Overview
overview
8Static
static
3CL-Eye-Dri...ne.exe
windows10-2004-x64
8CL-Eye-Dri...ne.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/wdreg.exe
windows10-2004-x64
1$PLUGINSDIR/wdreg.exe
windows11-ltsc_2024-x64
1Analysis
- user interaction
yes - max time kernel
46s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 00:05
Behavioral task
behavioral1
Sample
CL-Eye-Driver-5.3.0.0341-Emuline.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
CL-Eye-Driver-5.3.0.0341-Emuline.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/CLEyeCleaner.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/CLEyeCleaner.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/wdreg.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/wdreg.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target CL-Eye-Driver-5.3.0.0341-Emuline.exe
- Size 5.2MB
- Sample260819-ac94pavvbx
- SHA256 29cbd9d9bc6571d15d6a2b29dd2532fe6c7fb81d255778deb40f64dc79502bf5
- MD5 64112c1df0d80d195d006da9c15bf710
- SHA1 f0bfbc32171ecfb03614470b9c06ef34c07e66b0
- SHA512 eefac2d69ece3ac07745a71c6e895200f1fb1b7c1f144ba44fcb658f9232bd613d894929bb81f24d86815eb09f87757b96277f7cd0aa40b1f092c366b54bc1c6
- SSDEEP 98304:4cf1PgNuKGzp9kp2aqDNsmXWtKI/cdVo+J2v1I54UJV17j7MayZkxMCOaX:7xz3zApCXEtECd64eV1TyZkxJ
- TLSH T11B46332AEE8625C3D04764B4053A57F487E197D371A4600B0729FF2759BB23A1F63CB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\97B8DB93E99E6D5D8F6424143BE1F8F96D0F4FA7\Blob = 03000000010000001400000097b8db93e99e6d5d8f6424143be1f8f96d0f4fa7200000000100000077050000308205733082045ba00302010202103621615d5dc8015358e6e878c541abf0300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3132313230323030303030305a170d3134303130313233353935395a3081b6310b3009060355040613025553310f300d060355040813064e6576616461311230100603550407130948656e646572736f6e3120301e060355040a1417436f6465204c61626f7261746f726965732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e2076323120301e06035504031417436f6465204c61626f7261746f726965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100db4b56899f9bd1e780be42d133beb8426d253c6b5cf7b128e80d41bd72f947737c78608b0b45dedddb081bbd9e049fc4a29d5f1c3ac2f04299858cce5d349e6d9aa60e86bc37a16538944aa347b47b9a0e4be17e3ff56d4eb4b8982b6db146f6dec8df75e49c0403e4e97b201e95edbf7e76d1b1ffc11da2d142734e9bc5d3e4ba589b1633d3a8aba95e7ca19b179b0bb8b91ada8ea120f6acd01cca47869d41fd4455258e8ad5ed4ed96e74152434aebc2d4b60212e79b9bbef9e70d80243e2a3b22ef9fc852cb328f11b921c88980deb34891439674778e653dee265537a42de0953083ccd56b57242a4279b7d6a4eda6f31b6335ae56864ca65d5dfac073d0203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d010105050003820101006cb2632ab501ff6eee27631a111c2f2066724399bbd09c80e7a0a68e2ab14816dc7d13c4a7285a640f8a8b63fcc40e718b81513d7b1d12b65408c093b14f0d4a3bd2df599de287b5a5ac62b71b795fa33d5f1ee81a07117ef04cd43c2c68e4e94088d62324b1b0d9a4362e3fbe8a9398a89e17315dd942e782f36de5b3cb1b58c6c4dd67da13277b2cbcfd5bb48e1133bef9d2bf1ec2d26a3acbb93da0a94ec01def19f79f5b442fd29a648bfdc96996bd9c64945c39af5e3603706c7677000b9f5776bf339fc650701617b12c45478f56052249a68e0996f4b54e89a747c157d113f7ed5c4790ea1d6ea9c874b86c3f52135e9bbf755121319043f441e6a07b CertMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\97B8DB93E99E6D5D8F6424143BE1F8F96D0F4FA7\Blob = 0f00000001000000140000009429b7ba3c207e859f3b6087ebf608f3af34a09303000000010000001400000097b8db93e99e6d5d8f6424143be1f8f96d0f4fa7200000000100000077050000308205733082045ba00302010202103621615d5dc8015358e6e878c541abf0300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3132313230323030303030305a170d3134303130313233353935395a3081b6310b3009060355040613025553310f300d060355040813064e6576616461311230100603550407130948656e646572736f6e3120301e060355040a1417436f6465204c61626f7261746f726965732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e2076323120301e06035504031417436f6465204c61626f7261746f726965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100db4b56899f9bd1e780be42d133beb8426d253c6b5cf7b128e80d41bd72f947737c78608b0b45dedddb081bbd9e049fc4a29d5f1c3ac2f04299858cce5d349e6d9aa60e86bc37a16538944aa347b47b9a0e4be17e3ff56d4eb4b8982b6db146f6dec8df75e49c0403e4e97b201e95edbf7e76d1b1ffc11da2d142734e9bc5d3e4ba589b1633d3a8aba95e7ca19b179b0bb8b91ada8ea120f6acd01cca47869d41fd4455258e8ad5ed4ed96e74152434aebc2d4b60212e79b9bbef9e70d80243e2a3b22ef9fc852cb328f11b921c88980deb34891439674778e653dee265537a42de0953083ccd56b57242a4279b7d6a4eda6f31b6335ae56864ca65d5dfac073d0203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d010105050003820101006cb2632ab501ff6eee27631a111c2f2066724399bbd09c80e7a0a68e2ab14816dc7d13c4a7285a640f8a8b63fcc40e718b81513d7b1d12b65408c093b14f0d4a3bd2df599de287b5a5ac62b71b795fa33d5f1ee81a07117ef04cd43c2c68e4e94088d62324b1b0d9a4362e3fbe8a9398a89e17315dd942e782f36de5b3cb1b58c6c4dd67da13277b2cbcfd5bb48e1133bef9d2bf1ec2d26a3acbb93da0a94ec01def19f79f5b442fd29a648bfdc96996bd9c64945c39af5e3603706c7677000b9f5776bf339fc650701617b12c45478f56052249a68e0996f4b54e89a747c157d113f7ed5c4790ea1d6ea9c874b86c3f52135e9bbf755121319043f441e6a07b DrvInst.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000f00000001c4bf-71.dat acprotect - Executes dropped EXE 3 IoCs
pid Process 4124 CertMgr.exe 4120 wdreg.exe 4520 CL-EyeTest.exe - Loads dropped DLL 11 IoCs
pid Process 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 4352 regsvr32.exe 4520 CL-EyeTest.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\SET191C.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\SET192E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ps3eyecamera.inf_amd64_1bee6f347e56b9c0.ini DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd} DrvInst.exe File created C:\Windows\system32\CLEyeDevices.dll CL-Eye-Driver-5.3.0.0341-Emuline.exe File created C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\SET191C.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\SET191D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\SET192D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\WdfCoInstaller01009.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\WinUSBCoInstaller2.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ps3eyecamera.inf_amd64_1bee6f347e56b9c0\WdfCoInstaller01009.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ps3eyecamera.inf_amd64_1bee6f347e56b9c0\WinUSBCoInstaller2.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\PS3EyeCamera.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\SET191D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\PS3EyeCamera.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ps3eyecamera.inf_amd64_1bee6f347e56b9c0\PS3EyeCamera.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\SET192D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ccdfc1e3-b9d1-9a43-9297-488295d478dd}\SET192E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ps3eyecamera.inf_amd64_1bee6f347e56b9c0\PS3EyeCamera.cat DrvInst.exe - Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\WinUSBCoInstaller2.dll CL-Eye-Driver-5.3.0.0341-Emuline.exe File created C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\ps3eyecamera.cat CL-Eye-Driver-5.3.0.0341-Emuline.exe File created C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\CL-EyeTest.exe CL-Eye-Driver-5.3.0.0341-Emuline.exe File created C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\PS3EyeAxFilter.ax CL-Eye-Driver-5.3.0.0341-Emuline.exe File created C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\uninst.exe CL-Eye-Driver-5.3.0.0341-Emuline.exe File created C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\CLEyeDevices.dll CL-Eye-Driver-5.3.0.0341-Emuline.exe File created C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\PS3EyeCamera.inf CL-Eye-Driver-5.3.0.0341-Emuline.exe File created C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\WdfCoInstaller01009.dll CL-Eye-Driver-5.3.0.0341-Emuline.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log wdreg.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CL-EyeTest.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CL-Eye-Driver-5.3.0.0341-Emuline.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CertMgr.exe - Checks SCSI registry key(s) 3 TTPs 22 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID wdreg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 wdreg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs wdreg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 wdreg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs wdreg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID wdreg.exe - Modifies data under HKEY_USERS 42 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe - Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8E36632-8B66-410A-B7C9-8AAF2B27392D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\ = "PS3Eye Camera" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B07D086D-BE71-4089-A5CD-5A0E450964C4}\ = "Camera Properties" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{A8E36632-8B66-410A-B7C9-8AAF2B27392D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\FriendlyName = "PS3Eye Camera" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\CLSID = "{A8E36632-8B66-410A-B7C9-8AAF2B27392D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera\CLSID = "{A8E36632-8B66-410A-B7C9-8AAF2B27392D}" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera\Description = "PS3Eye Camera" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B07D086D-BE71-4089-A5CD-5A0E450964C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B07D086D-BE71-4089-A5CD-5A0E450964C4}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA72091E-1213-41BB-8E13-5478D0AEB711}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera\FriendlyName = "PS3Eye Camera" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\InprocServer32\ = "C:\\Program Files (x86)\\Code Laboratories\\CL-Eye Driver\\PS3EyeAxFilter.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA72091E-1213-41BB-8E13-5478D0AEB711}\InprocServer32\ = "C:\\Program Files (x86)\\Code Laboratories\\CL-Eye Driver\\PS3EyeAxFilter.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera\DevicePath = "PS3Eye Camera" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B07D086D-BE71-4089-A5CD-5A0E450964C4}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B07D086D-BE71-4089-A5CD-5A0E450964C4}\InprocServer32\ = "C:\\Program Files (x86)\\Code Laboratories\\CL-Eye Driver\\PS3EyeAxFilter.ax" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA72091E-1213-41BB-8E13-5478D0AEB711} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA72091E-1213-41BB-8E13-5478D0AEB711}\ = "Camera Settings" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA72091E-1213-41BB-8E13-5478D0AEB711}\InprocServer32 regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\97B8DB93E99E6D5D8F6424143BE1F8F96D0F4FA7 CertMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\97B8DB93E99E6D5D8F6424143BE1F8F96D0F4FA7\Blob = 03000000010000001400000097b8db93e99e6d5d8f6424143be1f8f96d0f4fa7200000000100000077050000308205733082045ba00302010202103621615d5dc8015358e6e878c541abf0300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3132313230323030303030305a170d3134303130313233353935395a3081b6310b3009060355040613025553310f300d060355040813064e6576616461311230100603550407130948656e646572736f6e3120301e060355040a1417436f6465204c61626f7261746f726965732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e2076323120301e06035504031417436f6465204c61626f7261746f726965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100db4b56899f9bd1e780be42d133beb8426d253c6b5cf7b128e80d41bd72f947737c78608b0b45dedddb081bbd9e049fc4a29d5f1c3ac2f04299858cce5d349e6d9aa60e86bc37a16538944aa347b47b9a0e4be17e3ff56d4eb4b8982b6db146f6dec8df75e49c0403e4e97b201e95edbf7e76d1b1ffc11da2d142734e9bc5d3e4ba589b1633d3a8aba95e7ca19b179b0bb8b91ada8ea120f6acd01cca47869d41fd4455258e8ad5ed4ed96e74152434aebc2d4b60212e79b9bbef9e70d80243e2a3b22ef9fc852cb328f11b921c88980deb34891439674778e653dee265537a42de0953083ccd56b57242a4279b7d6a4eda6f31b6335ae56864ca65d5dfac073d0203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d010105050003820101006cb2632ab501ff6eee27631a111c2f2066724399bbd09c80e7a0a68e2ab14816dc7d13c4a7285a640f8a8b63fcc40e718b81513d7b1d12b65408c093b14f0d4a3bd2df599de287b5a5ac62b71b795fa33d5f1ee81a07117ef04cd43c2c68e4e94088d62324b1b0d9a4362e3fbe8a9398a89e17315dd942e782f36de5b3cb1b58c6c4dd67da13277b2cbcfd5bb48e1133bef9d2bf1ec2d26a3acbb93da0a94ec01def19f79f5b442fd29a648bfdc96996bd9c64945c39af5e3603706c7677000b9f5776bf339fc650701617b12c45478f56052249a68e0996f4b54e89a747c157d113f7ed5c4790ea1d6ea9c874b86c3f52135e9bbf755121319043f441e6a07b CertMgr.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 4120 wdreg.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4520 CL-EyeTest.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3436 wrote to memory of 4124 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 89 PID 3436 wrote to memory of 4120 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 91 PID 3436 wrote to memory of 4352 3436 CL-Eye-Driver-5.3.0.0341-Emuline.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\CL-Eye-Driver-5.3.0.0341-Emuline.exe"C:\Users\Admin\AppData\Local\Temp\CL-Eye-Driver-5.3.0.0341-Emuline.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\CertMgr.exeC:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\CertMgr.exe -add C:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\CodeLabs.cer -c -s -r localMachine TrustedPublisher2⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:4124
-
-
C:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\wdreg.exeC:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\wdreg.exe -inf PS3EyeCamera.inf -silent -compat install2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s PS3EyeAxFilter.ax2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4352
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c57aac9e-4088-6a40-80b8-f959a7d44a52}\PS3EyeCamera.inf" "9" "47b741263" "00000000000000F0" "WinSta0\Default" "0000000000000114" "208" "C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver"1⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4396
-
C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\CL-EyeTest.exe"C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\CL-EyeTest.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4520
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\CODELA~1\CL-EYE~1\Driver\PS3EYE~1.CAT
- Size 8KB
- SHA256 d70910eb2d223f843328443a18b79b50a71470b40f0a19b7c422f062322cd562
- MD5 2b1ef3be14db406855e7ef58a725ffe0
- SHA1 7498d416ad02288ce86696ca1633e750fd8a2c7f
- SHA512 1633ed6842962a135f5750a2c2aaf48d2c5fcb6ebd44c84514425546bdf0afc1f2f8fd2290aa8edd57f9f5e642edb481278fbd3a7ed16dc3684699f13d885f14
- SSDEEP 192:Tt+quC09Qw335/wJirNmL/TSrR1DHC+v+pSXjtlAur9ZCspE+TMcrZQvM:YP3mirILTaTICUHeMcQE
- TLSH T1B1120AEB4A181462EC86CF70D5E6E02BFD3073D66DC8556A40B683C56D827B03B5980F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\CODELA~1\CL-EYE~1\Driver\WDFCOI~1.DLL
- Size 1.6MB
- SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
- MD5 4da5da193e0e4f86f6f8fd43ef25329a
- SHA1 68a44d37ff535a2c454f2440e1429833a1c6d810
- SHA512 b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853
- SSDEEP 24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
- TLSH T10485234577FC1178F1F3AAB48ABA84062A767C854FB6D28F0250C95D6DB2FC489B4363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\CODELA~1\CL-EYE~1\Driver\WINUSB~1.DLL
- Size 979KB
- SHA256 981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6
- MD5 246900ce6474718730ecd4f873234cf5
- SHA1 0c84b56c82e4624824154d27926ded1c45f4b331
- SHA512 6a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c
- SSDEEP 24576:aAEBXzGJ7fW6hHv62VYeL7WCE3wixdLZWQzMjp:uBXQz/hPzxRwPdcO
- TLSH T16225124117A48478E4F2AB74A5FB8A11D770BC111735C3CF8285AAAC2E727D9DE38727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\CL-EyeTest.exe
- Size 157KB
- SHA256 8560d2f4fdf7d3a2c5fd7f3ed1c414cbb4477d8d39f84e161dcc8895cea00e3b
- MD5 c4be1ab315322e9c3d7de01e7a6880f9
- SHA1 9931363ccd9c113c3cda4be6092cb09564f37543
- SHA512 6113e9945ad0bfa5d38a91eb23a297d0ebbe17b0c69ca4c75e8c92173c3fbc1624cb53e7a103e645a395d7325642d10c9622778ce934542c1d2298486b4583a3
- SSDEEP 3072:OPeHl6ZYeUSPzphcZ6DMgPOjT22lv5nHr7wZTG:ieF6Z1Pths6PPt2lv5LMZq
- TLSH T13EF36D1236E0C13ED0E265B1CD75DA6616B9FC31073941EB67E8297D8E70BC1BA78352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\PS3EyeCamera.inf
- Size 2KB
- SHA256 3d75843cf756e744177c3c5b31b9100d2c18c9fe8a7b6d0cf62ffee9b5f53788
- MD5 60bb6d15f8989d61064565c5e7b7e7bb
- SHA1 7a56f978ce9f66ff9fe7c399155d9c16f0309b2f
- SHA512 74e9a3ab0507272d5dfa928c870bd3d0dac23c32cfb8c95149819aefe4f033cca54bd9bb27c988004f83758689e88521d0bd3421fe6f206a6aa138a6a19a516d
- TLSH T1BC511E4C528A257DB6D3170D2F032C95B564B444A1BA2939F6DF49CACF84FDC23612BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\PS3EyeAxFilter.ax
- Size 100KB
- SHA256 d64bf4dd9944c21da5e21f7aaaecbe9ada4cbf77933738ab17d4bc68571cb346
- MD5 a71f6a671273897012b7b656d9e41f3e
- SHA1 231ea80c336a55e7a3143b747b2fea97a2e9b7fc
- SHA512 1797b73c18e89a04c16ab7109953be94ad3cadfa63830efff81d94240532aac2af709185e8c5c1c8b9bff7f9db14b7ba50190ed24cf260d70499623acadf0e7a
- SSDEEP 3072:DtL8kpWxTAPjG7hJ2JtYbZVB7ZLs5kgYLbYvC:DWkMtAKbCKV1ZLmkgYLb7
- TLSH T151A30183CA191C30FDCB1E7D7BCFA0A6C935729596D64186459882CEAE7FB54230670F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\CertMgr.exe
- Size 63KB
- SHA256 781f4eca34d7ea200ec534f556ae0d39a89e0e38d909899166a6e910b57e2cbd
- MD5 1444bcfeff029bb1e9b1ca3b896cd143
- SHA1 a002c0995aef87a0b523c69073b0b10ef850acaa
- SHA512 2bd309dc6605a0ed714c21e9c0bbe9a973e7d4f078e9944ec1e2cc273c98b400a76b94beaa8389d000eee3ff982b4a1b9a4e6e5fd21fae84de622951b15faebc
- SSDEEP 1536:qnOUkO0UXRiKvbVAc5xt3xGnmdYw+WXsA9iYzvy:OOUu3KvbVtxtBGnmdt+WXso
- TLSH T14C53B50163F94926F9F326B15E3A66A44FB7BA901A30D78F0378468D0E73B94C971367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\CodeLabs.cer
- Size 1KB
- SHA256 7d535ad3e333875076288791bbce84fd7db67624940b2639418eb40bf39ce465
- MD5 972b62b8c7088af29c364514e6582f0b
- SHA1 97b8db93e99e6d5d8f6424143be1f8f96d0f4fa7
- SHA512 f0e54b5eab3d67902b823c879cf73db95372ae222f60885597c43ba93be81852008c88cc20de1fb96a93b86e219025191d670ec373e4fe256071bd3ae7d175cd
- TLSH T1642174F7090018228DD55F40D1E7E7539D7133C2AFC4B492965840C73B8E7B1379465A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\modern-wizard.bmp
- Size 150KB
- SHA256 8d40754ea0871fea52cf2d97c9cfef69d0828fce118b13b178310a9fd390f9bc
- MD5 5f3567bf12b8c1ebb11696240b49a1f6
- SHA1 f8082db4d83ccd587fe1db1a6bb6cecfb793b646
- SHA512 eb784c1a91d9e72ece96db7656fc26f296c36f18656b8356a5091f8ac4f92a725738b64c354b8e35ae3a1d986c0b3a39a9b4bcbd1d649734080292ba84434b05
- SSDEEP 768:7PP4Cu6o3BJeg3m4IBzaGhVmF3mIpVR2VoGEwUNg6KKIrs+ysufmhAGU/oZIy8Zd:mr
- TLSH T105E36BAFE50AFA0767D0C8E9C9655BB54E98FC8E176358786D6C389C953F3200A0D21F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\nsExec.dll
- Size 6KB
- SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- MD5 acc2b699edfea5bf5aae45aba3a41e96
- SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
- TLSH T19BD1E73D75C33DB3C54ACA762C65292B0FB8C9261B5402119B6716C279D5AE3FE29382
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseDA02.tmp\wdreg.exe
- Size 142KB
- SHA256 5957f8a0bea130c6c4d91af8c5d6879943dc76faf1ebb50a70e3bd285fc8d86e
- MD5 d0047e39b0dfd11ec2a50e2a45c2d9be
- SHA1 7dd0c7c4689aa4c70e3ffad86c2336d0785283b3
- SHA512 4807e11cdff1f5fe78b7172cc0170de51fa97997f0096ef44e1c6d159df7e933889e64a368055cac5c57f5297478f1a035e0402818ccf33c540503f36305a64c
- SSDEEP 3072:pDsy3Iz27vf6Uz4wtApVzVH8csZm5Z4GFQeLn04gQAL/iha8n:pDsy3K2jfewtApTH9sc5Z70n
- TLSH T14AE34959736151B6E463C17EC9838786EB32B4158B3113CF136A977A1F233D2BD3A621
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\ps3eyecamera.inf_amd64_1bee6f347e56b9c0.ini
- Size 570B
- SHA256 7aeb15a18073e56a3c917305d413af40eebab46b8e1cbb1964f65d37119bcd91
- MD5 59d4cec0259f561cebcbd42c9e1508ea
- SHA1 466826d18a98c11ac462fa813d7c7fe63faecb45
- SHA512 9d8e1c14f14de93de5e6af0c14637733ec8ad37c1992e06ce120fe1c8f72c577dd830d61b1372419c3c064daa2ed6ae1923ce67d181b99f96866241e519d4927
- TLSH T1C7F08B4B82DDB84C37904E1F8215B2A7194CB10F84C61D5C71C386D0DF02E6A278734F
- MD5 SHA1 SHA512 TLSH