home

camstudio.exe

Connector Quality (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application camstudio.exe by Connector Quality (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
CamStudio  (signed by Connector Quality (Fried Cookie Ltd.))

Product:
CamStudio

Version:
2.0.5.a0.1_55308

MD5:
317c4af26497aa22926f941684278dbc

SHA-1:
a1d62486fa931210f74467dab95e6195c3333c1f

SHA-256:
5b66c4b52c7f667d1f4b6499dac72e72b80b3a7c789e5979895e452519c40b5f

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/28/2024 2:39:21 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC (M)
16.4.13.9

File size:
984 KB (1,007,568 bytes)

Product version:
2.0.5.a0.1_55308

Copyright:
CamStudio

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\camstudio.exe

Digital Signature
Signed by:
Connector Quality (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:47:30 PM

Valid to:
6/29/2016 8:37:09 PM

Subject:
CN=Connector Quality (Fried Cookie Ltd.), O=Connector Quality (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11214A88F68EC903582205A06D650E3E0649

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:AKuENZEq8MjIQQZC3CPaIDthCFwn2hyBugux2TrhbICE:AvEoq8lQQw39wCyWyBvq2TdbICE

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9321

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file camstudio.exe has been seen being distributed by the following 50 URLs.

http://www.toursupdatebyte.com/c?x=NlFprHWC9t13gmqneRiDckL8Yha3FMAWqEqWIJdNgvs=&c=XzfGuKItnsrS3ndoOlJLHs5ngcMicNIsgxZPw4wK3RKeePvjvVT2rQnrenhJkw/Y6WCppwqtZOT8n62K1ZOgZN6K8jXTHjtytDPHidPs8GhBIQUN/PckMejaEI2TVpFCB5cV80ZJYzX7tp sgPaBqiJE/CwY8OcSUL9UtutvUKA=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.signbulkvault.com/c?x=YSj0BdGxyD9NDWmtj/aO7AnoOfIGyT3ptJyMW2MBDZg=&c=kILQ80GBXaVH81eliiPDQZOl9ir5aj8xuaFGX bhhCxeYqQH4uZxdRKF2 XOB1BgmeviOgPWnAhRhlxJY/yyf6sCNHliq6udsa6B6Ow0AapKRblReW6gyLXztSuFm0r2/OIoc5K4TRSNNFJcEnLP3w==&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=PirrAYCZsFsr6/WJILR9VOr0KjW7yvD80c75JeB6pT0=&c=81P3MhqqPLSbKcGZ7Ein1ZxiUKYhCIPoyWdHzFOfaX0hPBhV7vjDYARr5NDl2q0lHpyotNiZlLbzmM3qrQfGT BiSne/H809n8ZScPq9IGdukGpxbhH1ZRCx0DIWcDjiyOlZAGuOe/jTTFlkNP2KgmOpLVivL3Ay01S3KqUhsvY=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.signcityconecpt.com/c?x=TupiIgkz6X6lg3 8FqS1kc4TyWIu4napA3mTYwa8vH8=&c=eOkgty7zPWEcILYQakmaUrnABm yawyoimgW9/7lrHfSeaaK06P277fw/OrVEBNM2lDLljOxjg HedroTrnMak6 Nfnc3sWB1VxXA3N/EkCz0Q4kXzysxgN7Um3d2Xd2bfunXV9nE71zXp367p0T3vNaid88miHXENsm3AeqohJ77hxHpiHYn2qTVN7zuuvK&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.signcityconecpt.com/c?x=NMTyFV03SLOpJz90 dMSQru23IqvexYO5FRtE32qwOI=&c=ms2aD8uUimNvI1djYimXg3tY5k4EQ Y6axKXFgdCZOTv9rhhYI9tEdsyRfGoo59V/qSzVfvXCrTMexZOeZgF8y8 gEryS0f0kNjaI8u9aJts5dUZ3awEeS0L2wvKcfVFUNKz21OZJ7788ELgYS7fKeWwMs3HmO1pdJ5vlLNxGog=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=lLHhc9 y5G8Ay12xJR1rP5uNnHIq0iX2ZNZZskKJxMY=&c=D/GZ4Y b8OXCbagimSdQh /1a/VIdpnK8q2bTRLX7LIc9v6EGTb0MSiIToSdmfd1voFCtl Wh235I9XzEb6C9t1bx2Gxp Bs8nVBBG96jU3 cwgSAtEYXenk5xfG HoyDd 13PbfNL0K6XcUEV5TtLlJPrWUSMVAZNP71 OBx4gf/4L/VG70IP/D8uUMTBoT&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.signbulkvault.com/c?x=XAoYDHwptmwExQllcACwkOhYVcCbnF8X9BRWK3LMz9M=&c=tqWIogIGDXxWcXTLxZ327Tq4fsH 0GBJgAb4Mae /3Ch9izDckKA0e2AIMUkYTjzoxAR34p7egE8s2bR1q/R5sr9ITcaZgxDBUNmzBvDSJmYdzo45coiWMeD0d3yul1pkS4lmNfVSte0Opy4TR0JS/CG5BDjYjTp7n4ikcODvFedjfu3VHNoMm9JqWLcRzAN&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=W5xb1bnZhetQd/MH 3CqJy9BeV330oV1zOVO3z57eEI=&c=6VXm C04ZM/0KwTnoXpgiMMIgsX0pkXMCUovpfyZxJXvI5dupcKN4 hdSEOCpflxCN1abp Yx0V92/gla2ruStawmdbizJrt5/aDVGE4HkO0YvXlJgMSEeH8hV7d5uMj6PhEQH7kWKnKxRmL9CkcfA==&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.signcityconecpt.com/c?x=558l1tRRkPk4IrbCFbebH3CGq2pBhF3LJK6OD3y6pcM=&c=mJwXmTTXenthEUAtyxzwkMtkxouumF6BpqDK1EE 2BjMCWpdgqTpbvAVfkUVwF6nZrRJS/CsSLZabEaYY9PNyjSfMA5M9htaMSnsdewa7WB8rlvfy9/8ycDoLTKPNA27m0IAH vHilu41TP0y6ZPavLGgCRZ9xqaIHBFEllbxvU=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=F4ls0R9KcxqWnaG8cK1DT2gu14eIWEelFmW5S2Kpfd4=&c=XTI3yl3qC Bke Wj/RzNsJfjJkdcbp1hNzWLEO9EvrQAe/fqPaUnCjlaUcjG6Vhm6wk5UeC0Vxvu0DTVyD88e 8EJXM6ZKQgBh2o3mgp9fW HTfHgkqOm JEtGhrFB7YJpAL7FBKQAyVpB9454u WHzNKy8u0HLQ2D82KUFQtm4=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=msXVtKuragnhW2GTSjLSAd0XEMm s1HejXmgef8codg=&c=R2wCUIiKXRpc4liJDHpV PpxkzZZPvu6FK2HlpNHNin 8ffP6Xa3MZIti8Cd8GdSdWbCHluw 7pD7IaggXeliiRX5/o LyaJ DZl3wd2A45BYDyWn9OB45TaHAgucM9tOWrbOKax9uI5S8x8yedb0g==&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.cleantowncurrent.com/c?x=/KKuYhsmX6TXyJYzUleFhqJaGSuW8ZJzHMJW12ebaHk=&c=AP28Aw9zAHvmFv9aqeJhNQ 7mwRHhTaXhj7krnNbj/m/4OPezxOgmLGjCXT7hYtZpfamO7c1SkoGd84NP/FPMllSJCtyXuaVpT 1BjA46gq20xgaP66bvidRcHCSN7Z23 sCblqRYRnd9JUYwnoRhb8Mg74oDY7WH1 BE5iXfTs=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=9lHDTI2bWVxvq7BhOnpdKvkmj LGrFHnnQb7eSGzUco=&c=F1S4IyYGRSU9Iol/mNZBeUnR9an63RLyeuuRr/EeiMRMcxZ1C4e/UuLbW1KXa5oMr5Sb5lB2697kwoLz9tSkdvZMzp rHOfA1AhBSBaZVCgK7w/xsx9O617QqJDz0131Jdilw2aBF nhLGqvGRmm6Q==&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=lQ0mjX0bsqw2Y7/FRl ukQ9Gc50Q5qrC0fDkho4EFRc=&c=K eFU8H4u1 AN4xPlUKMybHzd1U6ghmlwIS2RTc8nyQOj2f1YU1AjahV33ehWU17yAxktemnGVIny F3qIZs/0ERM9/TavAzzMm87 2u2AewbgMNB6cH2lnupwCH8lBG5F8PcJTPqZIEqht9ptYN979Y0Y1IeQxjYRUJyX1pH28=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.cleantowncurrent.com/c?x=i C6z7hR1jAZsOsQClhw8lhIVgv0GHOT/FoP9DQFTWk=&c=tMf0MG9YA8 j/dooDrn McQ2Ov NHClR K4ESugp 7/hQCHEYoyUbAja0ny1Tr6iPBfleuXkGzVCw9nijuxeAJEjP0AnxE8qaFjJtTVGS4xrwMlAbRTkauLWmWcztyzFr6TeSYcX3Ne1/aICEil5CQ==&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.cleantowncurrent.com/c?x=8ydcSSWyFggkethEJxB777fx/CIBDIoclMBKCKQouaQ=&c=xXNvwv5GAh9jUWt0egErnieI59nYICm4d5WQOijDAxtWKZGEjbqS9YqnF025d0WMItW83aMbwJ48dFMd8gEIYJ xau89oCR2yqcVD0GMThfpeUR/S5 DtolU EElLCmOZwyTY0YevmWNIeBW0WXqNQ==&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=XU7pc5jr9yCmpbSNsSk0vN FjXl21SJQzup7BGr7xDw=&c=CGispQsKSc43YQ fIENoQAEXrLv wNJf2njujTGozyLVcno1LNgDTrwDljsCvLGSmdLY5mthJaxU oBIUMMvnhuBPJC2SAlWXrKEEAMPCUu7WbFAB3AxiEflHfeuzzLBdryaEgmSCJ30wVGNAYD6earFv3 Ky7OdlepO4O /D7KewfU/BQqysqUDLnFCusVI&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.signbulkvault.com/c?x=TAUGZlWXtmSS4fcq2imwdn55SI9dj5SzTt0orbtk9Ac=&c=/9mGZioEnGGKpmWc2ZBGsY7z/lEM0xscInwjE1AMD4pF quLg8/madRGZwplj7DPY 5S4ddCAGoYICcWp/ p7KgLBqN1C7A0uTV/lNV0dmz 94h7AbMokltEDvVBPu/2ZK3acZif6EHwo 0LJGf0UvbagZ2tznPuuc1rqGq8tZtW9/1Cph1qigjgAgBy7KZy&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=NniLC0DC1YOr92mDkidtUbVduy6Sc0B2bMIEvR3v9i0=&c=5cmGRy7ZDZAWqt7EKpoQ//kh 709iN4Ols10N2zxFmbFyWSs mrynh3sdVvBTkiEpekFfsRFtJ/GzKEcrQRtZvR9xBimzhibJhUDeNkyTfi0IvQ8VCNlCVABU18/7u6Ry1ehyXSaz0M0Eg7k3XiOIVH8wkwCAldPFvYYkBdHiYg=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.cleantowncurrent.com/c?x=vvs 4UQTogvPqFv9eM0LOHYPq 5b mH78TWJJKANi0s=&c=GWR iN/sg7mxT1UrJ5rExd0Yl9KC/0tc2PzbUkQbGD8yAQdPHtTheriZuR0g2Km8VkNgCkbI1 Sy2oCaflS8feRgxKfojZN s/QS8d9GOIqqgokQSpuuOt4MT3wle32LWNV4LO/yziHul9D1pYBn3EwtrkdqY0kMbTmP8/h xy2woe2iwSgYdEdVTmrohP7K&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.signbulkvault.com/c?x=KRO0vztJJ6A6PxcFsUIl1ZdHeG0IAmnoELYcgXRKuGU=&c=sjtNkk9Sge8ef8oNJjZ86I8eChcMfzHdbQk4nYuA3WBh/sGQfa8 hkk7Z8pCQrzkKIP adH9YdbAwaqeTBDlB7WDwTmQyvvphDLlXu WdH dza5WHyhbrrE/enRllv98IZqx7s1t924ZmSShR8wbOw==&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=yRbRWx 7GeFf5dgbLC/SlUCXtu2l2EEhXpj0l0AuosM=&c=P/8SgCeR8KizwKOrqMbOk1VJ7D2wkU9P7x6C4ld9N7a9cv9Lqw39in2XiFDx8yqDTKyJTprIRlZpUTHQ3/l2xfiutA Y PCFQ6KX0ZUT2tvqNJfbzuESc0l6mDDmupjYLmcdH/lo0ostCIqPdUX V/RlSoATnMakamkgrL9FWklJnulqTHSZGN3kX2fN rCx&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.signbulkvault.com/c?x=FVnK9U7J0AQkvg3DISftBh66HutZ0TW3f1ahQU07PRQ=&c=ikigg8k/yVYUTt6QfYkNu5t3RUGrvza1H7a7diJy1xT4QoEI3R9vChjX12PJYA6/t5JXAIsZFM26JFhok5cCPRQhXbBLCm XC WqikZg7O3hHm04Hdf5VPC2 v4QAX8nIeuPqMS9BcACOky7D/xQF3uGHMn78dIdh6hpWhNFG98=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.cleantowncurrent.com/c?x=SaGrwUGQKL1HDyf12jJVuKWETv5y4BJ087Vk7PXzlzo=&c=5fVZMPGKx17ejhRbFPIWvR/cjqZ96oefe0izyjqED1cbTX0fZ/8JXukUf97Ut7utm 6DvbZPEecSwQWPeZ9Mv71L/WNTWt5hPkQfq1R0Rdq930z0Ce0nK3WhODOJgitAiOMx1iXBg07cEBFpt7O1Mg==&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=C2i1mCrebL1AqFbEIg5vxMfgZWZJMw5WYOxIS00cHIs=&c=aIVPWy6Z9ohg4XP6lG6wBGYQkb3G3HjoiZd anmKiXjDlmuKMSIMrxXvpRMuTIeJ2vF7rYYkdZL51jZ7sLFSeJN74BIaqdeC0klG12Rf1bhEsfB27jX0hcDYTulcjx0r0wjozt7u2IC0VN qtiY3 Q==&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=tCorJRrpNo8xyLupZcmuPLBWyO4iPQEiadDnQ25OqoA=&c=sD0B6CEnHiWPw9P6 kXte6PZgci2FsRsqKqN5QKFkDMbPK pZ D8C2JRBqHrH8dPsoeLNUmqYkrnDS4VsARGN3O24f03c8agTt6VkTb5 AfljtQCU Kdt06tanfQTuoVMB8PGyo/3dOBYs2wWXpkAhQT6CNhzYixtwr5yDMChpE=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.signcityconecpt.com/c?x=XGeXiHM7Z xfXsCGDxYYA4zmqfvW3pnOxQiqto7RTEk=&c=VFM3Zn1dcY9E5r181z202bNjCYabqSMDfGn/CsO717gwypTqiJAdvOSbqoAu68cjIyGajCON5q5DiwwoEO39dhbCa L5xxOwdrbDvbiZ43OHr1LMrWRjzydpFmnyJNhMbaQC5MbTAVzn9hVxSFh5Ng==&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.cleantowncurrent.com/c?x=0Ewnm4yrchTB7r9NonKjLapGjg/r84NBOvFQ9ssNRo4=&c=Lp2PBWhHPYSQafHSLmfjQfWBNirYhkBbd7O6TPqd0t2p dJuPxiq6c4P5jzOA5SiG0i2tgmQfFwX2MWHPMxRmXnDoWaYDzfPMdLGiaDcUyet24JN59vL7rCUcSwqWUH1LoaAhyQRIeaIlllt2xuEF90aKiby4TuuBC3vtJUkw6Rb6HXV/Pkd8ZjC47H14BNn&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.cleantowncurrent.com/c?x=l22JDPAZJA74YK3jzoisoWnoSJH23FiBD0R8g49r470=&c=0mNEJ6/al 6KTBH 3YMRyCRtCFZ7yXmiSCM3SDhEQTZ7QmtbCFCAeVMlsYaXGrqvhzH22YqUADWcOL9JjCkBedTD7SIbjn8ndF8A3grt8gduczke3 aYfoLKkCbhjcW Od2vg292 jMznB hXHsB04MiyN47dsjGCYWVrqQ39EI=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.toursupdatebyte.com/c?x=cnmqQRnsshEbA7PijwxAUdXJKqhq gojowlwarUGoH8=&c=/OgC0E9C/Qo2X1dKavMbyTivZRZ1USYlQqgSOnj5sqfd22C4TZX4ILh07b1ttLzvFQsoK9YL83O8LxHsgajrFOl/pqZw0 TnpFIxU8TWMN94s8cG8D1nZLQefY4p0VM6 Fk30OjX65UbwGSq3Ox1GPSHIbfcqVp9Zhgd9QDfL0s=&e=0&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

Latest 30 of 419 download URLs

Remove camstudio.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.