home

free-sound-recorder-13331-dp.exe

Kisi

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application free-sound-recorder-13331-dp.exe, “Kisi Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Sacip   (signed by Mode Beta (Fried Cookie Ltd))

Product:
Kisi

Description:
Kisi Setup

Version:
3.2.2.4

MD5:
05849e82f300e91355a479454a99bfab

SHA-1:
41f630f42e8c371f27130eeb9e3f8d75fcd8b47e

SHA-256:
7ac58fd4f3212ef804b22e46b401722d4d88124ff70c9655c4b9ee19b560aad1

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/28/2024 2:54:35 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.22.23

File size:
952.6 KB (975,504 bytes)

Product version:
4.4.2

Copyright:
File Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\free-sound-recorder-13331-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:0jJz9OiMv1hlYlmHZRY5L5H/9x7NJXH6:0lZMb/5RYRV9h36

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file free-sound-recorder-13331-dp.exe has been seen being distributed by the following 6 URLs.

http://www.farmtowntowers.com/WVl6OTRQWGxQWTBOR05FRlhiVGxRVW1WU2NEaE9PRWwzVFZCdWJUTnRNa3BVZW04NUpUSkNXSFJVWVdORmVFNHlaeVV6UkNaalBYRmxiVEZHUmpCYWQxaDRVM29sTWtaWGF6bERWMmhYTTBWMGFUVlplWHBSY25Cb2FVODRKVEpDZVZNeE4yOVRlRVYzVkZCc1VqaHNWemd4Ym5sc1pscEdZVmRaWVhnd1FuTnJVakF5TkZaS1lUUXdiMmRpYnpoc1owVlhObEJtT0ZGcVlUZ3dUbnBVZERobE1saDJOM0Z4U1VjMEpUSkNlalpMTkhkVGNXVkVOekVsTWtKdllXZERjVklsTWtaQlRVMWxXSE5sUlZwbk9FY2xNa0pKSlRKR1pHbDNKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabk4wYjNKaFoyVXVaRzlpY21Wd2NtOW5jbUZ0ZVM1d2JDVXlabTExYkhScGJXVmthV0VsTW1aR2NtVmxVMjkxYm1SU1pXTnZjbVJsY2k1bGVHVW1aRzkzYm14dllXUkJjejFHY21WbExWTnZkVzVrTFZKbFkyOXlaR1Z5TFRFek16TXhMV1J3TG1WNFpRPT0=

http://www.capitaltoursoftware.com/WVl6OTRQWFZSTVZoclF6UnpjVTg1WW1nemRtZDZVMnBMUVdvM1VtOVBka0UzVmtoNk4wbDJlRWxHTUd4UVpITWxNMFFtWXoxcmNraEJhak5rYUVWM1JsWmlVVmxVWWtsMVkySkRTMlo0TmxsUFUyNHlWV1pGT1VwS2FHeHdOVkpuV1hsVkpUSkdhRXR5UlZkVWNVMTBielJTVEU1M1NsZEVKVEpHYmxoRFFXdEtPRE4zUVZWdGNIbHJObFUxYzJGQmJIaHBNVGMyZWtrMllVOUhRekIxWkZkSFJIVXdlRTVGWlVkQ2JEVjBhV1ZRVTFwVVpUTlFVV3BLTTJwTUpUSkNSekpCZUhwYVVFZFBKVEpDYm0xb01rTTVaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp6ZEc5eVlXZGxMbVJ2WW5KbGNISnZaM0poYlhrdWNHd2xNbVp0ZFd4MGFXMWxaR2xoSlRKbVJuSmxaVk52ZFc1a1VtVmpiM0prWlhJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05Um5KbFpTMVRiM1Z1WkMxU1pXTnZjbVJsY2kweE16TXpNUzFrY0M1bGVHVT0=

http://www.appsfunbyte.com/WVl6OTRQVXRxVkd0R1JsTjNSbkpDSlRKQ1dVdE9KVEpDV1hWMmVHZHlOMGx3WTIxYWVEQk5ZakZ3WWs1T1UySkZOVFV3SlRORUptTTlSRkJ2ZUhNM1RtaEtSWGxzZFdzMWIzcHdOeVV5UmtaTGJXTkdUREJoZUhOaU1uRmpSakEyVFd3M1VrdHFNalozYldKbFQwaDRNazAyVDJ0WGIydGlaR04xZUV4d2JtNXBNMFV3WTI1U1VFZGhjRXBQUVVWV2FtTk9ZWFZFWlhkVWVWbEtTVzlMZEZGd1ZIbzVZMEpIT1V4Rk1tZFpNM1ZqYlc1dWVHeEdlVWRpVW5wcGF6Tm5UVXB1ZG1sSk5sSnZSVGh3WkZOUFMzY2xNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5oSlRKbUpUSm1jM1J2Y21GblpTNWtiMkp5WlhCeWIyZHlZVzE1TG5Cc0pUSm1iWFZzZEdsdFpXUnBZU1V5WmtaeVpXVlRiM1Z1WkZKbFkyOXlaR1Z5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVVp5WldVdFUyOTFibVF0VW1WamIzSmtaWEl0TVRNek16RXRaSEF1WlhobA==

http://www.cycleupdateguard.com/WVl6OTRQWFZMZUZaUVdXTnZXR05ZUkZwTWMyWkNkMUJLVEhSUWNIZ3hUVzFwVDBOSVdYUmpaRmRxVERGTldqQWxNMFFtWXoxcE1VUTBORmN6VlZSbFRHUm9XVGxhT1hKWGFETm5ZMmh4YkVrd2JrYzFiSFpYYW05U2FFRnlURkkzUzNSM1pWWXhVVEYxVXpaV1kyUjFaSFpFYUdsb1ZHRnRhVzlDVFdOMlptaEdUMjlwZVZsSFRYbDNKVEpDYlRCaFVtcEZNR0ptYjFWMVVYTWxNa0pXWWxJemQzSlRPVnAwSlRKR1FrWjZhV0p5U2tKcVZVeDJaRlpJUkU1d2JIVTBKVEpHWkdwSmVtOWlhbFY2UTB4U04zTnRVU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTJFbE1tWWxNbVp6ZEc5eVlXZGxMbVJ2WW5KbGNISnZaM0poYlhrdWNHd2xNbVp0ZFd4MGFXMWxaR2xoSlRKbVJuSmxaVk52ZFc1a1VtVmpiM0prWlhJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05Um5KbFpTMVRiM1Z1WkMxU1pXTnZjbVJsY2kweE16TXpNUzFrY0M1bGVHVT0=

http://www.conceptsbodysafe.com/WVl6OTRQV1UxYlZNMFJsbE9KVEpDWjFCUWRVcGhUWE41WjNKbFR6a3hOMWhOZVdsSlNVeFZia1JvYVRWR1pHSmFUU1V6UkNaalBVTjJTMmcxZFdwMFRqbHNTR3BvVFhkaVluRlZUekJYVUcxbmJFOXNNbll3TlV4TFFXdFBSVVJYU2sxRFIwSTVSSEF6ZDB0dFNFbG9PRXhxWWlVeVFtUndKVEpHV1NVeVJuZGFVMmhOVXpGTmNTVXlRa05vZGxCRlpWRmxkWFExVFdGUmRuQnZWbVoyTlVrbE1rWlNNRlZ1VHpoVlEwSlFlRUV6UkcxcmREUktka0ZWUjNsRFprcEliVnBXU2pKM1ZUSnNOVFJHU25OSU4yeFBUekVsTWtaclFTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWnpkRzl5WVdkbExtUnZZbkpsY0hKdlozSmhiWGt1Y0d3bE1tWnRkV3gwYVcxbFpHbGhKVEptUm5KbFpWTnZkVzVrVW1WamIzSmtaWEl1WlhobEptUnZkMjVzYjJGa1FYTTlSbkpsWlMxVGIzVnVaQzFTWldOdmNtUmxjaTB4TXpNek1TMWtjQzVsZUdVPQ==

http://www.currenttoursclear.com/WVl6OTRQWGMwWVdoNFdGUm1TR1pCVHpObE9VdDZkVXRxYlhST04yTkZZbVJLVTJjemJEUlVVRVppYlZONlpsVWxNMFFtWXoxYVZUaHdWRUpoSlRKR1ZraFZWM1poVlNVeVFtcEVlR05VZDNOcVRUY3hjMUpaUTFSYWFYbzBTM1Y1YTAxeEpUSkNhRTVsTTJwUmRGaGtVemxwZDJKUEpUSkNjbUpsTW1GU1FuWTVhRmRoU0hFeFZXVkxkVGhQVUUxRWMxRldZemM1Y0RaaWMzbE9NVXczU0ROMVlsTmFVMms1YTJWMFRXeG1TVGxzT1VSRE0wUmpaRWR6YTJJeldIRlBSMmRrZG1oMGNFOUNjWFlsTWtaTU9IQWxNa0pQTjJjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbWMzUnZjbUZuWlM1a2IySnlaWEJ5YjJkeVlXMTVMbkJzSlRKbWJYVnNkR2x0WldScFlTVXlaa1p5WldWVGIzVnVaRkpsWTI5eVpHVnlMbVY0WlNaa2IzZHViRzloWkVGelBVWnlaV1V0VTI5MWJtUXRVbVZqYjNKa1pYSXRNVE16TXpFdFpIQXVaWGhs

Remove free-sound-recorder-13331-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.