home

avs-video-editor-36779-dp.exe

Kisi

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application avs-video-editor-36779-dp.exe, “Kisi Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Sacip   (signed by Mode Beta (Fried Cookie Ltd))

Product:
Kisi

Description:
Kisi Setup

Version:
3.2.2.4

MD5:
ec5c0c9eddbc4058a19dd05e92fb8688

SHA-1:
17a9e6089e994e042e63952121a2a3aeb87a7c17

SHA-256:
7b9e19e08b8b1ea3b31d28ecf639f9bbd36d9d6628b3ef736e626a7bba2035c8

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 12:05:56 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.23.1

File size:
952.6 KB (975,504 bytes)

Product version:
4.4.2

Copyright:
File Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\avs-video-editor-36779-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:VjJz9OiMv1hlYlmHZRY5L5H/9x7NJXH6:VlZMb/5RYRV9h36

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file avs-video-editor-36779-dp.exe has been seen being distributed by the following 13 URLs.

http://www.sharerepositoryhosting.com/WVl6OTRQVGhhYlVOUlZXVTVUbWt3TUZodE9FcEVKVEpDYVdSNmVHOUhhbkZVVWtNNVpXbFJRbUZFUVNVeVFpVXlSa2RuWlVrbE0wUW1ZejFhY2xSV1dtUlFSa2xwWWpoSk1tTm5KVEpHUzJ0RVVXUjJUWGROWlVaSVZEbDJWM3BuZEVkYWJIRjNSSEpaUlRKMWIxRklZVlYwZEZoVk5qWmlaalJrUjBWemJXVkRVaVV5UW1sc05YbElhRFZGU0VvMFRYSktjRGR5V1VSUFJuRkRWMFE1VVhBNGRWcE5aMkp2VTI5WVZuUjViR3A2ZEZOMFYydFpUamhtYmtkRlowTkVVVXd6Y1hodVpFRjNPVXAwVnpkVE9VdEJaa3BCSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1SdmQyNXNiMkZrTG1GMmN6UjViM1V1WTI5dEpUSm1aR2x6ZEhKcFluVjBhWFpsY3lVeVprRldVMVpwWkdWdlJXUnBkRzl5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVUZXVXkxV2FXUmxieTFGWkdsMGIzSXRNelkzTnprdFpIQXVaWGhs

http://www.gifttownsign.com/WVl6OTRQVzlvU0hkbldrTk5UVmc1UnpCeVkyZFhaM0lsTWtKd2RUZEhkblEyY25WSGNITTJTRE01UW1WblNEWnhVU1V6UkNaalBXdEtNMGhzVXpCU1dEUkRKVEpDTXpKbGFrVlBZbWh6Tms1WllVRkVKVEpDVURka1lsSXhkMDgzYVd4NFptSk1jVW8wTmxaUFZIWk9UbEozYmpKSE9VVkRkVWRwZUdWbVFqaFZOVVoyUzFadFdFeHJWVFpIYmxwSVdHaHhORUpWV1hwUU0yRjBNR3NsTWtKUVNtdE9SakJOVkZoUVdHazNWM1JRZUdwQlZUWnJaVVpzWkRoMFYyRlJjSEIxYXlVeVJrbE5lVVJIVURaTUpUSkNiblIzUkVFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRdVlYWnpOSGx2ZFM1amIyMGxNbVprYVhOMGNtbGlkWFJwZG1WekpUSm1RVlpUVm1sa1pXOUZaR2wwYjNJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UVZaVExWWnBaR1Z2TFVWa2FYUnZjaTB6TmpjM09TMWtjQzVsZUdVPQ==

http://www.clearguardapplication.com/WVl6OTRQVWhhTWlVeVFpVXlSa0ZFWVRaNVRWUkZkVmhEVDJVMk5VeHNNVzl0U0VOM1VEbFFOQ1V5UWtWeFIwVkhVelZUUzBFbE0wUW1ZejFNWTJVMGFuRnhXRGRoY2taaFZ6Qk1WR3hzWVdabEpUSkdWV014UzJnd1dWWlVhMVIyVVZoNlJXZE9kM1ZNWmtKUlkzbFROSEZ6YVVwS1pDVXlRbEZTZVhoV1JWUXlNMGgyTVRGVVRsRjFWMU5QTTFOWVVrcHhlbFJvVkdGaVN6VlNRemhwVFZkbk9YbFNXR3hXZUdJbE1rSkxTM0ZVTlhCblRGQkZORFZVY2tKNEpUSkdSVXRuT0hCT2RTVXlSa1ZZTlVOWlVWaENNV293Vnpoc01HbFJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtMbUYyY3pSNWIzVXVZMjl0SlRKbVpHbHpkSEpwWW5WMGFYWmxjeVV5WmtGV1UxWnBaR1Z2UldScGRHOXlMbVY0WlNaa2IzZHViRzloWkVGelBVRldVeTFXYVdSbGJ5MUZaR2wwYjNJdE16WTNOemt0WkhBdVpYaGw=

http://www.conceptsbodysafe.com/WVl6OTRQVzBsTWtKUVRERXpKVEpDT1hwTmVtRndSV3cxWTBkMGVITTJaM0J2YWxRMFFWZDNSR1JVZEVWcWRIcFNiMDluSlRORUptTTlPRVUzVWxsck5ITmpNVVk0SlRKR2NUVldiSEpzWmtoMVZUbHdZM295TkhwdWMzaG9RVWMxWW05SE5YbGpaRlphUmxabWFXNW1ZMjlNUkZOaFNXNTFkSGdsTWtKRldrOUxaVFpsVEVGaldHZFpNR1Y1YkhNeGNsQjFWR3RRVWtoT1ZEaGxUVXRXT1ZCTGRXTklialk1UkVKd1IzUmtXRkF4U1ROS1JtWm1VR3gwWVdKM0pUSkNXR3RZYTJ0cVozRWxNa1k1YjFZM1ZHcGxPR2N5VG5jbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRdVlYWnpOSGx2ZFM1amIyMGxNbVprYVhOMGNtbGlkWFJwZG1WekpUSm1RVlpUVm1sa1pXOUZaR2wwYjNJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UVZaVExWWnBaR1Z2TFVWa2FYUnZjaTB6TmpjM09TMWtjQzVsZUdVPQ==

http://www.conceptsbodysafe.com/WVl6OTRQV0pQTkdOWmIycEhSSGhSSlRKR2JWSlVZMFZMU0ZvNFZXMVpja3A1T1ZCcVRUTjJjazFoYUdwdFZUVkhieVV6UkNaalBVRkdOM3BGVDBOa1QzWXhiU1V5UWpkVE5WaDRlVXd3VlVNNGRrRWxNa0paY1NVeVJtRTBORTVhVEhacGJqSnZTRGsyV0ZwQk1tdG5SWFZQY1dGb1UyUjJPVE54WlV0SGVFWk9WVFI0ZURka2NFOUxhbkU0WmxWVE5EZ3hkMm8yWm1GM2VYWXlkRVpOTkZNbE1rWm1PV3N3YVZGeGRtMHpZVXhaTXpsQ2RrNTNlVkJuZDJWVmJuQk5TR2w1TjBKRGRrcFZVakI1VkVGTE9GaFNZVmhuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1SdmQyNXNiMkZrTG1GMmN6UjViM1V1WTI5dEpUSm1aR2x6ZEhKcFluVjBhWFpsY3lVeVprRldVMVpwWkdWdlJXUnBkRzl5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVUZXVXkxV2FXUmxieTFGWkdsMGIzSXRNelkzTnprdFpIQXVaWGhs

http://www.gifttownsign.com/WVl6OTRQVUYxYUV0WFVVWWxNa1pDU2xaWE5WVXdiVzR6TTJ4RWVsazNOMU5CWm5nMlp6YzVUR1oyVTFacVVXdDZRU1V6UkNaalBYSndaRzlIY2tKblNuQjNSWGtsTWtKS1JHVk1aems1VkZSVVUwOHlkbTVUU2xwSVF6RlFjRzFVSlRKQ2REY3hObU5HZFVOVk9UVlBRMEp5VEhSNWR6ZEVhbUl3Y3pKSk5rRXhjbVJ5Ym1KcVRUTjRTVE53Vkc1V2VGRTBWV3BzU0dKMFdXcFhaRlp1ZW5SQ2MwRjRNa1Z1ZVdodVluSjFNbE5UVVhWR2FtVTVZWFZxZVZsSE5YVTBTeVV5UW14R2EyUlpXR2RZVEhoRE1XWndRU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprYjNkdWJHOWhaQzVoZG5NMGVXOTFMbU52YlNVeVptUnBjM1J5YVdKMWRHbDJaWE1sTW1aQlZsTldhV1JsYjBWa2FYUnZjaTVsZUdVbVpHOTNibXh2WVdSQmN6MUJWbE10Vm1sa1pXOHRSV1JwZEc5eUxUTTJOemM1TFdSd0xtVjRaUT09

http://www.appsfunbyte.com/c?x=ItwFfsYlBUl8xe7Km8IftN2oaleuKdor8ImwoMhLzwI=&c=W hQXC28ND63OGEl3wRaRUWQxT4YybumrNehDJCSa4PJDikVKg/uGc61TwK/rNkkh5dCdzzbNLR7LDmgLGgPXcGExyhuA6GJOY3AI9dyBx5lNPAPleg8uiyzi3xhpxcY6H0VU4xke5FT1CxyBvnt9vBMhK01nXKhcSXS1serELw=&e=0&fallback_url=http://download.avs4you.com/.../AVSVideoEditor.exe&downloadAs=AVS-Video-Editor-36779-dp.exe

http://www.conceptsbodysafe.com/WVl6OTRQVzh3UlVOS1ZFUTBSMjlYVkdaa2JVZGhZVmhvYVdkVmQzUkxlRlF5ZVhobGRuUjRjM01sTWtaVFptWkNPQ1V6UkNaalBXcHRSMjFoUjJ0NWREQXdjR1JuU2xRbE1rWTJSbGQ0UWtwV2JGRjRhbElsTWtKblJVMU9NWHBIZHpsck1rMW1WVzVSWlhaQlZEQkZVbmRQWXpCTVltbEVaR1kxVEVGQk5tUnVKVEpDU1VWRFRsWXhWaVV5Um1Od1lVSlZRVWxHYWtOTVZVUmxTRUp5YW5wM1JWRTJZVGxHWmpGc2NtcHZXR2c1U21jNVNXdFVia1l6VkV0MVlWWXdiRVpuUm1kdVpVVm1hVXBhSlRKQ1lWbGtTSGR6YTBFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRdVlYWnpOSGx2ZFM1amIyMGxNbVprYVhOMGNtbGlkWFJwZG1WekpUSm1RVlpUVm1sa1pXOUZaR2wwYjNJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UVZaVExWWnBaR1Z2TFVWa2FYUnZjaTB6TmpjM09TMWtjQzVsZUdVPQ==

http://www.conceptsbodysafe.com/WVl6OTRQU1V5UmtGQlFra2xNa0kzYnpoTFIwWjNRMWhFTkhRNE0xTmlOM0oxVVdWWGFXMWlZbVpDYkNVeVFtTjJaRUpZWVVrbE0wUW1ZejF5ZGpOMlFtRnJOM2RtZG5kUVdFMWtURkZKV0dWQ0pUSkNNVFZoVGtjeGVuaEVTRXRQVVVwVWRYbFRWRTVDU3pKSGEzZENialJLUWtNbE1rSnphRXN3SlRKQ1NsTjJaVXA2VTIxdVpIcEpXbkkxTkd4MWQwSmhOR1JLWmtZd04ybzNOaVV5UmxKTlNFcFFjVnBtUXpGUVJqTmFXaVV5UWxCVkpUSkNlRE5DU2xCMmNYazVkSE5YUkZSMFYzbDFhbnBUZDFCdVVWRnNiMWh6Ym5WdFdtTnFVbEVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWkc5M2JteHZZV1F1WVhaek5IbHZkUzVqYjIwbE1tWmthWE4wY21saWRYUnBkbVZ6SlRKbVFWWlRWbWxrWlc5RlpHbDBiM0l1WlhobEptUnZkMjVzYjJGa1FYTTlRVlpUTFZacFpHVnZMVVZrYVhSdmNpMHpOamMzT1Mxa2NDNWxlR1U9

http://www.citysafeapplication.com/WVl6OTRQVGRHYkNVeVJreEJZU1V5UmxsU1RuWlhUVUpFY0VzbE1rWjRjbGN4V0VKeVEwSTJjVTFKU1Zsa01GUlVWMlZaYWxVbE0wUW1ZejBsTWtaRWJIZG5UVUZpV1dkbVNrbGhaRVpJT0hWSVVHYzVTSHAwZVdGRmExTkxRbmhSYlhkcVdEbG1Sbmx6UjA0MFZDVXlSbGhOV1RKSlJYSm9XRTluUVdoRVRrbFVSR2Q1Vmt4VlZrVlpWMFp4YlZkblpUaGpORzV2ZVVGV05raG1OSEZET0ZObkpUSkdPVVJTVkhSYWNsSlRNVXhaSlRKR01tdzRUekJUVW1sUWNHMXZkV0Y0VkZSMmVIQjZNMkpJUTBWVE1rWWxNa1kxUWtkalUzQkJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtMbUYyY3pSNWIzVXVZMjl0SlRKbVpHbHpkSEpwWW5WMGFYWmxjeVV5WmtGV1UxWnBaR1Z2UldScGRHOXlMbVY0WlNaa2IzZHViRzloWkVGelBVRldVeTFXYVdSbGJ5MUZaR2wwYjNJdE16WTNOemt0WkhBdVpYaGw=

http://www.laboratorysafehead.com/WVl6OTRQVWhVT0VFMFIwaFZPRVpwTVZCcFlsRm5lbXhRVlZkNVkzVkxUMjFQUzBwSU1EbGxNMVY2ZG0xV016UWxNMFFtWXoxa1FtRldSbUZDUTIxSE1TVXlRbEIzTmxwek1rVm9VRWN4VlUweFZ6WXhPRlEyUVRsVE4xa2xNa0kyT0RkT1kyZEhOelF4V1ZFNVYwOVBaRmwyVTBSYVpreEdTemxOYURSdll5VXlRbWQwT0hwdWNVOW1kSEZVUkRWaFVVVktkblJTSlRKQ1UzZFZVbFJpWkhCMFVHczNlV0pxU1Rab2VHeFlSM1pvVjBOTlozcDJlbmRNUm5wNWNrWmFjVzkyYjNKS2FtaHlTMmRFVW01ek1rVjNaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprYjNkdWJHOWhaQzVoZG5NMGVXOTFMbU52YlNVeVptUnBjM1J5YVdKMWRHbDJaWE1sTW1aQlZsTldhV1JsYjBWa2FYUnZjaTVsZUdVbVpHOTNibXh2WVdSQmN6MUJWbE10Vm1sa1pXOHRSV1JwZEc5eUxUTTJOemM1TFdSd0xtVjRaUT09

http://www.appsfunbyte.com/WVl6OTRQVVpTUW1WclJ6UnViazQ0ZG5rd1NsaHZWSEp6TlhkdldHeDZXRzVtUVhGTVNVc2xNa0pRU2tSYWQwWlJUU1V6UkNaalBWRTFOalIxYm5Rek0yaGpOamxoVDJ4SVRESjZaRUZNYTB0NFRHZG9NRWxOUVZOd1dWUXpKVEpHU1daamNFTlZjSFU0WjNwMGNXRXhjMHN6Wm5VNU9EaDNWbEl3TUhORGFtdEJaRVI0WmlVeVJtcHlORXQ1VkRGb2IyRmtkelpVTjA5aldWbG1KVEpHVlVGWVpDVXlRbUpOUjIxNlIzaEtZbTFhVDNWMFZFWnRkMVk1T0hsV1FUZENTbXhEWW5KeGVWTjVVR1JTZVd4VlJWcE1PRWxuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1SdmQyNXNiMkZrTG1GMmN6UjViM1V1WTI5dEpUSm1aR2x6ZEhKcFluVjBhWFpsY3lVeVprRldVMVpwWkdWdlJXUnBkRzl5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVUZXVXkxV2FXUmxieTFGWkdsMGIzSXRNelkzTnprdFpIQXVaWGhs

http://www.farmtowntowers.com/c?x=1bHMr9oixG42RW3e3qdqz0rNSPS1l88cE3Rro2TKMwc=&c=HeC0xI1roZBpCgQNnqb7Wedy4ReqxvVpFE71gN Vwd2xp93EYvhRRV5UIE xHxR0q6Bjm2cFWHvOLTtsPp4JRLE8IpWTyin6anWt6thdfa57Y1QEt/rekivHARi9u04eiWSJB/fwHEfvGPKcGWMF8A==&e=0&fallback_url=http://download.avs4you.com/.../AVSVideoEditor.exe&downloadAs=AVS-Video-Editor-36779-dp.exe

Remove avs-video-editor-36779-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.