» notepad-12986-dp.exe
Overview
Analysis
File Details
Downloads (15)

notepad-12986-dp.exe

Kisi

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application notepad-12986-dp.exe, “Kisi Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Sacip (signed by Mode Beta (Fried Cookie Ltd))

Product:

Kisi

Description:

Kisi Setup

Version:

3.2.2.4

MD5:

4478f4b5052fdbe8310a7adefd5b0515

SHA-1:

c0c555d4db30e0ba85a285be5da6d49052d8c920

SHA-256:

473143ab8318578066609b806c787e076f4434981bb4fa8ceb91575b2e79dcfd

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

1/13/2025 7:33:34 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.4.23.13

File size:

952.6 KB (975,504 bytes)

Product version:

4.4.2

File Lite

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\notepad-12986-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:UjJz9OiMv1hlYlmHZRY5L5H/9x7NJXH6:UlZMb/5RYRV9h36

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file notepad-12986-dp.exe has been seen being distributed by the following 15 URLs.

http://www.clearguardapplication.com/WVl6OTRQV2xySlRKR1RYWmlkVFZRSlRKR05uTTBUM0pDZEVsSlYyaFJOMXBqTW5OVk5IcHdTVFJCZWtkQk4zYzFRV1YzSlRORUptTTlSWFo1ZFRNeVZVUjNNQ1V5UmxRMmNtOXdSemwwT0ZwNkpUSkdVM2gzV2tka1UxWlRUMWQ2WnpGV2RuaFRORzk2WjJkVGEzUmpXalYxY0NVeVJtaFlTa1JoWlV4WlFWWm9hSFl4V0ROeFVIbFlkMVlsTWtJNU4zSjVUMWd4VGxVbE1rSXhka0l6YUc1UVFsSnFkMngyVTBkMmRuVTFSVzFVWlVnM1F6SjJOVWgwYlZWM2RrbG1SVXRaTkdKT05qWTRWV1ZSYVU1SlJGVlJOMFpzUXpCeFp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQnpKVE5oSlRKbUpUSm1ibTkwWlhCaFpDMXdiSFZ6TFhCc2RYTXViM0puSlRKbWNtVndiM05wZEc5eWVTVXlaall1ZUNVeVpqWXVPUzR4SlRKbWJuQndMall1T1M0eExrbHVjM1JoYkd4bGNpNWxlR1VtWkc5M2JteHZZV1JCY3oxT2IzUmxjR0ZrTFRFeU9UZzJMV1J3TG1WNFpRPT0=

http://www.capitaltoursoftware.com/WVl6OTRQWHBrUnlVeVJqTjNhbGhyZEVsaFNXOVdVbU5LV2tKelFuZzVWMGRNYmtJNFdqRm5kMDgySlRKQ1V5VXlSbXhpV1VrbE0wUW1ZejF5TjNJMFFUaDRWMUE1Y1ZsTE4yaFdjeVV5UWt3eE9YQnJjV05hUVZOTmFtWlZiVXBPYjJwVGRXTTBVM2NsTWtKMmJ5VXlSblZvVFRaa1dtTjJjbEZSVFVkVk9EbEJUa3BsVlc1cGRFMUZUR1kyYTJNMlpGQlJjMDFJUlhkNlpERTJSM0JpT0hWWVQycGxTWEZMVUdKWWFYUlFlRXhTTlVaSk4zbE9XRTVFTkZaV2QyWTFTV051TVZWM1pXUm5kVmswYjFkb1RXWkNWbFpZWmxFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpZU1V5WmlVeVptNXZkR1Z3WVdRdGNHeDFjeTF3YkhWekxtOXlaeVV5Wm5KbGNHOXphWFJ2Y25rbE1tWTJMbmdsTW1ZMkxqa3VNU1V5Wm01d2NDNDJMamt1TVM1SmJuTjBZV3hzWlhJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05VG05MFpYQmhaQzB4TWprNE5pMWtjQzVsZUdVPQ==

http://www.sharerepositoryhosting.com/WVl6OTRQV1ZOYkZWU05tczJjVEYySlRKR2JsRkZTR3RYZW5CRFFXRjFURTAxYkRneVdFWnpSVmNsTWtKVWNqTnlRVU56SlRORUptTTlUa1ZGWTB3MFlYZGpaR1ozZFdsQlJYQkNXVTVOZG1waE5YQkhTbFpDTjAxclZFdFhhRUozYzBKTWMwcFZVRUpLZVdKWmRGSjZXSGQyTlZsVVZDVXlSa1JpY21NMWNDVXlRbWRSYTBoRlZWWm9Ra2gwWkhkeVRHTTJkbFp5UkhCU1VYaHJjU1V5Um5KYWMwRjZXa1ptV0Rsa05taHpOV2xwUjBSWVMzcG9XVzlIUTFwSGJUTlRUR3h5YTFGbWRERjJPVzlPTUhoclZVWWxNa0pvZFhjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpZU1V5WmlVeVptNXZkR1Z3WVdRdGNHeDFjeTF3YkhWekxtOXlaeVV5Wm5KbGNHOXphWFJ2Y25rbE1tWTJMbmdsTW1ZMkxqa3VNU1V5Wm01d2NDNDJMamt1TVM1SmJuTjBZV3hzWlhJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05VG05MFpYQmhaQzB4TWprNE5pMWtjQzVsZUdVPQ==

http://www.sharetodaysafe.com/WVl6OTRQWEl6U1RObFdHZEtaV0UwUVVwM1pHaDRSRkV3TlZaVUpUSkdRM0UyWVROcU56UlJURzkyYUZoM05EUk1UU1V6UkNaalBXTnplVXR6ZUNVeVFsTkNhM0JFV1VWaU9HRkNiVVpaUjFaYVdEWktXSFphU21GWWJIaEZZMjFLYlcxNlVrNGxNa1pVVUROVFRHRXdjMUpqWmxjMmRHcFFWbVJTTW5sR1lqZ3hhRXhITUNVeVFsZ2xNa0prWWpWMk5GVjFUR3N4SlRKR1kzSmljbUUwZG1kb2JtaFdWek01YzB0c2QwTlZSMDVyVFdWU2NERWxNa0owYkhGMU9IVndaWE5xVFVadVFVUlJiMVJIY1UxalFVNHhTbElsTWtKaFUwZFJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTJFbE1tWWxNbVp1YjNSbGNHRmtMWEJzZFhNdGNHeDFjeTV2Y21jbE1tWnlaWEJ2YzJsMGIzSjVKVEptTmk1NEpUSm1OaTQ1TGpFbE1tWnVjSEF1Tmk0NUxqRXVTVzV6ZEdGc2JHVnlMbVY0WlNaa2IzZHViRzloWkVGelBVNXZkR1Z3WVdRdE1USTVPRFl0WkhBdVpYaGw=

http://www.sharerepositoryhosting.com/WVl6OTRQVU41Ym1GWlNrNXZjWFJ6WlUxYWVGZDRlbTlKVjJOR01XUnZKVEpHYTFaRFF6VkRZakZyV214VWVqQjRPQ1V6UkNaalBXRnRXVmh3YkRSdVV6STBiMlE1ZUVweU4zZFRWakZoVjFoRmJIVkhkVUp2U0VwQ1lUY3hNMUZRV2xKblNtcHRXRkYwVGxKWWRuUnNUMmxtWWlVeVFqbFNPVWhEWVZCRFoyVklTRGRMYkRGaGRIa3hOa2RFWlVwVlZXMWxjaVV5UW5WNVR6QjZVbEZMYldkWmFHTllTVXBrVWsxYVVHVlNPRXAyWmpKTWIxSXhUMFZHTURCV1dWUTRWV3g0WTNaWlJGSnpiRTR3ZEdsblFsRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndjeVV6WVNVeVppVXlabTV2ZEdWd1lXUXRjR3gxY3kxd2JIVnpMbTl5WnlVeVpuSmxjRzl6YVhSdmNua2xNbVkyTG5nbE1tWTJMamt1TVNVeVptNXdjQzQyTGprdU1TNUpibk4wWVd4c1pYSXVaWGhsSm1SdmQyNXNiMkZrUVhNOVRtOTBaWEJoWkMweE1qazROaTFrY0M1bGVHVT0=

http://www.currenttoursclear.com/WVl6OTRQVVJyVDFwNllXc3pObGMxSlRKQ01rc2xNa1pYTUdsNVNVSkpia0ZrZVhOQldsbE5kak4yYWpOTVJHSXdkSEZySlRORUptTTlWakJ1VFV4MGVuUXphbWRSYm5WVEpUSkNjVEk1Ym1KWWF6SjBNR3QySlRKR2IxRXlOMmgwYzJVbE1rWTJOV0pJVWlVeVFrbzBTVmsxVTIxVWNVTmhkMVprY1hWUlowUmxOREpZY0ZSSFlXd2xNa0pFTmlVeVJteHpVakZ1UlZGck1rSnlkM2hDYzJaT2RIUmlKVEpDTlU4MFVuaEdXR2czYlc5dlZYWkNNVFZXYlZVeVVVdFNUM04xZGlVeVFsRkplRXAxUjBGak5uSm5NRVJ6YlVkWlRXcFFhR3hsWnlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhCekpUTmhKVEptSlRKbWJtOTBaWEJoWkMxd2JIVnpMWEJzZFhNdWIzSm5KVEptY21Wd2IzTnBkRzl5ZVNVeVpqWXVlQ1V5WmpZdU9TNHhKVEptYm5Cd0xqWXVPUzR4TGtsdWMzUmhiR3hsY2k1bGVHVW1aRzkzYm14dllXUkJjejFPYjNSbGNHRmtMVEV5T1RnMkxXUndMbVY0WlE9PQ==

http://www.capitaltoursoftware.com/WVl6OTRQV1p1Vm5KeWNHVllVMGRQT0ZwMmJsVk9jelZzVmswelRsbGpWRXRUWkRWQ1l6bGFWaVV5Umt4b1RXaFRheVV6UkNaalBUaFhWR1pQUkROR0pUSkNORlp1WkZkTlVYRklkVXROWmlVeVJuQWxNa0ppT1daU1RFUkZjMHRFVTJnNGRIcEtkMFJ6Vmt4bFN6VlJabUlsTWtKb1puUlVOMVY0VmpWWlZsWTNaamMxUVRoMFlVVjVjVFo0Wm1oMVpWVkJWMEo1VGxkbGRqZDNXWE5GZUd0NlMwRnBWVGhuYURWRWFXcFhRbXRGYkZWWmN6UmtRaVV5UWxRbE1rWldibWRoU0ZRM1ExVWxNa1kwVnlVeVJtZG9NMHNsTWtadk5rbHhiVVZrVVNVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhCekpUTmhKVEptSlRKbWJtOTBaWEJoWkMxd2JIVnpMWEJzZFhNdWIzSm5KVEptY21Wd2IzTnBkRzl5ZVNVeVpqWXVlQ1V5WmpZdU9TNHhKVEptYm5Cd0xqWXVPUzR4TGtsdWMzUmhiR3hsY2k1bGVHVW1aRzkzYm14dllXUkJjejFPYjNSbGNHRmtMVEV5T1RnMkxXUndMbVY0WlE9PQ==

http://www.citysafeapplication.com/WVl6OTRQV0pYYXpWYVQxWk5SSFJhVDJSRlJtMUNNR05MZFRGV05VbHBVVTBsTWtKalRrNVFTRUZqYTNjNWNXeFlVU1V6UkNaalBWbG9TV0ZuVUhGd1RHWmtRWG93ZGtOT2EyTnZTemRMWWs5c09GRkZUME5VWnpObVppVXlRa1JaZEd3bE1rWm1Ta1pDWWtZM1puZDRiell5ZVRkTk1rMUdRM2hXWlZad05qQmlSRlZRTUZsNWQxQnlaMEYxWmxNMFluUnhUblV6SlRKQ2RWVkNVbmt6VTFkdVlWRlJNbmxqZWpSbVNIVnhiaVV5UWxsR01qZE5TU1V5UmxWWlNsaGxTMU5TU21sVVQwTmxUbTFrY0NVeVFqRkVWek5UUTIxcVp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQnpKVE5oSlRKbUpUSm1ibTkwWlhCaFpDMXdiSFZ6TFhCc2RYTXViM0puSlRKbWNtVndiM05wZEc5eWVTVXlaall1ZUNVeVpqWXVPUzR4SlRKbWJuQndMall1T1M0eExrbHVjM1JoYkd4bGNpNWxlR1VtWkc5M2JteHZZV1JCY3oxT2IzUmxjR0ZrTFRFeU9UZzJMV1J3TG1WNFpRPT0=

http://www.gifttownsign.com/WVl6OTRQVWgwVjJKbVkxRTJPVlJSSlRKQ1pVOVJkSEZRWTFsUWMwRkVjRk5DYzFSR2MxTldlVWRyVFZZNFlVVTFjeVV6UkNaalBXSmtOWEZ4Y0ZCSE1XcHdWR1ZTZUVSTmEyaHdTVE5DYW5WVFoxQTBkblU0T0UxdlpsRkJSSHA1Y0RodVNHcHRWV3BETjNoSVlWRTJUbUZMWlc5dVZWSnBjbmxYY0ZkNUpUSkdhVXhhZGpOalJXTnhjVkZSUlhJMlRXNHpWRzlyZWs5cmNVSTVTV3hNT1c1blNsUnRRa3RqWVdGb1RVdGtKVEpDY0NVeVJtZFZhRk00YUVOdVJtbFVOMVZxTkVkRlMzRjBNMWhyY25KRlJuWklRU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEJ6SlROaEpUSm1KVEptYm05MFpYQmhaQzF3YkhWekxYQnNkWE11YjNKbkpUSm1jbVZ3YjNOcGRHOXllU1V5WmpZdWVDVXlaall1T1M0eEpUSm1ibkJ3TGpZdU9TNHhMa2x1YzNSaGJHeGxjaTVsZUdVbVpHOTNibXh2WVdSQmN6MU9iM1JsY0dGa0xURXlPVGcyTFdSd0xtVjRaUT09

http://www.citysafeapplication.com/WVl6OTRQWGRLWVVOblUweDBUbmRwWkc5VFJIWkNjbHBsYXpkcWJuUmxZMjlKYVhsM1luaFVkMDlJUm5JNFpYTWxNMFFtWXowNFYzUlBhazFCYkc5cFNpVXlRa1ZHWkdWbmRVWlJRV0YzUm1kNVVHNU5TMDFVVmxkWE5GY3laVzloT1VzNFJFZDBVV3hTYUVWUU1XbGhWbUpQVXpFbE1rWk9WMFJpYkVsU2EyVkpKVEpHTUVGRVF6aExaMFZOZERSNU4yVjZPRFZSWkRkb05IRjBORUZNUW5OT0pUSkNPVFZxZFhwWU4zRnlTMDEzZHpSaWJEUkxTbkU0TXpKaVdIVlBjMUZhY1NVeVJtNDJNMjlDTlhsUFluSm9XbEpuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0hNbE0yRWxNbVlsTW1adWIzUmxjR0ZrTFhCc2RYTXRjR3gxY3k1dmNtY2xNbVp5WlhCdmMybDBiM0o1SlRKbU5pNTRKVEptTmk0NUxqRWxNbVp1Y0hBdU5pNDVMakV1U1c1emRHRnNiR1Z5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVTV2ZEdWd1lXUXRNVEk1T0RZdFpIQXVaWGhs

http://www.farmtowntowers.com/WVl6OTRQVkoxZWpOUWVucFlaSFI1TW5CbVkyczJZelpsTmlVeVFrSjNWbmxzT1ZWU2VGYzVOV2RqU0RBNVVpVXlSbE5aSlRORUptTTlWQ1V5UmxGMFoyNWxjVWw2Y0RoS2RXUkpValY0UTFWa1dFMTZaRmgxYjNveFJUZ3pTREZGVjBRMWVsZDNWRmhMZWxGS1ZrNWhKVEpHVkZVelZFdFNkV0Z0VTFkR1lubHFaV2wwZFVWQ1NsaDFRWGgxZGpNeVRXMDNZa28wZERkRVVFMTJVbGxsVUdreFIxVjZaMUZVTTJ4UWJYcHRkSGxyT1hGR2MxWlpNRXh2ZEVaRlYxVndWbmN3YkRKbFZsWjVNa05KVkRkdFRIQmhaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEJ6SlROaEpUSm1KVEptYm05MFpYQmhaQzF3YkhWekxYQnNkWE11YjNKbkpUSm1jbVZ3YjNOcGRHOXllU1V5WmpZdWVDVXlaall1T1M0eEpUSm1ibkJ3TGpZdU9TNHhMa2x1YzNSaGJHeGxjaTVsZUdVbVpHOTNibXh2WVdSQmN6MU9iM1JsY0dGa0xURXlPVGcyTFdSd0xtVjRaUT09

http://www.gifttownsign.com/WVl6OTRQWEZ3V0ROUFZuUlhPVlJxZVdoSFJsSXdhVUpHVjNCTFUwcEdVa1kzUkRaSVEyTmxkRVptVDJ4MVFqUWxNMFFtWXoxclZTVXlRbE4yU0NVeVFsQnFRVXRrVFRCUFExQjZlRUZTUkRGMmNHVnFjbVpVUkd0ME1UUk1NbFk1TlVWVmNISnlkMEphTVZobGJVNUlVbmxwWWxCakpUSkdOa0V5Um5oRU1YZHljMGhNU2s1RE0zWldTelZzV2pCcVdubERTemN5TmpKTU1VNUZUemxOU1ZKdGRqTk5hV3BLZWxwbVprUk9SRlJWUWsxWGNXUlhRVXM0YUhFeWVrZGphM2hUTlZWUGRFY3pSaVV5UW1JM1NIWldVU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEJ6SlROaEpUSm1KVEptYm05MFpYQmhaQzF3YkhWekxYQnNkWE11YjNKbkpUSm1jbVZ3YjNOcGRHOXllU1V5WmpZdWVDVXlaall1T1M0eEpUSm1ibkJ3TGpZdU9TNHhMa2x1YzNSaGJHeGxjaTVsZUdVbVpHOTNibXh2WVdSQmN6MU9iM1JsY0dGa0xURXlPVGcyTFdSd0xtVjRaUT09

http://www.cycleupdateguard.com/WVl6OTRQVkJJYWpOak5XZHhNamhzYWlVeVJsSTNiMDB6VVNVeVJuaFZTelpPWTFKd1EyTWxNa0pHTWxkT2NqSkNWbU5pVEZVbE0wUW1ZejFHTTNneFNYbHlVSFpJYVVReFVqQnBjWFU0VDBJeGVFSTJRaVV5Um1VeVVEVkhRMUpxWlZkQk9WQllOMHh1U0dKTGRUVXpiWE40TkZadWFYUTFjVVl5YkdWNFpHRTFXbTlWUVV4Q2FVRlNObmhKTUVwd0pUSkNVMHRpWjFWa1RIZzRXWGs0YVRSS1l5VXlRbmtsTWtKd1JrOXRKVEpHUzJ3MmFqSXdXamxDUTFGNk9XNHlhVEpXVkdObWVHSjZkazl1YUc1NFpWbHZiME5wVGxCV1MwVm5KVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTJFbE1tWWxNbVp1YjNSbGNHRmtMWEJzZFhNdGNHeDFjeTV2Y21jbE1tWnlaWEJ2YzJsMGIzSjVKVEptTmk1NEpUSm1OaTQ1TGpFbE1tWnVjSEF1Tmk0NUxqRXVTVzV6ZEdGc2JHVnlMbVY0WlNaa2IzZHViRzloWkVGelBVNXZkR1Z3WVdRdE1USTVPRFl0WkhBdVpYaGw=

http://www.capitaltoursoftware.com/WVl6OTRQWEZ1T1RSNWFHNGxNa0k1VVRsTmFGaEVNVFE1U1d4Uk1YUmpSbXd3UXpSYWFIcHpaSGhqY1hWeUpUSkNkMVJKSlRORUptTTliRWxNZFRkd1owTlBZVmwxZEVkUmFWTmFXR2wzVEhNMllqUXhhRmxRTmpjeVNtc3hUMWRJWVdocFFWSnJXa2xCUXpONlQyNVNOR2t3TlROTlpVNVRKVEpHU0NVeVFpVXlSa0p0VDNsUU9WUnNTbEJDV21GMmJEQndUWGRFTWpaUkpUSkdZV1E0VlRnbE1rSjZNelJDZVVNbE1rWndlRFZ0U0dkWVRUZGlkamRQTUZoMVNDVXlRbnBPUWxCa2R6YzVNRmgyYUVkMVNrTkJSVXBvV1dOblYwSmlVMEVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3Y3lVellTVXlaaVV5Wm01dmRHVndZV1F0Y0d4MWN5MXdiSFZ6TG05eVp5VXlabkpsY0c5emFYUnZjbmtsTW1ZMkxuZ2xNbVkyTGprdU1TVXlabTV3Y0M0Mkxqa3VNUzVKYm5OMFlXeHNaWEl1WlhobEptUnZkMjVzYjJGa1FYTTlUbTkwWlhCaFpDMHhNams0Tmkxa2NDNWxlR1U9

http://www.citysafeapplication.com/WVl6OTRQVmROVUVzMU9VSTFUMGRyWWtsSVlUbGFjemhEUjBnbE1rSnpiVEYzZVV0elVqTktiMEl6V25SeFlVeGhVU1V6UkNaalBYcGFTbFZVYmpGWlFXNUZWR2xwVGsweGRrZ3lSV1YxVW1SaWNHSlhkVUZaYUdKdGRGbzBNRWhWZVRneWVFbGxKVEpDUlRsaFpGbEVSREU1UjJaRWRWbE1SRlprVW1NbE1rWTVlVEprVjJkR1JtNURUMWN3V1hnMVdrdEphbFI0YlU1ckpUSkdZbUZaUlhGcmNqZzBOVEkxZFdFNFZrd3haSFpPTlVRME9HWnhlVkV5YlhRNFdWUTFObmszVUd4dVJsVkliMm8xYkVrbE1rWlZkRnBSSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0hNbE0yRWxNbVlsTW1adWIzUmxjR0ZrTFhCc2RYTXRjR3gxY3k1dmNtY2xNbVp5WlhCdmMybDBiM0o1SlRKbU5pNTRKVEptTmk0NUxqRWxNbVp1Y0hBdU5pNDVMakV1U1c1emRHRnNiR1Z5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVTV2ZEdWd1lXUXRNVEk1T0RZdFpIQXVaWGhs

Remove notepad-12986-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.