home

camstudio.exe

Path Quality (Alpha Criteria Ltd.)

The application camstudio.exe by Path Quality (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.giftcapitalbyte.com and multiple other hosts.
Publisher:
CamStudio  (signed by Path Quality (Alpha Criteria Ltd.))

Product:
CamStudio

Version:
2.0.5.a0.1_61161

MD5:
6272da4b3022d924778a5615a6f1c17f

SHA-1:
e5235369a85e1d64c400553854c019c92c962db6

SHA-256:
6f1fbf86405559477873f640b08d8c53b6ebdc41aed946fe1594157139b17740

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/28/2024 12:46:22 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.7.20.11

File size:
988.6 KB (1,012,368 bytes)

Product version:
2.0.5.a0.1_61161

Copyright:
CamStudio

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\downloads\camstudio.exe

Digital Signature
Signed by:
Path Quality (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 12:09:15 PM

Valid to:
8/3/2016 3:53:56 PM

Subject:
CN=Path Quality (Alpha Criteria Ltd.), O=Path Quality (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121865442A968BACB1F4EC1956476A3AE8D

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:zTfX+OUopkvQikg+G0uJpX8rv6Wa3BmVTf/XvQyMBTlP0QjcpMXVJoa:zD1pkvqkKCWaYzGpfL

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file camstudio.exe has been seen being distributed by the following 50 URLs.

http://www.giftcapitalbyte.com/c?x=q65dJJlHI0/JSzNicf7CZHprR7uEdC1ZDIHzOwfz7N0=&e=0&c=pxJwMmOCrzDREae2VcBcosWghhpt Y/wlzfwo1eC/r9Hzp3RysrmZTFDpfFU2REAPDiJLLkzpEqapjQdtyjUKTrAy2iEqN8UfzUQnpojXtx9ShCgEKyxS1xExOekOpkE/5EKv tdc3XsxsvQy/g01reHlMd2lFOLoFvkbjUlZDE=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=g/Q7IDexPM t0TNgE4Z5lFXEBaWw/JyoO4Qv4FqS1y8=&e=0&c=/SNxxZUViUrgZfBvWailSAbhw9xjPMZRaMBkiZw1NWzgocfgLXjNGUxdySRLJ4AzS44JWFsU/6YVtmX1RjoCsSwwg4wy i8CNHuPKVZzd BVV1wlba6cIcgWUa1NMgxvK 3X5AFxaMcfAonzTbbg4ulaNdN2C8EWlJ/ vcqGfUI=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=hJ5WU1mTKLCIN2C8PmOSoXQSsFpCZNiYVeBeGW74Sb8=&e=0&c=Ta6U63WlziSFsjdGlbRyegoq8hDsP9Sk1N1YEF3 GBBWHE1F0EONbsBA7pZBJPdUOkCfrxTXFacVSGXk HaEMX4IakmTnaR3NllNwBJMT09o5O5oUZg4qRYQRP5zxgfbJ7F2T5gJH9Omi183tYcYZOtI9ycFelB 9AySklgdsVY=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=LA6IRqY5IPLLuKnswm3Cv4DYXW52apSlTpptQekFdFI=&e=0&c=OKuK8YoOrlot70JbFH1wyTm4P0DxEyafG9itaieGWJU12D7hJntY6Ws3S7c6T2RKQoApI3XEQrMeeFXPolnmi7WV7/huh5Xq9DaD6dnHihCSF2YPwfe1aQH92IRL3/55P2gaphIHnROx7JScV7P/LmYNhvmrB xXXCztFZlXsOs=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=NtqWSywPhcWVb4AS XJEcTImNUO qewaulAQpas4M9Q=&e=0&c=IyaD6fCR6ySmz/uUGUOJVO/3Dubw77x/I0ZSjnTuhFiLCITBrapg7u5IG4A4OGglek8BnPVyZw dA3sEJANky4UsN LT9EjtRVVu7g88Z5hYY849z3E0T6/wq2NyueHElM2I23HB1rgMGQ5ewp3osTpljEKLDO1tUQLPJxMgfR0=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=XNORX5IPCKMinbsVh2 jiYKfM3PA4KqGMKv3RlH9QD8=&e=0&c=neRrgc3e51TZPv s3fFwBwNz6IZ8wa1YsFs3grNiG 6/q33nfHOiyL6HqpwV2ff4kHPO1pIbDPp ybKkkrB7XPzotfHZxLHHAVASQQ3 mB3YQtDkwai00N5GbiROuV2NE7cQPUqhcjUuKkS0/w4Q5VQsg1wrM52lxGYDcNBU21M=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=YFlwgH8XAxK5 RBw8NK4abMNSJUJLtw/lIP055ZsKkU=&e=0&c=HPWxgSr/gqB03UZbjPK5yJl5z/4I3FRxWSrmoebxKJc2sM1S/U1arjMJnYYB9DVaGdio07csZv4mBnu3ig5RxRgISJ4HK4CdXC SJ SFnuO 9XdyHoYrB/fEWy0WblIsbl4SNDawuR8g Rsgbc9qP8nAvRWIdQ7z4HkD5Cqk5w=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=KeuNJ2LgJh1NWoSMyN6Wqe3fW/kXp7SmP74ftpbw2oA=&e=0&c=tYTIk2xZCNUiAZqwbVGlHSDXJBgEILUtiErSdwoRVtrqKvwQN8cWa59zm8ZYirRI1t8oGB96T12lCbU0hQgY3eNsd HbSylsjQmLP1inWlspfxkEKpbBqVQkLTr4VaHW/1n7LCGnhPtvjbzqjftMD3qC1ky2DeQPqIqg3jF2nLQ=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=fFwiPeKR7zIJWBccmvKnF6qGwsIW2P6n7Ckmv kUvmE=&e=0&c=286oqDQTzrRU XYzvZ2jGYTlcttgXmS2GjRpWFcY3I/zl3nx78AodfDQpeEciQGmiKDUr3hTO9rK5xwhZ1P1lBzUOZf2BH3ZsPXqLAIWpZ01PwInud92ucNiL9H14eWmdnRmzU juNyUxZ9 JNE cbyVYW7d5IZJW0T7FrVsPxU=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=5KRBJDF/jDx5hCraVJVewJlsx4419 RNEujc9bKdlbY=&e=0&c=WgqSmxzt5Yt8r1UcqHmyfHzzeO9LBHOfjo3pHlf6eoYXKoXOsqANEcTknWq68cLSwej6/AHlcxtka2Y9uOWP8wiLfijVZBwGutv7C5YT7jTVmjjTmhwvRf3TGXrD5JCYmF8duKrzbspm7MjuoGQdWY193awscn9zVajZueCJqyk=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/giCmmjsz8TAXNwWOfN54 IqQ_AyyYwcN9KV289wUm73Rzqj DSrmCjX5agjd0FGDzyrlBAeJr83k4trhX_ 3qu8026u5zgJBvuhzPxPkye2q1n64BpGyeaTjdSQvcejs3oFpGoYoQWkiDLek_ryapPCzlzQUs1hKnOZ6jkvExAqlchntrWi9seBWy43RGyHKSxTFIMqv-GzAAAMRtbD7PaUzHinBGEQXBRA4cWkRd6E1tHcgbYzSEZ7dGXVqZJ lTew29AA==

http://www.giftcapitalbyte.com/c?x=Ukccg4DEOns4GIL1sqecXZ5E2qpWJDzISP30ubewFOA=&e=0&c=wJobrksPV9HOyzV5l8tEhN5V4qf1NL IHBm3VtjryHUmWnvIrj8hl0CI04PO 6i0lsgiWN5HYj1dE6vX4YK1/dGocD8Zl9jiQzbgb24kWszZe5nNf M1zPbbtiQsmZ4Z3MHOnGi O7MkqFoanTJZicTq8adiTq4rjQXkheb1rg8=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=geEDaOjcDLDwvC6mH0GICGBGh6De9Cm2D xI69qcsRI=&e=0&c=E7fAAq/vkV/I6UbhUmU0A9jP2f5lyO6X2yR05rqtTQNxmr8TS7TcYJsq AJj3s7ApOAkJMu5thhMfDifI9JXTeIVvjvgbADa818MkEiVDU7mme1BNfs8Tb16QVYwWDVtXtBIRYFc6B3Ie/ZN9jQ8vdG1ig9IZKMvrR2QLoR5xII=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=03CetKFCZDPV CumtML5JMoQLyqGS182kWEysRjD75Y=&e=0&c=FKkOQweqh6FFqoOis6/OZjVAUpbipyf3xog9qIxlG6 tXnRRFwgS5VeG31gTsPPdXqZLIU2QV1rHLqwH1CCO5aH6FokeE9pT/N3c3bD7o0e8 JbLsUqbyNxDKxf3aHCzvtyz9oxKnANmgJaiQxsAkLF2f5iovA1uAUvhCej0gdM=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=eUNv9twOQkbLKqCvu5IOALbSr3TWHhgbcQs4HJcqsCg=&e=0&c=MRnLWAuFn ZKFjREIoM/sax/6Mxlj2Bos5r B3GghUcxZTzp7YhaHIHuABKr5yKuWHY10qPbuYOXj L7cKJCvjLBprhZd0ajraFuMal0nh3rILXy03XVURuT6F1epKdBsGE8fV4Ba1h6oLMqNwhLguO4NgcfKgncAo2DHqLTybI=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=PxTc9EiMjYOBtcHEAZusP6sQ1TxjI5WHpGx5LncxbvA=&e=0&c=c63XgGPOU9TpZgzGxm 1GJbv iPJju6tGxVOo1BwdjdMZ2e9wnUzEDJhTeMDQvixjbR uWjxp2JE0DjaUYovcmLg6y2RfdyLDlQtL6wpx/bTvwKMAHJMMaY5e7LDeqcp1OkcuDJk2afDI3H/rAsdsyk0LccHfhsS5zavrLoCmoA=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=3ISBQ8lUO4iCs4TNBSJ4PBt8aC/0hP YPFFr0V um7Y=&e=0&c=9agugCTqolJpbzNbv6kaE/j35F1npKeKiuHt7K3wT 4j96NCR0X7VOl2DlCKbi7c1fQVoRJwCSYDtomunqCljRGIW6XksL8RwPFp0Fdskc2JQMlnluTcY9C0d17gbRC0rjv9KFVR6NLW8GGJMioX2SkoQ9X7B6VKEMySOoWo/Gg=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=TvYS49EbGnZrFFVyD xFuEaUKgiFqjdJpHtup076RgU=&e=0&c=qQ/VGnHVBszUzkB7Wz9LmNRHdCvJgh9xB1 LoUypNCr9FR8etMWeXQ9cbB4tc/0f3h4HJ8Fz6hbiWMOtMKC0qS0igv4oHzVYbg2VSKxMfn7FYgwU6VWZBYY9WvcmN9Y68wl8C2uvgKfffVMsbHIQsql4JrCvsNg7KRVVdE13oAg=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=z1x0kBnyT/uZiNTeeJNsJBSK1sm9s4se3ftcbe9aTUA=&e=0&c=X0HMgwQh5nu2vx9Qc1PunbpmP3yqow40jLkUnrJ0ONk1k3pVpBXdGwfVYrTRxqA9nTRkxoeJEaIilLyU5ro FxrUBf51ev6bucZWgvc5vLBfxCRycfwf5zWjLQlIcukMevJOVUrHZDbMr8tSunANgoGin5kFlnBaifPBWLM1mr8=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=PD 0lUSvAOpSQZ3QW3sX3tCU8OqWngh4RdMGTLjIAmU=&e=0&c=0htFRUNpVmiT2i7l6ZqaEZKVT/k0s4zIXkV2/6lj/eobsp442rjFFz/Qsk3/nOWhO6jpr0jJCCsBXxWexSa8GjYqMVyXLRYAGyJCVH/tdfLqSQqe5lJQGFEFsdJDk1o61zyCIGcAXQpBNwW0CeiTlh88G wdtQ90oetA9u15nPM=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=ScG1BzuMDNSuzyDdvDUrV8tuk6ul6imvCjtF22MOi9I=&e=0&c=Q4GeoCI6mMBObirl1fUhNozON6SBYZeeA7vULqwymh67625CtnoasMNsjv1CnbdwFOY96NY3X0GrrFaj Lmh3qmDeUBmUMrwTvld1o159NUqyR13IqsNo6wwvP IlUtK6shoe9YV XTynbT45TQlvFJfWv4RmXIGoaxb3s0PglU=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=DhS1EPzNgBjAKQe1dL7qtx8HYr8Y0KvFkDh1Ej7df M=&e=0&c=KoMsSRsmRzpzWt8n5/LjYPBhKTy/0GzQdz63T3LdBywLexH0J/qXGCju A4grrWNV B0Ft0GWED4j1LgNkjjO1pvBGndwGem3bYEv0YrKKbLF0Bz4Ec4ec74h5Y L5YGieDlV WN6lzYjbuiCwI7cmSwIq1/oLfyYXiLPOsgchY=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=84/JhAW KU8T23Im5QCVKGGn6of8SjB8GDpHKECyPmM=&e=0&c=fRV7DrmTVzHvtbW4OnAP3q7sO7ee6bpV4cam4dkQ1xdBs9NyZtMk5obA16XnPSsxW2URSRYamgbfggz ZXor9YWxdDwWLxvtpvXYlBc9KfSsVwY2wRKpP6lx0W/c8DZhVcyFibim0mhK4GCQZHeTHDcmd0LzgVwvP4SCfUbFGvQ=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=IBT tEZbmh86rjLfKm8XxXNUTbsqx EGz/QNd6/Rj2k=&e=0&c=6SYVmJhNys3xl07ux07BB/GrM8r0Zq0ahpAndKOWCTnrbMOdcneX6VELPP7PZ5XDDDRvdxQjqdTOsTjfuV1QIFCr5AfTjY8PYpwxR5NEoiTr6i0HmECRNRPdH1O8ETXyAImJp36J8INrhh8Bp3/6VNSc hwty5IzyIrzccfMJgk=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=6hNBibiYeoKsgMbCdaS6kSLH9OxXKRftYwYDeaByrl4=&e=0&c=6BEfEPwvLn6Ve0kNFj4kY5gvQL3kOam7qvvf2Lb2N4Bpb/jRoCWyx/EmlhTbJ9cMMN6Nf5jkjcTQlsywKs/wxGWtEZZZ/HhpZyvCT o8Nt4z4 hVK9dg7WEMosQBwjT1f9IZ0kLQnZSrZ2RfpiAUmAYs/nWHUYNTTkHnzJSSEQ=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=lo/4c4z30m9U2lvTXh5VpSWLDi8PH0St8kwmBWO1hXY=&e=0&c=OEtnKI79JZLHuBbvLcWbBCFay4rdR38wguxGgeRJ92vxQdgOcBQDkKu2kSbNRz0EshXEJK86D2T4YzhfbTb KXg0OjDX3fxEKG bclQLP906IQRN1Cg25c9KYb21zZ3hJpVIkBIDZL21GVYy5dkkKhJaDTZfYyCoXuiYzEp6KHU=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=cNAjBwdrZQrScBUu1XOdiEkFp7uBW0P2d0bSgWJNd24=&e=0&c=vQTcpzNxpLHbNW11dLsCLyQgup7cqXhzW1Sq0UNOb2LHn3qNE3jx7eP58vW3VFQQ5Chp1Aqn9r7kyu4ziNor1L9BTET6fSeVKEWj4wL6xEkddHZrmHJhTIspffeTlpe7cPK9ItThDJcW5BrcxKHFSmz6/pCbwvbTHg2ui4C2bq8=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=k7YdF6zgv/hc2hL/TEk eKNS0Bk197aGRecueLRT5Ac=&e=0&c=u4Ib XLaWoV1NIPmPPW RizqyeZVOD8PdrYq8J7bLccz9MIBfLMX/zUAhnOT/ht3ZGhYiScC62elIb2 LfAKKH73H12ClVs8fWUvsnRSn9cXWceOg4VAWwdm/mQJecKshKFVPUPQvj8W3MqI8fGvx61Qu3IjfaNNVZxO84sehGs=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=Bp1k 9aeCXuYUo2jJj5CEDSrgiqiuD7qDx eLzaQhZY=&e=0&c=xSGjFUEtRs2/eHpg17028bL23IykdryW5b10eG6Qur58f5Y31HZXPUyT4gdHcnrz nAqQmGT8RWyYj8d08G0p6KEFWl5 DJ/XBmLLwA8gDld94Ykg8D2KYhWJ3BmhKaYbnr45fbNof/idGCWyF6AMeh8ObvI/6f AEjkLJhC0uM=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=oh4lFES1c8rObDqTUjMpfWT0dy2TdjZm7FCD7qhJ1S8=&e=0&c=Ebt1xlwiX880qj52r2A3 80Stv1Lnze 9uxRcPLKmiFIrXrmFs/qRjholIBzTybE ZRiVlAOZx4VxyjywlslLxRbaScTE0pXaR6XGhd01OV5v ZdTZ67a v1Sj1DNv0XsVn5nK8psPlmeoDP35VLh54nbn7EJRKlCY5U46ZE9iI=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

Latest 30 of 83 download URLs

Remove camstudio.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.