42c1db18694a798a9248ac6b771fcf7701c6a38a70bd2efbe93828abd896305d

Resubmissions

03/10/2024, 12:59

241003-p8gvca1gme 6

03/10/2024, 12:56

03/10/2024, 12:53

03/10/2024, 12:52

03/10/2024, 12:46

Analysis

max time kernel
77s
max time network
80s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03/10/2024, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

GazeRecorder1.9.2.msi
Size

19.5MB
MD5

3e0e430226b9781f0a71356d6b6b8d78
SHA1

cdfc7317daca37e7e0ad6b6091d9284cd6b18dea
SHA256

42c1db18694a798a9248ac6b771fcf7701c6a38a70bd2efbe93828abd896305d
SHA512

4655e4a764ac56a49d45b876bd6717aea18fbea4741b649fa441721937fef23c67e4bc3d2067497c9a91bfb9f0004b06d8473e56fd78656b2e343092f3f5971a
SSDEEP

393216:kQcxyvHncyhhFuQYHfWCzFBhHLP532F7WRGz74ehIbLsTHDPBZW9XJAEUNovd:rcEvpHYxxHchDz0SYLsjDPG9/

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	GazeRecorderdfddddf.exe
File created	C:\Windows\assembly\Desktop.ini	GazeRecorderdfddddf.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\EyeTouch.bmp	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\Shortcut to Primary output from GazeRecoreder (Active).lnk	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\NAudio.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\AxInterop.WMPLib.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_objdetect248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\wmp.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\GazeRecorderdfddddf.exe	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_ffmpeg248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_nonfree248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\DLL.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_features2d248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_contrib248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\GUID1.dat	GazeRecorderdfddddf.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_flann248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\Trajecoty.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\Distortion.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\SMIConnectionSettings.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\ShellBasics.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\EyeLib.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_ocl248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\NAudio.DLL	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\GraphLib.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\NAudio.WindowsMediaFormat.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_legacy248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_ml248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\haarcascade_eye.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\Eye.ico	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_calib3d248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\Data\Tests\empty\TestFileSettings.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_video248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\Interop.WMPLib.DLL	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\GazeBoardLIcencja2.rtf	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\head.raw	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\haarcascade_mcs_mouth.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_photo248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\GazeRecorderdfddddf.exe.config	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_core248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\haarcascade_mcs_lefteye.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\Shortcut to User's Desktop.lnk	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\colorscale.jpg	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\haarcascade_frontalface_alt.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\Options.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\iViewXAPI.h	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_highgui248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\icon.ico	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\haarcascade_frontalface_default.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_stitching248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_superres248.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\GazeRecorder\GazeRecorder\icon.ico	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_imgproc248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\haarcascade_mcs_nose.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\Intrinsics.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\InputSimulator.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_videostab248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_gpu248.dll	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\haarcascade_mcs_righteye.xml	msiexec.exe
File created	C:\Program Files (x86)\GazeRecorder\GazeRecorder\TestFileSettings.xml	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDF279575917242E0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA4F7E9438CEA356D.TMP	msiexec.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	GazeRecorderdfddddf.exe
File created	C:\Windows\Installer\e57fabb.msi	msiexec.exe
File created	C:\Windows\Installer\e57fabe.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF074102DA2253DA79.TMP	msiexec.exe
File created	C:\Windows\assembly\Desktop.ini	GazeRecorderdfddddf.exe
File opened for modification	C:\Windows\assembly	GazeRecorderdfddddf.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB09.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC54.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2D7ACAAF96D91857.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57fabb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB49.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{44538B2D-B056-4652-8E12-B63C2F959AF7}	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
3564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe

Loads dropped DLL 39 IoCs

pid	Process
3904	MsiExec.exe
3904	MsiExec.exe
2644	MsiExec.exe
2644	MsiExec.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5048	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GazeRecorderdfddddf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GazeRecorderdfddddf.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000908a982beaea54420000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000908a982b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900908a982b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d908a982b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000908a982b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	GazeRecorderdfddddf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	GazeRecorderdfddddf.exe
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	GazeRecorderdfddddf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	GazeRecorderdfddddf.exe
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Internet Explorer\Main	GazeRecorderdfddddf.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	GazeRecorderdfddddf.exe
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Internet Explorer\Main	GazeRecorderdfddddf.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	GazeRecorderdfddddf.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
748	msiexec.exe
748	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5048	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5048	msiexec.exe
Token: SeSecurityPrivilege	748	msiexec.exe
Token: SeCreateTokenPrivilege	5048	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5048	msiexec.exe
Token: SeLockMemoryPrivilege	5048	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5048	msiexec.exe
Token: SeMachineAccountPrivilege	5048	msiexec.exe
Token: SeTcbPrivilege	5048	msiexec.exe
Token: SeSecurityPrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeLoadDriverPrivilege	5048	msiexec.exe
Token: SeSystemProfilePrivilege	5048	msiexec.exe
Token: SeSystemtimePrivilege	5048	msiexec.exe
Token: SeProfSingleProcessPrivilege	5048	msiexec.exe
Token: SeIncBasePriorityPrivilege	5048	msiexec.exe
Token: SeCreatePagefilePrivilege	5048	msiexec.exe
Token: SeCreatePermanentPrivilege	5048	msiexec.exe
Token: SeBackupPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeShutdownPrivilege	5048	msiexec.exe
Token: SeDebugPrivilege	5048	msiexec.exe
Token: SeAuditPrivilege	5048	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5048	msiexec.exe
Token: SeChangeNotifyPrivilege	5048	msiexec.exe
Token: SeRemoteShutdownPrivilege	5048	msiexec.exe
Token: SeUndockPrivilege	5048	msiexec.exe
Token: SeSyncAgentPrivilege	5048	msiexec.exe
Token: SeEnableDelegationPrivilege	5048	msiexec.exe
Token: SeManageVolumePrivilege	5048	msiexec.exe
Token: SeImpersonatePrivilege	5048	msiexec.exe
Token: SeCreateGlobalPrivilege	5048	msiexec.exe
Token: SeCreateTokenPrivilege	5048	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5048	msiexec.exe
Token: SeLockMemoryPrivilege	5048	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5048	msiexec.exe
Token: SeMachineAccountPrivilege	5048	msiexec.exe
Token: SeTcbPrivilege	5048	msiexec.exe
Token: SeSecurityPrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeLoadDriverPrivilege	5048	msiexec.exe
Token: SeSystemProfilePrivilege	5048	msiexec.exe
Token: SeSystemtimePrivilege	5048	msiexec.exe
Token: SeProfSingleProcessPrivilege	5048	msiexec.exe
Token: SeIncBasePriorityPrivilege	5048	msiexec.exe
Token: SeCreatePagefilePrivilege	5048	msiexec.exe
Token: SeCreatePermanentPrivilege	5048	msiexec.exe
Token: SeBackupPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeShutdownPrivilege	5048	msiexec.exe
Token: SeDebugPrivilege	5048	msiexec.exe
Token: SeAuditPrivilege	5048	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5048	msiexec.exe
Token: SeChangeNotifyPrivilege	5048	msiexec.exe
Token: SeRemoteShutdownPrivilege	5048	msiexec.exe
Token: SeUndockPrivilege	5048	msiexec.exe
Token: SeSyncAgentPrivilege	5048	msiexec.exe
Token: SeEnableDelegationPrivilege	5048	msiexec.exe
Token: SeManageVolumePrivilege	5048	msiexec.exe
Token: SeImpersonatePrivilege	5048	msiexec.exe
Token: SeCreateGlobalPrivilege	5048	msiexec.exe
Token: SeCreateTokenPrivilege	5048	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5048	msiexec.exe
Token: SeLockMemoryPrivilege	5048	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5048	msiexec.exe
5048	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3564	GazeRecorderdfddddf.exe
3564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe
2564	GazeRecorderdfddddf.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 3904	748	msiexec.exe	82
PID 748 wrote to memory of 3904	748	msiexec.exe	82
PID 748 wrote to memory of 3904	748	msiexec.exe	82
PID 748 wrote to memory of 4844	748	msiexec.exe	86
PID 748 wrote to memory of 4844	748	msiexec.exe	86
PID 748 wrote to memory of 2644	748	msiexec.exe	88
PID 748 wrote to memory of 2644	748	msiexec.exe	88
PID 748 wrote to memory of 2644	748	msiexec.exe	88
PID 3564 wrote to memory of 2592	3564	GazeRecorderdfddddf.exe	92
PID 3564 wrote to memory of 2592	3564	GazeRecorderdfddddf.exe	92
PID 3564 wrote to memory of 2592	3564	GazeRecorderdfddddf.exe	92
PID 2592 wrote to memory of 4212	2592	csc.exe	94
PID 2592 wrote to memory of 4212	2592	csc.exe	94
PID 2592 wrote to memory of 4212	2592	csc.exe	94
PID 2564 wrote to memory of 2548	2564	GazeRecorderdfddddf.exe	98
PID 2564 wrote to memory of 2548	2564	GazeRecorderdfddddf.exe	98
PID 2564 wrote to memory of 2548	2564	GazeRecorderdfddddf.exe	98
PID 2548 wrote to memory of 3308	2548	csc.exe	100
PID 2548 wrote to memory of 3308	2548	csc.exe	100
PID 2548 wrote to memory of 3308	2548	csc.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\GazeRecorder1.9.2.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5048

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9BBB95F39B4EA4CF121A9C77617A2D64 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3904
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4844
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 04CC1DCC3351E7C143598D2A89C8B0F9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4356

C:\Program Files (x86)\GazeRecorder\GazeRecorder\GazeRecorderdfddddf.exe
"C:\Program Files (x86)\GazeRecorder\GazeRecorder\GazeRecorderdfddddf.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m2qwvj1d.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2651.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2650.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4212

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\438e2a617afe463692967ba4d43f3d16 /t 800 /p 3564
1⤵
PID:1480

C:\Program Files (x86)\GazeRecorder\GazeRecorder\GazeRecorderdfddddf.exe
"C:\Program Files (x86)\GazeRecorder\GazeRecorder\GazeRecorderdfddddf.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1vimreud.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FD6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9FD5.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3308

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\e4667a6cf64b4eaa88748e4af08182d6 /t 868 /p 2564
1⤵
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57fabc.rbs

Filesize
25KB

MD5
73a873f8884cc7dce84c66de91f8ae5c

SHA1
353462d72fa277db1f6aaefcaa10f5b85d7ac9cc

SHA256
3d5aacc41cc4feb721338a29e8f2decc5650d64cf431970c06c046a24cf2e45d

SHA512
8aaf89b836b1dc3314c4d7c1523e19ecfaa488cbeb23c15d82776814702c7b7c8b74ac064c6c778f90f0b84f4541d784d5ba5563ad235ae7ce1febd1139dbba4

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\DLL.dll

Filesize
1.2MB

MD5
4bd587cf0a24fe2705f48ec6ad4d91db

SHA1
7c4a8b8c5c8934759491881ec231f2224ed06265

SHA256
8bc00bb1459fa4b41ee10d560d8dd29d344741a6a129043985f8f9ab2d6785f3

SHA512
1aa3080fd863364dd82086b878edfd405807d8fbf395fef08029615b5e4575d7851b1e0a2bf3767b53e81ece134c9a6cce80e5a8658760e498759e279ca4eca6

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\EyeLib.dll

Filesize
239KB

MD5
86f2b2e2dd19cf831513850a8af9b9de

SHA1
2a90065b75c3b853f1d7078e68674d24fdfe8801

SHA256
9eff7f397a9d9e967f99e5684234c16491203f48fc3d767e9f01a654bf83ccb2

SHA512
ac0855637e060fb4256e5c246e85358063032fb32bb475e8cb00e19aafb016d3702be800a11ec60bbadf4576880ba5238bd8b9c08f2925983bb7b4784a94003e

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\GUID1.dat

Filesize
54B

MD5
827b8a7951b7e0aff0f18a169d2ac3b4

SHA1
338a2410f05bd45b67e7aaa797a4aacb5583db39

SHA256
9715f7b8d4b37c1de0753c834ba3d77602815b047c003ec66880a34386d03ca6

SHA512
594dc5a445872b9a35e63f21e72f57f2c251d7f8686a2c7b71f8ed5169e3799005b713bbc8995987156035651bde0019ebd2acfdc683499409c315e125d38c9b

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\GazeRecorderdfddddf.exe

Filesize
899KB

MD5
cf69c9f3d54ee3b2a1a80b2f372d1730

SHA1
ff1e98bc128548ad3c225fb9e2f744ef57d60255

SHA256
e219c79eb93096c93b61b3c438a003be7535943085dc05d674080f1b687d45ce

SHA512
e8cb57dfe0479c89ca10ef75503df93040085b9d1772e4bb5514ac91c4b3d5b2154b65b30836abb4c02e7c7ffa289d8827b30e1fb7ab8a0308becaff4aefb2df

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\GazeRecorderdfddddf.exe.config

Filesize
117B

MD5
d0089718b62f6e9d91154acae007699c

SHA1
6b7168ae1fa2fa7cf268e36ba4678aed2b9dbb5d

SHA256
83233e66d0f47f016ac44626c179f9006bdb15c22586ee737278a281a8e0a503

SHA512
a498eb1505894ce30f8a518432b41c85275defccdb339fea6c0a5425fdd00583da16e3524a175292615929d5bc6ec9eba20b2c9e363a575bdb2763ac2a7cea6b

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\GraphLib.dll

Filesize
72KB

MD5
39f100b7dbff19f66da4c1538609e895

SHA1
f29ee29a3880cbb30506106320709e0b5c577f89

SHA256
2004b0f5680daf19df9cc77ae91f673963acf03182efddf675d76b9e2b5fbe09

SHA512
3e715925ef1e1fc8f334a3deeaa350b6ab612f4d28f34a40f2a64c66b90e7205c5e4e09ad6a53a1769d4bacd6daf9b39cd72750b3798c4814506e9c0721eec2d

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\SMIConnectionSettings.xml

Filesize
322B

MD5
c07c16a6b26dae261f6dd7f71d518a60

SHA1
6b28d59c6c8e8cc899d8df87a937d92a51dece56

SHA256
7ddf730c56d0677a78f342b68e1e09172f845e6e1bdcfe6499b6649201e5f937

SHA512
83de6133aab0943cab8487c32e84a865eecb93b25390fd62c57c8d94456a6efc26543f480d21e086efd34681d8501bf51e9533e1bba3f267f84a7ff49a8867a5

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\TestFileSettings.xml

Filesize
3KB

MD5
21ce2d494785d4a9ba686ac0d9ca8889

SHA1
480e9afef7079111be41595957fa94829b4d6772

SHA256
350025b738ae04af11d976acd543745bc14e0b8682a1ae61add9c73bbc039fa5

SHA512
7c88c5fe1d34a1a7b3fdba042050e777baa9174d4af1eca22e409b94a885e2d7c725fe8b96f37715a71c6bdf4af372644892f895fe5a1d11bdce30e7658d6d0c

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\icon.ico

Filesize
1KB

MD5
0e07a06c3e8444ac835774be6241cb51

SHA1
220306a1863f5afb49610c9a3759b9116500095f

SHA256
8010ae8b6b0e470b3483638d62a33d0cfb1ce8b1bc64fc087033dfcadb10e8eb

SHA512
0e00155923230f7c2c5b820684aa1b2fd009b657e5d1c36f99245fddb31de79996df759573306dc2a06210c464fb2a94c82c6db99c858e832c1f62df36a478d7

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_calib3d248.dll

Filesize
768KB

MD5
36068ea146ac14666058f3e4c3216a65

SHA1
e569bdb88266cd4dad65417b832965c9e924a0d1

SHA256
8cf1c9fd0310471c5406c6ef5f6738a7f4b8292e57f022ed23cbdd790e1e965a

SHA512
57fb881187593e6746ec9451badfbb425b63c31fafa4b7852a58c4ce514d1e1f230b08f505570463a8bca2c8996946089f02af7dc10836cf7736754ecc858e14

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_core248.dll

Filesize
2.0MB

MD5
53ffc4c9e1606d4d8fa049d549651104

SHA1
70e3391efd38e137311bfd900360b94266d35dd4

SHA256
af2f66ee7c753d237154fde0ef393481ce8594bcc2119d05930862e691a89cb6

SHA512
1167878d5379dd434c0199432458e77966fa20e08422eea863c903a86882544735fcae5a0dcb99aca1befe200c4859615cd9f120f8847b1a0bffb3960aee06df

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_features2d248.dll

Filesize
701KB

MD5
8e351ee79205a497c5338e2522689eae

SHA1
e34c89c1083f17d33a40a1ea04c40fd6e739fb7a

SHA256
b2eaff76386dc8be5bb1abfda757cf0d8a5c75ec6f8bd0c82318167dac0c3274

SHA512
22594fc910485a26dea022f90732cc250b690812229bf829c5a22fc0e1454d36a360c6166b9597b65f1afd53aba7f4594d8fe9f435583363bad25e8466252329

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_flann248.dll

Filesize
477KB

MD5
33f8185d818139cdd47e823d82ce2ae8

SHA1
812ebb69356be9cd40d66e739cea53c7b7132a1e

SHA256
3365314de76adf2a09a5f24abf5662c7cf5e683371c2378b096aad77af615bfd

SHA512
7456a5fe15fc19b29c3c4debbccc7d547d170e7bad8c502e4c9947c9d6dddc89686434d36991b6fd56cf078e9e361f746dd68489f7328b22f1ead63cd8d70651

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_highgui248.dll

Filesize
2.0MB

MD5
fe034abedb912c83136ee03c6b7f3228

SHA1
4f28357c7b53ba2e1c5348b603de0c2cd0890428

SHA256
600f5cd773b9ea340358f42c770bdaf3000570d35eddc3e260203b01115e8646

SHA512
9e8b7df7238f3cd26f36a457c148581dcf3deace1c247c37aa1d5639ca6fa4de3c0e069f4c6e688b16e17bc684cd4b3054bf2cdb6ebc418ffcf5e12cd732feb1

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_imgproc248.dll

Filesize
1.8MB

MD5
22ea6173cee9b8e95994a31dd9f2601d

SHA1
18c6967b806059f4e4939848506c4312f441e29c

SHA256
00047008cd596aeeba177adb8a207609f9be9d1eaa883a666459c0d132dbabfb

SHA512
c3bef7b88ba8a7562ffe0d6f1ea44f22410e9c9ae70c6d13cd89c88c9cd168caa8f2298f354957d6e74811623e13e4b2abdfacee9e07e5e9e1031e8e5b1b3838

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_objdetect248.dll

Filesize
642KB

MD5
7278869cb30a2ded4d28be19dab225f7

SHA1
ca0e3952e4ce7531bd573cde04b225514b5a5ebe

SHA256
54177bbee9d2ccc4afa9c6d89ad10323f509bd4e9814480a7a33feac1c989e25

SHA512
fdd0b261ce5ef5c67ed0bb008ee295d62cfc9164f6741063dfc906369ca321835891c0a19d1dfaedc44d65b89abc202c877b4aa039c110aebd20642900b93337

Download Submit
C:\Program Files (x86)\GazeRecorder\GazeRecorder\opencv_video248.dll

Filesize
357KB

MD5
9f9332b8f31e20781e4cfb6ca3d4b518

SHA1
820d929847a131a53f7077f7d663de4b17190633

SHA256
ad2198911a4522fb2bf80c0df2ab061ac59c9bb89d15fc30aa975327b76befb2

SHA512
b0c5c8dd47c033b1b23e8240b51017361eb6a6fe4c73f7f5f61b8620d44f904d4bd9b292021663c373479fbd9b1d9f63a4a33c2a93eef70e63e1b514ff38f783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
3824db8cba23d8e47761080c8ad5cd5c

SHA1
23c4effcf2a4c85d84344ce1f0508796044563c3

SHA256
62d9a123332b6176cf4daa12736ed3492854fcbf894bf09e463db81baba58923

SHA512
1b54cf18051b43faaccbdb0fbe80fbf0dce65b23634d82c256160ed479d76bbcd62aa777e34dfd2d5b22aafb06f80974add8a11b8447c23408aa0393bcac6708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
98a828cb0e52d53e438e68cd0c2a00a6

SHA1
f7967a8abb1cbfd2b1e11de409e4cc7701f4409c

SHA256
3739a69f95125679b9812b5b63787c762da6aeea6497583d982ac6d2cdbe88b5

SHA512
bfb1c7e23e69cba98dcfbc0ff2425b912a62337bc513c124fe436fa4947ea9368ad85b02ab563bf9f4d0ffcbefbc0501097453dc3dcaf77d2542555e709c0fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M3DUQV5R\index[1].htm

Filesize
315B

MD5
2f113dbdafdd6ae7b33ae2a99b21a4f0

SHA1
c98de59de307a845925cf8507962141afdae969d

SHA256
9046f78b82b01b20d03394786db1a2e8e4d1c2a15af52ce925c9d5a2072b2a69

SHA512
d7bd6036197602f3ecc3e689c83f1c5844909279f605bb306bd4ea7c26397933a2236417efe65c500ab0d2068f92d0d16fa08060dc4d40171c90d50827f6b72c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M3DUQV5R\register[1].htm

Filesize
251B

MD5
5a691ac8421ca1c89289ab584e6c9170

SHA1
569919b91c8ad2778191ff5d52da6126e9d99b04

SHA256
cb760240e081da8e9a4c0d4930f330a2fdf5cdd0b08cf0cbb644a66d9aa26c0a

SHA512
25c9e9ae6bbda88089b6f78da1d3dd03fd3e949c28d5ecfd9c321099039792183f38218d1174815961d557bb0e0a4f3bf376fc5be9c7e48d97ffa7427a342e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S3X7BG9B\index[1].htm

Filesize
6B

MD5
735b7aa55a14c0d07ce6f1526d7f4df0

SHA1
9dfa7a993fd31f56d476b30b75d0dcefc9973169

SHA256
6af380b7b870a8a71defa84137d5e001dbcc8d9c6c09bbb79622098ae356d055

SHA512
30e90632a86bc6c3eea8109063cb1b2dc813054bd00a5aa20e03dccfb07da5ac587bdbafefb8ec09bea648faab2b7a3fd24d159a52e2a90d49c5a0f4d5219ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S3X7BG9B\register[1].htm

Filesize
3KB

MD5
8e3d8ad3d3e32188981de1836199ceb5

SHA1
d93d1203c2d83a0c7214ba552c62052a42eca7a6

SHA256
e8af194a6255ca7c40a1a7f4419e0432b75d004344984774147566ce97ae9d60

SHA512
da4580229cf074e6b22bd729909592ac25638dd0247b5e83e5c3ce5264d2a968afc1d7123fa11aa8c9e0d01521e6fcacdb16e0bc11e67f7fc2f023ae088f892c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC459.tmp

Filesize
231KB

MD5
5494165b1384faeefdd3d5133df92f5a

SHA1
b7b82805f1a726c4eee39152d1a6a59031d7798c

SHA256
ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055

SHA512
ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2651.tmp

Filesize
1KB

MD5
5e2752a2bbd3da9f12caa27b4151d9e3

SHA1
b6a7b833a8a50e6e0c399c31d6d22af31610c468

SHA256
e20f4916f745e989346a1ba910f89ecab8cab95e9ef31ef6d17e8a2cb487383b

SHA512
b4fe67892667a70b259656b83016d4d259047c4d4dbae92d58db2e1aaddf3ab13faa810a0295cc1ccde68fd0bd1a331829655df330a9dfffa408cbfabab17dcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\m2qwvj1d.dll

Filesize
8KB

MD5
00accf06a60f20f00533ded5e71a27ec

SHA1
86e84fae745d684d40b3195cd076dce6551e4b07

SHA256
12f3b27e5470b1fc723065c87220414b88dde8ad9e3cb7a2d4bbb019273cdc9f

SHA512
c79d7f79bd57e92e7d197a714ce753aba73932a49cf75ac71129f6e28b6921b2e35f79c07264226f14de7a26e4ded01461c64ef5ba65684c51a20c7ccbfa8032

Download Submit
C:\Windows\Installer\e57fabb.msi

Filesize
19.5MB

MD5
3e0e430226b9781f0a71356d6b6b8d78

SHA1
cdfc7317daca37e7e0ad6b6091d9284cd6b18dea

SHA256
42c1db18694a798a9248ac6b771fcf7701c6a38a70bd2efbe93828abd896305d

SHA512
4655e4a764ac56a49d45b876bd6717aea18fbea4741b649fa441721937fef23c67e4bc3d2067497c9a91bfb9f0004b06d8473e56fd78656b2e343092f3f5971a

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
12.8MB

MD5
e2c28ea58426b903dfd9deda695b93d4

SHA1
f1bbad4f43834edb7e5df33d68bf0f2a8e0ef87d

SHA256
a5f4f299ad5ca4c40c42a4a53cce358dd08b9f26d67d3f9733e1b005046e754a

SHA512
328f351de34b23ec2efcd5e64a06815dbdbfe400798eaff184a5856dc47535d785695b83cfd56593dc6bee3001d8c2aeeee790d68b8f70b5fd2b664168fb3879

Download Submit
\??\Volume{2b988a90-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2617230b-90d6-4ed8-80c0-38b9246df4d7}_OnDiskSnapshotProp

Filesize
6KB

MD5
21c1c8403a21bdec93bbd11aaa725aa4

SHA1
6edead3faa73673ab909c60b7f105e2a8a637976

SHA256
bc548354eeb68b57764c6d45bf0db1dc99edde0ba6efbaca56d1e2a5f24267ad

SHA512
5160b80b4d0061b50a3319665bfe27e23587e73e2eb242b384d2819ff54e9bd5d47a14db171194e88af2947a5b22795adee68a856a57fcbeead32bbb4bbe81aa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2650.tmp

Filesize
652B

MD5
b79b9b254640db4c86d077db2f67cbee

SHA1
887acca7ad1c6c1cff3a789ed1cddc2caf25078c

SHA256
59c57da6cb824587e7da7acf8f9cdb110426f2dae464889da9fd2a113b58cdfc

SHA512
0371c1733125ef77024ffb537edb431c9c368f16ce08e62c12814973653c786b6d1d928c0323d897bc4405a18e16df0cb958a584c053ba2a7f6906bfd0b384d1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\m2qwvj1d.0.cs

Filesize
10KB

MD5
746d24216504d6ff4e7ab4a8e3d1faa2

SHA1
43b29b62d031065867ccf840ed39a1359ca34e93

SHA256
18aa2e150811632d4d96adb64e146388812bd7e225b5396a356696bce86ee8ff

SHA512
030ed080197e4fcd90ede6a140b4c10a6d02db562967ad354884fc05e089109d8c515834879454d25a4045ed64f343291b6d8a98961248cba51544e64559eee3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\m2qwvj1d.cmdline

Filesize
412B

MD5
ed5f79c78432c0c3e30f1f79bbcb20ac

SHA1
2140910bcdd3445497f0c95e7a3bede9176cbae5

SHA256
b51cad9f8fda25641137b0ad0d060f5f87027f02a70ef42755c98ffe23716afb

SHA512
87837be140608ec316dc7de168f0d09b67ae693c3e2570b5069225a05c802e1d57d13307b7a5f3a06e4167df6e88b628da7e3335e36a5feedbc838d1bd01de41

Download Submit