Edit tour

Windows Analysis Report
RE_iRecord_Installer.msi

Overview

General Information

Sample Name:	RE_iRecord_Installer.msi
Analysis ID:	635361
MD5:	fd867ada4f27257b97cd1086e2308309
SHA1:	ef352d9be1ba30d40007d41c396a93d98ce4ea3b
SHA256:	609053e562cd36056b79d4aced7547b6ea7f7af8c0d46afc08a7fce52a292909
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Compliance

Score:	32
Range:	0 - 100

Signatures

Queries the volume information (name, serial number etc) of a device

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Creates files inside the system directory

Stores files to the Windows start menu directory

JA3 SSL client fingerprint seen in connection with other malware

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

EXE planting / hijacking vulnerabilities found

DLL planting / hijacking vulnerabilities found

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Launches processes in debugging mode, may be used to hinder debugging

Checks for available system drives (often done to infect USB drives)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64

msiexec.exe (PID: 6632 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\RE_iRecord_Installer.msi" MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 6692 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 6960 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 5E1FB7355188E254823CE3315A71CFED C MD5: 12C17B5A5C2A7B97342C362CA467E9A2)

iRecord_WPF.exe (PID: 7048 cmdline: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe MD5: 211ED9D4E17D3FED889A73CA6065FC69)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\System32\msiexec.exe

EXE: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe

Jump to behavior

DLL planting / hijacking vulnerabilities found

Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\WPFToolkit.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ScintillaNET FindReplaceDialog.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.DataGrid.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: WINMM.dll
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: bcrypt.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\jint.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: MSVCP120_CLR0400.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Signature.XmlSerializers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.VS2010.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.Input.Toolkit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: CRYPTSP.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.ProcessingObjectModel.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ScintillaNET.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.jbig2.encoder.64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Aero.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.DataVisualization.Toolkit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: d3d10warp.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Expression.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: WINMMBASE.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Hexasoft.Zxcvbn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\JavaScriptEngineSwitcher.V8.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Common.XmlSerializers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.WinForms.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.DataVisualization.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.WebForms.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.jbig2.encoder.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Signature.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: D3DCOMPILER_47.dll
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: VERSION.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Metro.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\JavaScriptEngineSwitcher.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Net.Http.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ClearScript.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.Layout.Toolkit.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecordBO.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\zxcvbn.net.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.Toolkit.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.Common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: d3d9.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecordBO.XmlSerializers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: WindowsCodecs.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\BarcodeLib.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.64.dll	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\System32\msiexec.exe

EXE: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe

Jump to behavior

DLL planting / hijacking vulnerabilities found

Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\WPFToolkit.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ScintillaNET FindReplaceDialog.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.DataGrid.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: WINMM.dll
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: bcrypt.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\jint.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: MSVCP120_CLR0400.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Signature.XmlSerializers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.VS2010.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.Input.Toolkit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: CRYPTSP.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.ProcessingObjectModel.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ScintillaNET.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.jbig2.encoder.64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Aero.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.DataVisualization.Toolkit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: d3d10warp.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Expression.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: WINMMBASE.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Hexasoft.Zxcvbn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\JavaScriptEngineSwitcher.V8.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Common.XmlSerializers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.WinForms.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.DataVisualization.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.WebForms.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.jbig2.encoder.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Signature.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: D3DCOMPILER_47.dll
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: VERSION.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Metro.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\JavaScriptEngineSwitcher.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Net.Http.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ClearScript.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.Layout.Toolkit.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecordBO.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\zxcvbn.net.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.Toolkit.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Core.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.Common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: d3d9.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecordBO.XmlSerializers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	DLL: WindowsCodecs.dll
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\BarcodeLib.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.64.dll	Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 205.234.175.175:443 -> 192.168.2.3:49753 version: TLS 1.2

PE / OLE file has a valid certificate

Source: RE_iRecord_Installer.msi

Static PE information: certificate valid

Binary contains paths to debug symbols

Source:	Binary string: C:\dd\WPF_1\src\wpf\src\ControlsPack\WPFToolkit\obj\Release\WPFToolkit.pdb source: iRecord_WPF.exe, 00000011.00000002.538081309.0000000009B72000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\Projects\!OPEN_SOURCE\clearscript\ClearScript\obj\Release\ClearScript.pdb source: ClearScript.dll.1.dr
Source:	Binary string: D:\jenkins\workspace\Real-Estate\NugetPackages\iRecord\BusinessObjects\obj\Release\iRecordBO.pdb source: iRecord_WPF.exe, iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: f:\dd\ndp\fx\src\Reporting\src\ViewerControls\Common\obj2r\i386\Microsoft.ReportViewer.Common.pdb source: Microsoft.ReportViewer.Common.dll.1.dr
Source:	Binary string: D:\jenkins\workspace\Real-Estate\NugetPackages\iRecord\BusinessObjects\obj\Release\iRecordBO.pdb4 source: iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\jenkins\workspace\Real-Estate\iRecord\InstallableApp\PROD_Build\iRecord_WPF\obj\Release\iRecord_WPF.pdb source: iRecord_WPF.exe, iRecord_WPF.exe, 00000011.00000000.363708375.0000000000F17000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\jenkins\workspace\Real-Estate\NugetPackages\iRecord\iRecord.Common\obj\Release\iRecord.Common.pdb source: iRecord.Common.dll.1.dr
Source:	Binary string: D:\Programming\dotNet\_Standard Components\ScintillaNET-FindReplaceDialog\ScintillaNet FindReplaceDialog\obj\Release\ScintillaNET FindReplaceDialog.pdb source: ScintillaNET FindReplaceDialog.dll.1.dr
Source:	Binary string: C:\Dev\ExtendedWPFToolkit\Release\2.6.0\OpenSource\Generated\Src\Xceed.Wpf.DataGrid\obj\Release\Xceed.Wpf.DataGrid.pdb source: Xceed.Wpf.DataGrid.dll.1.dr
Source:	Binary string: D:\jenkins\workspace\Real-Estate\iRecord\InstallableApp\PROD_Build\iRecord_WPF\obj\Release\iRecord_WPF.pdbT source: iRecord_WPF.exe, 00000011.00000000.363708375.0000000000F17000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\Programming\dotNet\_Standard Components\ScintillaNET-FindReplaceDialog\ScintillaNet FindReplaceDialog\obj\Release\ScintillaNET FindReplaceDialog.pdbp[ source: ScintillaNET FindReplaceDialog.dll.1.dr

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Windows\System32\msiexec.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Local\Programs\CSC\iRecord
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Local\Programs
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Local\Programs\CSC
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Local

Networking

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 205.234.175.175 205.234.175.175
Source: Joe Sandbox View	IP Address: 205.234.175.175 205.234.175.175

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /cdn/gateway/csc/csc-logo-erecording.png HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ocp.cscglobal.comConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443

Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\RE_iRecord_Installer.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5E1FB7355188E254823CE3315A71CFED C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5E1FB7355188E254823CE3315A71CFED C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe

Source: iRecord_WPF.exe	String found in binary or memory: images/add_document.png
Source: iRecord_WPF.exe	String found in binary or memory: images/addpersonblack.png

Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Automated click: Next
Source: C:\Windows\System32\msiexec.exe	Automated click: Next
Source: C:\Windows\System32\msiexec.exe	Automated click: Install

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\WPFToolkit.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ScintillaNET FindReplaceDialog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4103.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Signature.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.DataGrid.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\jint.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Signature.XmlSerializers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Metro.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.VS2010.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.Input.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.ProcessingObjectModel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ScintillaNET.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\JavaScriptEngineSwitcher.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.jbig2.encoder.64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ClearScript.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.Layout.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecordBO.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Aero.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\zxcvbn.net.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.DataVisualization.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecordBO.XmlSerializers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Expression.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Hexasoft.Zxcvbn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\JavaScriptEngineSwitcher.V8.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Common.XmlSerializers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.WinForms.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\BarcodeLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.DataVisualization.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.WebForms.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.jbig2.encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.64.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CSC			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CSC\CSC iRecord.lnk			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe TID: 6036	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe TID: 6036	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\WPFToolkit.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ScintillaNET FindReplaceDialog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Signature.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.DataGrid.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\jint.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Signature.XmlSerializers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.VS2010.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Metro.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.Input.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.ProcessingObjectModel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ScintillaNET.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\JavaScriptEngineSwitcher.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.jbig2.encoder.64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.Layout.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\ClearScript.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecordBO.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Aero.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\zxcvbn.net.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\System.Windows.Controls.DataVisualization.Toolkit.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecordBO.XmlSerializers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Xceed.Wpf.AvalonDock.Themes.Expression.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Hexasoft.Zxcvbn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\JavaScriptEngineSwitcher.V8.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord.Common.XmlSerializers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.WinForms.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\BarcodeLib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.DataVisualization.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.WebForms.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.jbig2.encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.64.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation

Source: iRecord_WPF.exe, 00000011.00000002.533621333.000000000163E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: iRecord_WPF.exe	Binary or memory string: UJBptUEGmg4p0G1QTQYTDSDCbURERERERERmBTJIiIiIiIiIiIiIiIiIiIi2IhhCIiIiIioiIiIiIiIiIOIiIiIiIiIiIiIiIiIiIiIiIiKiIiIiIiIiI/pvpa/lcKFbVaX5BmVywF20jsWMJE2BT/lcoBuw1oaoMJsIJthJpqIiE2GojCbDBKrHVqE3q1O0pHVE3VoiSV6YKdjs7Agp2CBQUhGFSau7hluGGTHDd8KGonlkqWdwqBuEDfuk19f29t/V
Source: iRecord_WPF.exe	Binary or memory string: TJIiIiIiIiIiIiIiIiIiIi2IhhCIiIiIioiIiIiIiIiIOIiIiIiIiIiIiIiIiIiIiIiIiKiIiIiIiIiI/pvpa/lcKFbVaX5BmVywF20jsWMJE2BT/lcoBuw1oaoMJsIJthJpqIiE2GojCbDBKrHVqE3q1O0pHVE3VoiSV6YKdjs7Agp2CBQUhGFSau7hluGGTHDd8KGonlkqWdwqBuEDfuk19f29t/Vo7n1/X//RBMT9df/v+CBppZ2KmXIwzGgeXZ8j

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecordBO.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\CSC\iRecord\WPFToolkit.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WPFE457.tmp VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\CSC\iRecord\iRecord_WPF.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	1 Input Capture	1 Security Software Discovery	1 Replication Through Removable Media	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	2 DLL Search Order Hijacking	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	2 DLL Search Order Hijacking	1 Process Injection	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 DLL Search Order Hijacking	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 File Deletion	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Programs\CSC\iRecord\BarcodeLib.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Programs\CSC\iRecord\BarcodeLib.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\CSC\iRecord\ClearScript.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.64.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.64.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.64.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.dll	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.gemedicalsystems.com/it_solutions/rad_pacs/	0%	Virustotal		Browse
http://www.gemedicalsystems.com/it_solutions/rad_pacs/	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/GetConnectorTransactionXmlByCountyGuidAndErIDT	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/GetDemoXmlResponse	0%	Avira URL Cloud	safe
https://www.ic-secure.com/ROD_WebServices/ROD.WebService.SynchData/Service.asmx	0%	Avira URL Cloud	safe
https://irecord-uat.erecording.com/irecord_service/DataService/iRecordDataService.asmx	0%	Avira URL Cloud	safe
https://irecord-dev.erecording.com/irecord_service/DataService/iRecordDataService.asmx	0%	Avira URL Cloud	safe
http://10.98.134.15/isubmitservice/isubmit.asmx	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/iRecord.Common.DTOsI	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/IsValidFileTypeT	0%	Avira URL Cloud	safe
http://www.gemedicalsystems.com/it_solutions/orthoview/2.1	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/MigrateOrganizationConfigurationsT	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/IsValidFileTypeResponse	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/MigrateOrganizationConfigurationsResponse	0%	Avira URL Cloud	safe
https://apps.erecording.com/Portal	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/InsertOrUpdateDemoXmlT	0%	Avira URL Cloud	safe
http://172.17.3.125/DocConverter/DocConverter.svc	0%	Avira URL Cloud	safe
https://www.ic-secure.com/ROD_WebServices/ROD.WebService.SynchData/Service.asmx/	0%	Avira URL Cloud	safe
https://www.ic-secure.com/ROD_WebServices/ROD.WebService.ProcessInstrument/Service.asmx	0%	Avira URL Cloud	safe
http://foo/usercontrols/usercontrol_password.xaml	0%	Avira URL Cloud	safe
https://irecord-uat.erecording.com/irecord_service/ConfigurationService/ConfigurationWebService.svc	0%	Avira URL Cloud	safe
http://defaultcontainer/iRecord_WPF;component/usercontrols/usercontrol_password.xaml	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/GetNextTransactionIDT	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/GetNextePrepareIDResponse#	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/GetNextTransactionIDResponse	0%	Avira URL Cloud	safe
http://foo/bar/usercontrols/usercontrol_password.baml	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/GetDemoXmlT	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/CopyOrganizationConfigurationsEnvToEnvResponse	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/GetNextePrepareIDResponse	0%	Avira URL Cloud	safe
http://www.countyaccess.com/ROD_WebServices/ROD.WebService.SynchData/Service.asmx	0%	Avira URL Cloud	safe
http://www.w3.o	0%	URL Reputation	safe
http://tempuri.org/IConfigurationWebService/GetNextePrepareIDT	0%	Avira URL Cloud	safe
https://www.ic-secure.com/ROD_WebServices/ROD.WebService.ProcessInstrument/Service.asmxT	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/CopyOrganizationConfigurationsEnvToEnvT	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/iRecord_Server	0%	Avira URL Cloud	safe
https://irecord-dev.erecording.com/irecord_service/SignatureService/SignatureService.svc	0%	Avira URL Cloud	safe
https://irecord-uat.erecording.com/irecord_service/SignatureService/SignatureService.svc	0%	Avira URL Cloud	safe
https://irecord-dev.erecording.com/irecord_service/ConfigurationService/ConfigurationWebService.svc	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/InsertOrUpdateDemoXmlResponse	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/iRecord.Common.DTOs	0%	Avira URL Cloud	safe
http://www.gemedicalsystems.com/it_solutions/bamwallthickness/1.0	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/iRecord_Server.ConfigurationServicec	0%	Avira URL Cloud	safe
http://www.countyaccess.com/ROD_WebServices/ROD.WebService.ProcessInstrument/Service.asmx	0%	Avira URL Cloud	safe
https://apps.erecording.com/Portal#Reports/Main.xaml	0%	Avira URL Cloud	safe
http://tempuri.org/IConfigurationWebService/GetConnectorTransactionXmlByCountyGuidAndErIDResponse	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vip1.g5.cachefly.net	205.234.175.175	true	false		high
ocp.cscglobal.com	unknown	unknown	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
http://irecord.ingeo.com/SendOnboardingEmailT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://www.ingeo.com/AvailableCommandsT	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false		high
https://irecord.ingeo.com/irecord_service/SignatureService/SignatureService.svc	iRecord_WPF.exe.config.1.dr	false		high
http://irecord.ingeo.com/LoginT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://icongal.com/	iRecord_WPF.exe, 00000011.00000000.362624464.00000000008EF000.00000002.00000001.01000000.00000005.sdmp	false		high
http://www.gemedicalsystems.com/it_solutions/rad_pacs/	GdPicture.NET.12.image.gdimgplug.dll.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://irecord.ingeo.com/Y	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://tempuri.org/IConfigurationWebService/GetConnectorTransactionXmlByCountyGuidAndErIDT	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
https://ocp.cscglobal.com/cdn/gateway/csc/csc-white-logo.png	iRecord_WPF.exe, iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false		high
http://tempuri.org/IConfigurationWebService/GetDemoXmlResponse	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
https://www.ic-secure.com/ROD_WebServices/ROD.WebService.SynchData/Service.asmx	iRecord_WPF.exe, iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://irecord-uat.erecording.com/irecord_service/DataService/iRecordDataService.asmx	iRecord_WPF.exe.config.1.dr	false	Avira URL Cloud: safe	unknown
https://irecord-dev.erecording.com/irecord_service/DataService/iRecordDataService.asmx	iRecord_WPF.exe.config.1.dr	false	Avira URL Cloud: safe	unknown
http://10.98.134.15/isubmitservice/isubmit.asmx	iRecord_WPF.exe, 00000011.00000002.535818042.00000000031C1000.00000004.00000800.00020000.00000000.sdmp, iRecord_WPF.exe.config.1.dr	false	Avira URL Cloud: safe	unknown
http://irecord.ingeo.com/SendForgotPasswordEmailT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
https://irecordbeta.ingeo.com/irecord_service/DataService/iRecordDataService.asmx	iRecord_WPF.exe.config.1.dr	false		high
http://schemas.datacontract.org/2004/07/iRecord.Common.DTOsI	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ingeo.com/TU	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp, iRecord.Common.dll.1.dr	false		high
http://irecord.ingeo.com/Q	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://irecord.ingeo.com/SendEmailT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://irecord.ingeo.com/T	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://tempuri.org/IConfigurationWebService/IsValidFileTypeT	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://ocp.cscglobal.com/cdn/gateway/csc/logo-csc-ingeo.png	iRecord_WPF.exe, iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	iRecord_WPF.exe, 00000011.00000002.535818042.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.gemedicalsystems.com/it_solutions/orthoview/2.1	GdPicture.NET.12.image.gdimgplug.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xceed.com/wpf/xaml/datagrid	Xceed.Wpf.DataGrid.dll.1.dr	false		high
http://irecord.ingeo.com/ValidateSessionGuidT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
https://ocp.cscglobal.com/cdn/gateway/csc/favicon.ico	iRecord_WPF.exe, iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false		high
https://irecord.ingeo.com/irecord_service/iSubmitService/iSubmit.asmx	iRecord_WPF.exe.config.1.dr	false		high
http://tempuri.org/IConfigurationWebService/MigrateOrganizationConfigurationsT	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://irecord.ingeo.com/SendTrusteeServicesNotificationEmailT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://tempuri.org/IConfigurationWebService/IsValidFileTypeResponse	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://irecord.ingeo.com/irecord_service/ConfigurationService/ConfigurationWebService.svc	iRecord_WPF.exe.config.1.dr	false		high
http://tempuri.org/IConfigurationWebService/MigrateOrganizationConfigurationsResponse	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
https://irecord.ingeo.com/landing/assets/downloads	iRecord_WPF.exe, 00000011.00000002.535818042.00000000031C1000.00000004.00000800.00020000.00000000.sdmp, iRecord_WPF.exe.config.1.dr	false		high
https://irecord.ingeo.com/irecord_service/isubmitservice/isubmit.asmx	iRecord_WPF.exe, iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp, iRecord.Common.dll.1.dr	false		high
https://ocp.cscglobal.com/	iRecord_WPF.exe, 00000011.00000002.537328306.00000000069F6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apps.erecording.com/Portal	iRecord_WPF.exe	false	Avira URL Cloud: safe	unknown
https://irecord.ingeo.com/irecord_service/DataService/iRecordDataService.asmx	iRecord_WPF.exe.config.1.dr	false		high
https://ocp.cscglobal.com/cdn/gateway/csc/ere-solutions-375.png	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false		high
http://tempuri.org/IConfigurationWebService/InsertOrUpdateDemoXmlT	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
https://irecordbeta.ingeo.com/irecord_service/SignatureService/SignatureService.svc	iRecord_WPF.exe.config.1.dr	false		high
http://172.17.3.125/DocConverter/DocConverter.svc	iRecord_WPF.exe.config.1.dr	false	Avira URL Cloud: safe	unknown
https://ocp.cscglobal.com/cdn/gateway/csc/csc-logo-erecording.pngXUa	iRecord_WPF.exe, 00000011.00000002.535818042.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ic-secure.com/ROD_WebServices/ROD.WebService.SynchData/Service.asmx/	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://irecord.ingeo.com/GetUserFromSessionT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://schemas.xceed.com/wpf/xaml/avalondock	iRecord_WPF.exe, 00000011.00000000.362624464.00000000008EF000.00000002.00000001.01000000.00000005.sdmp	false		high
https://www.ic-secure.com/ROD_WebServices/ROD.WebService.ProcessInstrument/Service.asmx	iRecord_WPF.exe, iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://irecord.ingeo.com/DeleteSessionT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://foo/usercontrols/usercontrol_password.xaml	iRecord_WPF.exe, 00000011.00000002.536355561.000000000335D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://irecord.ingeo.com/LoginWithDuoT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
https://irecord-uat.erecording.com/irecord_service/ConfigurationService/ConfigurationWebService.svc	iRecord_WPF.exe.config.1.dr	false	Avira URL Cloud: safe	unknown
http://irecord.ingeo.com/IsUserUniqueT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://defaultcontainer/iRecord_WPF;component/usercontrols/usercontrol_password.xaml	iRecord_WPF.exe, 00000011.00000002.536355561.000000000335D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.ingeo.com/CommandT	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false		high
http://irecord.ingeo.com/UpdatePasswordT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://www.ingeo.com/T	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp, iRecord.Common.dll.1.dr	false		high
http://tempuri.org/IConfigurationWebService/GetNextTransactionIDT	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IConfigurationWebService/GetNextePrepareIDResponse#	iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xceed.com/wpf/xaml/toolkit	iRecord_WPF.exe, 00000011.00000000.362624464.00000000008EF000.00000002.00000001.01000000.00000005.sdmp, iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false		high
http://tempuri.org/IConfigurationWebService/GetNextTransactionIDResponse	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://www.ingeo.com/2001/v2/documents	iRecord_WPF.exe	false		high
http://foo/bar/usercontrols/usercontrol_password.baml	iRecord_WPF.exe, 00000011.00000002.536355561.000000000335D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://tempuri.org/IConfigurationWebService/GetDemoXmlT	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
https://irecordbeta.ingeo.com/irecord_service/ConfigurationService/ConfigurationWebService.svc	iRecord_WPF.exe.config.1.dr	false		high
http://tempuri.org/IConfigurationWebService/CopyOrganizationConfigurationsEnvToEnvResponse	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://www.ingeo.com/#	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false		high
http://irecord.ingeo.com/GetLatestVersionT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://tempuri.org/IConfigurationWebService/GetNextePrepareIDResponse	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://www.countyaccess.com/ROD_WebServices/ROD.WebService.SynchData/Service.asmx	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://www.w3.o	iRecord_WPF.exe	false	URL Reputation: safe	unknown
http://www.fonts.com	iRecord_WPF.exe, 00000011.00000002.537791869.0000000008DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ingeo.com/)	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp, iRecord.Common.dll.1.dr	false		high
http://tempuri.org/IConfigurationWebService/GetNextePrepareIDT	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
https://www.ic-secure.com/ROD_WebServices/ROD.WebService.ProcessInstrument/Service.asmxT	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IConfigurationWebService/CopyOrganizationConfigurationsEnvToEnvT	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://irecord.ingeo.com/UnimpersonateUserT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://schemas.datacontract.org/2004/07/iRecord_Server	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://irecord-dev.erecording.com/irecord_service/SignatureService/SignatureService.svc	iRecord_WPF.exe.config.1.dr	false	Avira URL Cloud: safe	unknown
http://www.ingeo.com/Command	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp, iRecord.Common.dll.1.dr	false		high
https://irecord.ingeo.com/irecord_service/isubmitservice/isubmit.asmxYE-a	iRecord.Common.dll.1.dr	false		high
http://irecord.ingeo.com/ValidateResetGuidT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://irecord.ingeo.com/PushStatusT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://www.ingeo.com/SendEmail	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp, iRecord.Common.dll.1.dr	false		high
https://irecord-uat.erecording.com/irecord_service/SignatureService/SignatureService.svc	iRecord_WPF.exe.config.1.dr	false	Avira URL Cloud: safe	unknown
http://irecord.ingeo.com/-	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
https://irecord-dev.erecording.com/irecord_service/ConfigurationService/ConfigurationWebService.svc	iRecord_WPF.exe.config.1.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IConfigurationWebService/InsertOrUpdateDemoXmlResponse	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://irecord.ingeo.com/SendEmailAboutUpdatedEmailT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://schemas.datacontract.org/2004/07/iRecord.Common.DTOs	iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://www.ingeo.com/c	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false		high
http://www.gemedicalsystems.com/it_solutions/bamwallthickness/1.0	GdPicture.NET.12.image.gdimgplug.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://irecord.ingeo.com/UpdateAttachmentImagesT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://schemas.datacontract.org/2004/07/iRecord_Server.ConfigurationServicec	iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://www.countyaccess.com/ROD_WebServices/ROD.WebService.ProcessInstrument/Service.asmx	iRecord_WPF.exe, iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://apps.erecording.com/Portal#Reports/Main.xaml	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ingeo.com/AvailableCommands	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp, iRecord.Common.dll.1.dr	false		high
http://irecord.ingeo.com/ImpersonateUserT	iRecord_WPF.exe, 00000011.00000002.536937886.00000000059F2000.00000002.00000001.01000000.00000008.sdmp	false		high
http://tempuri.org/IConfigurationWebService/GetConnectorTransactionXmlByCountyGuidAndErIDResponse	iRecord_WPF.exe, 00000011.00000002.531759467.0000000000812000.00000002.00000001.01000000.00000005.sdmp, iRecord.Common.dll.1.dr	false	Avira URL Cloud: safe	unknown

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	635361
Start date and time: 27/05/202220:17:52	2022-05-27 20:17:52 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 46s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	RE_iRecord_Installer.msi
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean4.winMSI@6/73@2/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 33.3% (good quality ratio 33.3%) Quality average: 87.5% Quality standard deviation: 12.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msi Adjust boot time Enable AMSI

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RE_iRecord_Installer.msi

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\3e4f5b.rbs

C:\Users\user\AppData\Local\Programs\CSC\iRecord\BarcodeLib.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\ClearScript.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.64.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.barcode.1d.reader.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.64.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.filters.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.64.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.image.gdimgplug.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.jbig2.encoder.64.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\GdPicture.NET.12.jbig2.encoder.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\Hexasoft.Zxcvbn.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\Hexasoft.Zxcvbn.pdb

C:\Users\user\AppData\Local\Programs\CSC\iRecord\JavaScriptEngineSwitcher.Core.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\JavaScriptEngineSwitcher.V8.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.Common.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.DataVisualization.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.ProcessingObjectModel.dll

C:\Users\user\AppData\Local\Programs\CSC\iRecord\Microsoft.ReportViewer.WebForms.dll

Windows Analysis Report
RE_iRecord_Installer.msi

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	18165
Entropy (8bit):	5.843732012251395
Encrypted:	false
SSDEEP:	192:sTARp3Nw/aJGPstaTARmxPPmcguW4EdcLDrvzWQCCNqyb/RT2IoqI7PXKn8GS3Zm:skRgcqClQqQC6p2uqW
MD5:	BFFFB8526D93FFE19FFF51387F95E551
SHA1:	3BF7EE1BCDACC04A0B1F373364B88F0EF6716B3F
SHA-256:	B60F47D91C68D6953996300A163858F2BA229705A0680EE483075F6A27473A16
SHA-512:	EC91853630596471450013AEC3ED00A93A4B0657B9C9E7B4A6EE2C216CF02B40ED495B5755A0B15928D0E3C7713AB7A814A8E8F65651E6AB2171DCCEBEF4B7CA
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@k..T.@.....@.....@.....@.....@.....@......&.{FD00B0DF-1F5A-4C9D-B945-7531468B5011}..iRecord..RE_iRecord_Installer.msi.@.....@.....@.....@......iRecord.ico..&.{152FDDD3-47D2-4FCB-98AD-A21852A58929}.....@.....@.....@.....@.......@.....@.....@.......@......iRecord......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{5E92A47E-6632-5D72-862B-8813B97D88D9}&.{FD00B0DF-1F5A-4C9D-B945-7531468B5011}.@......&.{93D1A2DE-2F2A-5F74-9143-43A38E185206}&.{FD00B0DF-1F5A-4C9D-B945-7531468B5011}.@......&.{6E797130-59F2-463A-85FE-097117D91A20}&.{FD00B0DF-1F5A-4C9D-B945-7531468B5011}.@......&.{65238290-6439-43E6-981F-DDC4CD2EFD71}&.{FD00B0DF-1F5A-4C9D-B945-7531468B5011}.@......&.{2C51C388-6C8D-4115-A9CE-23E781CF82F9}&.{FD00B0DF-1F5A-4C9D-B945-7531468B5011}.@......&.{2C51C388-6C8D-4115-A9CE-23E781CF82F8}&.{FD00B0DF-1F5A-4C9D-B945-7531468B5011}.@......&.{2C51C388-6C8D-4115-A9CE-23E781CF82F7}&.{FD00

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, MSI Installer, Code page: 1252, Title: Installation Database, Subject: iRecord, Author: CSC, Keywords: Installer, Comments: Published by CSC. Email csc-help@cscglobal.com for Questions., Template: Intel;1033, Revision Number: {152FDDD3-47D2-4FCB-98AD-A21852A58929}, Create Time/Date: Wed Mar 23 20:26:58 2022, Last Saved Time/Date: Wed Mar 23 20:26:58 2022, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
Entropy (8bit):	7.960956421946434
TrID:	Microsoft Windows Installer (77509/1) 90.64% Generic OLE2 / Multistream Compound File (8008/1) 9.36%
File name:	RE_iRecord_Installer.msi
File size:	27500544
MD5:	fd867ada4f27257b97cd1086e2308309
SHA1:	ef352d9be1ba30d40007d41c396a93d98ce4ea3b
SHA256:	609053e562cd36056b79d4aced7547b6ea7f7af8c0d46afc08a7fce52a292909
SHA512:	b480b12579d995b4f965c411422df73414184be824e8711d722d485afd44bfaae1610bfd12c0c8e7a949a1db357304453a0d09fa30983cea7d50257b4a05dc41
SSDEEP:	786432:Odb6YLKPNv/326EPRCg/5RWfIKhdlfFXfHp+A8cVHTfPeEPfUH:OoYOPNH2/zSvHgAbdOn
TLSH:	7E573349E9D0DEC6F63A913D5671960CF9AEBC199E40481E76A83B7D2CBB7CC223D005
File Content Preview:	........................>......................................................................................................................................................................................................................................

Signature Valid:	true
Signature Issuer:	CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	5/12/2021 5:00:00 PM 5/12/2024 4:59:59 PM
Subject Chain	CN=Corporation Service Company, O=Corporation Service Company, L=Wilmington, S=Delaware, C=US
Version:	3
Thumbprint MD5:	E6741EBF7E64CFFF5457B3C91A3F8772
Thumbprint SHA-1:	AC7B61A59F47F85D7D1E1EB0C36D6877C9D78794
Thumbprint SHA-256:	2697408544DF78FC6982BE9A46C85A95B8EE1C0642A32DE7F04F03D56988FECD
Serial:	3D8865DFBC59BAE29428935D285C7ECE

Has Summary Info:
Application Name:	Windows Installer XML Toolset (3.11.1.2318)
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Code Page:	1252
Title:	Installation Database
Subject:	iRecord
Author:	CSC
Keywords:	Installer
Comments:	Published by CSC. Email csc-help@cscglobal.com for Questions.
Template:	Intel;1033
Revion Number:	{152FDDD3-47D2-4FCB-98AD-A21852A58929}
Create Time:	2022-03-23 20:26:58
Last Saved Time:	2022-03-23 20:26:58
Number of Pages:	200
Number of Words:	2
Creating Application:	Windows Installer XML Toolset (3.11.1.2318)
Security:	2

General
Stream Path:	\x5DigitalSignature
File Type:	data
Stream Size:	6817
Entropy:	7.3699911949108525
Base64 Encoded:	True
Data ASCII:	0 . . . * H . . . . . 0 . . . . 1 . 0 . . . + . . . . . . 0 g . . + . . . . 7 . . . Y 0 W 0 2 . . + . . . . 7 . . . 0 $ . . . . . . . . . . . . . . . . . . F . . . . . . . . . . . . . . . 0 ! 0 . . . + . . . . . . . . . . " S . A . d . : . . 0 . 0 . . . . . . . . B J : ` @ ! . . 0 . . . * H . . . . . . 0 r 1 . 0 . . . U . . . . U S 1 . 0 . . . U . . . . D i g i C e r t I n c 1 . 0 . . . U . . . . w w w . d i g i c e r t . c o m 1 1 0 / . . U . . . ( D i g i C e r t S H A 2 A s s u r e d I D T i m
Data Raw:	30 82 1a 9d 06 09 2a 86 48 86 f7 0d 01 07 02 a0 82 1a 8e 30 82 1a 8a 02 01 01 31 0b 30 09 06 05 2b 0e 03 02 1a 05 00 30 67 06 0a 2b 06 01 04 01 82 37 02 01 04 a0 59 30 57 30 32 06 0a 2b 06 01 04 01 82 37 02 01 1e 30 24 02 01 02 04 10 f1 10 0c 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 01 00 02 01 00 02 01 00 02 01 00 02 01 00 30 21 30 09 06 05 2b 0e 03 02 1a 05 00 04 14 19 9f 8f ff

General
Stream Path:	\x5MsiDigitalSignatureEx
File Type:	Non-ISO extended-ASCII text
Stream Size:	20
Entropy:	4.321928094887363
Base64 Encoded:	False
Data ASCII:	r v o . " u : @ F } .
Data Raw:	72 f8 76 6f db b5 22 86 b8 b9 75 f5 3a 40 80 ba 46 f7 7d 0a

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	496
Entropy:	4.625139990370765
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . \\ . . . . . . . h . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I n s t a l l a t i o n D a t a b a s e . . . . . . . . . . . i R e c o r d . . . . . . . . . C S C . . . . . . . . . I n s t a l l e r . . . . . . . > . . . P u b l i s h e d b y
Data Raw:	fe ff 00 00 06 03 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 c0 01 00 00 0e 00 00 00 01 00 00 00 78 00 00 00 02 00 00 00 80 00 00 00 03 00 00 00 a0 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 bc 00 00 00 06 00 00 00 d0 00 00 00 07 00 00 00 18 01 00 00 09 00 00 00 2c 01 00 00 0c 00 00 00 5c 01 00 00

General
Stream Path:	\x16678\x14437\x16830\x16740
File Type:	Microsoft Cabinet archive data, 26683823 bytes, 50 files
Stream Size:	26683823
Entropy:	7.998431579133897
Base64 Encoded:	True
Data ASCII:	M S C F . . . . ) . . . . . , . . . . . . . . . . . 2 . . . . . . . T . . . . . . . F . . . . . . . . w T G . f i l 0 0 8 4 D 5 7 2 C B 1 4 E 4 9 E 1 0 5 B 1 8 8 4 3 2 5 2 E 1 8 4 . . . . . . F . . . . 1 E / . f i l 0 6 E B 0 9 0 8 8 3 3 1 7 0 2 1 B A D E 2 1 4 5 6 0 C 3 E 7 D 2 . . 8 . . . d . . . . 1 E . . f i l 1 2 D 7 6 3 6 5 F 3 2 B E A A C 9 9 4 6 D 8 6 1 9 5 6 6 9 6 1 C . . ~ . . . . . . . B R . f i l 1 A 1 2 0 6 C 5 C 7 F 6 A C F 7 3 1 6 5 B 0 C 6 5 0 9 3 C D 4 7 . . . . . . . . . . L . .
Data Raw:	4d 53 43 46 00 00 00 00 af 29 97 01 00 00 00 00 2c 00 00 00 00 00 00 00 03 01 01 00 32 00 00 00 00 00 00 00 54 0a 00 00 d3 07 01 00 00 46 01 00 00 00 00 00 00 00 77 54 47 83 20 00 66 69 6c 30 30 38 34 44 35 37 32 43 42 31 34 45 34 39 45 31 30 35 42 31 38 38 34 33 32 35 32 45 31 38 34 00 00 1e 04 00 00 46 01 00 00 00 31 45 2f 99 20 00 66 69 6c 30 36 45 42 30 39 30 38 38 33 33 31 37

General
Stream Path:	\x16786\x17522\x17214\x16923\x17574\x16885\x17214\x17574
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Stream Size:	15086
Entropy:	2.5234526920529645
Base64 Encoded:	True
Data ASCII:	. . . . . . 0 0 . . . . . % . . 6 . . . . . . . . . . . % . . . . . . . . . h . . . 6 . . ( . . . 0 . . . ` . . . . . . . . . . . $ . . . . . . . . . . . . . . . . . . . s H o S . m P . y _ / t } } c 4 o S . o S . . f 8 . r H o S . m P . z _ / u b C . d F . k _ c C . [ : . k @ x ] - ` @ . . b B . e F . k ^ b C . s W & ^ ? . . . . e F . . W 6 . r r V $ _ ? . . . . [ ; . g 9 . . . f 9 W 6 . [ ; . h ; W 6 . ^ { \| b 2 ` A . Z : . l @ W 6 . ` W 7 . Y i < Y 7 . i L . y P W 6 . [ . _ @ . y ^ . . Z 9 .
Data Raw:	00 00 01 00 03 00 30 30 00 00 01 00 20 00 a8 25 00 00 36 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 de 25 00 00 10 10 00 00 01 00 20 00 68 04 00 00 86 36 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff c8 ff ff ff c8 ff ff ff c8 ff ff ff c8 ff ff ff c8 ff ff ff c8 ff ff ff c8 ff ff ff c8 ff ff