home

niepotwierdzony 800076.crdownload

Sera

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The file niepotwierdzony 800076.crdownload, “Sera Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Sera

Description:
Sera Setup

MD5:
5f66d07e2bb91627605ad91e7dbde3f3

SHA-1:
9eef344707715c09729eccb19cdcd49875850247

SHA-256:
c250fed8827238f1d4d0958108a7ec061699c95d3c7c3dde4d639be1a37122da

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 3:44:07 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.5.22.19

File size:
964.1 KB (987,216 bytes)

Product version:
2.2

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\niepotwierdzony 800076.crdownload

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:+L9ipPc/HY7+5AxnJ58fr9rWh4WSa82P1YbAqxh5d+u0o1O/:+BUPc/47+a8fr9rYoa82P6kgh5dL0r/

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file niepotwierdzony 800076.crdownload has been seen being distributed by the following 11 URLs.

http://www.vaultsgrabstock.com/WVl6OTRQV041T1VReldVZEZaekZoTm1GUGJURkNOaVV5UmlVeVFrUTJVMFZ2Vm1kdVJqTnpjbE5wY0dadVRVZGpPVWM0SlRORUptTTliMHBxUjNCMVVGQXlaVEEzZDBzd05YQjRVa0pJVlZSVFIwSlpURWsyUkVRMlYxaFRORmwxWW1kVU1FbzJTVXBTVkhkaVV6bFVKVEpHWmt3bE1rSXhSVU5qYlc5S1lUY2xNa1pXU1cxa1FXMVJPRGhPYzIwM01WTXhTbUp2WlZOWVEwTWxNa1owYVVsbWNXNDJiamRrTW5od2VqTmpWMWhKWjNSSVdqUnBRMEpoWW5SMWIwWkNWa2hRUTNwd2EwRmxhV3N6ZEhwdVZETlBNekF5UVZFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWMzUnZjbUZuWlM1a2IySnlaWEJ5YjJkeVlXMTVMbkJzSlRKbWJYVnNkR2x0WldScFlTVXlaazFOTWpaZlVFd29aRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDa3ViWE5wSm1SdmQyNXNiMkZrUVhNOVYybHVaRzkzY3kxTmIzWnBaUzFOWVd0bGNpMHhNVFUwTmkxa2NDNWxlR1U9

http://www.todaysafetoday.com/WVl6OTRQVk5SU1dab2NFTTViRkphUWxsaFNUQjRTVzEyUzNwRFpubHFUazFQVDFkalRXcFRVa0p0SlRKR2VEZFlZeVV6UkNaalBUSldVbTFYUnpnd0pUSkdTbXcxWnpOeFdqVTJZVEpHUTBoUldHcFdka1kwV1VsblZHRjZOMWxXVFZkblVWbFljRkZVWVVKS0pUSkNkWEJ1Y25saFlUZHRaWFo0TW5aV1NIRTVkSGdsTWtKd2VXTldjVXhZV1c1UVFtbFpWeVV5UWxrelRuTlRlVXQzYUhwelpteExaV2RqUmxaWFlVb2xNa0pTVDJONVFXYzVWMjlhZUZVMlpGbGllR2xXUjJGbGVuQjFNak1sTWtaRFl6WlFWbXBXYUVSblp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWnRkV3gwYVcxbFpHbGhKVEptVFUweU5sOVFUQ2hrYjJKeVpYQnliMmR5WVcxNUxuQnNLUzV0YzJrbVpHOTNibXh2WVdSQmN6MVhhVzVrYjNkekxVMXZkbWxsTFUxaGEyVnlMVEV4TlRRMkxXUndMbVY0WlE9PQ==

http://www.vaultsgrabstock.com/WVl6OTRQVWhEY0RWNmFGRkdVRFJJTWtsdlpWWlpOa3czYmpkTFdXVkZVVEpsUkdsdU1XbGpkV2REYVVkTFpFRWxNMFFtWXoxWFl6WlBNMHhsY0ZRNGJUTmplRWQyVURrM2JUSXlTWFV5Ukd4SFFtUTRRa0pQYW5wTGVWVnlUMmhMUzBONU4wMU1UMFJPZUhaTU9GWnVaVkpOT1Zoc1VFMWFTRUozVmxGYVZuSkJNQ1V5UmpaVkpUSkdjRFV3VTBwMlZFMVpSV1F4Y1ZSTk5sRTRlbGhZVDNCM1EzbE9ORlJNUWlVeVJrZG9aVmxsSlRKR2FtNWlZMlJrVmxKUVNXVm9kamN6ZVhSM1QxY2xNa0pRUVZBbE1rWkxPSGwwUTNjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWMzUnZjbUZuWlM1a2IySnlaWEJ5YjJkeVlXMTVMbkJzSlRKbWJYVnNkR2x0WldScFlTVXlaazFOTWpaZlVFd29aRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDa3ViWE5wSm1SdmQyNXNiMkZrUVhNOVYybHVaRzkzY3kxTmIzWnBaUzFOWVd0bGNpMHhNVFUwTmkxa2NDNWxlR1U9

http://www.todaysafetoday.com/c?x=xd8D8wtz34/6dTFhji7AxpKXkLT0HiNKpRU1Vpfltrk=&c=47rckUrJ9zYfFbThbeu6VxCUC E4SCJDxQQi 17MFG/fbXZaPxK2r5wKqzR9sSgBoWIz67yPQfCeHS2KAjrsqIFYW7OnioNYOQVW1g8ZbYnndQ9J9TW7QhySk1TYdF/8j6tmplGfVolpT3w4CntnEg==&e=0&fallback_url=http://storage.dobreprogramy.pl/.../MM26_PL(dobreprogramy.pl).msi&downloadAs=Windows-Movie-Maker-11546-dp.exe

http://www.cleantowerspackage.com/WVl6OTRQWGMyVFZSTmRWZDJkMHBIYjNReGIyOUVUbE5PZFdoSFVuVmFiMWd3VVhJeFRHbzJVazl2VmpKSlpHOGxNMFFtWXoxcmJWcENRaVV5UmpWSmRHTkVKVEpHZVROemJEVnhRbXRKZUdWVVRGSk9lamR0TVdSa1RsQnpSelJGTUZoMmEwMVVkVFkwUkdGM1kyMVhKVEpHUm5aWVJDVXlSa05GVkd0R01rMUNVR1JDY1ZaMFJtTjNVMnhJYUcxS1QyeHpNU1V5UWpGRk1IUXpiVVkyVkRBeWFWcHJjbTlNU1ZwSmNDVXlSbmhsY1RSUlYyNTNSbkp6VkZKS09EY3pjM013TVdGMWIwVXlNM2xwVjBJMlpGRWxNa0lsTWtKaFZuZEJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabk4wYjNKaFoyVXVaRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDVXlabTExYkhScGJXVmthV0VsTW1aTlRUSTJYMUJNS0dSdlluSmxjSEp2WjNKaGJYa3VjR3dwTG0xemFTWmtiM2R1Ykc5aFpFRnpQVmRwYm1SdmQzTXRUVzkyYVdVdFRXRnJaWEl0TVRFMU5EWXRaSEF1WlhobA==

http://www.vaultsgrabstock.com/WVl6OTRQWFpKT0ZsUVFVVlZUbEZISlRKQ1VFeHZTVVpoWVRkMVowc2xNa1pyTW5ZeFdGQm1hVlJYY3pSNFlWUnRSa1EwSlRORUptTTlaRUZ0VGtKSVRESnFja1ZJWjBZMU5UQXpNVEUzV2tGbFlVNXZNRWMwT0RSc1RGZzBNbFJLYlRJNE16TnpTRWRxUVVka2FqZ3dRa2xHUkRGTlRHeFFURU42YzBSMVltVlFKVEpDYVhGTVQzbHVUREpoTUdaQlN6azBNemxaWmtOeVpVMVRRWEEyZG5ZMlN6QkhlRlZYV0RBeE4yTlpNa2RxZDFCeVRIUldValpVU0RGdlRtOHdhWFYxWmxCQmFHSTJKVEpDTTFOMVptUkhVU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp6ZEc5eVlXZGxMbVJ2WW5KbGNISnZaM0poYlhrdWNHd2xNbVp0ZFd4MGFXMWxaR2xoSlRKbVRVMHlObDlRVENoa2IySnlaWEJ5YjJkeVlXMTVMbkJzS1M1dGMya21aRzkzYm14dllXUkJjejFYYVc1a2IzZHpMVTF2ZG1sbExVMWhhMlZ5TFRFeE5UUTJMV1J3TG1WNFpRPT0=

http://www.cleantowerspackage.com/c?x=ALc68MSkOVwRI9cof6Cqy9iXzEXuFfRAPfmZ4wKl8ww=&c=VwpL0nXYhRZsZdWi69/hHtl5tnRN2eeIKSUOhCaaZF M8RO06DGBsRoozm3zUaeEfUlKJKMDvaySwV7CVVh4zGqUdFcp6KfuG/5hPM7e3LnOUiNV83wQ1 nXybi Hfcx5Ezx4NPcRy2e g1xYq3sbw==&e=0&fallback_url=http://storage.dobreprogramy.pl/.../MM26_PL(dobreprogramy.pl).msi&downloadAs=Windows-Movie-Maker-11546-dp.exe

http://www.todaysafetoday.com/WVl6OTRQVXhGUkZkUlRYcHdVa1JXTUdSRVUyWjJSMWt5VkRCWGF6bDVXV1JYZEZaSGFIbzVSVFZhUlROQlZGVWxNMFFtWXoxbVQzUlVNMWRWWmpaQ1VHczJOM0ZYVjNodVREQWxNa1ppT0UxUFdWaFJOMDVYTjI5VEpUSkdiVUZWWkRRNWQza3hjM1ZUT1RaWWJEZDBUMDV5YUhGSU9GaERiR1EyWVV4aFQxWmxURUYyT1V4MmRDVXlSbFJrVHpadGQwbFRVeVV5UW5sT1lWaFhWV05hWlVoVlFWSnFXbHBuSlRKR2VWcDRXRTV3YVdOWk1ITTJjekpaU213eFMxSTViWGxhVEV0elJFTnlWVTk1TlZoeE5qZExhMDlCSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm0xMWJIUnBiV1ZrYVdFbE1tWk5UVEkyWDFCTUtHUnZZbkpsY0hKdlozSmhiWGt1Y0d3cExtMXphU1prYjNkdWJHOWhaRUZ6UFZkcGJtUnZkM010VFc5MmFXVXRUV0ZyWlhJdE1URTFORFl0WkhBdVpYaGw=

http://www.todaysafetoday.com/WVl6OTRQVGxKT0VjMlJtcExKVEpDY1ZGTU1rWjBTV3d4TTNoMk9VSmtUR2hSYzJwUFRGZFZZbVJaUm5Kb1JtbGlSU1V6UkNaalBWb2xNa0ppZW5WNlNXMURkR3MzYkRSamFVa3lTVlUwYW01TlFXcFVlRlZWUVhCRVRTVXlSbGxDTTA5T1YxZEtWMUpEV2xCelYweHZSVEZyT0V0emVGaDFObGtsTWtKdGJsaE9WRFpEUjBOdWRrVXlUV050ZURaTE9HOTZiVlUwVEVoS1psbFJTMmxGYUZWU0pUSkNXVFo1ZDNOdGRuTlFTbk5hY25Oa1VHbElVemhMZFU5VE0xRnVTMndsTWtKWWFHVkpkakZTZGs4Mk1WQjRka2hyWWxFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWMzUnZjbUZuWlM1a2IySnlaWEJ5YjJkeVlXMTVMbkJzSlRKbWJYVnNkR2x0WldScFlTVXlaazFOTWpaZlVFd29aRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDa3ViWE5wSm1SdmQyNXNiMkZrUVhNOVYybHVaRzkzY3kxTmIzWnBaUzFOWVd0bGNpMHhNVFUwTmkxa2NDNWxlR1U9

http://www.todaysafetoday.com/WVl6OTRQVUpFZVc5NE9YbGljRWRXVEZoT1pWUjRja1pJVkc1VVJERkhlRVpGYTFvbE1rWkVkVUZvUW5WaE9WRk5TU1V6UkNaalBUQkhOU1V5UWpaVVVrNUxUMjlKVlhCbGRWbGFlVkF5YVZaSUpUSkdKVEpHTUZKVlptWnlPRWhVVEd0MGIzWjRiSE5VUmtkbFMxZE9iakpFVFdnM1UzcENKVEpHUjFwMWFHUnhhMlpUVEhaQ2NYWmlOSHB1T0VoVFlsQkZOMHRoY0dFeFpqWTFkak5XVlV0NlpsaEZWVVZZSlRKR1FubENkMU5ZUnpOeFN6RmFVa1FsTWtaVVMwRTNSVll5TWpGTlowSk9aRk01WVZwRE5VeDFZV05OT1ZSRFp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWnRkV3gwYVcxbFpHbGhKVEptVFUweU5sOVFUQ2hrYjJKeVpYQnliMmR5WVcxNUxuQnNLUzV0YzJrbVpHOTNibXh2WVdSQmN6MVhhVzVrYjNkekxVMXZkbWxsTFUxaGEyVnlMVEV4TlRRMkxXUndMbVY0WlE9PQ==

http://www.todaysafetoday.com/WVl6OTRQVVZZZWxwVmMweFNWbVoxWjJWMk5tZFJlSE5ZTjBWNVJUUnlVekI0VFV0YU5tRTROMDFXTlhseWNHTWxNMFFtWXoxSFkzZGhPRlEyYTBaT01FRnFVRlpzYWpGRVNsaHRhRkJaWVhsM1ExZEtPRFJQY3pKWVNtc3dNSFZPVlRkU1JUZzJZekZDU1V0TFZrOXdZbXBzVUZOWWVYZHdWM0ZQVlVkbWNsSWxNa1l6T0hCQlkzTm5KVEpDVW14bE5uVkZUMjl6SlRKR1RWTTFialpLVkZWdGNISkJaR2g0UVRaVWVFWmFVbFZSVVNVeVJrWWxNa0p0YlROelRtVnRlakIyU1ZoSVNtcEtibkV3YkdScVVsWmFiRnAzSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5OMGIzSmhaMlV1Wkc5aWNtVndjbTluY21GdGVTNXdiQ1V5Wm0xMWJIUnBiV1ZrYVdFbE1tWk5UVEkyWDFCTUtHUnZZbkpsY0hKdlozSmhiWGt1Y0d3cExtMXphU1prYjNkdWJHOWhaRUZ6UFZkcGJtUnZkM010VFc5MmFXVXRUV0ZyWlhJdE1URTFORFl0WkhBdVpYaGw=

Remove niepotwierdzony 800076.crdownload - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.