home

xnview-12934-dp.exe

Kisi

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application xnview-12934-dp.exe, “Kisi Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Sacip   (signed by Mode Beta (Fried Cookie Ltd))

Product:
Kisi

Description:
Kisi Setup

Version:
3.2.2.4

MD5:
cea4dd33b59503f86aae7b89a50aa76b

SHA-1:
619ccae01aeb0db7b1eda579c6015c0a38ac9ba6

SHA-256:
5198d29c0935848ca4a1d0184242456d399e398b3754b02e6146bdab16e54ab8

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/1/2024 12:39:37 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.24.5

File size:
952.6 KB (975,504 bytes)

Product version:
4.4.2

Copyright:
File Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\xnview-12934-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:ujJz9OiMv1hlYlmHZRY5L5H/9x7NJXH6:ulZMb/5RYRV9h36

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file xnview-12934-dp.exe has been seen being distributed by the following 10 URLs.

http://www.laboratorysafehead.com/WVl6OTRQV0p6TURadWVFaEtZbEVsTWtaVVlYVkpkbGRJTlZsU0pUSkNPVVE0WlRRNE1HTkJZelEwV2xreGNtVTNWRnBSSlRORUptTTllVzlhT1dSMFpWWkxOWHBrVURnMk5sazRZekJDWW1kcVpUaE9PRGhDUTFrMVFrZFliWGRDZUZwRVF6ZDNOM1JpTkUxMlFsVlBUMFZQYjNkSGRuWkplbGQzTjNab1JHOWhZa0pMYm1NNFpIUTBZMlZRVm1RMlQweFhTekJ1YmtGak1VdHRaSFExWnpGMlZDVXlRbVpOVkd0UFlWQmxkMlJvVkZremRraHVPSGxpUW1sMGFVMUtXRkJFY2pKa2VtZEpWWFZOVkd4YWQxRWxNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1aRzkzYm14dllXUXpMbmh1ZG1sbGR5NWpiMjBsTW1aWWJsWnBaWGN0ZDJsdUxXWjFiR3d1WlhobEptUnZkMjVzYjJGa1FYTTlXRzVXYVdWM0xURXlPVE0wTFdSd0xtVjRaUT09

http://www.farmtowntowers.com/WVl6OTRQVmxNYnpGT1Mwc3dUVVpaVEVwSFVXOVlaRmxSTkRGeFJEVnRjbTlzUjBaUk1VTkhOVWd5VW01Q1ZFMGxNMFFtWXowelZHRjNSVWR1V1VodVQwRnFabUZPWlhaUmJGUnhhM2xKVFhKTFl6Qk9UMVZwV0RjemN6ZG1UaVV5UmlVeVFsZDVhbG96UldSNVIxQjFTVkpLVjIwMlZtd2xNa0poZERSaWRFbEZVVzAwY0VWMmFGVjZTMmdsTWtKTE1HUXdkVVJYWjFkWE1YazFSRUZUWlRsT1N6SkhSbWt6YlVOV2RteHdWbXh0WXpZemVtNGxNa1pvUm5wSmFYVjVhVmhxTW1SMGRHRTNiRFV4TTBkM1dIWTFabVpCSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1SdmQyNXNiMkZrTXk1NGJuWnBaWGN1WTI5dEpUSm1XRzVXYVdWM0xYZHBiaTFtZFd4c0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZodVZtbGxkeTB4TWprek5DMWtjQzVsZUdVPQ==

http://www.citysafeapplication.com/WVl6OTRQVGRhUlZOd2VtTlFVak5UYlRSTkpUSkNTMHBJZUVaR1NpVXlRazFTVXpSRWRucFhKVEpDTjJoWVZEQk9hVXhIU0RnbE0wUW1ZejA1VWtGT1IwTldiRU5IY1VWSVdGQldVREptVnpGSVMyWWxNa0lsTWtaUllWazNhbVl5V0Voa2RFUTFPR2RZVlVVeVJEUTVjSHBXYW5WdVpuUkpNa1JrTUdaQldqRnBOVFpuYVRWaWNtTjFjRmhCSlRKQ2FVczVXbEJ6YWtzeVNYQnZiMloyWTNwNmNuUmlaMmRJWVU1M1FXaGhNMGxNZFVodFJuUWxNa0pySlRKR1FXOU9kVWxVVEVweGEzSlFlVlE0TVUxalNXMVdjMjlUYVdwWlpUVlJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtNeTU0Ym5acFpYY3VZMjl0SlRKbVdHNVdhV1YzTFhkcGJpMW1kV3hzTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVmh1Vm1sbGR5MHhNamt6TkMxa2NDNWxlR1U9

http://www.cycleupdateguard.com/WVl6OTRQVzlvSlRKR1NXUTNjbmhCT1ROTlluWlZOR0lsTWtZMVltUnRiVFJaZFVoMmJIQXdaMUJSUVVka01GRnFkbE5CSlRORUptTTljR2xLWjJOVFRtTm9kelF6UzBaelNEVkpTU1V5UmtReWVtZEJlR2w0YTNGbFMyWXhiRlZYTW1sQ1RtSkhRbVZPV2xSRlRHVnlObkJSWmpSTVYxVkJZekl3Um0xQkpUSkdZM2wxV21WaGVUaGxXR2hVWTFZMlNrTkhkVmQzVVRSTGRIUnlTWGxqVjA1NVFrRlFZM01sTWtaak4wZG9hVmRNZGxGbGNUYzRNMjlWYUV3d1ppVXlSaVV5UW1kUmIySkhVSE5wWkVGRU1tZENUMUZvSlRKR1JuQlJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVJ2ZDI1c2IyRmtNeTU0Ym5acFpYY3VZMjl0SlRKbVdHNVdhV1YzTFhkcGJpMW1kV3hzTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVmh1Vm1sbGR5MHhNamt6TkMxa2NDNWxlR1U9

http://www.appsfunbyte.com/c?x=nIVHpGjXiAZAj4OW1uwqP96pd IICKorXaW68xAB W0=&c=z2v3kSBP2PeP/Qhj4ZUB036E2 5rOcBs6b5X71SHcoK0Otm0K9MUCT2y3/1oxX3tqEpnXnah1HEjspcB15y2Jszv7m5ZekRKHJi8a7NQtimOBn9QbOBs3IXtzcvJlLUvQ2VW7qJ3NvpzkL0kK0TlHP1LyAGgm0OCmch9eO vW5P9aNvBkxMFwcwZoT0sQAdt&e=0&fallback_url=http://.../XnView-win-full.exe&downloadAs=XnView-12934-dp.exe

http://www.sharerepositoryhosting.com/WVl6OTRQWE5zWVROTFRWa3pWMWRYUTJjd01uUlVUbWRJWjFneFpWUmlSMXB4VlZGSEpUSkdKVEpDVm1oeE9WbENiR0ZCSlRORUptTTliM1o0TldOSGNqRlNOMXBDY2poYVJHdGFPVTVMTVdkUFYzTllKVEpHTkVGbFUwa3hVVWR1Vkd0bFFUQTJkblJoVGpBeGJFVXdablJrTTNabE1qQTViak5sYUVZNU5qTm5jRzVvZEc5NlRUWlViRVF5YUdwV1RraEpaazV1VkNVeVFtMUxiM0JwYzJnbE1rWnlXamdsTWtZeGNGbFdSVkF5T0dKUU9Fd3dRMVpXY25OeGRERlRlbTF1YXpsSldXUTBkMFJLVG1aRFQwczBOMlpsVUZFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRekxuaHVkbWxsZHk1amIyMGxNbVpZYmxacFpYY3RkMmx1TFdaMWJHd3VaWGhsSm1SdmQyNXNiMkZrUVhNOVdHNVdhV1YzTFRFeU9UTTBMV1J3TG1WNFpRPT0=

http://www.laboratorysafehead.com/WVl6OTRQVkZtVGt4a1FWSmpiVlU1ZFVGQ1pHcEpTVzkwYVVWck5VRmpVek5GWm1OQlpTVXlSbk42Yms5V2RuRk5ZeVV6UkNaalBYTXhSVEJ0VWpKb1VuQTRORWxwWjJwcFlVb2xNa1ptZGpSRFJtUkpZM2xtVlc5NVRYcHBPRWg0Tm1Gek9HVjNSRWhXSlRKR2FHSXhaSEZQUlVkdWJWbFNVRkIzTW1oME1XMTBXRGt4UlNVeVJpVXlSbEk1V1UxdlJYUkZVVzFPVlhZeFQyTkZOWFpuYlhsWGNucEZablJuVjJoSlZERWxNa0pUTkdvM2FsRk9NVWR6VW5sQ1JWQkZURnA2UTBkV01XeG9UelpMWldnMU1EVnRNbk0zVFVFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHOTNibXh2WVdRekxuaHVkbWxsZHk1amIyMGxNbVpZYmxacFpYY3RkMmx1TFdaMWJHd3VaWGhsSm1SdmQyNXNiMkZrUVhNOVdHNVdhV1YzTFRFeU9UTTBMV1J3TG1WNFpRPT0=

http://www.citysafeapplication.com/WVl6OTRQVnBpVjBOU1VYWjFTalpTVFc1NFlUZFZRVlZ4VTBKQmJFVjBRa3N3VG5OdlJXUlBaRUYzSlRKQ2EzaDFSU1V6UkNaalBYZDJiWG81Unpnek5HdzJZV016WVhKb2NFd3hkVk41WnpsRVpVOVFRVkU0WVhaQ1ZqZFBOR04zWm05dU5VeEVha1J2Y0Uxa1NXd3hia2RETVVzNFUxazNaemR0Y3pOcmNsb3hTbkpMUTA0NFNYTm5SRVpFYkV4Q2R6WmlTbWxNU0hWdVZYQmhSVEJVVWtZbE1rWTFOblpOUjBSaVl6RktZemMzY1RZeWFHTkhZV3B4U0hCT1lrc2xNa0pHVVhOalJGbHVUVWRLU1hkUFNHY2xNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1aRzkzYm14dllXUXpMbmh1ZG1sbGR5NWpiMjBsTW1aWWJsWnBaWGN0ZDJsdUxXWjFiR3d1WlhobEptUnZkMjVzYjJGa1FYTTlXRzVXYVdWM0xURXlPVE0wTFdSd0xtVjRaUT09

http://www.sharerepositoryhosting.com/WVl6OTRQVWxwWkdSbVJWTk1jVU0wWTJONmJEbFpTeVV5Ums1dEpUSkNkVkZGY3pWU2NtVnFlbEZCWkZoaWFVUTRVMHBuSlRORUptTTlXbEY1Tlc5a2RVeFpObmR6SlRKR1kxRk9lRVJ5ZVhoYVpERm9ObWhJVjB4aVNqQXdUaVV5UmpOVFlXVTNjM1o0SlRKQ0pUSkdhV2RYUTJSRk9VMVhkRkl5TTFreGIzUkJaMGRqV0RRM1FtdHJWRlpHSlRKQ1lsVWxNa0p3VG1oVGRGbGFhblF6U205bGIzQnlaMUFsTWtaM1ZubGthM3BZV2xwclpucFRNR1pVYlZkUFZYWnBSSFp0VkhGbVYzRm1OMWhPU1ZneVdsbDJjM0E0UW1WeE5URmphMmNsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROaEpUSm1KVEptWkc5M2JteHZZV1F6TG5odWRtbGxkeTVqYjIwbE1tWllibFpwWlhjdGQybHVMV1oxYkd3dVpYaGxKbVJ2ZDI1c2IyRmtRWE05V0c1V2FXVjNMVEV5T1RNMExXUndMbVY0WlE9PQ==

http://www.citysafeapplication.com/c?x=B3lkAHpIiqTIZUjpeeoiTlmGiCOAJMcaOvyXUipgcEM=&c=K9lNM73VcxmlEuQlKii4tKBbVALb7uTT5eLKy8FpBFc Sv32MUMhD3Nu91usORUl2yrJSLIbG3il/y7m1VaZOXmnLC8KxUXBRZrowAI9OkEKgpNwRHq2FzerUbUHNwAq8QCcwQ8HwlBbOsK8bOGFKEUBP1V7Gop79iL6v0xTMfE=&e=0&fallback_url=http://.../XnView-win-full.exe&downloadAs=XnView-12934-dp.exe

Remove xnview-12934-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.