» slimdrivers-25819-dp.exe
Overview
Analysis
File Details
Downloads (8)

slimdrivers-25819-dp.exe

Hico

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application slimdrivers-25819-dp.exe, “Hico Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Nifalise (signed by Mode Beta (Fried Cookie Ltd))

Product:

Hico

Description:

Hico Setup

Version:

2.0.2.8

MD5:

7cc0e891d87d9dc10d120a582d0185c1

SHA-1:

88d715a04f62193dec80f273fc5717f5cccf34cf

SHA-256:

5b7c794ca4eebfc07bfc41947fc22bc2e7c8093403842cf13a9e57efe3b56c49

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

11/1/2024 1:20:47 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.3.19.5

File size:

1002.1 KB (1,026,152 bytes)

Product version:

1.8.5

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\slimdrivers-25819-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:XJ2D03P2/b9Gb7eDa+GrQws4NTGVCE48JbD7Vvs9VK42r:XcD0f2/bEJ+k5Op/bVvs9VKt

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file slimdrivers-25819-dp.exe has been seen being distributed by the following 8 URLs.

http://www.todayuniversebits.com/WVl6OTRQVTVOYTIxUldqaHhVbFJFVmxoNWFuWnNVa2RpUld0emIzWTNUWE5HZWtwa1RYRmlZbTQzYVV0bWVsRWxNMFFtWXoxbU1HUkNhMWRqZHpSV2EybE5kRVZKYzBZbE1rSkhRamc0VFVSalpHZ3pUbGxuV0VSSWVsTXdkM1JWUkhKRGJqaE1WamwxU1dwdVMydHJkak4wT0d0cWNqQmtjMlJZT1cxRmJFdExhMVl6Y3padWEwSjBVMGhOUW1kQ2NubzJiVGgyUVVaWlNVNW5Za05PUlhkc1ptWkdXSE5IYkhKWk4zZE9lVTAzY213eU9VZGljVzVqYjI1ME1XbGphMHhXUlV4VlpVaDZRazV5WnlVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0yRWxNbVlsTW1aM2QzY3VaSEpwZG1WeWRYQmtZWFJsTG01bGRDVXlabVJ2ZDI1c2IyRmtjeVV5WmxOc2FXMUVjbWwyWlhKekxYTmxkSFZ3TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVk5zYVcxRWNtbDJaWEp6TFRJMU9ERTVMV1J3TG1WNFpRPT0=

http://www.bitscentralgift.com/WVl6OTRQVlppTnpZbE1rSkhNa0Z5ZUVWMlVEQXllVzlwWkhWaWMza3dhMjlVWWxablozcFRUa2hJUTJKdVNtcHVVU1V6UkNaalBYUjZjbkpzWldrMmVucDBkQ1V5UW5obk1VcDFXVEIxVlVOV1QzSWxNa0pDSlRKR2JtMHhRVmRzY1RJM0pUSkNUV0Y1VG5WSVVUZEdTbU5qY2t3bE1rWjNaM2REVFRWUlQwMW9RblJIYWxkTVRqUjNTV3h5TmxZd00xSktSemxXY1ZneFYwNUdlVFIxUVdWclVXOHlSMHRzVVROVFdFMUpUR0l6TkU5eVp6UWxNa0pXT1Vwc1NtaENibUpvVkZWa05YWXhXV3BoVW14SGJFVjJaazVpTlV4M2R5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjNkM2N1WkhKcGRtVnlkWEJrWVhSbExtNWxkQ1V5Wm1SdmQyNXNiMkZrY3lVeVpsTnNhVzFFY21sMlpYSnpMWE5sZEhWd0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZOc2FXMUVjbWwyWlhKekxUSTFPREU1TFdSd0xtVjRaUT09

http://www.grabtodayupdate.com/WVl6OTRQVGR4VTJKdmJGSnhWM0ZPWTBRelNDVXlSbFE0Y0c5RmRWTkxjVWd4Y1ZORGRHUlFSV05rTTFoaUpUSkdhMVZaSlRORUptTTlaa0UyTkhCWmIyWlNKVEpDYVRGS04zUXlVRUZOVGxGUmFIcHJhVUZ6U0VabVF6ZHRXVEpyV1hwa2FrOW5kekpsSlRKR2EyZDFTR295Y1ZjNE1qUm9NVGQyZVRGV2NucFJabU42UkU1UVNrNXhjVkZLZDFac2VqWllWV2RPVWpCbGFFcDBja1UyTm10cldrUmtWR05SV1dJeFNUQjVZbmd4TkNVeVJrUk5KVEpHVVdSUWJtc2xNa1pDVUZGRGEzVm1OelJUVkhaa1RVNU1jMlpWT1ZCTlp5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjNkM2N1WkhKcGRtVnlkWEJrWVhSbExtNWxkQ1V5Wm1SdmQyNXNiMkZrY3lVeVpsTnNhVzFFY21sMlpYSnpMWE5sZEhWd0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZOc2FXMUVjbWwyWlhKekxUSTFPREU1TFdSd0xtVjRaUT09

http://www.binarieshostingtours.com/WVl6OTRQWEJNT0U1aGJtVnNOakUxVVhnME5tcE1jRTRsTWtZNFIwNU1keko1Y1NVeVFrVTJZM1YxZW1OVGRTVXlRaVV5UWxCVmF5VXpSQ1pqUFdjbE1rWjZZMHBTTkdoc1VXMU9NVXd5WlVsc05FcHVKVEpHZFZaMk1HOVJkakJaYTA1aGJGcDRSRnBZVGtwNGVrMTJRVmczTUVsT1pWTm1ORlZsUlhCTGJreEdWRkZMUjBWUU1XaDRWekozYUdkT0pUSkNUazUzTmtnbE1rWnBWVlo2VW1OV1l6SlhZbFJETTBwdmRWVk1UMncwZFRGQk9EZHJlWEpITkU5clEyNVFXbVpvWWxSUWMwcGxWbk5KVldodFFXRnlKVEpDWVZnNGQweEZhRUVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptZDNkM0xtUnlhWFpsY25Wd1pHRjBaUzV1WlhRbE1tWmtiM2R1Ykc5aFpITWxNbVpUYkdsdFJISnBkbVZ5Y3kxelpYUjFjQzVsZUdVbVpHOTNibXh2WVdSQmN6MVRiR2x0UkhKcGRtVnljeTB5TlRneE9TMWtjQzVsZUdVPQ==

http://www.todayuniversebits.com/WVl6OTRQV2R6YUNVeVFqWm5kMnRPZWt3MmFTVXlSaVV5UmtoSVpuRmxVRUZtZDA5RmVEWkxjVGRLZW1WUmJrNUxaMlZ6UkVrbE0wUW1ZejFIZVdac1oxSlpNV0V6U3pkVVUzTldNRGxKYUcxcFUxSllVRlZuUTIxS2RuWndSemxRUkRaQ1JqZFhkM2xoTlZwUWIwbzRWM0pRTkhRNGVtVTJRekkzU3pCSVJuWlBiRFF3T1hGeGFFSnNlalpSVlVkalVrWm5aRmxRVjBoclJVZzJiSEJ0Y1cxeVlreEJNMEZsVG1waldWWWxNa0pQZUhRNVkwZEVlbTVsV0NVeVFuWTVSa1ozVDJSdFNrTk5SVXBvSlRKQ055VXlSbE5rZVdZM1VTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWjNkM2N1WkhKcGRtVnlkWEJrWVhSbExtNWxkQ1V5Wm1SdmQyNXNiMkZrY3lVeVpsTnNhVzFFY21sMlpYSnpMWE5sZEhWd0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZOc2FXMUVjbWwyWlhKekxUSTFPREU1TFdSd0xtVjRaUT09

http://www.binarieshostingtours.com/WVl6OTRQVXBDTURSTE9HUjBiWEU0SlRKR1VVVkxRV3Q0Y0UxSllYTjVjVkYzTkRnbE1rWjFhbFJMTkhOYVEwOWFVRWwzSlRORUptTTlTbWhUUjNZNU1sWkxWMWhvV25CaVZUUnFSWEZ2UXpCSlJXOU9PRGxYUzFsT1kyeGtTR3hTVFVwdE5sTnBSR0YzYWxZMGIyTktZV1ptWlZGclEwRktUbkZIVFdWcFIxVmxhR3hQUjFFd2RXSm1NVXRrZVhGYVEzVjRTMkZDTlZwMmNqbFdVVVJ2VTI1VGFWZEVPR3huYlRVbE1rWXhVbTBsTWtKUFZqTmFXbTFWVFdjM1dDVXlRa2xxVjI5SmIweEhPRE5vZVRoWVRGQm1jSFIzSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5kM2R5NWtjbWwyWlhKMWNHUmhkR1V1Ym1WMEpUSm1aRzkzYm14dllXUnpKVEptVTJ4cGJVUnlhWFpsY25NdGMyVjBkWEF1WlhobEptUnZkMjVzYjJGa1FYTTlVMnhwYlVSeWFYWmxjbk10TWpVNE1Ua3RaSEF1WlhobA==

http://www.bitscentralgift.com/WVl6OTRQVGd3Y2t4VWF6ZEhhMmRPUXpaSlRXVnpOazh3YjBWaE1rbExla3RsU0RaalNGSnZNM2hvWXpSQloyY2xNMFFtWXoxWVVXbDZkVkZwUWxOU2RWZEdhM0pRT0ZoR1puRlVOWEp5ZHpkTWFHUjJSeVV5UW5kUGMza3dSR2wyVW1OUmNVMWlWV2xKVVhGS2NYbFFWVlZtY0VGNVdqSkhhVXQ1V0RaSmRUZE1aR3AwWWtWRVJ6VlJjRFJVUVc1WFJrUjBhVWRPWjJWSlYyeFJORE50VFdGV2N6VnVVMjFhUTNORFVrcHhiMEpTTkhjd1ZuTXdKVEpHT1dNbE1rSldja3NsTWtaVFJWaHRTbEJaTVdRd2FVdFNkeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVozZDNjdVpISnBkbVZ5ZFhCa1lYUmxMbTVsZENVeVptUnZkMjVzYjJGa2N5VXlabE5zYVcxRWNtbDJaWEp6TFhObGRIVndMbVY0WlNaa2IzZHViRzloWkVGelBWTnNhVzFFY21sMlpYSnpMVEkxT0RFNUxXUndMbVY0WlE9PQ==

http://www.cycleflashbulk.com/WVl6OTRQVlZ3T1RsMVdISndjRE5hTm04eVJGcFhRVGxWVDFsa1oyWnVPRWN4TTFWeVRFdElha1ZEZW1WUVpXc2xNMFFtWXoxcVMwNHhTV05TTkRseGVHRlFZVEpzVlVaNE1YQktSVXRGWW5CVVZEaDRaR1kzYkVkdGVVbGFSRlJsVm1JNEpUSkdja1p2Y2xkeFJGaFVZWEV3ZG5wWWJHcHBTMUZ0WTNFd1NWUXlUWFFsTWtKd01sZ3piRUpaWldWTmNWVXpOU1V5UmxCWlRFMXpibEZ0TlhwYWJtZzBhSE5HVTJaNUpUSkNXVGh3YzBaUGNHRllTSFowYTFCbFZHZEZKVEpDYVZwamJrWjRUMUJuY2tGUVRVUm1URVJSSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm5kM2R5NWtjbWwyWlhKMWNHUmhkR1V1Ym1WMEpUSm1aRzkzYm14dllXUnpKVEptVTJ4cGJVUnlhWFpsY25NdGMyVjBkWEF1WlhobEptUnZkMjVzYjJGa1FYTTlVMnhwYlVSeWFYWmxjbk10TWpVNE1Ua3RaSEF1WlhobA==

Remove slimdrivers-25819-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.