» free-video-editor-33621-dp.exe
Overview
Analysis
File Details
Downloads (13)

free-video-editor-33621-dp.exe

Kisi

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application free-video-editor-33621-dp.exe, “Kisi Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Sacip (signed by Mode Beta (Fried Cookie Ltd))

Product:

Kisi

Description:

Kisi Setup

Version:

3.2.2.4

MD5:

c9950c87063ea6c6eeaf6e08ea8f6b33

SHA-1:

56893c04be048e686edc8d76cadfbb449cae3e27

SHA-256:

f06b31359fb3091d61ea35556a9a2dafbf07e74fdb2fa7ff053872725f1b50a5

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/26/2024 11:47:26 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.4.23.8

File size:

952.6 KB (975,504 bytes)

Product version:

4.4.2

File Lite

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:AjJz9OiMv1hlYlmHZRY5L5H/9x7NJXH6:AlZMb/5RYRV9h36

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file free-video-editor-33621-dp.exe has been seen being distributed by the following 13 URLs.

http://www.currenttoursclear.com/WVl6OTRQU1V5UmtwS0pUSkNTV3hsWXpGWmNYRWxNa1pRUlhOaGJESjRXVkk0YnpGM1ZrWnJORlZ3TVhSTGVteEpaMUZ1UzJjbE0wUW1ZejFyVDNvMVJYbzRUbWhaZFRsNGNtRnVaREpQYmxoS0pUSkdNMHA2ZERGSU5sRjBhR1p3T0dneU1XdHplVUV4VG13MWEwaEZOVzFMUkZJM01VeEdlSGhDTVRGbGRVZFBhMjFFWlV4VVFtOUJWRUlsTWtZeE1tbElhbFo2Y2tOSVoxSjJRbVJWVlVseE9WVmpNMWxHSlRKR2EySTJaRXBTWW5sd1RrVjRWVTFoVjNkVE1VcHdjREU0SlRKR01HaHJXRGhGV0VkV1JVNVdZVk01VVV0UmR5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnZabVl1Wkhaa2RtbGtaVzl6YjJaMExtNWxkQ1V5Wm1Sc01pVXlaa1p5WldWV2FXUmxiMFZrYVhSdmNpNWxlR1VtWkc5M2JteHZZV1JCY3oxR2NtVmxMVlpwWkdWdkxVVmthWFJ2Y2kwek16WXlNUzFrY0M1bGVHVT0=

http://www.sharerepositoryhosting.com/WVl6OTRQWFZqT1RsV09ISnFXSHB4VWpOQ2VrUTRabG95TWtWaE0ySTBVVW8xZEhsUmJFeE5ZbEFsTWtaMmJHeGhXU1V6UkNaalBYVkZjRkpxUXpJeVJYZGlPR3hZSlRKQ2FWWTViRlJhY0ZKTVkzZ2xNa1pCV1cxM09YUjVOa2N6Y21sMU1YWTJVelJVUmxSNFZHVnhNelpJWVZsUWFFNDVTMkpJY2xoM1FpVXlRalJWTUdsMFRUQXlaR2xLTlZGM1JIUlVZMEpQYjJWblltNWhhRTAzZEZOeGRITlljVlo0ZFV0eWJrRkpOblkyVUU5V1VrdzNXakY1WWtnME1FRXhKVEpHYW1KWVZYSnBla2xxZWswME1GQmtRbTVuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm05bVppNWtkbVIyYVdSbGIzTnZablF1Ym1WMEpUSm1aR3d5SlRKbVJuSmxaVlpwWkdWdlJXUnBkRzl5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVVp5WldVdFZtbGtaVzh0UldScGRHOXlMVE16TmpJeExXUndMbVY0WlE9PQ==

http://www.gifttownsign.com/WVl6OTRQVFEyZEdkYU1XaHJhRmRzTkhGdk4wTXlURTB6YUhCWVRFRlpaV04xWmlVeVJrWTRWbVpYTW1KclVHbENkeVV6UkNaalBVMU1KVEpDYXlVeVJrNDVTR2c1Wm05VmMyaDVOR04yUmtobFNFZHdTVVpaVkZCSFZGaG5XalZyWTFNelYwaHBka0ZYVEUwMU5GSnJTMGxIVTJSbFNIZFlSWFZJVERST1R6SnRibVpWVkZReGFYaHZhRmtsTWtKQ1MwZE9TVUkwU0hCWllVbHRWVUk1Y2pkbVZEUkpObVJzV2pkNFkxaHJVRFJxYTNoSWR6UkRWSGhwZW1vd2VsVTBWRGxUVGpGa1owNGxNa0phVWtsdFZYRm9XRVJSSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm05bVppNWtkbVIyYVdSbGIzTnZablF1Ym1WMEpUSm1aR3d5SlRKbVJuSmxaVlpwWkdWdlJXUnBkRzl5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVVp5WldVdFZtbGtaVzh0UldScGRHOXlMVE16TmpJeExXUndMbVY0WlE9PQ==

http://www.gifttownsign.com/c?x=y5CuS fePS/vWUITF2fobOAjJX7mVhb2bhcDmPh3Ln4=&c=r7reBvqLR8QvtiujwaM6qbNsEtStksSU6qbtWSY wjirFVS3lYbukWOiHUK3AqUDFfZozxvWSSnJGDxfWmitdAm2MCcg43Xnlja9lTZgJ8xGLtP1bZNNwfx9M8lpCvLB88c93D2d4SyKmxa0r1wrIYVo CB aKeT Nm/ALkkXDNXK3Bix3br1Dg0RA6iRYzl&e=0&fallback_url=http://off.dvdvideosoft.net/.../FreeVideoEditor.exe&downloadAs=Free-Video-Editor-33621-dp.exe

http://www.currenttoursclear.com/WVl6OTRQVU00WjBkUlIwcEdNakJGUm10eFlXeDBkRlUxSlRKQ0pUSkdOazFDZDJvNVZqWldjbEZEU1c1QldFcFFkM2hCSlRORUptTTlPR1JQTkZaV1RYSkNkalZzZFRBMVZTVXlSbTAwVEZWRE9WZHVSazVXT0VoaWRrWkpVa2hFVGt3MFIycHdNa3BPWVNVeVFqQlpibmhhVkd3MGFrNUdNWHAyT1hCdWNWWm1iMFprWTNSVWFXMHpVVVJNYURkSVV6Wm5VRGRGU2s1RGFFdHNTbGRVTm1jMWMwdDBRMFZ3Y2paS0pUSkNkVGx2YkROaFp6UjRhVGgzU1ZSWFJGUllRMnByV0hkbU0yUnJUVmczUTFWa1pHSlVKVEpDY1VFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWIyWm1MbVIyWkhacFpHVnZjMjltZEM1dVpYUWxNbVprYkRJbE1tWkdjbVZsVm1sa1pXOUZaR2wwYjNJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05Um5KbFpTMVdhV1JsYnkxRlpHbDBiM0l0TXpNMk1qRXRaSEF1WlhobA==

http://www.citysafeapplication.com/WVl6OTRQVFpEU1doMmVsSnRkeVV5UWt0SFJFcEJZMXBoTmtoMlRWbHZkRkYxTm1ad1NTVXlSa0ZxU1RKcFZrVndTR3hySlRORUptTTlOR296V21jeFVtSnVOM0FsTWtKa016ZGhiM2hHTnprNWFEZHZSMGQ0Y0ZWM2VUWldlRUoyZDNKa2NEVnFhVlJGY1RNbE1rWlRZbEpUVDAwbE1rWlNNblF6WmpockpUSkdPRnByVmlVeVFtSmpXa3BQVEd0RlUzWlhOVkJxYWlVeVJtcHZNVE5VZVdWbFJFWjFaMlZZWjNNMmVVaDFkR1o0VW05MVRXRWxNa1poUTIxeFpGUjJWVmxtYzJaNVpUTjNlVTVSZG1GbFJXcEJXbkp3Y0dKNVVHMU5hV2NsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptYjJabUxtUjJaSFpwWkdWdmMyOW1kQzV1WlhRbE1tWmtiRElsTW1aR2NtVmxWbWxrWlc5RlpHbDBiM0l1WlhobEptUnZkMjVzYjJGa1FYTTlSbkpsWlMxV2FXUmxieTFGWkdsMGIzSXRNek0yTWpFdFpIQXVaWGhs

http://www.sharerepositoryhosting.com/WVl6OTRQVTV6UjNoMU1qSk1NbEZMVVc5TFZYaFFia1JHVVZoaGVucFRORlZpVWlVeVJrNUliVEZvZEZkYVRYcHdTU1V6UkNaalBUWndSMmxDWTNaTWRtaGpWMVYwZURsQmVWaEVZalE1UzNacVlVbHBkMXB5YmxJbE1rWkZja1pXTWxWeFFWZFJlVGxOSlRKQ01sVTBaekEzY1VSRmJWaGlibEI0WldGaWJEbDVlVGt6VjFGbmRGbEZlRlZMU0Zkc1JGRm9abHByUTNGVlUwZEViMUZ6TUhCU1QzUnZZVXBSUkZvMk1pVXlSa2wxWnpnM0pUSkdkbUZVYzBWemFHcG9KVEpHVGpOc1kybHliekY2Wm1rNU5FaEllbkZRUjJjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWIyWm1MbVIyWkhacFpHVnZjMjltZEM1dVpYUWxNbVprYkRJbE1tWkdjbVZsVm1sa1pXOUZaR2wwYjNJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05Um5KbFpTMVdhV1JsYnkxRlpHbDBiM0l0TXpNMk1qRXRaSEF1WlhobA==

http://www.currenttoursclear.com/WVl6OTRQV2RrYlVwRGEzWnNTVEEwWWtSNlJYZDVSbEZ2ZURVd1YwMUNibk5JSlRKR1JHaFFNMVpCYUhsb05VcEhieVV6UkNaalBUVm5NMnh2VUc5dVdUSTVSRE1sTWtKUWNHazJjRVpGWlVkdWFUUndUSGs1TkU1WmJqVkZKVEpDZUhsd1drRk5jMFpEYW5sd1JXMTViV05tSlRKQ2VuWjJVMHBCU0dKUmNVczFVSFptVlVSWU9YRk1halZ4ZG0xS1ozVXpVSGxsUXpOeFkwUnVTWGtsTWtJbE1rSlFKVEpHVVhkaVNuZ3diWFJ5YTBSSlVVRnRTMnQwTm1aeldXVk9ZVzFyY0hJMGVtWnBVRVJKTUZWb2VXdDZWeVV5Um10aEpUSkdhWGNsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptYjJabUxtUjJaSFpwWkdWdmMyOW1kQzV1WlhRbE1tWmtiRElsTW1aR2NtVmxWbWxrWlc5RlpHbDBiM0l1WlhobEptUnZkMjVzYjJGa1FYTTlSbkpsWlMxV2FXUmxieTFGWkdsMGIzSXRNek0yTWpFdFpIQXVaWGhs

http://www.sharerepositoryhosting.com/WVl6OTRQVVpuUzJkSlQydGxKVEpHTkZSdVUwbGpVRzF6Y2xSYVZWZHpSbGRYU0VaNmQwdEhWV3g1UVdGc1pYbDJRU1V6UkNaalBWSWxNa1owVEU5NU1YazRZbE5VU1d0bVprTlllamhGTUZkd1pUUnJjRkJPSlRKR1R6TjJUalJ3WTFwbkpUSkNRblJvVWtkQmVYaE5RMlZxVFVzelkxVTVTVzlST0RSWlpHMTRiazRsTWtJNFFsVkJZWE41TjJZMlUxTkpUMnh4YzA5YVQwVTBNbE5zU2xaMmFqUTBXR2RYV25KbVR6TlFTRU53VHlVeVJrSk5UVlJVTWsxWlVHbHZPSHA0VEd4ckpUSkNKVEpHYzBaTVUxSnBUSGxhYlZkVGJVSjNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabTltWmk1a2RtUjJhV1JsYjNOdlpuUXVibVYwSlRKbVpHd3lKVEptUm5KbFpWWnBaR1Z2UldScGRHOXlMbVY0WlNaa2IzZHViRzloWkVGelBVWnlaV1V0Vm1sa1pXOHRSV1JwZEc5eUxUTXpOakl4TFdSd0xtVjRaUT09

http://www.cycleupdateguard.com/WVl6OTRQVWcyYms5UldtVTNkRU5wTXpaeFp6WWxNa1psV1U4MVZWa2xNa0p5WlROYVVXZEtUa3AwUzJSMmFVSldSbVEwSlRORUptTTllVEZLZW5jM2NXWnZWM2gwTXlVeVFqUnBSRzExZDJkTFdrdE1aamhVYkZsUldrcElKVEpHTlRKSGVIVmtXVzlsVUdkS1EyaHdWVTA1VVV4ak5YVWxNa0pHTW5GTGFraE9iMUJxVkdoTFRVdDZOVEpPYjBORFFrb2xNa1pGWVdWalp6Z3hVbnBMWW1kTFVXRWxNa0prYmxSRVJrNVRibU5YU0V0SlVHRndOa2R2TmtOaFEyc3pKVEpHUTFkRlRFNXNKVEpHVVZGalVEWkhKVEpHVjJnd2JVeExSMHhWWnlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1adlptWXVaSFprZG1sa1pXOXpiMlowTG01bGRDVXlabVJzTWlVeVprWnlaV1ZXYVdSbGIwVmthWFJ2Y2k1bGVHVW1aRzkzYm14dllXUkJjejFHY21WbExWWnBaR1Z2TFVWa2FYUnZjaTB6TXpZeU1TMWtjQzVsZUdVPQ==

http://www.gifttownsign.com/WVl6OTRQVEpRZVUxbFdFeGFZbTVXV0VaamNUWlNTSEJ5U0RsbWR6YzBhRlUxWmpWamRrNUNXR2xqWTFOVlJuY2xNMFFtWXoxd1psWjVka2RqUTJwcFYya3laVWRpSlRKR2VIWkllaVV5Umt0eFdXWWxNa0pSVjNsV1pHaGFhbTl6WkRJM2VUaHdRbWhwSlRKR2VubG5helZxUjNWVFNXUk5UVkZTUjBzbE1rWnRWRE0xYTFVNU0zRlZablpLZFdGR1IwTXhVVE56UkhOQ2IxcE9WMFYxUnpnd1dHdFZRWGQySlRKR1NrMTJhemR4YkVOa2NFZzJjRk0wWWlVeVJqZHJVREkzZDJORFIyMXZTbVUwVkRacFRsSkhZVFU1ZUVaMFVTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnZabVl1Wkhaa2RtbGtaVzl6YjJaMExtNWxkQ1V5Wm1Sc01pVXlaa1p5WldWV2FXUmxiMFZrYVhSdmNpNWxlR1VtWkc5M2JteHZZV1JCY3oxR2NtVmxMVlpwWkdWdkxVVmthWFJ2Y2kwek16WXlNUzFrY0M1bGVHVT0=

http://www.gifttownsign.com/WVl6OTRQVlJaTWxSb1VGUkNWekZJUW14Q1VYcElSakJLZUdaNU5HMDFTRkl5YmtoNlZGUWxNa1pvUmtadGEyTTFaeVV6UkNaalBVdDVXVVUxV2sxTFprdFZSbU5HYTAwMVVHRjJRbUY0VmsxSmNUWm5kSEJ5V0RodVIyNTJOWE5OWjNKdmRUSm9kMHRoYURoSWFHbDRNVWtsTWtZeFZGVTRNSGsxUVZkVE1GRk5SWG96U2s1aU5UbDJhbXRpT1ZWd09IbE9OMUpZVTBKVGJIRjZVamhYUTBVMVJqTXhZMGhNUzNNbE1rSjVWRU5DTm1KcWRUbG5aMWhCWW5wRllpVXlSamRPZFV0eUpUSkNXVVUzWnpSSmVVY2xNa0p2ZVdjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWIyWm1MbVIyWkhacFpHVnZjMjltZEM1dVpYUWxNbVprYkRJbE1tWkdjbVZsVm1sa1pXOUZaR2wwYjNJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05Um5KbFpTMVdhV1JsYnkxRlpHbDBiM0l0TXpNMk1qRXRaSEF1WlhobA==

http://www.cycleupdateguard.com/WVl6OTRQVEpJVW5KVGVHeEljSFEwY0ZWNmVHdFpRMG80WVVKaFpITmljMkZ5Y1dOS2JqQkljRE0zWVdWaGVGRWxNMFFtWXoxbFFWTlVaMUFsTWtaeVJVVlBaak5vTjBvbE1rWXpVMDFhT1U5RU1FZzVXSGRoTWpKNGJ6TlhaVUptWjA5Rk5XbEdPVTVZZERWNWJHcHBTRTU2YjFGWVJGazFVVzlsUm5KaE5uWjVVWEIzYVROUmVUbFVNakJNZEVFNVlYaFFNRVJGUkhSU2RrRktiblV5VUdwMmNqazVkakJrSlRKR1REUjVNQ1V5UmtsVk5tNU5KVEpDYXpkdlZtRlFPR3BQVHpFM2JubzNPWFpoTW5wTmExbEJkalZCSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm05bVppNWtkbVIyYVdSbGIzTnZablF1Ym1WMEpUSm1aR3d5SlRKbVJuSmxaVlpwWkdWdlJXUnBkRzl5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVVp5WldVdFZtbGtaVzh0UldScGRHOXlMVE16TmpJeExXUndMbVY0WlE9PQ==

Remove free-video-editor-33621-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.