home

freescreencast.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application freescreencast.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.funtourbundle.com and multiple other hosts.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
7340b527a7d52a18e5d84d0edd1b8115

SHA-1:
ad4415c5641b66fb85458c38fd7b87047063b8d1

SHA-256:
5b540104f9ab82cb4c5749acb9ac206c9912004038c5d43d1f4a627498cc6fa7

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
1/13/2025 4:20:54 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.6.30.14

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freescreencast.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/23/2016 8:00:00 PM

Valid to:
3/24/2017 7:59:59 PM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:lti0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:lEcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9345

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freescreencast.exe has been seen being distributed by the following 8 URLs.

http://www.funtourbundle.com/PNxS5B2Cs0VnxldfdsqP_aNLgxpqdau3F2gP5fgRya5fuNAF2zzO1xBxpIxp6vByVQRLc0TVP1L6jez7nr0C gBVpCc7w xqjDVA3 tnwDscHWcdjTFdcaRawvB0MPPRjYsgXRHEzMQuvO6Yd6kBoxEf5gc0eNTlBAJepODSmQdYgp8JAsy2LI3SwubUeOo_zMRmgAhgQt9qZPT8BrWykx19I27qww==-G1IAAARkczGppQlm6QZZEM4Pfzk4x0LuQ02Wdjj95eAxfB6N4uA3ZvyEzdnTncArRuaVvrN49DO_kNCtSOUD

http://www.funtourbundle.com/jRj76oReVQ8JdRhCKKOuK0oZBBX36EaMp0CH84OTZ7bcpznBAUozgn gKFlDR_BXOiDHD0NDrz q3jHDYMCmWLBn_iwEKo ozTdEeLx7nJ5m4p1z DdUgYxIUyQWZv9tIXj26wx4K_f7c5i7Y8BIzBtJSsv8vUrUAinbGB6ktfd1vayVO_iiVCbvY0C8VTymzyT07eXO1bstcILBgdFqiiDq0m0OiCmDLKjhAOKRdKl0Ysa9Uj51viTWTh BKcr0c0nO8oiuXGLgL2gM7UgrFWSRIR8c9O3I3DzxpGaMocC6aHKYT9ZwMOMonhtdGrfZgK4VPPkDztggzacouq4ykq ee5Cy12xubiL77xXJBzwmTmg9ILdyJ1YwcVktsEVz_rMYKhttb0ht oqcFyWuawLiB7MuCi2UmXc92Kf8P9XKikk458PQhICAkA1iGnSumgS dWC-G1IAAARkczGppQlm6QZZEM4Pfzk4x0LuQ02Wdjj95eAxfB6N4uA3ZvyEzdnTncArRuaVvrN49DO_kNCtSOUD-e

http://www.factorycapitalstock.com/qxpiO1guBVNqUw_MHkA9frPc pYIvn3HCc0OessxyigXqUDuUsCxSOorUn6qnSAoS9 ipRiEVsO8FrEE3XQyONSlu2zGEJXsSSrnaW8dAP1hWmMjjq0bZyxcHiN2lVkoxGxLTqyN9aVXAkVvnIQ8C_IC4d7gsdju2oeYz4lbpV3l_sMBg373VlK0pFCIcjJ_9_j1WNh VlqRIJFLpzucca43zA_ElpbN8BkaTWUYLQeQVT0J2Nk8SoZLiI9rE1gLC0FGcLALEmxQvjRT6Qx_a_myCssyzh9sWx9dLAWnnciv6G uryzcStLlQChs8UrqxwCSCHIirwfqRhZaCznW3nJUvJWaGN fz4Tw1AJvc1br64E DiVi1bQO2_1FgmK3vO2ij4GAsiRvaEVdY0OkVwfCGoJRQ1dD NPdn K_OZw5r9NAABYj900ruLocAf60UobkfVOQ-G1IAAARkczGppQlm6QZZEM4Pfzk4x0LuQ02Wdjj95eAxfB6N4uA3ZvyEzdnTncArRuaVvrN49DO_kNCtSOUD-e

http://www.funtourbundle.com/iYaqfzcENwVL3bH49U3VRKBNfhlLyVaHjzMi1I7mqnzOEEusdelrpGqAXLrT_tGdoG MD3Bn0KW2A66yhLFlRQoOfJUFO93gcoIyfHGHYhwYzKSBJ0CetbNiQHSLO_CIAN_8GiLHT72sUzPLBheFExLMvJKQbU9b40rLLQJ1AhP37YqulpavbY3pnxdgGDrxQzratJJRdN5iRBIrHhhGqEASjw2LpqbVzXfJEsN10UXxne6ybB16f pSwdC YqZ6mNwVTcNhtP9QxQxY5KirD9jv9V7rcG0jvmjq4x0AqXkITX50IHPMoNnp9By13awg0_6BXah6Gz3KmszKk6 Ngr6SsciY4TNWzi7gus7f3d2LCvbNma0ooVte387VOrqreGfogCvfUO606TqAIQSganjvu6Q0LETM7mgfVSS8xa5D_sxOs70 tLJ1r63TZkK38LEK6v0J-G1IAAARkczGppQlm6QZZEM4Pfzk4x0LuQ02Wdjj95eAxfB6N4uA3ZvyEzdnTncArRuaVvrN49DO_kNCtSOUD-e

http://www.factorycapitalstock.com/MprSjh5LUBIQvXiwBjPVIio4PMTPvegFuriyaUfvBFrhglJiJOZvWl6HLMwIX4BFP_d5qqfnpOsW6Hp8srA3XmAmAxZZ3I4RAPEmRD3mxX7a25t2U4BcCVsLGlCe8W_eN2ewhYJJLvcQkh77Ie9u il52YhySWkSB2rw3IvYihvBgjAa7njd_H2vJmGcraJMqUaKohVIU3p5yCV_oanPSZH3xDb 3_gyVR89sQjL234pZO iIGHRBkLc5gor_NVW4b0jiDV3P2mo_cmyKerebsk8OXUxgCg7aD5TDOtNLROWlWBK9rFQEU2WfiMk4a9TwagjCyM5hUhOsWxJibXSsXMqSrxmspqQCxzUuLP7ABcKCl3hH9cKoUBf7C8edg3peQicwN0A7Y0bA6gqc6OmAAeXVJGuPW jG7hBtBEm_6PUvrq4dEP8joqQM5S_ZyYQDDmP2AfU-G1IAAARkczGppQlm6QZZEM4Pfzk4x0LuQ02Wdjj95eAxfB6N4uA3ZvyEzdnTncArRuaVvrN49DO_kNCtSOUD-e

http://www.taggiftflash.com/NlHar_aYUK4hOvOvA84clX_LhkukFZc_dGpIWr5ubC93wY2wpG8Y8voHL9R97HWSc RiiJuWj7hi5jlJLIdxg7Tyux7nojBp85phpA6IEDikVSI6mAgrHXanUK2IPF0uwQPNX4kgXf3wYGwgNCcz8KsLwcV0OS9Xzr8SiVriH0my1tQWjx4YIPXvGOE8eJmhRw4CxmXiu8 YqTbhephIxeA2vlNTLw==-G1IAAARkczGppQlm6QZZEM4Pfzk4x0LuQ02Wdjj95eAxfB6N4uA3ZvyEzdnTncArRuaVvrN49DO_kNCtSOUD

http://www.factorycapitalstock.com/fvBdTbWcHD0JGLWHL8moROmlggd26 fKVBzTepHbk9mxLSXJDU_S91jAgcuBobx6QrjsJHI28gI2CltC2Nt7SsdDx9XzEk7v6 nil0ZjG R8ZjLaU dteVr6e NuOse fQnVNez1_F3d8OT8d_KuU4mZT4zn OydQyEOUfXKf39aZyGqOdvdjPNoWMk2hpmFEDMD5Kwy9JYrCr 78UyQlmwT5jo02hdKMfFdjHq5MMuBr9GZMYVIJtqv36r2 bRA1eMNcyW4_dCtc3T_LwRCo9lVLQm5ZoVyIaw mY03uILdff3klirUlu7qRic XPJIXw3MEo8uEzymT_7i2GuZ13zUgoXNlIgO1OzEZbQakF sVUMrUI_UzAi0G7dGYlGAZou27DbB5hGw0GWb33SEXyE3QzASDJbI6VpK3lJMl3aVRtCV1wL5hBi6KjiPVLcQ4RAL7T-G1IAAARkczGppQlm6QZZEM4Pfzk4x0LuQ02Wdjj95eAxfB6N4uA3ZvyEzdnTncArRuaVvrN49DO_kNCtSOUD-e

http://www.funtourbundle.com/kOOAnTJBVgtonWuIjTUnX56fzPD7ZreDOmOJzUSygHoHXREYS1XVLFTu4oLsbsA5TtbwfkznHTZtWKButWHCEJAbWJb5M5jRJhZA8q157ZPSPA0xvcuRPtODeUtmnjbadPQJJEBtZePHVGnguSVZZoPuCEG0okv2TzRKJ8U7owXe_U2b LgPzEO9Dm8 ODQNrDG vXOIFBX 8bcojFswENWuLP5VMw==-G1IAAARkczGppQlm6QZZEM4Pfzk4x0LuQ02Wdjj95eAxfB6N4uA3ZvyEzdnTncArRuaVvrN49DO_kNCtSOUD

Remove freescreencast.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.