmtZak5sWXpFell6azBPREl6WXpFMk9XTmxKVEptWVdsdGNGODBMakF5TGpFM01URXVaWGhsSm1SdmQyNXNiMkZrUVhNOVFVbE5VQzB4TWpRNU9TMWtjQzVsZUdVPQ==

http://www.farmtowntowers.com/c?x=Al9qXGsp2u tYhzkfFOAtWQtQfYPczAtD3vDK9qHEto=&c=Su0CUE7suDukOkyGjoPh4U8yOMJ 0qpnMq6oRbb6nnUQD9QWf6XnvxhTOqjDV2HP0gx4M6aQobgUOuG3pyqc7xjEfA43vz4QjQPCkPT6zeNWF PiQiPvSwBvnh/OgE2O5SVaYDY5ZXoF1pUj xCIFXcaeAVfp400mmP00Vt1zK8scu65TPJUb8lgGoDHR7IW&e=0&fallback_url=http://aimp.su/storage/.../aimp_4.02.1711.exe&downloadAs=AIMP-12499-dp.exe

http://www.sharerepositoryhosting.com/WVl6OTRQVFUzWmtkTk1VdDNXRVZ4YjBSS1NscGxjMkZDZWt0NU1WRTRRbmhEYm5aQldVeHZUV1pHVFNVeVFqaFdUU1V6UkNaalBWVTBWRGcwUzA1d2VFSjJkelJOUzBOMU5HYzRUa2hSUkVKdldWTkVaMmd4ZVZKcVMxbFFlR0lsTWtacGJFbG9Za2RJTW5ZNFZHVk5kbE1sTWtZeE5VVjNjRkpVY1ROYWEwSjZaVXRFUlhWbVRURlJVV3RDUWsxV1QzRkZWMWRZTm1vMVUweGpZMDFhYTJKelNrMXZkM1UzYkU1Qk4wMXNNMVk0UmtRd0pUSkNVVmhqTjFkMU1rdDVTMVJuTlZGMFVEaHlNV0l3T0hvd2FFMDBRU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVpoYVcxd0xuTjFKVEptYzNSdmNtRm5aU1V5WmpoaE5UQmhNR05oTWpjek16QmtZak5sWXpFell6azBPREl6WXpFMk9XTmxKVEptWVdsdGNGODBMakF5TGpFM01URXVaWGhsSm1SdmQyNXNiMkZrUVhNOVFVbE5VQzB4TWpRNU9TMWtjQzVsZUdVPQ==

http://www.farmtowntowers.com/WVl6OTRQV0UxVFU5WlYyUjVNM1JvTmpObFNqSk5hVVZxUldoRmVFVmthbTlpUTBWclIzUmtSazh4UVdKdmRVVWxNMFFtWXoxdFZWSm5WRkk0YmxSTVl5VXlRbGxOY2xwa1RTVXlSbmxsZEd0SGRtTXhaa0l3YXpKbmQxUTFWWE5HVlcxWWJVTmtaVnBXZFZORWVUWmpPVGRLTldWRlQyUnVXVTFHWTBOR1EyRXpTamRaVDNVeFVHWmxWMVZUTlc5Q2JWWlROSE1sTWtZeloyTnpTRWxzVGxWQlJXdE1kVTkyU0hkVVJqZGtTV1ZtV0dKaFN6WXlUbVIyV2pFNE0zQmhNRFpXV1hSeFJHTkpVMmRRU1d4amNuY2xNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1ZV2x0Y0M1emRTVXlabk4wYjNKaFoyVWxNbVk0WVRVd1lUQmpZVEkzTXpNd1pHSXpaV014TTJNNU5EZ3lNMk14TmpsalpTVXlabUZwYlhCZk5DNHdNaTR4TnpFeExtVjRaU1prYjNkdWJHOWhaRUZ6UFVGSlRWQXRNVEkwT1RrdFpIQXVaWGhs

http://www.gifttownsign.com/WVl6OTRQVGhpTjB4WGFtNVlkbWROTVVOQ2NGRkNaM2QwVDJKVlZFbDVRV3hOYm0wMFptNXhka3RJYzBvbE1rSnZNQ1V6UkNaalBUVWxNa0p2VHlVeVFrNVRhRE5DYWtaMlVESjRWMDQ1VGxkTFNUWTJiM3AzU1ZoWVltdDNabmxxTTBWQ1QzSk5UVE5RTm5KYVZHZEtXa3M1TVVoSFRTVXlSakJ1WldGemRtSmtTelIyWjFGQ01IWndhRWR1WjFKR2VYcGxKVEpHYVV3NVUwcHNhM014UTJSYVRrTlBiM0ZKSlRKQ2J6STJTMDFOWm5sRWIxaDNlbGQ0ZUdka1JUZEJUVWdsTWtKWVNpVXlRaVV5UWtsU1RYVWxNa1lsTWtab1JscDFNMGxrU0RabkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVptRnBiWEF1YzNVbE1tWnpkRzl5WVdkbEpUSm1PR0UxTUdFd1kyRXlOek16TUdSaU0yVmpNVE5qT1RRNE1qTmpNVFk1WTJVbE1tWmhhVzF3WHpRdU1ESXVNVGN4TVM1bGVHVW1aRzkzYm14dllXUkJjejFCU1UxUUxURXlORGs1TFdSd0xtVjRaUT09

http://www.citysafeapplication.com/WVl6OTRQV2RwYUZFNFpGcHpkR1pSVGlVeVJqbGlXV3R2VUVwWmJuUXhObXhZU2xGWWEwbHBNbGhFY25oSFJHeGhheVV6UkNaalBVZzVlSFZSTW5CYVJGSkNkbE5YV0UxeWFFczJOMlpvVTI0MWVVSTRUMFpMTWpsYWEwY2xNa1ptYlROMmIyMDJWVU16TnlVeVFtWnBjbll4VEZreWREWTNKVEpHYzJaWk1uSk5kek5pWm5KNVJsTTFTR1ZFWm1Oa2RrZzRPVkJ4VVdwdmVrRldlV0p6UzI1d05YbEVNV2w1U2pWWWJGRnNKVEpDZFZKd2VUY2xNa0p3UTI1T1RrWm9iVWxOUWxCamNYVlpNM2Q0VUNVeVFtcFZZMGRWV0VaR1VTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWmhhVzF3TG5OMUpUSm1jM1J2Y21GblpTVXlaamhoTlRCaE1HTmhNamN6TXpCa1lqTmxZekV6WXprME9ESXpZekUyT1dObEpUSm1ZV2x0Y0Y4MExqQXlMakUzTVRFdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UVVsTlVDMHhNalE1T1Mxa2NDNWxlR1U9

http://www.citysafeapplication.com/WVl6OTRQVEZ0VGs1UlpIbENKVEpHSlRKR0pUSkdVMFI2ZWs4M1MzUnRObkJZVWpGcWRGRXlRMDFzUzBzNGVXNVdZM0ZtUm04bE0wUW1ZejFCUVdVMlNVaHNRblJ2VDJSaVVVczVia1JsVlhZbE1rSk1iVXhMV1RaYU4wSm9ZVVowY1ZVME5WWTJSVlJTYlZwWVp6YzBXblpNYW1ad2FWSXhZV1ZZY2tod05UaFlVek5sWlVsWmRVTldNQ1V5UWpSMVFrVTRXRGxhTVNVeVFuWm1KVEpDWjNZMGNESTNSVEFsTWtaSFNYZzVTU1V5UWtkc00zSTBSWEI1ZVhkSlJIUkVNRnBIUjNwV1psTTBjV2h3Ym1Sb1RrNUliMUJHUVc5dGFIVlRPVkVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWVdsdGNDNXpkU1V5Wm5OMGIzSmhaMlVsTW1ZNFlUVXdZVEJqWVRJM016TXdaR0l6WldNeE0yTTVORGd5TTJNeE5qbGpaU1V5Wm1GcGJYQmZOQzR3TWk0eE56RXhMbVY0WlNaa2IzZHViRzloWkVGelBVRkpUVkF0TVRJME9Ua3RaSEF1WlhobA==

http://www.cycleupdateguard.com/WVl6OTRQV2xZZVRsU2JWTXdiWGRMWkdWcU5FbG1PRk5rUkc1bVRFTndkV04wU0d4YU1EazFTblZLUmtJemIyTWxNMFFtWXoxMlNDVXlSakpDTVNVeVFtTTNVV05tUzBOTmIyVm9VemhWUmxWQldWcENZVEl5Y2xCa1owSkJZbGhhY25GNlpVa3lSbFpZTkZKdmFHSTVabUpXWkhOSE0wTmhhVVk0VFhnM2FWQk1iaVV5Um5Ca1NGcFhXbEE0VG5sWmNqWklNVmRaY1Vock9EUlBNMlUxUzJoRVNDVXlSbFZpSlRKR2VWTnlOWGREUlhsbmVHWmlZa3RYYTBGcU5uVm1Sa1lsTWtKeFNpVXlRblJLSlRKQ2FHOW1OSGRpYjBaeVJGQlJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabUZwYlhBdWMzVWxNbVp6ZEc5eVlXZGxKVEptT0dFMU1HRXdZMkV5TnpNek1HUmlNMlZqTVROak9UUTRNak5qTVRZNVkyVWxNbVpoYVcxd1h6UXVNREl1TVRjeE1TNWxlR1VtWkc5M2JteHZZV1JCY3oxQlNVMVFMVEV5TkRrNUxXUndMbVY0WlE9PQ==

http://www.sharerepositoryhosting.com/WVl6OTRQVEpHTW5ScFJtUkJSa1ZOTlVNd2JUQWxNa0l6ZFhacFYwOWtiMmxPVWxSVE0zSm5jU1V5UWxOQlNFTmhUbXR2SlRORUptTTlKVEpHTW05WlEydEllR1JLWlU1U04yeGlTWGxZYjNkUk9XaHBjMUJ5VlVvMVlVVm9iV0pZYlVjd2NtUjFUMmxUVVc5WlJYYzVibEZJZW1SM0pUSkdTbGR3VnpWNk9ISTViRmxpVWtNd2VrUjRVVWhJVUc1bWQzcFNkR0V6TTBSekpUSkdWVlZ0T1dGS09XZDVRWE5LY25Oc2IwczViM1pLTVZWUVZVNDNkbWw0ZURBelVsZzNiVTlVTTNCdlMzQm9KVEpDZFRKelpVbDZiM1Z0ZGtFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVlXbHRjQzV6ZFNVeVpuTjBiM0poWjJVbE1tWTRZVFV3WVRCallUSTNNek13WkdJelpXTXhNMk01TkRneU0yTXhOamxqWlNVeVptRnBiWEJmTkM0d01pNHhOekV4TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVUZKVFZBdE1USTBPVGt0WkhBdVpYaGw=

http://www.citysafeapplication.com/WVl6OTRQVTlRSlRKQ2VrcG5VMDVGUlVvNGRUbG5VRE5CYTB4MFIwbEJXbTVIZFdaaGJqZEZVbGRTZEhKYWFVcFlZeVV6UkNaalBVUXdhV1IzSlRKQ05WUlFRbVZJYTJOVFNWWTVZMFpJYjBKVE0xcGlSVFV4SlRKR1NITkdNMU5HSlRKR1dDVXlSbGRPUWxGd1kwMXVUalU1Tm5kdmNYVklRblYwUVhSYU1sUkdWRTlMZDB0d1JIRjJURmhYVVd4d1NXNU1SbFpCZDJsU1UxZEtNa3hJY1hkQk5tRktKVEpDVkdaUU5WTXpXVGx1V0c4NVVrOWpaazVMVFRNek5XNVdOMVpITW5aSVVGQnhRMHMxTkVoV2VrWm9PR1ExZDFFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVlXbHRjQzV6ZFNVeVpuTjBiM0poWjJVbE1tWTRZVFV3WVRCallUSTNNek13WkdJelpXTXhNMk01TkRneU0yTXhOamxqWlNVeVptRnBiWEJmTkM0d01pNHhOekV4TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVUZKVFZBdE1USTBPVGt0WkhBdVpYaGw=

http://www.gifttownsign.com/c?x=MlNeDWyJgpFKE5DUwEaQOOh7rBIQN/cEIWR8couWYps=&c=usNX3pODs Q6VPIB79AbvdrUVvzeVMotBrTUJ4o4a5g 4cuUZk66 SL3GbWFRSxvKLNJV4wVqNlV3U5X1yJmIcsnSUNP4bCzYYaGFaEagDuyc2P1/NoWuoITQJHVKFLfD23BhWrahZq63SCficaznLsklBXHRmh3 Pe0H7e/5oc=&e=0&fallback_url=http://aimp.su/storage/.../aimp_4.02.1711.exe&downloadAs=AIMP-12499-dp.exe

http://www.farmtowntowers.com/WVl6OTRQWGh1V2tkdk1tbE5TMnhXTUdOaWRFbG1kSEowV25oNFRYVnFUSGhSSlRKQ2QyVjBjV0kxZFhCM00yZFVkeVV6UkNaalBVbDBjRVpxVm5KR2JGaHpUR3BoYjJwRk5XUmphazVVV0NVeVFuSllkSFZDZHpZNU5qWkpaRWg2V2pWYU5tVnNTRmR4WTNjeFVrMVVVallsTWtKR2FtSkxjMWhWT0dRNFRXWm9TbTFFYzJwV1RrSlZSemh2TVVOWU9ISkNWVWtsTWtKMVZIWjJaMkZoWjNZemJrWnRUbFYxTVZKMlVWRXpiMmhUYm5wUVNVd3pRMEZ5U1hSSVdtczJlbVprY1c1RFYxUnNjSEI1VkZweWJFdHZaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVpoYVcxd0xuTjFKVEptYzNSdmNtRm5aU1V5WmpoaE5UQmhNR05oTWpjek16QmtZak5sWXpFell6azBPREl6WXpFMk9XTmxKVEptWVdsdGNGODBMakF5TGpFM01URXVaWGhsSm1SdmQyNXNiMkZrUVhNOVFVbE5VQzB4TWpRNU9TMWtjQzVsZUdVPQ==

http://www.sharerepositoryhosting.com/WVl6OTRQVmxJVjNkU1YzUnliVzVTZVZaa1Zra3pWRWdsTWtaWGNYVnJVMGhuTTBKdVpubE5iMHdsTWtJMmJGTklkSG8wSlRORUptTTlXRmRRZVVSaGRWTlVOMlJMY2xacVdDVXlRbFpOZURaVGQwNTZSU1V5UmxKTmJrZExOamc1V1hWM05GbEtaQ1V5Um1WemJVTlFNQ1V5Um1GUWVYaEVTbU5HVFcxd1JqWklPRGd3YVVaUUpUSkdWSGxRT0dwSlZERXhTMWtsTWtKS09VNTJUV3g1VWtKT01EaHJSRTVRZFU1V1dURm1la3QxVXpoTlRsQjNhbmhGZUhOV2IzRldiWEUwZFVjeU5HRkpNbWRNUVhGWlVpVXlSbkpLYm1VMmMxZ3ljR2NsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWVdsdGNDNXpkU1V5Wm5OMGIzSmhaMlVsTW1ZNFlUVXdZVEJqWVRJM016TXdaR0l6WldNeE0yTTVORGd5TTJNeE5qbGpaU1V5Wm1GcGJYQmZOQzR3TWk0eE56RXhMbVY0WlNaa2IzZHViRzloWkVGelBVRkpUVkF0TVRJME9Ua3RaSEF1WlhobA==

Remove aimp-12499-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.