Hostile ^92% datasets Download

188105

Legitimate TechSmith updater binary

Detects executables signed with stolen, revoked or invalid certificatesAuthenticode chain CN: TechSmith Corporation

SHA-256182fe90c25c062249f0b8549058378373df5ca72a798a40aaaf143f20717e1c0

Evidence

.NET embedded resource access path 0x25a1–0x26b1

⋯3 more rows
0x25d1030000cecaefbe01000000910000006c...............l
0x25e153797374656d2e5265736f7572636573System.Resources
0x25f12e5265736f757263655265616465722c.ResourceReader,
0x2601206d73636f726c69622c205665727369 mscorlib, Versi
⋯11 more rows

refs NetworkInformation namespace 0x5a9f–0x5c3f

⋯3 more rows
0x5acf4f72456d7074790050726f6365737300OrEmpty.Process.
0x5adf50726f636573735374617274496e666fProcessStartInfo
0x5aef007365745f46696c654e616d65007365.set_FileName.se
0x5aff745f4372656174654e6f57696e646f77t_CreateNoWindow
0x5b0f007365745f5573655368656c6c457865.set_UseShellExe
0x5b1f63757465007365745f5374617274496ecute.set_StartIn
0x5b2f666f005374617274006765745f457869fo.Start.get_Exi
⋯5 more rows
0x5b8f747279436f756e74004c6f63616c697atryCount.Localiz
0x5b9f61626c65417474726962757465005379ableAttribute.Sy
0x5baf7374656d2e4e65742e4e6574776f726bstem.Net.Network
0x5bbf496e666f726d6174696f6e004e657477Information.Netw
0x5bcf6f726b496e7465726661636500476574orkInterface.Get
⋯7 more rows

.NET NameValueCollection type reference 0x5d6a–0x5e3a

⋯3 more rows
0x5d9a6f6e732e5370656369616c697a656400ons.Specialized.
0x5daa4e616d6556616c7565436f6c6c656374NameValueCollect
0x5dba696f6e006765745f4170705365747469ion.get_AppSetti
0x5dca6e677300576562436c69656e7450726fngs.WebClientPro
⋯7 more rows

Embedded HTTP or WebSocket URL 0x6caa–0x6d8a

⋯3 more rows
0x6cda00650072007600690063006500008087.e.r.v.i.c.e....
0x6cea680074007400700073003a002f002f00h.t.t.p.s.:././.
0x6cfa74007300630075007000640061007400t.s.c.u.p.d.a.t.
0x6d0a65007200730074006100670065002e00e.r.s.t.a.g.e...
0x6d1a74007300630068006f00730074002e00t.s.c.h.o.s.t...
⋯7 more rows

Visual Studio PDB build path 0x8404–0x8574

⋯3 more rows
0x8434ac7500489127721fc0b98c9c01000000.u.H.'r.........
0x8444643a5c5446535c39365c545343557064d:\TFS\96\TSCUpd
0x8454617465725c5453435570646174657253ater\TSCUpdaterS
0x8464657475702d47617465645c536f757263etup-Gated\Sourc
0x847465735c545343557064617465725c4465es\TSCUpdater\De
0x848476656c6f706d656e745c50726f647563velopment\Produc
0x849474436c69656e745c5453435570646174tClient\TSCUpdat
0x84a46572436c69656e745c6f626a5c52656cerClient\obj\Rel
0x84b4656173655c545343557064436c742e70ease\TSCUpdClt.p
0x84c464620000f0a200000000000000000000db..............
0x84d40ea30000002000000000000000000000..... ..........
⋯10 more rows