3988557312ceca76bee86e2df0c34f2cdc7b2dc370846ba8390ae1d36d61e900

Analysis

max time kernel
136s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe
Size

693.2MB
MD5

1afd68147ac485753917930116210a40
SHA1

8c8deec48a8a7c3d4e5af8e26e8b3d09decad08b
SHA256

3988557312ceca76bee86e2df0c34f2cdc7b2dc370846ba8390ae1d36d61e900
SHA512

4cd02d60b7f30c7b5e08e312330342c124c9fb4cda01ba99e8d765a4040ee7832760a25c1d9e32a5e5a3a4521a4bd2c2a75a6b48395f32da1959f2117dadeacb
SSDEEP

12582912:bGbk9hNMUyBXnkRSuLBCF8WwX2VX0I/wY3jCMQRoMCb+RSGcYHqEtZF8:lM5XnVTSX2VX0I/fjCpob+RSGdx8

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1936	vegas180.exe
1680	ErrorReportLauncher.exe
1528	vegas180.exe
1864	ErrorReportLauncher.exe

Loads dropped DLL 64 IoCs

pid	Process
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7298A3E0-78EE-11D0-AEBC-00A0C9053912}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6802BA1-A056-11D0-AEBC-00A0C9053912}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfppack3_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23C9F227-40EC-11D2-9D36-00C04F8EDC1E}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sftrkfx1_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40986922-0F56-11D2-9887-00A0C969725B}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfxpfx2_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D616F3E1-D622-11CE-AAC5-0020AF0B99A3}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2D7C794-D104-4B28-9FB3-00AA006BA2BA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{413A0975-168F-46C8-AE58-88E8D4D36AFD}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8448721-96FD-11D0-AEBC-00A0C9053912}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfppack2_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3F901A21-79BE-11D0-AEBC-00A0C9053912}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfppack3_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000000B-0F56-11D2-9887-00A0C969725B}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfxpfx3_x64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{87FF3E97-AD64-4363-88C1-D28521C362F1}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B7226EE-4584-11D1-B4CB-00A0C9270A10}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8448720-96FD-11D0-AEBC-00A0C9053912}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3F901A21-79BE-11D0-AEBC-00A0C9053912}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000003-0F56-11D2-9887-00A0C969725B}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfxpfx2_x64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54F29261-79B1-11D0-AEBC-00A0C9053912}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA97FC26-0F62-11D2-9887-00A0C969725B}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000007-0F56-11D2-9887-00A0C969725B}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2D7C794-D104-4B28-9FB3-00AA006BA2BA}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfxpfx3_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000000B-0F56-11D2-9887-00A0C969725B}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F27D2C8-2AA0-48A2-B082-00AA006BA2BA}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F09F6980-7845-11D0-AEBC-00A0C9053912}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28D9F1E0-6ECC-11D0-AEBC-00A0C9053912}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74D54F5E-CE55-11EA-BD9E-00155D43CFCE}\LocalServer32\ = "C:\\PROGRA~1\\VEGAS\\VEGASP~1.0\\vegas180.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B7227EE-4584-11D1-B4CB-00A0C9270A10}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000005-0F56-11D2-9887-00A0C969725B}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfxpfx2_x64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40986922-0F56-11D2-9887-00A0C969725B}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000003-0F56-11D2-9887-00A0C969725B}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000000A-0F56-11D2-9887-00A0C969725B}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F27D2C8-2AA0-48A2-B082-00AA006BA2BA}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\mchammer_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{607682E0-6E21-11D0-AEBC-00A0C9053912}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfppack1_x64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D616F3E0-D622-11CE-AAC5-0020AF0B99A3}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B97C0F23-196D-11D1-B99B-00A0C9053912}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6802BA0-A056-11D0-AEBC-00A0C9053912}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23C9F225-40EC-11D2-9D36-00C04F8EDC1E}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA97FC2A-0F62-11D2-9887-00A0C969725B}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000000A-0F56-11D2-9887-00A0C969725B}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfxpfx3_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8010C341-6D4C-4390-B828-E4D246C3DDB2}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B7228EE-4584-11D1-B4CB-00A0C9270A10}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B7229EE-4584-11D1-B4CB-00A0C9270A10}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E3E4541-8339-11D0-AEBC-00A0C9053912}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfppack3_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8CB69A0B-10E8-11D2-9B89-00104B8D13C2}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3F901A20-79BE-11D0-AEBC-00A0C9053912}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfppack3_x64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{026D0AA0-9BB9-11D0-AEBC-00A0C9053912}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{026D0AA1-9BB9-11D0-AEBC-00A0C9053912}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{026D0AA1-9BB9-11D0-AEBC-00A0C9053912}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000004-0F56-11D2-9887-00A0C969725B}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfxpfx1_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000004-0F56-11D2-9887-00A0C969725B}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7B5FB82-1031-11D2-9887-00A0C969725B}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfxpfx1_x64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40986926-0F56-11D2-9887-00A0C969725B}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{026D0AA0-9BB9-11D0-AEBC-00A0C9053912}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1010333D-5114-41CE-807B-4483785EEF84}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{026D0AA1-9BB9-11D0-AEBC-00A0C9053912}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfppack2_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6802BA0-A056-11D0-AEBC-00A0C9053912}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{869419DD-501F-11D3-8CDC-00C04F6B8E4C}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB0F363-3A6E-485D-B39C-00AA006BA2BA}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\mchammer_x64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39224540-6F92-11D0-AEBC-00A0C9053912}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{260DF3E1-AC77-11D2-9E93-00C04F68BE44}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8CB69A0A-10E8-11D2-9B89-00104B8D13C2}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sftrkfx1_x64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3CBDF57B-9A33-4DD4-B33A-4BD31B5E1C13}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3CBDF57B-9A33-4DD4-B33A-4BD31B5E1C13}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8CB69A0B-10E8-11D2-9B89-00104B8D13C2}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sftrkfx1_x64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000004-0F56-11D2-9887-00A0C969725B}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000007-0F56-11D2-9887-00A0C969725B}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfxpfx1_x64.dll"	MsiExec.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
9	2132	msiexec.exe
11	2132	msiexec.exe
13	2132	msiexec.exe
15	2132	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\mfc110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm110u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\CddbLangJA.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp110.dll	msiexec.exe
File created	C:\Windows\SysWOW64\CDDBUI.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr70.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\CddbLangDE.dll	msiexec.exe
File opened for modification	C:\Windows\system32\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\DLLDEV32i.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\CddbLangRU.dll	msiexec.exe
File created	C:\Windows\SysWOW64\CDDBControl.dll	msiexec.exe
File created	C:\Windows\SysWOW64\CddbLangFR.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr71.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\CddbLangES.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp71.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110ita.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\Filters.ofx.bundle\Contents\Resources\Filters.ko-KR.xml	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\Vfx1.ofx.bundle\Contents\Resources\Vfx1.ru-RU.xml	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\MAGIX Plugins\essentialFX\Help\EN\eFX_Reverb.htm	msiexec.exe
File created	C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Help Files\sfresfilter_x64.chm	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\MagixCVFx.ofx.bundle\Contents\Resources\MagixCVFx.es-ES.xml	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Help Files\xpvinyl_x64.chm	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\Bitmaps\MxAutoUpdate\dialogs_additional_hilite.png	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\Video Hardware Drivers\extviddev.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\ofx360Stabilizer.ofx.bundle\Contents\Resources\ofx360Stabilizer.pt-BR.xml	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OpenColorIO\configs\aces_1.1\luts\Log2_48_nits_Shaper.RRT.P3D65.spi3d	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\protein\Forms\UnlockFormMail_cs_CZ.rtf	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\OfxStitch.ofx.bundle\Contents\Resources\OfxStitch.xml	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\MAGIX Plugins\essentialFX\Help\EN\30453.png	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\VEGASCapture\locales\hr.pak	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\protein\Forms\UnlockFormServiceCenter_ru_RU.rtf	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\protein\Resource\WhyUnlock_CN.htm	msiexec.exe
File created	C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\mchammer_x64.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OpenColorIO\configs\aces\luts\adx_adx10_to_cdd.spimtx	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\FileIO Plug-Ins\mp4plug3\mc_cpu\mc_enc_aac.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\MAGIX Plugins\essentialFX\Help\EN\project.hhp	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\MAGIX Plugins\essentialFX\Presets\StereoDelay\[Sys] Vox BBD Slapback.efx	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\ScriptPortal.MediaSoftware.Skins.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\Vfx1.ofx.bundle\Contents\Resources\Vfx1.xml	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\Vfx1.ofx.bundle\Contents\Resources\AutoLooks\2.cube	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\Vfx1.ofx.bundle\Contents\Resources\AutoLooks\9.cube	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\libmfxsw64.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\fonts\Grand_Aventure_Text.otf	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\Filters.ofx.bundle\Contents\Resources\Filters.es-ES.xml	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\FileIO Plug-Ins\mxfplug\mc_config_mp2m.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\VEGASCapture\locales\gu.pak	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\eula	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\Script Menu\Add Timecode to all Media.cs	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\FileIO Plug-Ins\mcplug2\mc_dec_dd.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\FileIO Plug-Ins\mxhevcplug\mxhevcplug.chm	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\Vfx1.ofx.bundle\Contents\Resources\AutoLooks\5.cube	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\ofx360Stabilizer.ofx.bundle\Contents\Resources\com.magix.ofx.vr.stabilization.png	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\Bitmaps\MxAutoUpdate\dialogs_main_template_hilite.png	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\protein\Protein_x64.4.1.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\bdmux\Vegmuxfb.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\MAGIX Plugins\essentialFX\Presets\Compressor\[Sys] Black Face FET-1.efx	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OpenColorIO\configs\aces_1.1\luts\S-Log3_to_linear.spi1d	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\fonts\hotel_de_paris.otf	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\System.Threading.AccessControl.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\15dd936825ad475ea34e35f3f54217a6\mfxplugin64_hevcd_sw.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\VegasUtilities.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\MAGIX Plugins\essentialFX\Presets\Gate\[Sys] Attack Enhancer 6dB Kick.efx	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OpenColorIO\configs\aces_1.1\luts\Dolby_PQ_4000_nits_Shaper_to_linear.spi1d	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\VEGASCapture\locales\he.pak	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\readme\HTML_ASSETS\release-banner.jpg	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\sfcdsim.cdd.dll	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\ofxRotation.ofx.bundle\Contents\Resources\VegasOfxRotation.es-ES.xml	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\MAGIX Plugins\essentialFX\Presets\Reverb\[Sys] Very Large & Rich.efx	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Help Files\sfppack1_x64.chm	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\bdmux\StatusCodeTable.xml	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\bdmux\udf_image.xsd	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\MAGIX Plugins\essentialFX\Presets\TubeStage\[Sys] Older Radio.efx	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\MAGIX Plugins\essentialFX\Help\EN\29615.htm	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\OpenColorIO\configs\aces_1.1\luts\Dolby_PQ_2000_nits_Shaper.RRT.Rec.2020_ST2084__2000_nits_.spi3d	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\VEGASCapture\icudtl.dat	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\VEGASCapture\locales\pt-BR.pak	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\protein\Resource\WhyUnlock_FI.htm	msiexec.exe
File created	C:\Program Files\VEGAS\VEGAS Pro 18.0\protein\Resource\WhyUnlock_KO.htm	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140cht.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\f766e63.msi	msiexec.exe
File created	C:\Windows\Installer\{75111FE1-CE55-11EA-8B12-00155D43CFCE}\vegas.ico (new loc)	msiexec.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140u.dll.D6D6A777_183E_3133_B603_785C0E6F235B	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfcm140.dll.D6D6A777_183E_3133_B603_785C0E6F235B	msiexec.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat	mscorsvw.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\F_CENTRAL_atl100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140chs.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\index13c.dat	mscorsvw.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140kor.dll.376F96B6_AD69_3104_A1C3_B0A3704DB24A	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140deu.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140chs.dll.7631C5EE_5656_3421_AE44_00C5FBD84302	msiexec.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\vcomp140.dll.376F96B6_AD69_3104_A1C3_B0A3704DB24A	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140ita.dll.D6D6A777_183E_3133_B603_785C0E6F235B	msiexec.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140u.dll.D6D6A777_183E_3133_B603_785C0E6F235B	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140deu.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat	mscorsvw.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140u.dll.376F96B6_AD69_3104_A1C3_B0A3704DB24A	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\msvcp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140kor.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfcm140u.dll.D6D6A777_183E_3133_B603_785C0E6F235B	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfcm140.dll.7631C5EE_5656_3421_AE44_00C5FBD84302	msiexec.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat	mscorsvw.exe
File created	C:\Windows\WinSxS\InstallTemp\20240428090837715.0\vcomp90.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\vcomp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140enu.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.log	ngen.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPD165.tmp\BdmuxServer.exe	mscorsvw.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\msvcp140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\vccorlib140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140u.dll.7631C5EE_5656_3421_AE44_00C5FBD84302	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfcm140u.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140chs.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPD430.tmp\Vegmuxdw.dll	mscorsvw.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140enu.dll.376F96B6_AD69_3104_A1C3_B0A3704DB24A	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140ita.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140kor.dll.7631C5EE_5656_3421_AE44_00C5FBD84302	msiexec.exe
File created	C:\Windows\Installer\f766e62.msi	msiexec.exe
File created	C:\Windows\Installer\f766e66.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\msvcp140.dll.376F96B6_AD69_3104_A1C3_B0A3704DB24A	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfcm140.dll.D6D6A777_183E_3133_B603_785C0E6F235B	msiexec.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPD4FB.tmp\Vegmuxdh.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\index13c.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat	mscorsvw.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140enu.dll.7631C5EE_5656_3421_AE44_00C5FBD84302	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140enu.dll.7631C5EE_5656_3421_AE44_00C5FBD84302	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140esn.dll.7631C5EE_5656_3421_AE44_00C5FBD84302	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfcm140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\vccorlib140.dll.D6D6A777_183E_3133_B603_785C0E6F235B	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00DB3E6755ECAE114B900051D534FCEC\1.0.0\mfc140jpn.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat	mscorsvw.exe

Modifies Control Panel 7 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001\Version = "4294967295"	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Microsoft Input Devices	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Microsoft Input Devices\Mouse	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001\Filename = "MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe"	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001\Description = "Sony Application"	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BB424E1-053F-11EF-BC3A-56D57A935C49} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000038edf8e37fd5fb26d9b975959933ac165cd770b00018d20e8580827f0e59d83c000000000e8000000002000020000000dd7c1aaa4dc39617bf3d08ed2b028f2dd07c75c0b617e96fe76c91a3e7bead6220000000d4ce612ed645fdbbd46a6c5f9ea281bfe0361c2cc36dfbecddec8d8b980f51444000000069dc31d8f3a783c767e0d69c82f9583cca64a96b1bba89dbff27bbfc87c2de29b8ffac22597e70ed311c5f76a141335f0c83d8d24d72b20ee996923f0d41c482	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0968ff04b99da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000fa33059d9c429a59d4181bf044eb245831f896b5666b9f336beda9ed932cb4ec000000000e8000000002000020000000cfaa29541ad57d89dc6a5ec34a171e4db039f1735604c0b3297c269bebc648da90000000725782978d894918adbfc58c6cc45ee203dd09e92bc04695635209beaef2bc35127789d12dc31d99dbd87fdb0ddd133248fe4d4005b86c6c8d0cef12004d354aed298d87ec4054d5447e85e710a338e046cff0f9955f59ba3250e57f65f9d2df196064171e3cec8a7ccb9ab5e3efbd8bad87038e284edc374480d43e6c47946bf9f25d3aa6c7d6e4215ba072379773fe400000004683039aa55e5b72c88843b045df786089660071b0cc009068356a4bd777c42daca13f97d4498e178239475f307deefc6711f4630f37de2a89ef6e9488230168	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1EF1115755ECAE11B8210051D534FCEC\OFXROTATION	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1EF1115755ECAE11B8210051D534FCEC\SourceList\Media\56 = ";VEGAS Pro 18.0 18.0 Install Disc"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3B8E880-B4E0-11D0-AEBC-00A0C9053912}\Pins\Output\ConnectsToPin = "Input"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFEF3E96-F1D4-47CE-A429-2CC8C10DFDB6}\InprocServer32\ = "C:\\Windows\\SysWOW64\\CDDBControl.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B34EB93-450E-4BFA-84E5-8999010B0780}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFEF3E96-F1D4-47CE-A429-2CC8C10DFDB6}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBF37B9F-2F4F-11D3-B02F-00C04F4C0826}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBF37B9F-2F4F-11D3-B02F-00C04F4C0826}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95B14F82-2AE0-4BD1-9705-8AB6A51DC3C6}\ProxyStubClsid32	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED1B4100-93BE-11D0-AEBC-00A0C9053912}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Filter\{54F29260-79B1-11D0-AEBC-00A0C9053912}\ = "VEGAS Simple Delay"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3F901A21-79BE-11D0-AEBC-00A0C9053912}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6A78627-D619-48BF-AD26-0C6B44B5C7D8}\Pins\Output\Types	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000005-0F56-11D2-9887-00A0C969725B}\Pins\Input\AllowedZero = "0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFEF3E96-F1D4-47CE-A429-2CC8C10DFDB6}\TypeLib\ = "{B0528CD1-F67E-11D2-8F8E-00C04F4C3B9F}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1EF1115755ECAE11B8210051D534FCEC\dsound_kaudioa	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B77C6368-3FFB-437D-B879-BA92D981493A}\TypeLib\ = "{26BF9366-95A2-463B-8237-238114494AF7}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1EF1115755ECAE11B8210051D534FCEC\WindowsStore	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F09F6980-7845-11D0-AEBC-00A0C9053912}\Pins\Input\IsRendered = "0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8B67BD60-1238-11D3-8F9D-00C04F4C3B9F}\ = "ICddbTracks"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F09F6980-7845-11D0-AEBC-00A0C9053912}\Pins	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBF37B9D-2F4F-11D3-B02F-00C04F4C0826}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF37B9E-2F4F-11D3-B02F-00C04F4C0826}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1EF1115755ECAE11B8210051D534FCEC\atracplug	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{39224540-6F92-11D0-AEBC-00A0C9053912}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000006175647300001000800000aa00389b7100000000000000000000000000000000	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23C9F225-40EC-11D2-9D36-00C04F8EDC1E}\Pins\Output\ConnectsToPin = "Input"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5F6A239-301B-11D3-B030-00C04F4C0826}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0528CDF-F67E-11D2-8F8E-00C04F4C3B9F}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1EF1115755ECAE11B8210051D534FCEC\SourceList\Media\133 = ";VEGAS Pro 18.0 18.0 Install Disc"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vegas180_vf\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED1B4100-93BE-11D0-AEBC-00A0C9053912}\InprocServer32	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000000C-0F56-11D2-9887-00A0C969725B}\Pins\Input\AllowedMany = "0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7B34EB93-450E-4BFA-84E5-8999010B0780}\ = "ICddbDataList"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1EF1115755ECAE11B8210051D534FCEC\opencolorio11	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1EF1115755ECAE11B8210051D534FCEC\colorcorrect_nohelp	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1EF1115755ECAE11B8210051D534FCEC\SourceList\Media\106 = ";VEGAS Pro 18.0 18.0 Install Disc"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{017DD7C6-623B-4BCC-8F4A-6BBB8DB00A01}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA9B2BD7-B7AA-4d4a-AF5C-D7B2C8FB6582}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{7298A3E0-78EE-11D0-AEBC-00A0C9053912}\CLSID = "{7298A3E0-78EE-11D0-AEBC-00A0C9053912}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{39224540-6F92-11D0-AEBC-00A0C9053912}\CLSID = "{39224540-6F92-11D0-AEBC-00A0C9053912}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F1F766E-8C04-4505-BFCE-1C6A892B8F15}\TypeLib\ = "{B0528CD1-F67E-11D2-8F8E-00C04F4C3B9F}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000000-0F56-11D2-9887-00A0C969725B}\Pins\Output	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AF1A9404-6CA9-11D3-B053-00C04F4C0826}\TypeLib\ = "{B0528CD1-F67E-11D2-8F8E-00C04F4C3B9F}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1EF1115755ECAE11B8210051D534FCEC\readme_vegas	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B97C0F24-196D-11D1-B99B-00A0C9053912}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{00000000-0F56-11D2-9887-00A0C969725B}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBF37B97-2F4F-11D3-B02F-00C04F4C0826}\ = "ICddbLanguage"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FDB0D300-6F82-11D0-AEBC-00A0C9053912}\ = "Amplitude Modulation"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{8CB69A0A-10E8-11D2-9B89-00104B8D13C2}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AF1A9404-6CA9-11D3-B053-00C04F4C0826}\VersionIndependentProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B2C767ED-0E50-4A1D-AF6E-EAF1F16EB1C2}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E0A000D-0847-4367-883F-8A08C8A2FE86}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F196D33B-FC9F-420B-8C9F-A7F51F8F69A7}\VersionIndependentProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AA9B2BD7-B7AA-4d4a-AF5C-D7B2C8FB6582}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1EF1115755ECAE11B8210051D534FCEC\SourceList\Media\86 = ";VEGAS Pro 18.0 18.0 Install Disc"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBUIControl.CddbInfoWindow2.1\ = "CddbInfoWindow2 Class"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vegas180_w64\ = "Wav64 File"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8448720-96FD-11D0-AEBC-00A0C9053912}\Pins\Input\ConnectsToPin = "Output"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFEF3E96-F1D4-47CE-A429-2CC8C10DFDB6}\VersionIndependentProgID\ = "CDDBControl.CddbID3TagManager"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vegas180_sfa\shell\Open\ = "Open"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6A78627-D619-48BF-AD26-0C6B44B5C7D8}\Pins\Output\IsRendered = "0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7B9B77-62A7-424F-9650-AC8B204B72E4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8627D8A2-A677-11d7-A773-00C04F68F44E}\Pins	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2176	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1516	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1516	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeSecurityPrivilege	2132	msiexec.exe
Token: SeCreateTokenPrivilege	1516	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1516	msiexec.exe
Token: SeLockMemoryPrivilege	1516	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1516	msiexec.exe
Token: SeMachineAccountPrivilege	1516	msiexec.exe
Token: SeTcbPrivilege	1516	msiexec.exe
Token: SeSecurityPrivilege	1516	msiexec.exe
Token: SeTakeOwnershipPrivilege	1516	msiexec.exe
Token: SeLoadDriverPrivilege	1516	msiexec.exe
Token: SeSystemProfilePrivilege	1516	msiexec.exe
Token: SeSystemtimePrivilege	1516	msiexec.exe
Token: SeProfSingleProcessPrivilege	1516	msiexec.exe
Token: SeIncBasePriorityPrivilege	1516	msiexec.exe
Token: SeCreatePagefilePrivilege	1516	msiexec.exe
Token: SeCreatePermanentPrivilege	1516	msiexec.exe
Token: SeBackupPrivilege	1516	msiexec.exe
Token: SeRestorePrivilege	1516	msiexec.exe
Token: SeShutdownPrivilege	1516	msiexec.exe
Token: SeDebugPrivilege	1516	msiexec.exe
Token: SeAuditPrivilege	1516	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1516	msiexec.exe
Token: SeChangeNotifyPrivilege	1516	msiexec.exe
Token: SeRemoteShutdownPrivilege	1516	msiexec.exe
Token: SeUndockPrivilege	1516	msiexec.exe
Token: SeSyncAgentPrivilege	1516	msiexec.exe
Token: SeEnableDelegationPrivilege	1516	msiexec.exe
Token: SeManageVolumePrivilege	1516	msiexec.exe
Token: SeImpersonatePrivilege	1516	msiexec.exe
Token: SeCreateGlobalPrivilege	1516	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1936	vegas180.exe
1528	vegas180.exe
1528	vegas180.exe
2440	iexplore.exe
2440	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1516	2176	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe	29
PID 2176 wrote to memory of 1516	2176	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe	29
PID 2176 wrote to memory of 1516	2176	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe	29
PID 2176 wrote to memory of 1516	2176	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe	29
PID 2176 wrote to memory of 1516	2176	MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe	29
PID 2132 wrote to memory of 1828	2132	msiexec.exe	31
PID 2132 wrote to memory of 1828	2132	msiexec.exe	31
PID 2132 wrote to memory of 1828	2132	msiexec.exe	31
PID 2132 wrote to memory of 1828	2132	msiexec.exe	31
PID 2132 wrote to memory of 1828	2132	msiexec.exe	31
PID 2132 wrote to memory of 1828	2132	msiexec.exe	31
PID 2132 wrote to memory of 1828	2132	msiexec.exe	31
PID 2132 wrote to memory of 1524	2132	msiexec.exe	32
PID 2132 wrote to memory of 1524	2132	msiexec.exe	32
PID 2132 wrote to memory of 1524	2132	msiexec.exe	32
PID 2132 wrote to memory of 1524	2132	msiexec.exe	32
PID 2132 wrote to memory of 1524	2132	msiexec.exe	32
PID 2132 wrote to memory of 2036	2132	msiexec.exe	33
PID 2132 wrote to memory of 2036	2132	msiexec.exe	33
PID 2132 wrote to memory of 2036	2132	msiexec.exe	33
PID 2132 wrote to memory of 2036	2132	msiexec.exe	33
PID 2132 wrote to memory of 2036	2132	msiexec.exe	33
PID 2132 wrote to memory of 2928	2132	msiexec.exe	34
PID 2132 wrote to memory of 2928	2132	msiexec.exe	34
PID 2132 wrote to memory of 2928	2132	msiexec.exe	34
PID 2132 wrote to memory of 2928	2132	msiexec.exe	34
PID 2132 wrote to memory of 2928	2132	msiexec.exe	34
PID 2132 wrote to memory of 2492	2132	msiexec.exe	35
PID 2132 wrote to memory of 2492	2132	msiexec.exe	35
PID 2132 wrote to memory of 2492	2132	msiexec.exe	35
PID 2132 wrote to memory of 2492	2132	msiexec.exe	35
PID 2132 wrote to memory of 2492	2132	msiexec.exe	35
PID 2132 wrote to memory of 3068	2132	msiexec.exe	36
PID 2132 wrote to memory of 3068	2132	msiexec.exe	36
PID 2132 wrote to memory of 3068	2132	msiexec.exe	36
PID 2132 wrote to memory of 3068	2132	msiexec.exe	36
PID 2132 wrote to memory of 3068	2132	msiexec.exe	36
PID 2132 wrote to memory of 2660	2132	msiexec.exe	37
PID 2132 wrote to memory of 2660	2132	msiexec.exe	37
PID 2132 wrote to memory of 2660	2132	msiexec.exe	37
PID 2132 wrote to memory of 2660	2132	msiexec.exe	37
PID 2132 wrote to memory of 2660	2132	msiexec.exe	37
PID 2132 wrote to memory of 1960	2132	msiexec.exe	38
PID 2132 wrote to memory of 1960	2132	msiexec.exe	38
PID 2132 wrote to memory of 1960	2132	msiexec.exe	38
PID 2132 wrote to memory of 1960	2132	msiexec.exe	38
PID 2132 wrote to memory of 1960	2132	msiexec.exe	38
PID 2132 wrote to memory of 2516	2132	msiexec.exe	39
PID 2132 wrote to memory of 2516	2132	msiexec.exe	39
PID 2132 wrote to memory of 2516	2132	msiexec.exe	39
PID 2132 wrote to memory of 2516	2132	msiexec.exe	39
PID 2132 wrote to memory of 2516	2132	msiexec.exe	39
PID 2132 wrote to memory of 2684	2132	msiexec.exe	40
PID 2132 wrote to memory of 2684	2132	msiexec.exe	40
PID 2132 wrote to memory of 2684	2132	msiexec.exe	40
PID 2132 wrote to memory of 2684	2132	msiexec.exe	40
PID 2132 wrote to memory of 2684	2132	msiexec.exe	40
PID 2132 wrote to memory of 1732	2132	msiexec.exe	41
PID 2132 wrote to memory of 1732	2132	msiexec.exe	41
PID 2132 wrote to memory of 1732	2132	msiexec.exe	41
PID 2132 wrote to memory of 1732	2132	msiexec.exe	41
PID 2132 wrote to memory of 1732	2132	msiexec.exe	41
PID 2132 wrote to memory of 2912	2132	msiexec.exe	42
PID 2132 wrote to memory of 2912	2132	msiexec.exe	42

C:\Users\Admin\AppData\Local\Temp\MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe
"C:\Users\Admin\AppData\Local\Temp\MAGIX_VEGAS_Pro_18.0.0.284_Multilingual.exe"
1⤵
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\system32\msiexec.exe
  "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\redist.msi" /quiet /norestart /Liwear "C:\Users\Admin\AppData\Roaming\Sony\msvcrt_redist_28042024-090834.log"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1516

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Registers COM server for autorun
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DCA863F1FCE95752155F5676A92915BB
  2⤵
  PID:1828
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding C78E93AD5105C09F8C2934271C277185
  2⤵
  - Modifies registry class
  PID:1524
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe" Install "C:\Program Files\VEGAS\VEGAS Pro 18.0\bdmux\BdMuxServer.exe"
    3⤵
    - Drops file in Windows directory
    PID:488
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 12c -InterruptEvent 0 -NGENProcess 11c -Pipe 128 -Comment "NGen Worker Process"
      4⤵
      PID:560
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 188 -InterruptEvent 0 -NGENProcess 18c -Pipe 190 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1968
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 1a0 -Pipe 188 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1556
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 12c -Pipe 1b0 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2924
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 1ac -Pipe 1b4 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2348
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 11c -Pipe 1b8 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1432
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 134 -Pipe 1bc -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2988
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 1a0 -Pipe 1c0 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2740
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 1ac -Pipe 1c4 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2616
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 18c -Pipe 1c8 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:992
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 11c -Pipe 1cc -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1924
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 134 -Pipe 1d0 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:2864
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 194 -InterruptEvent 0 -NGENProcess 1a0 -Pipe 1d4 -Comment "NGen Worker Process"
      4⤵
      Drops file in Windows directory
      PID:1948
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\mchammer_x64.dll"
  2⤵
  - Registers COM server for autorun
  PID:2036
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sffrgpnv_x64.dll"
  2⤵
  - Registers COM server for autorun
  PID:2928
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack1_x64.dll"
  2⤵
  - Registers COM server for autorun
  - Modifies registry class
  PID:2492
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack2_x64.dll"
  2⤵
  - Registers COM server for autorun
  - Modifies registry class
  PID:3068
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack3_x64.dll"
  2⤵
  - Registers COM server for autorun
  - Modifies registry class
  PID:2660
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfresfilter_x64.dll"
  2⤵
  - Modifies registry class
  PID:1960
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sftrkfx1_x64.dll"
  2⤵
  - Registers COM server for autorun
  - Modifies registry class
  PID:2516
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx1_x64.dll"
  2⤵
  - Registers COM server for autorun
  PID:2684
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx2_x64.dll"
  2⤵
  - Registers COM server for autorun
  - Modifies registry class
  PID:1732
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx3_x64.dll"
  2⤵
  - Registers COM server for autorun
  - Modifies registry class
  PID:2912
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\xpvinyl_x64.dll"
  2⤵
  - Registers COM server for autorun
  - Modifies registry class
  PID:2400
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\CDDBControl.dll"
  2⤵
  - Modifies registry class
  PID:2512
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\CDDBUI.dll"
  2⤵
  - Modifies registry class
  PID:2100
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\VEGAS\VEGAS Pro 18.0\x86\sfvstproxystubx86.dll"
  2⤵
  PID:1736
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files\VEGAS\VEGAS Pro 18.0\sfvstwrap.dll"
  2⤵
  PID:1836
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding BCC004AA17DBFEDE4D082EC1C4228603 M Global\MSI0000
  2⤵
  PID:2376
- C:\Program Files\VEGAS\VEGAS Pro 18.0\vegas180.exe
  "C:\Program Files\VEGAS\VEGAS Pro 18.0\vegas180.exe" /register /user 1085
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1936
- - C:\Program Files\VEGAS\VEGAS Pro 18.0\ErrorReportLauncher.exe
    "C:\Program Files\VEGAS\VEGAS Pro 18.0\ErrorReportLauncher.exe"
    3⤵
    - Executes dropped EXE
    PID:1680

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3060

C:\Program Files\VEGAS\VEGAS Pro 18.0\vegas180.exe
"C:\Program Files\VEGAS\VEGAS Pro 18.0\vegas180.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528
- C:\Program Files\VEGAS\VEGAS Pro 18.0\ErrorReportLauncher.exe
  "C:\Program Files\VEGAS\VEGAS Pro 18.0\ErrorReportLauncher.exe"
  2⤵
  - Executes dropped EXE
  PID:1864

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\VEGAS\VEGAS Pro 18.0\readme\Vegas_readme.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f766e67.rbs

Filesize
479KB

MD5
f8c0073e6a862b9245fc3b671b5271eb

SHA1
e8f7b2587615ab5d54c82ca15a619d62b074649d

SHA256
19c6a668dbbefa68ec5d4c75a68cb3c0cf5db93db626d16e25447e7014e63062

SHA512
1754fee56ee44c3379b613ec04304fc7f0fc6f89c13fc6b96c35afbcb04f0a801d6413ae26282df7051406c74ebfd590fc5e37c11d7e103b56db8280d0abbc15

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\FileIO Plug-Ins\so4compoundplug\mc_dec_mp4v.dll

Filesize
1.3MB

MD5
3c8a67f6443ca685751c14e1f8650107

SHA1
a14f7014e54aa5a6aac716be64ea55286fa5854a

SHA256
984530397a0239cf5ccfcddbe77664c4cd84978080d41daecbedf6782eb22aee

SHA512
24d3b2334592b8b756ecd1a00fa77075698be3ad7e169d7dc0b691a59244356514730eb77d22417e32fa38b65cd303997b28541ed9a7197aa5b223c8864134b5

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_de_DE.cfg

Filesize
66B

MD5
07ed4ee4417494dd308b41be90ffe60f

SHA1
26ecb8a80034561830a78fa1ef7028ac04b00ae3

SHA256
29deb5cf1069418d89bf302b18356e7588c93d7167ff888f73dc91aea71dc1a4

SHA512
1c28eac12d3226bb43ba05ecc060f2c1d3dce03edaad2ef390ae2cd918fd7fe1abee96fa94f91a0d1e06204dc4ce46d8746211c0fb0c8c953c7c36ede03e2233

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_de_DE.cfg

Filesize
168B

MD5
c8f5ad45f8a858b0d38d2666c9c4b673

SHA1
e9c419c0b05e2b1a95a810e4ac13bcfc126aee54

SHA256
8a38a6f79d0af0bdf33fd2e11c1ce0d28cf43243ef2233a3c435b58a88e8fd17

SHA512
23664c6f3cfa37e20969ecbfb2e01a5e2348076f16d2f5897e9f1740f1d66b87e2d8c6c5ef37b59c723a1374b0a8061ea5d14efba7f28eb7b96e8d416406c8a9

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_de_DE.cfg

Filesize
1KB

MD5
f2f7f0301f5f37b6c2294b5e37ee2bc3

SHA1
9bfc89870b09ff4642ca838857dc3b80979a4507

SHA256
aa59d27a3901cbdcff5b78d1d52ba1f5c5a3c95620456d810a696e4582ac3724

SHA512
e69a3db3b625131af2c329a28777948d62c5aa8af50393422736aca984cfee75222034710a52ac0aeea37df8062d6a132f4b628d583238e37cf4abc3fb6151ed

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_de_DE.cfg

Filesize
3KB

MD5
4498cedd768fdee63afd89bcafb2bcb8

SHA1
e122cb837df515d9ab307182b0dcb9b10b88b825

SHA256
9ecea58807c3e6207c434774fb3fe1fbffb3085072a30ed2337676437a7d5044

SHA512
f65e0fd1a2101de484ffc5b75d07946bdcd57afa8ef48440a30f5a2117403619e302ec1ea3be31eaa19a842ed2e72a295cb155ce6d3885719beec2bb32d9e7df

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_de_DE.cfg

Filesize
4KB

MD5
5d5e0610a300bdcd4ea081fc87b45f6e

SHA1
58ea674e31811866899025b7ba918f0260f57b79

SHA256
51a2a3db2c6534c35ab91f1aac503fbaebf2c7d7aee3ad27541a9b9b75efd5c4

SHA512
8f9ec1ba147f8d726e58915815ac37f96607bd67e681de2c90450a7192611f2c37381a93007c0a79ed673aa84725ab2c30bf7ba0c6b945c42f2e6df1a294cb40

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_en_US.cfg

Filesize
3KB

MD5
5c69a8fd9c72629fc8680ba7625c2230

SHA1
196e10d0880fed92a0691a4711b7901cb213ac60

SHA256
96acbfdbb045c851e0fd2c49b234b8bb76b8a36f4b6ca2239c8b3d850df7b68b

SHA512
3673f533396c4540c3d0599c15b904fd13f9d54de61423193cc7328c1862869d890e82537172c881f743ae37b4121c6a06d82c83b4bdb204abe78cad8b99d8de

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_en_US.cfg

Filesize
4KB

MD5
a5393662e8c6e8d046c99e995d735130

SHA1
8c8dda6ffc6b2ee8509b07932fdcf0346ec09f05

SHA256
7df00155f1d8b805119ef1e922e2711b0f72096b3528a8be8365cd90e6742ae0

SHA512
9316a6e7ea1fb3b30b332cf811293ec8916ba0289407b41c2dc185a38c01ec166f0ac7ece5454452a52b0cb22a3108be5c58296a9e1e9b1860e5238c1a1ed3fc

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_es_ES.cfg

Filesize
122B

MD5
48a632f92533a578b8a04776a959fccf

SHA1
b3631251c532a9a4cdd85e9c06da91f86b89053b

SHA256
f5e588dc8e4da2b8cc4bab169bea0f065817a245f3a2650aa919fe64ad388d3a

SHA512
a8f6f4df967d05dbce9878dc46db00846783a6ddbc58c6b821658deb6952b5b93e8117da2e192e44e22b9f9872ed202cddc0e3a81d10ceeb2597dfb5d2128a88

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_es_ES.cfg

Filesize
488B

MD5
004c84acf169f252209da79143146ef2

SHA1
16b235c7457915ccb5c819c71e2f22f96be9d77a

SHA256
614eadd6f142156af944099e0ec04de0615479411982a833862df17455029884

SHA512
973c4ed6382bf081224c993725ba99e7ebc562c792b6b124db372ba723704433ef2b26bd8692ab5a1f8cc80873e45dba782307b430763014c51178fbf7fe22b2

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_es_ES.cfg

Filesize
2KB

MD5
99d1192bf7143c577e2d5e1621932d95

SHA1
d19198467d868c2e1dde07f4d9d3ef2a5fe47cb3

SHA256
49747ecd77a3ef0d2c7c55c56413d9eb929ce2d7df67775642bf619fd3b0c479

SHA512
d2de77ce2b7d976b5a7c7b8c43cb35a76fd8a246d22f15d91e6fda18392abfed1e3328a300d12c610f1a4029b8442ddd2fb48dcc033e1343487332f9f5a6d585

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_es_ES.cfg

Filesize
4KB

MD5
009241cf180f096abf008d583cd07c2a

SHA1
fc07f72afbd3844f45ce46a819b05df5f4815716

SHA256
36af8faac91df372162e1d932958f9fdb16adee2c4a4680ad1a7f64886e406aa

SHA512
ca200e871eeabbdf861dc401b201841f712fa6e1e9449e7530d0e2d1315f419e5285b0d9d51c503a3a735941974f8e41214903ba8583103f497001be02388d48

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_fr_FR.cfg

Filesize
622B

MD5
95df8c338d15d1c31d72efe74c8ba29f

SHA1
8e61f159acc867518672511d7b5d88d6697d7c9d

SHA256
aebdbf0b5dc49ec3f971cf9532b0f92af6f157ad91c80d1df0821b8e447399c6

SHA512
c776bcd036c6947f035dd2edde6f6d60926b73705b37a197edb73bc523275b00308cb0ac7fb9e10049327c3abaa72b3b8c0b53076a45ad1f722a9cf60198d379

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_fr_FR.cfg

Filesize
4KB

MD5
24500a649fa105de1b13caee6afee1b3

SHA1
cf0297ce789edeaf05c416db39bbf0d072a316d1

SHA256
207fe461007b939c3685a1b9c59d1a65ef2878ae02f533e81c6680eb2b324003

SHA512
6a331448175ca70c87157287f0a748dd96b39550b6639b65baab0b4edb4389c8ff506e2bda47a9b9caaff43c0838a90b3ef5dff0aee99ff3135eff99c093e0ab

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_ja_JP.cfg

Filesize
624B

MD5
6168c7182f4062516e3a55bfe464ef63

SHA1
8b2fa94d6d350afccf6d7a82c136025f695abac6

SHA256
aec6ca977d0151a781af889142b5b543b8a0666c153e0ee2dc29f324cc89392c

SHA512
2212ec933ac339fe0c0962f44c6f64f0058b43e41ee90a37e2d303000aeb5d3b2de67bced5c42313d4d66f498e40847d635b98d2022a4a84c8d60093fabdae29

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_ja_JP.cfg

Filesize
4KB

MD5
b2c7bfa6ce4c7bd53190f91a0895bdae

SHA1
6a5e250a1dc2f8870f435d8a57cf2b187cee3275

SHA256
5ae2fbb251b606182f0104c22861449ca17bdf5df439494a3bdaa108aae44301

SHA512
fa097d9db2fad79feeb08dc446d4252275fc2322011795238c3f94b72c1c7db302f359e3e3fe829f73c3681588ae1b72ed68b0f549c0e92f217a09fd61ad1f35

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_ko_KR.cfg

Filesize
730B

MD5
4aae1717e36e762befae6edd2d4e6cfb

SHA1
5f33776ec78a846c63927db6d0f1d24670d82780

SHA256
5a44fd583bd712f2ca486977965cf71eac32672218011a8eeb9fdb9c3ad7b76c

SHA512
a52cc671f9000e8af1af70b7d3b704ee60c1cba6b77b729c5ce5983f1a08bd21a22914f31e74bf2b4957d5a9c85f4e669c07c1892aaa6f4771a89b104f41fa6a

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_ko_KR.cfg

Filesize
3KB

MD5
362080c9b2f581ea96cac431b1bae0e5

SHA1
79fa301a47b96005b6158b31f97fd9401962af4d

SHA256
e1e95124e23176a7ff8ee5ee378fab6460d2fd909a6605977a7c60d7a66fd7d7

SHA512
fad9d90298e88e9b58a2baeda633eaf342b5541ec970f4f0b8b22ad2879fa16421953eb9e8a9bf3eea4a0852368d402114d6b0f1ba2965bcedb38f2f94c97cd9

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_ko_KR.cfg

Filesize
4KB

MD5
4c5f457b83cb09d738e00e3df3994f54

SHA1
852e26e18c10afbd1c91780eded5b746665e433d

SHA256
897a1a0f2e16266cb771fd4ae9d190957351995bd96e5324edd1ff110569f963

SHA512
e28ef3729c6a08497465bbe7a40f7df362d5a5376b85f451b06933298b65cf207309ba53a657903a4ad0e9a512fcb59e0cbfb87c20893face5b88190dc0103ab

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_pt_BR.cfg

Filesize
852B

MD5
0381c2d246dc04ffb39ff935327ebd9e

SHA1
89608eda3e547505f663bad4adc817895edbf98f

SHA256
553b06dcf5ead0eb87e1cf98d65c136e521bc8c352093016f720abddf54044db

SHA512
9c4f99809418cab9a2ca74b8c5e9447a0c43b5a9a844433fe8c3bc70b3328f363f61e77a5374f8e25e1cdfce57d21764d65abec0f7c76cb4624140054b5fb311

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_pt_BR.cfg

Filesize
1KB

MD5
a1dc91632547eeea12b0fb89059ccc92

SHA1
b0843e33903c64a23600d00badbfe451ffd5c768

SHA256
f11086062faa9a45d227dbbc9d4a19cd55afb4d242ca1a1c72aed7fc44d039a9

SHA512
52e66272f609056910d87c38e8bf44d086e061f30957f49e4ab2d4d4e53fecfa43304fe32a293b6d8e3019a899d5d582ad7ad43e343debfebb772867c581f70d

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_pt_BR.cfg

Filesize
4KB

MD5
f0f06689f028fcbe87365cf4767673cb

SHA1
9917e9ab1c15f60770fa3e3d89c5f398f4f13f86

SHA256
8d62ed6d16d4ae57ef533758d429f17c4ae911b1ceccc3429cb32094264a9c2d

SHA512
192f2cc6eef4c171df30efb9abdaff82e03c0cba1d904d10a7586cf4a13336629d8798881ff5c9871a23fa18426183a3ebc4daa2a711ea60c8dc5c1258c0f4d6

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_zh_CN.cfg

Filesize
298B

MD5
1baaa072b4d14e9fee9ea7d1bec50898

SHA1
a9c9a4c4bbe25094208f61dfb3bdac2e8db6d54e

SHA256
15e1e621be008f33073ff0471a6fa3448d4ae9946720093fa7e2e9eb3d9e13ec

SHA512
76fd24b36053c69abb5d7e369b47e4e70d984b117524ed05c99dab00b6cfbb61833f59224bf7201fefc3382ef79638e0fe5541b12233ca9e01bd4ca1819566a3

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_zh_CN.cfg

Filesize
3KB

MD5
c0e5640da66eb7fd9262d39473e09292

SHA1
d645b87929c69709196e131a19a9e46130dddb29

SHA256
8851cba861b04b652e24d6d7040b9c5958e5d7fd3e070d80c11c781977b83071

SHA512
5aaef25c515100f1f17d8f37b528f339eba1d3a632b6c92cbd0ee168b44251b2e55e638c3262b5b6b71de19ed4d8036d2b916b07df2c7896914f98e12de035f1

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\Language\local_zh_CN.cfg

Filesize
4KB

MD5
68e2398e42a9cc5333ec914ebf880d58

SHA1
0004805c8b2726c18c6a3c8564b259c39d2eb572

SHA256
5da3943c8ef8019231848cb64a715652c16144c7c4b6e72af1bf5c56a0b95aab

SHA512
70c4395ab29a1235a0213b8bdf0f38a7cdcec5c1fcc855e5a0498f65e73b2f3d53055c766fb54cdefd93cd0f9f99884de271b656b6ee12673121eef5109884ee

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\OFX Video Plug-Ins\TitlesAndText.ofx.bundle\Contents\Presets\PresetPackage.ko-KR.xml

Filesize
122KB

MD5
525763c8338bc74c4b556c2640bd1394

SHA1
7b4d894253adaca84f30147431096cb4e7ad048d

SHA256
4366790b1f64ba66f92ae7194b1e7ccd4397eacc1a65ba144d1e185fc7ee2f9b

SHA512
5a313f20e7735bede91a18ae13d5b6baba949af3bd5d121f91eb726717bdc2e132475f84c8a39fa6631099045fd338939a0482aaaa0ed7226c70c7e74a77df5d

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\install.cfg

Filesize
134B

MD5
98d830de777bad5acf1a1c87d01c4468

SHA1
4de0feb99e75967fc36b916f36310d4631e65ad0

SHA256
2395dced50fff6e9fb3ccfab65a7c92f0a6c11fff94432f307881c78c4262c5d

SHA512
e50847027c4754c449ab0a6b44d3e90b9bbe211c3150936f2a60e7d2a5fea2f07cd2719c3fd2fa04359ef1d98acf26ca023a0d8e328ddb0da4605ba57b24bdb0

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\install.cfg

Filesize
590B

MD5
bebc65b89a22c228acde2247d072d15f

SHA1
dc9ccdfe851f1f1e82c72bc40c433bab1ea4ec17

SHA256
36549d7196ba2cf39b83755e379a3d3f26e69d61db46161dafee2d263a0b1c7b

SHA512
f9760eda61e7ff620eb05f90814723554b997c9917e80c6bb985421e68efa5ed3196afe29b0b68c9705ec40a8eaab96d00e33c5260075a8fcd4e24b8e740bafc

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\install.cfg

Filesize
710B

MD5
c6cf408c1b57ab22ca993b6d9a35fec5

SHA1
cf62ad643b8d39e8c3c5266a5ea2d817d47ae160

SHA256
df73092e532f4cc93bdb3b2b7d2b44044a61794ec0e178490bcd90cdb0a0a56d

SHA512
9bb8bf78dd7bf262c7f437689260daf9bcdce079b004387946893cd855fe9d0085923d69d7e6b78d601ca1a5a11fb7be3ba0a2f19f4fe2e1bd461b7916a9c442

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\protein\Forms\UnlockFormServiceCenter_nb_NO.rtf

Filesize
2KB

MD5
fa703609338cc05f182d4d0d7d07fb1c

SHA1
cc34fc7d8282a2fc2bc4610ac671dce0b82661f7

SHA256
5a31feaa4bdbc96da11a4f68a7fcb36bb791dc073b41e109f7d085dd008790bc

SHA512
05e30eed8c0d921e721d3382dc26bbbef047ce77564c5926c122477500f28ae11e63522e93dd119436717878fa065d4d83e02f33d2c4e71c2c9eb1ca73412e08

Download Submit
C:\Program Files\VEGAS\VEGAS Pro 18.0\vegas180.udat

Filesize
604KB

MD5
e34227582523dd5d6450d2a48e742d79

SHA1
0e7ad3795405d5eb2122fde5f0fc66ce74e1c855

SHA256
883986d00df7669a1d573a76317f036521232b0ad80a1b5f9cefbbda788f8932

SHA512
cf1ae9fa909655e7a639e382006cefd35ed29805cfdc92d48beec484794f79933313f6c7b13070bb9300e5c7829a63266048b5fdeaf84cf27ea27640f673531c

Download Submit
C:\ProgramData\VEGAS Pro\18.0.284\sonyinstall_x64.dll

Filesize
3.0MB

MD5
6cbb63c002bf04a8489ea320421e01e6

SHA1
1a8d18fb070773427343e746374c8d36c568e8c1

SHA256
7a679410002709fc21bf9a5b56c1fd097a556eb31b71547e309f24b23a9d92fa

SHA512
8b62795b0a886d3fca1c050faf89237c0b364b703cbff9c8cbc377205b8cdea0321910e268862fd0cbb3d78b362ec59066cc3f125887a00d72a073cd328272ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6112559027f301ff86f95eafe9c404f3

SHA1
438a202a2264d30e7296e2372fd926db07a04814

SHA256
5e9b5fa73a4305af0248376e4e201fde81fa2cc9fe1784eaf3a420ee0e268fe9

SHA512
d05a196f9ee05f1ae802829bfc857e66c3f70baaec7e46d1f4ec00a4292a92a80ae39d8b16e37e5acd6c468be26043b57d2e6984adf49be40bab9272a0d51d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2726924f1c8b194171ac31dc094b650e

SHA1
8d0a229f93aa328afc30a35ccaf1d2389aef3116

SHA256
9c5dde36634c290eb3e9210ea8f32c9dce4a4192ebf1d58659cf47455d967460

SHA512
973389a94b3a0e96f176f777aaefdf36ea2c36bc2052160d3c6a77e698fe501a8fdf3be3232db27d4821f921cd8d60d157070acd6a96ee167c1f9e3a89351240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36623a85098937b40edc6675b891bdf1

SHA1
a5eae5e9a3ce654c77d2056af34725a3933f05be

SHA256
2dfbecef79d72d798e50e30ecc942c15eb84b3adecba45e7e30959de15ccbeb1

SHA512
14b5bfd29264dabc8354c4e58aaaaf115b56c4f6ff3a75fe720cc7f6472cebef2e6c62a85ec9907a6e73b5eedc560d7b1c14cffd70df8ef360d9d1d5fd332c4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2daac3f40226f57207bd40098f56445

SHA1
2597fa99cf63366d16ff45a1a316b58120551415

SHA256
b0f82a55560f5b45fb31e9388b622fb76938d868c70f809f3f3394cc08d744d5

SHA512
e8b6b1186a8bff2a187d54bc772d8f250cbbc538aed16d3b36594d311cf14d217208df09b6c60bef45b132fa939c839995fdd223304e43c633f69997846d5c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5794bdf788598d8952280f560a50b3bc

SHA1
1bdd2fe8963972672ce7d7ce12274448dd94b787

SHA256
f8bd357af92d8bba5e7093bced6b78c6cfd948791bd3463726993962733a23cf

SHA512
5f0415d824417119bb58990d1192d9d86aa9c3763edd70f39d44599b95655d3163a65c48e190ff89707f7089b2e1cf3aa62663d06ea13c46d2c82660aad3efab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da60772e1244b84a54fc9f9c0c6b9e47

SHA1
2355d98b2ee26dbeeb02b85e414dbfa2a33a735c

SHA256
d6ca2848517cc5b7250ef4dfff318495db6e74f142d2e3c0aa598c08b4d83d72

SHA512
0cad535e4e93373498c6926e83c1bd0f3eedf95eda4a9552657fac317ce0aedaa6fde70c6ee25c0eaeaa59efd6d60cf34510534eb79e1567fdbb17ad3ae7d70b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63cc4fc4accc500fc71ae256d80d044c

SHA1
59ac6e6bd0bc3815927392d78201c291430db047

SHA256
2502546b79ed86c17e75cb706bf3f0bb2fc2b68cc04c264c14095a072c5b4411

SHA512
93780aacacfec39ebc219cafeaf13cdbcfc442e20c98126a3999de8c2ba8a90a8a00a921501045af1d32cdadc46d51bcbac58f25a53bb3e819d8ad00b121d8a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e3263d3d9d5d3073d9fc952295f73e7

SHA1
4caabc0a165af37c75caeca536031ebe55001080

SHA256
27a5b1dab141b5773cf2b8a32a130ff6d5956532cbfdca9f735415522b927323

SHA512
d19c3ded0ab451d860455be978f570f79467e80bc2fdb8d1ea20118039aff2d4dfa6c2dd27156b309cffb1af0f0240349e62816ed5b091b185ec094675772750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05738edb37a906f2df3c9d8f1c51869f

SHA1
7ea32e5aaa534e92b7c20fca1a4e863e9b70b1f0

SHA256
bf579340fe5de79d8a3bb1611a4c5c7c1173f41fbda361eee2a31b3cb0ce8821

SHA512
53edc44d81b9a4739d4172c1515223485fa4bf9b6d39fcbb856d111dd0ac8e819ed0c8692bfe1d861165c634098fcc7755ecc3132c84fc4057f2d4cd3fd996d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
365b1c2f551799d8c3bc4b92513547c9

SHA1
cbf153d22430c1633eb906adb6d16c4703a83a1b

SHA256
4829f8c1c9ccca5bb6821df96e176921ca90fddeebd68031b9d6d581d1e1ae59

SHA512
ad95299437e52d21dad95c629ca1b97e89617b3379be4f9911eacafca51a5b9dc85441d8b91ca2a426bb7f74b6cc310a626dc30b8f92b49da127434f573d487f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
366f2fbf14dc94bca62502edef2ee01e

SHA1
249110e969551205d78cfbb681e28cc37dff64b2

SHA256
6a1f231fdbbe0505010773d9c437d344341dc6be4633a953138dc70738b205a7

SHA512
bee73f90bd266832eebd3c5199b00227b3609579cf9b34125651ff1b2ac7f90cfd66e22d3f7b55c61e150f77c3836764aa4da5fc55152c14a623d7dbca8f819c

Download Submit
C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\inst_banner.bmp

Filesize
210KB

MD5
71b93e7050c89122d3a3eb37ca0b97fe

SHA1
784a170828d71fcf9b64a6542dcf9065d4b96e87

SHA256
08734a6c333d3eea6f5293ef1560d01e431a3d394122d5f48d5ab3100727e86e

SHA512
222c182df3eecb28cea5fea0e94cbd6945da59f778a1dc80a3a1f922c31ac78db2be3ebcccc4c97fdc923ae5f101979cfe91c8e2c1bebc1960bfc4ecaa8efdac

Download Submit
C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\redist.msi

Filesize
49.9MB

MD5
e6801cf002699ff8cfcd2b099fcefaeb

SHA1
37b58c13c284af48a2acfcc6875944bccebe00d5

SHA256
51363501212dae8bc9b33c8aec711271d311f2f360ebc620c20d36ed714995f9

SHA512
bed4d17102288fecc044fbace08b560d3597fca962ad0eebff6f094378870843904a7afeb6e7e790da2420414950e977e1ba4a0501c958abc1b8e5a040367ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\vegas180\vegas180.msi

Filesize
2.8MB

MD5
94a59313dd9592b79b3b03888167bbd0

SHA1
02f36fc109ddf9fd86924e88938410ea6f7eab2f

SHA256
30e1409e709335647a191c2a6310a5dd8909183577b8dc55168bb8d20fa71068

SHA512
7934b07f2ac3e04594c1235ac4ce72a09cd55d053c23c0ca39b42987cf65f6d3028cb10530e3c8bfcafd1f80fbb452ca899dd545291d8162d06aacafd496d839

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A8F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\Sony\msvcrt_redist_28042024-090834.log

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Windows\Installer\MSI8C69.tmp

Filesize
1.7MB

MD5
aa6140d90ba59625eff857dc9bf64125

SHA1
1c29f7ab92a4d6175dad72667b6d89a212349e07

SHA256
494d77dadb86b7bc5ed7fa8b6a3cfc16211104cb7a460808dc616118ad693888

SHA512
0e61051634cd825195d1d52f240bfdaefe48a64f9f9403d6e932357ea6020aa70bb1e5344fb010b16cea325c5d3023244587b5e3ddcf155a1dcd6e11e1a9e9f5

Download Submit
C:\Windows\Installer\MSIC1CD.tmp

Filesize
123KB

MD5
5cb7ec6843aa69694096d98e467bc5e7

SHA1
ade3a650ccfff23264c3e95819126c4be6eb57cb

SHA256
c03b47bcbe6c28cfa612950814ca383dddd0d4a527cc17f1750b8385d4917aad

SHA512
540e905256195ab904d1313b72811ca73f9dcbdb419c28cbbb83232e9fee966c3d80ca322f3701a0468e9bb545e4ca08e1106ae6254f59e100e703c139e40ce9

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.log

Filesize
257KB

MD5
2a04ec3c771ab71803751b70ef013860

SHA1
211401979c1486783718d3e2f027c6476404f8cf

SHA256
fad097aed0a9d3152a2fe6b82c45fb6e8d642bf0612bc9eefc7b18270321b68e

SHA512
ef3054dcb42eae332a8e725a44709928d6354b193a17dfa62628f579861df932e95c06a910c732e7ff6ff900863485dd477f1cffd5335169f19f0899ad163435

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\BdmuxInterface\c29eefd9707f5863c584712dfa2fce0e\BdmuxInterface.ni.dll

Filesize
14KB

MD5
210e7e05bd0877bd6bff94c05d4fa917

SHA1
721e1b1c9551869765aa86bff70ff09f90d473f5

SHA256
da8beade13a30da8d9c3bd2fde3364d891c98dfe44169226e97dbc1576a0c61d

SHA512
04a71c497ba493c391a94345d9cf32e6e1e9b941aa71c4817c1144803ca6a1b6af7cd8550c683b46b445c8e39eaa48b891d947acd7f79ec0bd6005a359377511

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\BdmuxServer\d02b666817fae3897053bf933535d5c8\BdmuxServer.ni.exe

Filesize
19KB

MD5
33a3e64daf7d123b35718e5c9f1cb973

SHA1
eff370273f79aa22ef79e6ed1a7b91b424645068

SHA256
e8c5e668908debed0fdbe15ca57ef69822d0c9665a2e6f130341f2640607ecea

SHA512
2fa19268e5af65ee0767382ce141b5e17c1e9f405f53c3ce7da1de0cfb59981f0e42ab05468ab4474cbf3640595e3ae2cb81ea0f6b63a1351d5e037eb326353f

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Vegmuxdh\7a28675395b714a0d49044ca328c7643\Vegmuxdh.ni.dll

Filesize
29KB

MD5
948a86d03f42dd868d0ea88a0a8e938a

SHA1
cdba3153ee135916331ab6504d0b19fabee85024

SHA256
61d1e60389d12c223fa585baa105b0b2e51bcd2349245944484dad5e8c2eae7f

SHA512
1dc19a8bc8a3106d37053beeef52d98118fac09c986969034475c2bb0f3a30e1f04948c86ff347a6dcdedea603462c07d02752362d5d49fd02a1f0c5b1842e9d

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Vegmuxdw\de3bd76721b074bc5a4e266e097ca191\Vegmuxdw.ni.dll

Filesize
635KB

MD5
19053312566c5cd89388a13d7359467b

SHA1
34a306655841a17379d712407304f04b9da3c40e

SHA256
dc4575cef05fd88a260ffc3a6f72bc6ab43b63e1fe3b058f9b2494bace6c2d1f

SHA512
8d7216f1894fc33216294aa0114d1632e7651b2262157592a4b468e623c5610e1f7ef8cd88a487264b1bff5267675f33b139ffcae3158cde183ab6bd886a1378

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Vegmuxfa\9be06121afaaffd90a2b717be30ecc28\Vegmuxfa.ni.dll

Filesize
300KB

MD5
85f6e2a72aab992ae121c0995631e9c1

SHA1
c047d38f87e6bd329637bd5ab372cb002813708f

SHA256
95937dfd2f8cd4b8575a91004bf1fdf511e7f05d21ddef3319e12e670df10ffa

SHA512
0b0fcef708936162f04863fa05ba39aa2fded5efb6cce1542ad3e32b9526a768c33587c0d3f91875780b7f7de789d970850450d46bcf8f6320c60383f2e88688

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Vegmuxfb\a58dc14046669caa57df69e4dc21cd04\Vegmuxfb.ni.dll

Filesize
747KB

MD5
7e87caa5faa4deabecde67f9ef88d6b0

SHA1
46b03f90879921f5da8144edd14d3d41491c89e4

SHA256
4083b2042201c531546b56d3735addc4014636b9eb2b1aeff637949d1884d2d7

SHA512
451345276eefafc5bdf16fd2f32dbe0c9a31f97af502d8a64babf01df78416027d79d15ff8b25d59165113ee29c6dba94271434c0d5a1f5ecb997da3990750c7

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Vegmuxfc\d85108fae1ada8b59f216a9b39f6a9d2\Vegmuxfc.ni.dll

Filesize
133KB

MD5
6dc3fa2f255b6dd969ce49ee53c3b978

SHA1
4aa7b4b765482433c9cb03d6fd719b3b260eabf8

SHA256
3b25a342fe4cec0895098f63f9160a2341cfc4e358f7fadccfd6efc60f548bd7

SHA512
829beb66cfce12a096d4b2a070df6c85ec1e22cb0b64fedae3e8e79e64fca989b651763f7182f42a01eb95ae982601a566b1b271fcb173d9b1562fdf15a9cf7e

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Vegmuxfo\9a0e8b3d470cacbf3c195830d3331dea\Vegmuxfo.ni.dll

Filesize
1.1MB

MD5
2e62cfdc8503c7ed18ea111017ca9860

SHA1
8170b125e9bc5c86e1357aa76ed497091f230d83

SHA256
06a920555dae5498a535463960b5dee9494505a003f521c2aa45f48fcb43e70d

SHA512
34e3373cee18c9b0e3111b64c0e2078b37f311b735c57c2843399fb16b8b2d52d9de1d00bf6f59a8f7c7ca55dad4fa9fa99f65f96d06ce1b182bfffccf133fa8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Vegmuxmc\14c31b7571e9968d2eb92b7963f4d9e2\Vegmuxmc.ni.dll

Filesize
139KB

MD5
0d96b681e7029d551d6d5014e7529d27

SHA1
9f7ced523f30968a0212a78f0db5fb00fce80315

SHA256
1d126d9aed83d0eee1221cc84faa9e79e6b6f97e47c3bbc46383db9ad1a55992

SHA512
5b421807180556176f64145f8166e05f196a9e585d49e1d433044dd97b93d483bba68f2e267c9589e67b8b049540c3965942b8c6a2b49fea457bdaba0bf89e04

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Vegmuxrt\9704ecb2402cda6438fa53165e570f7b\Vegmuxrt.ni.dll

Filesize
35KB

MD5
c6780c1322cb54126995091ac3f7a175

SHA1
4a8789ea2073a1c5ca92c32abeefa2ab3f4aad23

SHA256
a28fe5f4fd8a5111ea4eee1fe9af0594e839f74d8c38a038e5202269006cb89b

SHA512
177ac7b34ed7fd4ef496fae9fda8aebe5730e766d607668baec09e83378ce1b8ef46dc120e17185d02b4aed4a433f5364c551e0a536a0d87176fcd8d7b069f17

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Vegmuxtw\0276eb0da873f35756a957a1732b1a34\Vegmuxtw.ni.dll

Filesize
207KB

MD5
0e43303e6449519d6c503febfd096425

SHA1
55c094d9ae4a97d0778ab1a13c3e6e6bc67b8ae3

SHA256
fd9e59bc2912df52de869c746890219ad082f843258423bf7b1a3c4560268977

SHA512
1d2abb7458a0bce6ac6f57f1c6a5b17ce6ad93204acde870559d08b6d15ff1a67d2e1aaaec458a3e7f25bb2dcc2dd8c68394049bc87acc5a55f6dfb57c38d349

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\mux.net\c65d6534547ab1a721c05dd946c88d19\mux.net.ni.dll

Filesize
311KB

MD5
13abecea6b0878bd756f70f61b91dc8d

SHA1
8771e71c15e5a98c39c7b366b8bfe6029cea0930

SHA256
92265a4b434809621a31cb40c39794c36ae6a46c951b3c76660f6262a7c4ff70

SHA512
8f2c0de1cf590422170f0adc50a39cbb3ece137994e0b17122b537df0a699b234e5103d870256ecf1ed464cbb454a016cfefd07ae51678c464755121a58a400e

Download Submit
\Windows\SysWOW64\mfc110chs.dll

Filesize
45KB

MD5
25da02155472aa28f83b643304b5ccfb

SHA1
ee8bc7858f5adf69dc046d09dd49a18f2cda7289

SHA256
b4f2c910e6e4197f20008db4f652dbcffc7e7b0eed0f8c8ba571de06c617de75

SHA512
c901429d2b2db8e972603977fa6b0d8eacd421ad2916741e46cd20d91f87693d451a436d19b552770f778aacef9e172d92fa2d5db6619965f1fa8ed71a7fb27a

Download Submit
\Windows\SysWOW64\mfc110cht.dll

Filesize
45KB

MD5
02e7d3d61f01adedbb539064708c68b1

SHA1
8df261a71ddd1d5737aeebbb7176a256860ed838

SHA256
eb7d071593afb1c8d985096393687c8e6b00a2c47074d57b90678976ee0b1ad8

SHA512
cb92f49b68ec87c493266e056a2d63eefe5569abfbb809ec493fb171142b043fbc90cb878ed462d45f5aadc431221f4e288b047b360f53a792182148d2a3e6b4

Download Submit
\Windows\SysWOW64\mfc110deu.dll

Filesize
73KB

MD5
74228936b1444740fce4f037f8244983

SHA1
c891215bd4d80b74b56f62680edda82ce9c78aef

SHA256
c4ab4a92c35084d268190fed624c632665d7395847b75f3ba364d85c5b4e5499

SHA512
f6f772c9ec58f43b9fafe33f9310d4ffe3f2d2b3a695fa22568ec357d17d05d4054d162d52cd3117b91e869d18185f0d26a04db95c803b85e51480936ca4a8be

Download Submit
\Windows\SysWOW64\mfc110enu.dll

Filesize
63KB

MD5
57a9e201f60dcde8d5d2ee2679e57c06

SHA1
c780465fdf2f6c72e571975aaa12f3ab534a264c

SHA256
bdb8a368842a9ca914b8dd26697907e8048d8dab5c567594abcd46c7677cbb8d

SHA512
3382d1b1572ff268871ff2f2108ed02a13cdcd6ea1a1a465cc9c5aa7f143b487d3e1fb42647c2148a64abbd5962d25d47c8bc74a7733712cec602cd5e5cea8d4

Download Submit
\Windows\SysWOW64\mfc110esn.dll

Filesize
72KB

MD5
f90edef2727dd8ca9b3f8c589c9b0cbe

SHA1
15f07c1faa87babbac8b08e65a1c190b956a8e93

SHA256
d87b87630c1b79ec9544240b82965bfd0faae65cbde02aff37a42e4d44e8041a

SHA512
988affd86c76471a4b9d64aa518741c4f44cb8a7b70c60d9dff6f54ad43a85206bb02100ed381bdd239fede37f1fdeb675e48ce067f2b9e60cc682f7532c3580

Download Submit
\Windows\SysWOW64\mfc110fra.dll

Filesize
73KB

MD5
cb18433e9782c6e255a54c5a83ca5e12

SHA1
a5e444b24031444ed80c46bd05936afad481bb3d

SHA256
4caf47a2eb865dd75ce258ccfe62a8de804425a8616b8d8b0b43285554f26adb

SHA512
3990801cf48fe48182925c6fadb10981300aa960dff13cac55f307555c83cc1d25069f4c8641fda6fcf6e7c46b03da9a4bf9e8e54f90e8dcb787b28335a6a73a

Download Submit
\Windows\SysWOW64\mfc110ita.dll

Filesize
71KB

MD5
1546c92aa0b2772613d2e31bb13aa550

SHA1
07960165a99cf7176e2cad3346d99a2c398407b5

SHA256
2103cb2e7b03f7211b0c076d4d3b904ca61ded6231b67486293d516906bf804e

SHA512
0e70e6407dda1715f933164f87011fdfa73d21dbb8baf516957f060eb9f4dc1bc2cd057c277bb806ca6007b26fbd495b2a042d049a46f0e6fa34fa1e00bff875

Download Submit
\Windows\SysWOW64\mfc110jpn.dll

Filesize
52KB

MD5
80ff1c7795babf6aa5956ba502de68a8

SHA1
26bacec0bd19c191f9944f9a1234a4a5e152ea88

SHA256
36b88d764caab40f9daebec20c472b765171af8ac8b22dd5fea32a65d854eb3b

SHA512
e1fc8e6fb4362fe266ab2a9f1ef1d3fb5b446cf374a467dfef51205fe529348ec2a2e794cdae1adfcf4b7338f1cb617b7d0c95fe756d4ab48ca634b4ee80d8e2

Download Submit
\Windows\SysWOW64\mfc110kor.dll

Filesize
52KB

MD5
4296447cc8b48a308958f8104c62d57f

SHA1
e71ef69d30e3c8e46b81248783920a6ab6db9211

SHA256
cb6d68392b52768668d1f77679f234f2e884bc0f0d31a6fb6f9291066368b589

SHA512
e7d9f2ee30f8a3c3820b7f96f2b80749a0f2e76a73ac5fc83c87e5326f398bff117e29bb1105dfd5ee76ea28f7dc9b6d4c17acb4ff381b604e1832b62efe1e29

Download Submit
\Windows\SysWOW64\mfc110rus.dll

Filesize
69KB

MD5
fae18ffad74e6c55c905f1a630d49a98

SHA1
aa40f20b119f038a5c92093d23fda06423c4d7be

SHA256
f41a5c4537d0a653d47b5939c72a0aa1fd0408e52dec9a67d2c891c8caad4f7a

SHA512
6be4b35cb6a4cdaac018f8acb6a54026da32f6b9eadc3333830579265dc53e3135651981e96e4220b83f3c71c6950f3177e4cb3be809621220b35a45b33e55ec

Download Submit
\Windows\System32\atl110.dll

Filesize
188KB

MD5
fe00086a2fc935af640c7f302c12fe89

SHA1
919d9e63a3ed879d04bb31dc9d43a1195e24878e

SHA256
873d57e5cd660d49b403780685e91b6e3bc9e65b6e59435e0c5a5dfa1de0422c

SHA512
b9b0642b824846090a47c31e2730a568aff79b65808439277ff1ab0c0f257236f276efb1aae71ead5f6ddc8362463a9ae6843f00266e5e82ec2720792446a786

Download Submit
\Windows\System32\mfc110.dll

Filesize
5.3MB

MD5
ed15189b63c78cd4453954e0c9aceab0

SHA1
4cd2b0ed839d4ce4216b179f61f8606c94ce84b4

SHA256
18fca73cf08bd9d27511b2da1ec6573c352ee7d00bc5f2504a8ff56b28a73551

SHA512
a48ad34dcc68d2afd8f06c585a3cea9a6e3fdb926feb25c89ace8fa864d56265267f0205779753d50343fcc9548cdfd5559f936e036011b33a8a6e49feecf68f

Download Submit
\Windows\System32\mfc110chs.dll

Filesize
45KB

MD5
10ae8bff037a69718ee6f4aea2a3c752

SHA1
2909ac4ec88bdadd947c8fe82db5e1ea6f0f31f9

SHA256
ba804369560a31d6e9e623f37abaea3e5bf06cca457de3fe8a1c26786f2d1238

SHA512
3175f7e3a01159542cea1fc82257d40bff47c832a2ca2e168e31633dfc6c50bd4981784469a2deaf44309d7888276ec9d36a795c993cf2cf261baaf7d25ca9f5

Download Submit
\Windows\System32\mfc110cht.dll

Filesize
45KB

MD5
405e6cee49f463f406c0a51af82eb964

SHA1
3f77052afdaeb6317ce6c2b682bb65f9a5c2ca00

SHA256
06b7b1bdd83b32c621d4a9349280ab99455c830643d97a78e78ed844fb30e5ab

SHA512
2b70fba962fa1b39e1e134bf5157db7e9016808779f6413d9f9aed909b59cd11daaf85c61d3ae0862019c8c87f1d21d7b49960cfedb10fccfb5d0b5ab3754517

Download Submit
\Windows\System32\mfc110deu.dll

Filesize
73KB

MD5
c2dcb7fd239b310896985d2b31c089f7

SHA1
ae3ecc96b21d3a3b32e8d77c3922c90f440f4913

SHA256
70969f6ffc7dddeb26588410cf3bee5c40d27761d4116859f4e25b083656bce6

SHA512
e9af9ad4b2df18b5efdf641b97fed8dbf6d528fb9737d2437e68971a8c8f1bf3d18b2480df6be41ecb05af8d96568f07894b1ff59cf4bd28820cf810ed9cf9da

Download Submit
\Windows\System32\mfc110enu.dll

Filesize
63KB

MD5
2f41fa824c59cdc2c3e057d55069f826

SHA1
67518ca99b7d14876aa560108bb48b4591e82eac

SHA256
6279e0d79f7f5cb25431de09a76d6c6db197e6b2a6713b9329a1d2273271ccd6

SHA512
82fbb139cce703381560cd4936cc9f9c3e3d7dbf6ff82034544b469c37513134a797ed1bdb103bc1d021436ac629bf35fce8c0dc17da33a1fb86b2d09f04e8c6

Download Submit
\Windows\System32\mfc110esn.dll

Filesize
72KB

MD5
99542f773cc9b80e91a870ad771728b6

SHA1
0857599bca0fa9df2705d4dfc46239566fa7e815

SHA256
272cf9f204737851f31161d6e6a31347918b33dfc052d0ad046f5d7a9c2ad14d

SHA512
890b8d839748872e7503c16d66597d24ae0d36a7f0137301b15af9579dd862908d109ab9ed648c3be0749fe058be68d69845267e61db3aef6d7ec9a6855e252b

Download Submit
\Windows\System32\mfc110fra.dll

Filesize
73KB

MD5
44fe45c7fb65697649cdd60f1c57e022

SHA1
b93fe4a462b6720587e898068961f6c601b57db1

SHA256
90d556905811217470a98de3d08d0b523313729dd7b799d324a9424cdb618600

SHA512
e02fb3058748b25a94eb669d69859b6b2083926c96899ad02132574f2448844f255a60589cf8152d948d2f51a899b52c0fbd1f668a81671aa92ce59c521cb954

Download Submit
\Windows\System32\mfc110ita.dll

Filesize
71KB

MD5
5c2cc00020b825e82217fe4fd99037fd

SHA1
aaa698a70436bf5b3963976441b727dc56558513

SHA256
5dedfc5fabb64875918cf846628a133744bb8812bc9319f517e9e584b181aada

SHA512
6fd9307e9b15a7f5f036e3f3829dbef8763764b01b26a2cbc510b42d8b68a4205f9a8136c76837a2da420e145dd5202ae707a8afdf8ef66a951eda72435461dd

Download Submit
\Windows\System32\mfc110jpn.dll

Filesize
52KB

MD5
87a1daf7680142e4962e0e7776c53877

SHA1
fd82ac55ddedb62b24b4510f65ca8bc2361d5628

SHA256
b3aab7a77d7d1379be3b5e87bc627dd933074cb6897300c479ff2a5c67fe8efd

SHA512
f9fed03fbc0120f8401caee090d2fe2559e0f765a04604aa53bdb6d535d7f2820d25bd9d3691898934e3292306328da9c9612694d5b6432cf63c2bdc01cbdd6a

Download Submit
\Windows\System32\mfc110kor.dll

Filesize
52KB

MD5
3172360933d603020c082f87a482a457

SHA1
1ff5de6b281566c6b474d073d5749bd6f137065f

SHA256
cead3aab9ec7d02c826b0701292a11222cbc213b47ac1f3f040f38730a3202e0

SHA512
b2016ace0188d6f28a28d26fbb74688412b55f94b7b13d6e46c739d8f3bf461916e3fcf1cd666d5217d868153ae3ea91a1fbe42d800f395a301667e43b4cf8ba

Download Submit
\Windows\System32\mfc110rus.dll

Filesize
69KB

MD5
ed679e821b2ed9b9e38c18ef3549a292

SHA1
8f8a88fdf786117a9dff9bb528e03cd55e176833

SHA256
972e7259cb56ee54a4e5e31df1324f78fe22703535fc6ffc8e9f5eb4ae421ab5

SHA512
beaee5974ece2f92143e92e064ff470b11a842747deed2ff8f429f986635c269e004aa7330a6101e329f9bea8703531cf42382d1a4e107b759bd6e250f986113

Download Submit
\Windows\System32\mfc110u.dll

Filesize
5.4MB

MD5
f110cf19d56f58606eaae8a685279338

SHA1
1f5f9b99929fb39cb7ff002fb0d7a21fcd43063f

SHA256
49559ea7183464f3564c562e7d216ce78ef1e66ac9dea2ece32dae00905f385c

SHA512
98c6aa12a16bdb450759fe9bb344e740f51c498426011372f81cd6bf8a20ae6eabbffb131a3c6c0e0e3f2a9bf687aff98ab3cad8891f5f2b2c522f2c00456f43

Download Submit
\Windows\System32\mfcm110.dll

Filesize
88KB

MD5
4e3685c1423c10273102efffad418ceb

SHA1
46e59eca1fe8af6a6f4a0803492acb3b1471852a

SHA256
8d8e108ab7b57de812db4736811311595e1b785deebff1868dea739720290b84

SHA512
ab6be1bb9384435e08ebe2ca103f1e369eef5927c494c6cdfc2a223c49f49c05a47b76811acfd803b2b75394dcf9b0e675556989152534a1c4c56e82330b4560

Download Submit
\Windows\System32\mfcm110u.dll

Filesize
88KB

MD5
41a15a02c343bc5640a0a8dab6cee181

SHA1
1794f16ea26d1d214b7568787361525da8a4ae67

SHA256
4fd4dad2f823aae2f65f0ade89b22bba24edd35e0bac685c91ab3be0efa104e9

SHA512
7a0949836956b557f0ea9a8f7ea879d8002f8be8a09616a041a5c5feb6254a439eff8d82ddcfe2de3550d75d7bcf18816c3013ba7025c3c46953916dbd2aba8d

Download Submit
\Windows\System32\msvcp110.dll

Filesize
645KB

MD5
7caa1b97a3311eb5a695e3c9028616e7

SHA1
2a94c1cecfb957195fcbbf1c59827a12025b5615

SHA256
27f394ae01d12f851f1dee3632dee3c5afa1d267f7a96321d35fd43105b035ad

SHA512
8818af4d4b1de913aae5cb7168dcec575eabc863852315e090245e887ef9036c81aabaf9dff6dee98d4ce3b6e5e5fc7819eccf717a1d0a62dc0df6f85b6feeb8

Download Submit
\Windows\System32\msvcr110.dll

Filesize
829KB

MD5
7c3b449f661d99a9b1033a14033d2987

SHA1
6c8c572e736bc53d1b5a608d3d9f697b1bb261da

SHA256
ae996edb9b050677c4f82d56092efdc75f0addc97a14e2c46753e2db3f6bd732

SHA512
a58783f50176e97284861860628cc930a613168be70411fabafbe6970dcccb8698a6d033cfc94edf415093e51f3d6a4b1ee0f38cc81254bdccb7edfa2e4db4f8

Download Submit
\Windows\System32\vcamp110.dll

Filesize
376KB

MD5
0ab01b9ae2193fa1f3c25da163db5f36

SHA1
38d6fba7d32d3c633efb5cf5c5902ede7372384a

SHA256
b26ddd1aeaf3f81edcc5a55a1938357a466ea2b0652560c4999faa92960f6190

SHA512
0ab503ea4cda9bb9ce601a4aa9c693b58f2629aa0ceca524552e8168b9d1cee77577a20ce7afb719ef2a217286c38a67841db222a46074b3f1aa17220431311f

Download Submit
\Windows\System32\vccorlib110.dll

Filesize
345KB

MD5
2aeb4f8e2bd49fa46e7fca142a1003a8

SHA1
64c1a86155fce5c2d0612ff6e88f625406103835

SHA256
f5f635c0cf8252b81c8283ae7063e5bdbc7d608ee8798ec6064707b489339d5d

SHA512
a85e17b2a370a1776c6e3c3a3f975bea5c1f25a5beb5a81512f77503d4098c17e838cfc04a771c1d7db203b8deafcc1335ada66cb1ba040fa5df444065e788f0

Download Submit
\Windows\System32\vcomp110.dll

Filesize
134KB

MD5
2d73b9301db9798bd740ed393c13b9e2

SHA1
6b43b30aca5cbddb636b35ff4c6a7fa6830666c2

SHA256
30dbc138c12eca9cd0721c2208fd8c657090ac39b1cb7d20f1aa19935cdd946d

SHA512
52d4ef7563712e8620b03d350a177408d4920842b41116a65eeb235e24cd2c0cf60aadd2ea51865186d0c2077012ce2e253c58364a6ceb913371eb1721f3f4d0

Download Submit
memory/560-3919-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/1528-4040-0x000000013FA40000-0x0000000142A0A000-memory.dmp

Filesize
47.8MB

Download
memory/1836-3870-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1936-3876-0x000000013FA30000-0x00000001429FA000-memory.dmp

Filesize
47.8MB

Download
memory/2036-3845-0x00000000003F0000-0x0000000000406000-memory.dmp

Filesize
88KB

Download
memory/2492-3849-0x00000000002C0000-0x00000000002D6000-memory.dmp

Filesize
88KB

Download
memory/2516-3857-0x00000000001E0000-0x00000000001F6000-memory.dmp

Filesize
88KB

Download
memory/2660-3853-0x0000000000140000-0x0000000000156000-memory.dmp

Filesize
88KB

Download
memory/2912-3863-0x00000000003C0000-0x00000000003D6000-memory.dmp

Filesize
88KB

Download
memory/2928-3847-0x0000000000150000-0x0000000000166000-memory.dmp

Filesize
88KB

Download
memory/3068-3851-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download