home

recuva-13044-dp.exe

Kisi

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application recuva-13044-dp.exe, “Kisi Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Sacip   (signed by Mode Beta (Fried Cookie Ltd))

Product:
Kisi

Description:
Kisi Setup

Version:
3.2.2.4

MD5:
ef40d2b9de0961b7261c53d812f8e44a

SHA-1:
0edb3fdf64aaafded05c5ae7b39001d46f16d2f4

SHA-256:
1be8e5ece0302f2d6612415d23e21d69f1a835cc076eaf4387427a2c06266a9b

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 5:57:52 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.23.9

File size:
952.6 KB (975,504 bytes)

Product version:
4.4.2

Copyright:
File Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\recuva-13044-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:njJz9OiMv1hlYlmHZRY5L5H/9x7NJXH6:nlZMb/5RYRV9h36

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file recuva-13044-dp.exe has been seen being distributed by the following 11 URLs.

http://www.currenttoursclear.com/WVl6OTRQV0pCVWxsTmVqbHBXV3BXY2poUWJWYzFTa1pIYkZvNWFXNXdRVU5OYjJka1kxbHpURTAyVGtOTk1rRWxNMFFtWXoxTmJYY3lhbFpFSlRKQ2FrOXlWemdsTWtaTVNYaFNZbEZPUmpOQk1YZG9UVmhxVFUxVWNrUWxNa0pwUWsxak1XcHFkWEYxWjIxa1JFVlVXazRsTWtKM1kyTlRUV0ppU0VwdWFIaGhPVk5XUm5wbVUwMXNUWFpDUWtaUVZrSllabWROZWxKSVVTVXlRbFZ2V1U4MFdDVXlSbXA1U3lVeVFrRklSbUpXYUZKdk9UTlRTR2hSZUZsTE0wZE9XRkJPY2tNMU5tWXhNelZGV1ZnNWRuRnZZak5XVGtwVFVTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWmtiM2R1Ykc5aFpDNXdhWEpwWm05eWJTNWpiMjBsTW1aeVkzTmxkSFZ3TVRVeUxtVjRaU1prYjNkdWJHOWhaRUZ6UFZKbFkzVjJZUzB4TXpBME5DMWtjQzVsZUdVPQ==

http://www.citysafeapplication.com/WVl6OTRQVlI1VVhsUWNubGFaVzlqV2t4WmJWVkpXbFJJUVhoamNTVXlSbUkxU0VKdmFIZzRjRTlDYVRGQlEyNXJjeVV6UkNaalBXRndhemg1UmxaUFJ6RldjVmhJVFVaaWRqbGxWbGdsTWtKUk1taEZPVTlwWVZGQkpUSkdSV3BpWjBadGRWUnNXVlZrVWlVeVFrNDFUMkZKVVRZMFowcEJOVmxDVEU5NVFuWlBURmwxVDBGYU1rWkhkVlJPV0ZaMVkySXlKVEpHVmxWWGJ6VjJiekJIUnpZMmNYcHFZV1pJSlRKR04yNXRaRkkzUzBjeFltRmlUV1FsTWtaMGR6TTJkQ1V5UW01TlUzWTFKVEpHVFVWMUpUSkNVRTFyT0daaFltSlJTV1pHZHlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aa2IzZHViRzloWkM1d2FYSnBabTl5YlM1amIyMGxNbVp5WTNObGRIVndNVFV5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVkpsWTNWMllTMHhNekEwTkMxa2NDNWxlR1U9

http://www.citysafeapplication.com/WVl6OTRQVE5yVmtzMlYzbzROSGhSYURKSlp6Rk5hemRqYTJKRWEyUlpiSEZvUVVscFNIZzVRM3BIY3pWUVJXc2xNMFFtWXoxdU5YTlhORXd6UlVsVU9VVWxNa0pKZEdsV0pUSkdRVGd4UzBSNVdrOUdlVUZCTVdaalVteDBhMHBTUTFOTE1FaE5TMDB6WW10cFlsWTRSelVsTWtaUk5tUkNiMFZTZFRablRHdDJORGhDT1VWcFJVcDRaVVkxVEVSUWFqTnVjRkJKVmpKVGJraFVhbTlwYUZaYVlWbGxjSE5RYkZBelZDVXlSa2RVWTBkUVpXZDVRM294ZFc4M1p6bDVSRmw0YWxkVU0yVllhV0ZZSlRKQ1dXVlhlWFpuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1SdmQyNXNiMkZrTG5CcGNtbG1iM0p0TG1OdmJTVXlabkpqYzJWMGRYQXhOVEl1WlhobEptUnZkMjVzYjJGa1FYTTlVbVZqZFhaaExURXpNRFEwTFdSd0xtVjRaUT09

http://www.sharerepositoryhosting.com/WVl6OTRQV3gwTUVobVFrd2xNa1kyVlRKWU5qVTFOV3hLWlhOS1pHaEJiR1E1WTFWa1dVNUNZM2htU1dkUVdtaHpPQ1V6UkNaalBVOU5Va2xUTkhZeWF6TlFWSGhsVTA4NGNVdFdZWFEyUXpSb01WWkNjMU5MTkRaNFRXaEtTVU5NUzBkNlpXVndaM0kxY0RJemEwbFFXSHA1VWtOd1ZEUnVOREpEWTNKRk0yRXlTRlExT1ZoNE1DVXlRbmszYWxSSVdVRmlVV2t3YW0xemFtMUJTU1V5UmpCTFJucEdlblIxUlUxQ09ERjNkRlpIUW1wWVJGQk9KVEpHVnpCUmFHSlJVVU15U0dOYWVsQllWR2h3WTJwM1NqVXlVU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprYjNkdWJHOWhaQzV3YVhKcFptOXliUzVqYjIwbE1tWnlZM05sZEhWd01UVXlMbVY0WlNaa2IzZHViRzloWkVGelBWSmxZM1YyWVMweE16QTBOQzFrY0M1bGVHVT0=

http://www.gifttownsign.com/WVl6OTRQWGRxWlc1RkpUSkNVMDQwVTNsTk5YQWxNa1poZVhSV0pUSkNSbE5JUzFCNlQwMWtVMk53ZVVkbk1IbGxiVzVEY0djbE0wUW1ZejFMUkVSUFFrVldXbWhsVmt4SFUybEJZM2gwT0dwSmRGUTJaV3RtYW10M1VFMW9VM3BJTkdod0pUSkNibWdsTWtZbE1rSk1ORTFOYW1VbE1rWnFVSE52UVU5WU0wUlVPRkJhU0RSTlpVODRkbkpOVWpaNlRXRnNjazVrUWpWNlIyVTFWVVZPU1hsbGJWaHljVkJDWkVVME9YVk9lamxyYVRSWldYaHBSVlpPWTJzMWVUVkVjVWczWW1Ob1FYbE1lVWszV2tKQk1DVXlSbVZoZURkRGRrbDNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtMbkJwY21sbWIzSnRMbU52YlNVeVpuSmpjMlYwZFhBeE5USXVaWGhsSm1SdmQyNXNiMkZrUVhNOVVtVmpkWFpoTFRFek1EUTBMV1J3TG1WNFpRPT0=

http://www.sharerepositoryhosting.com/WVl6OTRQVEJVYm5KMlRHVm1SRWRTTnpodFRYWnZZbkZIUkVkR05GUnBZWGg1YzJoclRFRmllVWwxWlVOaFVuTWxNMFFtWXoxWlpsSjBlR0ZGYjA5eVJFaEhkRGhvYmtGWkpUSkdaamwyWjFrMWFTVXlSbXd3V0ZKWWJWZGtXVzVISlRKR1dsaDVOM0JSVVVkeGVYTnNNazAxUVRJMFFuRmtXbEJxTm5NbE1rWnZNVzFZYjFWdVVXaERRbHBJWjJjMFZXNDFhVzVyVlZod2NXbzJjVkJPWlVSaWRuWnRhbkF4WVc1Q2JrRmlabGwzU1cwMlduVkJabWMxYmt4T1ZYTTBTa2xXUmxOclRETmllRnBsY1ZwVlJYSkNaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprYjNkdWJHOWhaQzV3YVhKcFptOXliUzVqYjIwbE1tWnlZM05sZEhWd01UVXlMbVY0WlNaa2IzZHViRzloWkVGelBWSmxZM1YyWVMweE16QTBOQzFrY0M1bGVHVT0=

http://www.clearguardapplication.com/WVl6OTRQV0ZWVTNVd1YyUllaRkozYnlVeVFtTjNURTg0VGtkSWRrNDVOWHA2YXpWVFZtYzJkV0ZNY2xGaVVsSXlRU1V6UkNaalBUQnRibEJRWTNSaVJWSnpPR04wYkRNek5tNTRWWE5YWlZGM1EyWldNR0ZhY1d4eWQycEdURlZETld0TmIwOXVXWGxEZWxKSmFXOVFiSFU0VUdFeGNUSklTV3h3VG5kcFR6aEdWbGxaU0RaMk5sSWxNa1lsTWtKRmJscElOR2cxZVRSVVNuWk9iMU5GYkc5WWRYbGhWVVprUWs0eFoyTmpKVEpDTm0xTFFrbGtiWElsTWtaSWIzVmtkV2N5YkVwdE1Fa3piRWRVTlVoSGJ6Tk1kWEJuSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1SdmQyNXNiMkZrTG5CcGNtbG1iM0p0TG1OdmJTVXlabkpqYzJWMGRYQXhOVEl1WlhobEptUnZkMjVzYjJGa1FYTTlVbVZqZFhaaExURXpNRFEwTFdSd0xtVjRaUT09

http://www.citysafeapplication.com/WVl6OTRQVVZLY1VGamR5VXlRa0o0YW5oSmVucEhXVnBUY21sMVZHTnljMlpYVjI5d2VWWkhNamhCYW5sRWJreDRaeVV6UkNaalBWTlpXa2N6WnlVeVFraHhTM2RCZHpFMFNVVkZTak5PU0VKUk5HcEVOR05oT0RKSGVWcE1WaVV5UWprMlF5VXlRa0ptU1RoMk4yWkJKVEpDU25sWWRrNVNhbFF4VDBJeWNFOW5WazVYT1VaeGVHbFVVMlJrT1VORFFrTktKVEpDTXpaMldWWmhiSE4xV1ZwWU5WSnFlRU1sTWtadVRUZEVlbFZRYnpSeUpUSkdjVGxFYmpneVRuTlJhQ1V5Um1oalVtSndaRGRXU21VNWIycEtaRGNsTWtaS1FUZFhlbFZOUVNVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aa2IzZHViRzloWkM1d2FYSnBabTl5YlM1amIyMGxNbVp5WTNObGRIVndNVFV5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVkpsWTNWMllTMHhNekEwTkMxa2NDNWxlR1U9

http://www.laboratorysafehead.com/WVl6OTRQV1JHV21STmVtTWxNa0pSV2tac2JuTmliV0p2VDNsVldDVXlRbGRZWkVreGJreHBiVWcyWlcxR2NtcExUM1Z6SlRORUptTTlOVGt5T0dGMFduQnVVa0Y2ZUVOcWNrdEhObTFMZERFbE1rWm1TRGcxYW5CR1YwZ3piU1V5UmpWR2JreE1hU1V5UW1kT1RuUlFkV2xaYldwd1F6TWxNa1pDYzJwdWVYRk5SekZhUTB3NFkyaFhRVkZDVVZGa1dFUnFKVEpHU1hoeFNrMW1aRUppU21kM2JHUTRjVkJ5VHpOVE0zWXpRMVpHV0ZVM1RXaG5kVFJZTlVaclZIUlFVQ1V5UWpGbFlWUktTRTlzYzFaMWJYSWxNa0p1T0ZVNFZ6bFZjMEVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWkc5M2JteHZZV1F1Y0dseWFXWnZjbTB1WTI5dEpUSm1jbU56WlhSMWNERTFNaTVsZUdVbVpHOTNibXh2WVdSQmN6MVNaV04xZG1FdE1UTXdORFF0WkhBdVpYaGw=

http://www.gifttownsign.com/WVl6OTRQWE5rVUZReVdVMUNUekpPVUd4V1IxazVjMVl6YkZkaE9YWkRkM2xoZDJVbE1rWjBUV2RpVEhSb1VWUmtaeVV6UkNaalBYbDFKVEpDU2xGemVuaDZhVGc0UjIxSlpYSTVjMHMwVmxsM1VFNTFPVk5GVVNVeVJqWldaMmQ0ZVdKd1RGUklXVlJwU3pacWNYcFFTU1V5UWxZNWIyODJSVnAzYVc1YVJESlJiMGRTWnpCM01GRlpSbmRHYkVoWVZXaENjVmxHWjNsR2NubEhVSEZ0V21kYVNtOUNjemhwV21sYVFWTXlkWGxVUm5CMGRXVnRUbWx4WjFnbE1rWkVZazA0YUU1cmFsTk1NWFZsYTJ0YVVtcENNV3BCSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1SdmQyNXNiMkZrTG5CcGNtbG1iM0p0TG1OdmJTVXlabkpqYzJWMGRYQXhOVEl1WlhobEptUnZkMjVzYjJGa1FYTTlVbVZqZFhaaExURXpNRFEwTFdSd0xtVjRaUT09

http://www.farmtowntowers.com/WVl6OTRQVkZhWjBFM09VNU1XbGhSVmxrNFdISnZNV3BUZGpSTEpUSkdNMlJpYUVSaldWaHJSalJSZUZoRWFGUTNZeVV6UkNaalBVTlNRbVY0UTFaNlVtSnZTa1ZGU0VJMGRXTnNPRGhXVVZwRGFWQk9TMHBIT0hKVVRFTXpaMGRQUnpoVmQxTktZVXhaTUhBMlJtZ3ljVkpIVDFnbE1rSXdUa3N3TWtGVWEyODBjMU5wUzBoUmRuRndXbUZFWVRaa05YSkVNVXhhTmpoYVlYTklhM0pDYWtGR1QzVlpUMGc1U0hGNWRHMXhKVEpDWVVjNGFHMHdXR3RoVGxsdFZEQnJXV2QyTWpGaVJVMXRXU1V5UWsxTlYwOTZRU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVprYjNkdWJHOWhaQzV3YVhKcFptOXliUzVqYjIwbE1tWnlZM05sZEhWd01UVXlMbVY0WlNaa2IzZHViRzloWkVGelBWSmxZM1YyWVMweE16QTBOQzFrY0M1bGVHVT0=

Remove recuva-13044-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.