2260b2fb84e4edd7207d1088231f020da0267578cc2ae7be0eab0148acb9f72d

Analysis

max time kernel
115s
max time network
19s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

24.2MB
MD5

1a183345644b25b242c1de5405b68f2c
SHA1

a7430be8224a263ca58f6b41cc6241c192325244
SHA256

2260b2fb84e4edd7207d1088231f020da0267578cc2ae7be0eab0148acb9f72d
SHA512

742b50a8241f07727e54c2d56daed98f798ad084e474991f98d0e1e9cc07b0b7ab5727ed8d06f46ec218491d75e55b74de2d910c4128c0aab27bcc52fc2ab5bb
SSDEEP

393216:/HYst3DAEA6M1wrzLL7xnJWuycswFW6ZDcoEEulTGlVUj7JmO:wsBAE7zfL1bPswAjtT2VYh

Score

6^/10

discovery evasion persistence trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{050d4fc8-5d48-4b8f-8972-47c82c46020f} = "\"C:\\ProgramData\\Package Cache\\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\\vcredist_x64.exe\" /burn.runonce"	VCREDI~1.EXE

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombPerSplineLayerSetting.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombPerSplineLayerSetting.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsWithPoints1.gif	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\backWithChoke.jpg	Setup.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\CS5\MediaCore\RSMB6AE\RSMBPro_64.aex	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombPolyControls.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombSplineSetUp.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombustionToolbar.gif	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\lenny.gif	Setup.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\CS6\MediaCore\RSMB6AE\RSMB_64.aex	Setup.exe
File opened for modification	C:\Program Files\Adobe\Common\Plug-ins\CS5\MediaCore\RSMB6AE\RSMBPro_64.aex	Setup.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\CS5\MediaCore\RSMB6AE\RSMBProVectorInput_64.aex	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsSrc2.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsWithPoints2.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\fillInBG.jpg	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MotionVectorsFullAlpha.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\RSMBUsersManual.htm	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MotionSrcBlurredBad.jpg	Setup.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\RSMB6AE\RSMB_64.aex	Setup.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\RSMB6AE\RSMBProVectorInput_64.aex	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\AEMaskSetup.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPoints.mov	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\RSMBProUsersManual.htm	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\matchvertices2.gif	Setup.exe
File opened for modification	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\RSMB6AE\RSMBProVectorInput_64.aex	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\.updater\update.ini	Setup.exe
File opened for modification	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\RSMB6AE\RSMBPro_64.aex	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\alpha.jpg	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\combscrubcontrol.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\hand.jpg	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\LennyWithGoodVectors.gif	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MotionSrcOrig.jpg	Setup.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\CS5.5\MediaCore\RSMB6AE\RSMB_64.aex	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombPolyControls.gif	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsBadBlur.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsGoodBlur.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MotionSrcBlurredBad.jpg	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\vcredist_x64.exe	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPoints.mov	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\twixorAEmasks2.gif	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\RSMBUsersManual.htm	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MotionSrcEnhanced.jpg	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\source.jpg	Setup.exe
File opened for modification	C:\Program Files\Adobe\Common\Plug-ins\CS6\MediaCore\RSMB6AE\RSMBPro_64.aex	Setup.exe
File opened for modification	C:\Program Files\Adobe\Common\Plug-ins\CS5.5\MediaCore\RSMB6AE\RSMB_64.aex	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\alpha.jpg	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\nolayers.jpg	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsWithPoints1.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\twixorAEmasks2.gif	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\RSMBProUsersManual.htm	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\LennyWithBadVectors.gif	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\uninstall\uninstbr.000	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\hand.jpg	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\LennyWithBadVectors.gif	Setup.exe
File opened for modification	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\RSMB6AE\RSMB_64.aex	Setup.exe
File created	C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\RSMB6AE\RSMBPro_64.aex	Setup.exe
File opened for modification	C:\Program Files\Adobe\Common\Plug-ins\CS5.5\MediaCore\RSMB6AE\RSMBPro_64.aex	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\.updater\REVisionUpdater.exe	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\REVisionCheckUpdates.bat	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CatWiggleWIthMotionBlur.mov	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombSplineSetUp.gif	Setup.exe
File opened for modification	C:\Program Files\Adobe\Common\Plug-ins\CS5.5\MediaCore\RSMB6AE\RSMBProVectorInput_64.aex	Setup.exe
File created	C:\Program Files\REVisionEffects\RSMB6AE\.updater\REVisionUpdater.exe	Setup.exe
File opened for modification	C:\Program Files\REVisionEffects\RSMB6AE\uninstall\tclE7AF.tmp	Setup.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	VCREDI~1.EXE
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 3 IoCs

pid	Process
2492	REVISI~1.EXE
1192	VCREDI~1.EXE
1184	VCREDI~1.EXE

Loads dropped DLL 16 IoCs

pid	Process
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
2152	Setup.exe
1192	VCREDI~1.EXE
1184	VCREDI~1.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8800310000000000de5894a4110050524f4752417e310000700008000400efbeee3a851ade5894a42a0000003c000000000001000000000000000000460000000000500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\Dependents\{050d4fc8-5d48-4b8f-8972-47c82c46020f}	VCREDI~1.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12	VCREDI~1.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}	VCREDI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\Version = "12.0.30501.0"	VCREDI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\DisplayName = "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501"	VCREDI~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\ = "{050d4fc8-5d48-4b8f-8972-47c82c46020f}"	VCREDI~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\Dependents	VCREDI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12\Dependents\{050d4fc8-5d48-4b8f-8972-47c82c46020f}	VCREDI~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 6400310000000000de58a3a410005245564953497e3100004c0008000400efbede5875a4de58a3a42a000000a25c01000000060000000000000000000000000000005200450056006900730069006f006e004500660066006500630074007300000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Rev = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000de58a3a4100052534d42364145003c0008000400efbede5875a4de58a3a42a000000b25c0100000006000000000000000000000000000000520053004d004200360041004500000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 6000310000000000de5894a4100052534d4236417e310000480008000400efbede5894a4de5894a42a000000e4f60000000004000000000000000000000000000000520053004d0042003600410045004d0061006e00750061006c00000018000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2940	explorer.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeBackupPrivilege	2188	vssvc.exe
Token: SeRestorePrivilege	2188	vssvc.exe
Token: SeAuditPrivilege	2188	vssvc.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeLoadDriverPrivilege	1656	DrvInst.exe
Token: SeLoadDriverPrivilege	1656	DrvInst.exe
Token: SeLoadDriverPrivilege	1656	DrvInst.exe
Token: 33	936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	936	AUDIODG.EXE
Token: 33	936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	936	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1184	VCREDI~1.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2940	explorer.exe
2940	explorer.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2492	2152	Setup.exe	28
PID 2152 wrote to memory of 2492	2152	Setup.exe	28
PID 2152 wrote to memory of 2492	2152	Setup.exe	28
PID 2152 wrote to memory of 2492	2152	Setup.exe	28
PID 2152 wrote to memory of 2492	2152	Setup.exe	28
PID 2152 wrote to memory of 2492	2152	Setup.exe	28
PID 2152 wrote to memory of 2492	2152	Setup.exe	28
PID 2152 wrote to memory of 1192	2152	Setup.exe	31
PID 2152 wrote to memory of 1192	2152	Setup.exe	31
PID 2152 wrote to memory of 1192	2152	Setup.exe	31
PID 2152 wrote to memory of 1192	2152	Setup.exe	31
PID 2152 wrote to memory of 1192	2152	Setup.exe	31
PID 2152 wrote to memory of 1192	2152	Setup.exe	31
PID 2152 wrote to memory of 1192	2152	Setup.exe	31
PID 1192 wrote to memory of 1184	1192	VCREDI~1.EXE	32
PID 1192 wrote to memory of 1184	1192	VCREDI~1.EXE	32
PID 1192 wrote to memory of 1184	1192	VCREDI~1.EXE	32
PID 1192 wrote to memory of 1184	1192	VCREDI~1.EXE	32
PID 1192 wrote to memory of 1184	1192	VCREDI~1.EXE	32
PID 1192 wrote to memory of 1184	1192	VCREDI~1.EXE	32
PID 1192 wrote to memory of 1184	1192	VCREDI~1.EXE	32
PID 2152 wrote to memory of 2516	2152	Setup.exe	37
PID 2152 wrote to memory of 2516	2152	Setup.exe	37
PID 2152 wrote to memory of 2516	2152	Setup.exe	37
PID 2152 wrote to memory of 2516	2152	Setup.exe	37

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2152
- C:\PROGRA~1\REVISI~1\RSMB6AE\REVISI~1.EXE
  "C:\PROGRA~1\REVISI~1\RSMB6AE\REVISI~1.EXE" RSMB6AE
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\PROGRA~1\REVISI~1\RSMB6AE\VCREDI~1.EXE
  "C:\PROGRA~1\REVISI~1\RSMB6AE\VCREDI~1.EXE" /install /passive /norestart
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\PROGRA~1\REVISI~1\RSMB6AE\VCREDI~1.EXE
    "C:\PROGRA~1\REVISI~1\RSMB6AE\VCREDI~1.EXE" /install /passive /norestart -burn.unelevated BurnPipe.{AF81C2CB-E18F-410B-B239-FB6475736B05} {D3FF07FF-B5C0-49DB-A4D0-01ABA07E38EC} 1192
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:1184
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe "C:\Program Files\REVisionEffects\RSMB6AE"
  2⤵
  PID:2516

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000574" "00000000000003F4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x528
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\RSMB6AE\RSMBProVectorInput_64.aex

Filesize
4.5MB

MD5
5dbb25444ba0c20fbf1cbaad73ca86ec

SHA1
cbb342181a16804c4e788773409065b2789bda80

SHA256
d508c573a6d5e76b8ac4ee7f68e085a345c2ca52972cf47d3129e90e7938ee87

SHA512
f6f9dde633f10f65190632340212f61c2326ef1c07207ac764291683a41441e76a976ea4bd17c7006ad334ae49187385163be2ebdb5cb1d6aade3fcf1c786fa2

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\RSMB6AE\RSMBPro_64.aex

Filesize
4.6MB

MD5
3db1b6c01afc98b612572e3a64b39c28

SHA1
b10dda22e689a8f5b63e2dbabf624175f1ee5f6d

SHA256
de4362dbd0607119891ee47798ea254362b95274367a6a226aa1048616a2c415

SHA512
5be135fe16852605c7d4dd0bf19c456efa95eb6051c486249c02687311359044da8d98cea5bd75eb16434fb4d78ce626d27d223bf882a109ea4a82bc3a692fe8

Download Submit
C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\RSMB6AE\RSMB_64.aex

Filesize
4.5MB

MD5
d89e1597ac67121ad1ec97b90078a5b8

SHA1
2654ab5ba8fa543beffd273e33f259fa35d9e2b9

SHA256
6654c7250b08a93553ce908884982095ddca861d6ae45bc07d12bca4aa907d20

SHA512
8424814a61158d7ee6dc1ae72813c09419b9cead90cad3d1f31581212b5ef10ef657ff6fefca39850a55587e1693a22acab6d947743b5e3d4aaff8bf1005fad6

Download Submit
C:\Program Files\REVisionEffects\REVisionCheckUpdates.bat

Filesize
377B

MD5
17f9d93a0c7594339ceae7dc3114c1ad

SHA1
f183e65d4062575978aa062c309f6fd19f5c3f78

SHA256
c78bf5d105a79ecc6442791e4e8982efe7ea26d59a688936233f59a9125eb9ed

SHA512
a5d6078fd46f788fcb9188c95e294916958f2f0b078651a90df16355e583925f06ee8802497c4b6053bcbdf710ffa94e16343d214dbe9a04c82b045a89b6b2f0

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\.updater\REVisionUpdater.exe

Filesize
8.2MB

MD5
75dd8952f0bb4bef5106a545118d7b49

SHA1
c6ae04b60bfc6752fd59d2fe30cdfa1145b0d85d

SHA256
270a0708d6e2954a600b04e16a2c32ece20d88e11d0dd8a7f16e5b906e894332

SHA512
9141220f4c0b8ee2892ad8236a7752227bc375b3892eccc17bfb52b89e004d5c2c8259659dc0f5ccbafc1c32490a3f7447323cbf2e7e9bdef675fafab31e00e0

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\REVisionLicenseInstaller.exe

Filesize
269KB

MD5
950c9faa657a467f66d37a9567c31507

SHA1
e8c94d2befa7a6ee45ffde0920106f0701d799d7

SHA256
03909e706323337fa0c0da8a253829fce9198dc8cb4314082bd176b5e561b2fa

SHA512
8e04b88db67ee6de8340912313ae3611a7dabff09db6f283d04bec98b096a0e2f7b9f8fe2cafceac990a7e1f3afc6ffcbcbb681608b8d2d03f7caeca771738bd

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\AEMaskSetup.gif

Filesize
144KB

MD5
6cc8459af33eaf06ce8e4d74f764c324

SHA1
73eef4c6fbd270862aba3c6d0355bbc973cba1df

SHA256
abb0e2dd6bff31ff6642887136e14c1c2e6c284a6011bc24de21a7f7b875070d

SHA512
f5dd953c4065c05906dee52c05262755ff211f8dc7e847d4b40bf2edae467b8f635e1d760737b3bb8aa126363b034c1d0e28596b0b50705dd40808c47597f723

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\AEMaskTIme2.gif

Filesize
80KB

MD5
42f6c8482b6104beec84dab4be8a58af

SHA1
a2803715677d03ae0d91d75948d47d828f6117d9

SHA256
9313340725e92b3be92b2cd460c696d278bcfcee53365358ef496df1b6a61960

SHA512
9a4dd3d2a68c0f30da66ba27631705d95fa1b52544963f6e8a6a250aa153544da55fe9b02541460f52460d9ba4c44511c375cb6b768a5a68b96c40211ee995a0

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\AEMaskTime1.gif

Filesize
78KB

MD5
106fa72fbe42019925fa4a565471f638

SHA1
3107a24269e21828b10812c26060c18e21565949

SHA256
ac426c7c57a352509c1f041a08c0d0d1d86c59878cf741a2c32da0e89ee4ddd3

SHA512
9d59fae2c8fd1066deed7d76bdf3d5b540dfd7e3ac35508b746da210d699d18ef987eeb46d16405cc7c4e6c0a77d62a76f638a302ec4a88144e5528c1c1e6c49

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CatStillWithMotionBlur.mov

Filesize
77KB

MD5
66fb653bb4cb368894344f2a11d2f9fe

SHA1
2f7a3edbed35f98c970581ff8a4615a9aac19022

SHA256
275e6df6dff597ab8ebc48f701b37d68e2a6cb9ed892e329431b1bbb0ea56cc3

SHA512
e39bd99a75dd48aa5171c93dbbc71d46db3784cd1482e650d767e31b268555fc3d552baa516ab2f2d79a83e71d8013b29792ffcf83fade1d261cb125b8868932

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CatWiggle.mov

Filesize
414KB

MD5
a7823f5808d275bfa658d395f525eb16

SHA1
cd949fe32436758e883f00d04e78bf3cfc13f9f3

SHA256
f958ba9e91cb102b2bcfd8e3ae1de511dc815c77711d9a8f1c0658ea41335894

SHA512
499931ca8db32840725244e4a3dce7e10781f0e212b4d99782f0cfe927820d6909582a4064f08f96adc28a1ea1578c703488e276d597c72cb166564c025f6c9b

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CatWiggleWIthMotionBlur.mov

Filesize
95KB

MD5
18cb0a99ac4636aa240090dc08da811b

SHA1
bf2990e9165d5e450f56802c0ad672bcaf60c58b

SHA256
07d7cb3b3fe41652b74d8777a5b53c96d25431412adbf83cf3006caec7996ee5

SHA512
6f91b3296e81aae51d74aa68fab00441a859143718179e0779017ba7a90a136f6a5ff7ce5d99cc8be84c153f8535a6047359b975881c7d3424be3cf8df0efc20

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombPerSplineLayerSetting.gif

Filesize
81KB

MD5
df1bd176cf5e38704b86389d80a1b887

SHA1
6dcb1be2d6ca2b8e2a38f63281294df3283bd576

SHA256
5d6c6dddbaca1e725272154246747a27c20bd7d58b8783e9775e89b5638f08a7

SHA512
9e8e7d56d01e090c06dbc9592d264ceba9c970b25b723ba2f32fd7a8779aa5fef57f2e5d0a168997cc4d4f40f304227c944e487982c561ce72e8d1e84c9d3b5b

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombPolyControls.gif

Filesize
55KB

MD5
ffef574a31e91a8633c3e81ccec2f74b

SHA1
20dd5a8c4174524972d1ed144c6aaa6e82cc7a58

SHA256
c268cdf186e72addda421bec01bb898cf6f8c6b470a1b3aa9570d6c80104756c

SHA512
669b239d04c01c08d4ae555f95f27be60e1633d12e424319ae5064c5fcdddef8fd6c3add352ed5bdd5fef1771125486f591a1113d7fadeb1081f39c25078c0b3

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombSplineSetUp.gif

Filesize
94KB

MD5
f219137d1437a1398b2196cfa954c2fd

SHA1
679a7fe5146830ff2600987af2216645cc514c1f

SHA256
06339bf85d0957f6014100b7fdb40b9329f8af6d373410969719b9115127d7bd

SHA512
c9fca7573ddf4f0fb2bfc38cea45ddee3dfb99f30c3b2b61d6de858d446e87342002358b0ad0fd2234620e89775b1bf39328bd5d7950946f887337b82ce8d080

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombSplineTime0.gif

Filesize
80KB

MD5
5527fb0cf85a846a860bc14d5cd95925

SHA1
8c950f1beae607b937f5050174bb9387ae0fab71

SHA256
a48109af2e4c03ccdd47ab0af9d7d3287cbf3e782e3cd8ef0a1b14ec58195f9b

SHA512
d18092606491b24838525d75a5fa9d2d0a88f7c9330f449db2428ed4fb341fe6979f3a211260b3e81b52141b327da4b6b98183d85ae435353d7dce443ef42deb

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombSplineTime1.gif

Filesize
79KB

MD5
d3b36c01e24877b3b9e91b2908e305f0

SHA1
67536b05bde4ee3df04ce005d61f382fbfe07555

SHA256
3878c0ad4a70704a09ac2ac33271c9f6fc4e963a1973562c90d248e4f3482821

SHA512
c90a109488b28b7287e723244bf9606795afd946de5b1001568a3ee1d429c6020cabe714ba9117f09524405e5a6791547186b0a20ec4620ddecc5cb3085b3029

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\CombustionToolbar.gif

Filesize
12KB

MD5
c8e0b6a6e6051c0cefe659e5cf535765

SHA1
f3a174cea35316ef2b1cc21b843bcf4ea70ce488

SHA256
fcfe12f8cb66f1cdc633d6fb0fe4ccf7a18ad6ee1161edc499b5bfd92dd0e0a8

SHA512
be7ff9082160b2d4d08f2cf7d476491bf5e564778caf1cb1eb9e10e007e0fbe30572c893c0db4292fdfb5e4cda58ff0b6304bdc341734c1d28164c4274f71423

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\LennyWithBadVectors.gif

Filesize
6KB

MD5
4bd63e6e1c08edc847a12f5ab57fd207

SHA1
ae6cd4b3d8e954d80434d7d14eebe3463e7d54f9

SHA256
cb8f6c79edc484da09646d1a3f79a521b1bf5a5880fd2ffbb469f9509573fffd

SHA512
d1f42ab0063d65f7a7fd7073bbf46597e395cdf182a5611737e1f548a2e0952988d14d92c68ff7b7222ad6602d172a6da73bd46df33d79b1edcd2fc214c4884e

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\LennyWithGoodVectors.gif

Filesize
7KB

MD5
d7d42ea4029a7fd102c26fe8be2bde44

SHA1
de0b905a2ee41bbb2ff6060d3bc8bfa22d7c9a2e

SHA256
aa7efbca1edcb503ed1e3f1fa8ffcf4b91e663fc78d612967252e4201c06496d

SHA512
d9559bed4e0c21c77796dcfc44344aab1553ea5dd73384f57e069bcdf859504cb76d5d37edba45090dc1eebcb131a18431e1158e4348f01fc262fe8f94deb214

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MaskMenus.gif

Filesize
119KB

MD5
caae9a6418b398665d82e44c9ae2fc27

SHA1
b2ae4f0cf8233eabf9b48b7c8ecad0901223896f

SHA256
ebd210d9ae553238c0f9df153851ba28469d9345239b36487deb9ae3cc92231c

SHA512
25b45d76b37fdd0ade9c7d1368fbf8c2ddb3502febec377ac0f2ea89a86f842b3e5ec1522dcfeaa38e978eec22ef9fe4b4d6aa70df8f1011af10eb9a95c40497

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MotionSrcBlurredBad.jpg

Filesize
4KB

MD5
597ae8631999e47188ffcff83be3abfc

SHA1
717f541bc443152ba94c8325bf2c5822f4c3f330

SHA256
6aa2d06b6b575a73c2d40e985be5ce28f673cff24673f94295d84c6d64c4a922

SHA512
6b575967ea362dd4254c52a302bc541ab1fbd4d56103e6b69f3fed8b1987bd798cc64f9932b2bc41d8f23e8718bcfa758bf6d3e67c4415027ca8412affba04a5

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MotionSrcBlurredGood.jpg

Filesize
3KB

MD5
a4e946f4377e690b9dd39d03ca86819b

SHA1
ec20bde0dac072cc8e46a75c6a68f7886245c8ca

SHA256
ec561c6ab7d964c2e8e681249274de4af6a4f70d7de8ce68d0f14b9ae94684f5

SHA512
3a4d66a2fa333ca150d6c55978a7d3cc09f86ffac4a9c8b0ac3ac6994f32e3b3450588b94a1930c9c3e387f608c36c66c3a724e28778a3d66aea05ec933bba1b

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MotionSrcEnhanced.jpg

Filesize
9KB

MD5
0eb6d7797e3e83cc6fc2e0ba3be41209

SHA1
10be4599948c6a1daa5e510365424102b0882962

SHA256
983e0dfb483f29cf5c8d1e4f43e9e25fabdaa09886c631939878b9283f637d79

SHA512
46009932c938f1c82fc83019f826f9fc8c925719dfc32a28ed2df37ced5800a34777256defb5943c53689df6fce2b7190e15accc02e6aff5bf2ca4fedeb7f0d3

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MotionSrcOrig.jpg

Filesize
5KB

MD5
d0df1048cc7b53f50152f87956a67ea7

SHA1
020d41d1e15051efa271c0dc87ce6d28592ec62b

SHA256
f7ce0054aad3aac8657d8a5fd13d4d19ce4cd94f59ce2d637cf87f3497c13a43

SHA512
73009b4e58fd6c79096311a6b0a090a8793c45c4ce91fa18287a82a9bbc1260f99c026fa2e2b6e389a74c69728e4f960465f2c26205678bf100352c52cbac3bb

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MotionVectors.gif

Filesize
5KB

MD5
0ae7f2ec044a68965620acacfb17039f

SHA1
6421bacb6804ffebfbdb6411617300a884bed339

SHA256
a290de53a7d624ca282e1d8b58584d318d3c19ba51d203edb54f3b4569d10f37

SHA512
3becee6002162bee1b8ddc33fbcc0cdcfb9e68a8032d5527d46caef688845da71b209bd7d894d3160da19148e7561763930265cd527d52e3fbc9e6f27a54b9b0

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\MotionVectorsWithAlpha.gif

Filesize
6KB

MD5
93b9f47517edd7b6a03008dfbf21a2bd

SHA1
2f3952916dad50a9fa5cd9721e33f35465c84f51

SHA256
1469290f748d9771125a5486e8755fbe93f08bd021f6f60d591c92c0d49b2b68

SHA512
7b751d2ea4a82865de526efc27947b9a64eda0f16e5ab56cf12ac18c26781840125048a3f6e0b805597c30be6f4a90ec8ea947026d706f1df52ab4e5779a2dbc

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\RSMBProUsersManAE.htm

Filesize
7KB

MD5
0bfc28d78b08a1bbc9a63515f637105b

SHA1
4766bfd8d556256ef237f16c0511fbd70df8d00b

SHA256
0a75c8dabecd9e02e3decb5964a45d5e6f18bedf731c528ac895e8145cf3f2a5

SHA512
ad65305535a8f8a1f14ade5561f2e147c819591dfaeda94f56dc77198085376104cec51cf6070e1fd8129c176101a7bc10d1fed9c918527d1b67b8973cbba3a8

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPoints.mov

Filesize
46KB

MD5
78470588f16181160aa97b5ef0c6ca53

SHA1
f2043763e69925e1394398911b4c20553643f05a

SHA256
1393f3e9336f7abba26d7c62abf7939eaec2470bc6c1d0a3bcb4c43be3f8dfc7

SHA512
81e10e92126c2289f2d9fad746cfb5f4604e4414eef1821311fd512bde82489f6dd0a43841921d36a3dcf880b374af2c6cc5734ee8e7e3d7b6086c02fb095ae6

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsBadBlur.gif

Filesize
67KB

MD5
df17e7778c9e1ebeb87a766e50784caf

SHA1
be14cfb51a54ed41ffe958063d780e7035029d89

SHA256
d581cf8351394438b6bedf89047b7746ecafedb30d2e2e46964355f24f6dab26

SHA512
e65a135d12497b33d20617d2d3a556a3e95564d99a8a30104a5f6f72c513d19b247495cc8192c93a19cce81ca426be1f924fe9346927d3da71229749694ede53

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsGoodBlur.gif

Filesize
66KB

MD5
4ebd68aebb8ba53954c7a9a9b0cbab57

SHA1
e7ffd2929f71d286e720439e08bbb8719d1e8ded

SHA256
70bddf05cd6f7984a0bc6b621ca328c396352965887ff5df86d313e03dae7337

SHA512
66b064c93b3e5a89a19d1dea9ef0ab6f172fc4bbd6d35dc319e5577ef00bec4a3cc0b6ec2c3f1b09070aab883f6c9bd2230e0b0c7abadb6328cae69303b61a8e

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsSrc1.gif

Filesize
79KB

MD5
99263e987ed0aa289d28634eb1d427af

SHA1
3a423e4a1eae15dbe48545dcef3df0a4c866348a

SHA256
27162efc8ca277e7a4a7461774f88b457609c51824918391fecc4c7f201ccd22

SHA512
6c875702c66d5646f59eb62a4b26bccdbde74ee59c6352005a78ad9fc46ebb1aa80438e15e99ab71c26d93fa9e24cccb053cae9b64910a97eaddc75e83b72227

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsSrc2.gif

Filesize
81KB

MD5
7320210b0e1ccef48105e15ae7f08e06

SHA1
84a7523b120d5424d98fd221804e6332153b9a18

SHA256
6fbddec91721e0759f6241458452609bd95f0b590eac0f0bdadfea14137090c1

SHA512
d4e88b42260d3f3773357ebef263f8e25c1261087458c95ac2ff5abe95064d72ab36a70fe096cc0bf0611111ebbd8b286a364f772d664bfb0f5c7064d2aae559

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsWithPoints1.gif

Filesize
78KB

MD5
74059abce8662b6bf9d3f00a23b38a84

SHA1
6df7673a4c9ce32358e9844e7d49f5596a06c3c6

SHA256
8971af35eaaa16c253e006f3034131a9e9b53c0ea4432d67a2400446713a82ea

SHA512
33264d4c706ffea1310696514b66449fbff7008ba4011b1e35f359833274403f277ba360af06daf31b9af69ac62bef61a50a5c7b1a6256cd64ac948b5f4c8d48

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\TrackPointsWithPoints2.gif

Filesize
79KB

MD5
31c46dad363f2970bd18260c75716ae9

SHA1
a28a63b4ce468d10f0f79e46246424759a4661a0

SHA256
9f14a8db753d5573a50281c4b21227fb15635d3cce776e05760154b2a60cf8c6

SHA512
20b4c0c66229e2247e45a54daf1bbec633fe2fea4feded1ba16b1d235f05d7f139529939e401b352755ad1ee81dacdb52a1191392e9c65dfdd0bb2edc58ff710

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\alpha.jpg

Filesize
4KB

MD5
e1e09d66bce85c465249c054047aefcc

SHA1
e172b66d2e88802d1eba3fde1b60e20b9dc5da53

SHA256
7f093cc0afc7cb3012077bc0edf4d9eebda34d4194925bcebe633c476db381bc

SHA512
c7438375128abb93be48d134dceb1f2b248f78e9927d4cd8ed075ac0f1ae63228f706be7cd3da6f3dc1bb601db08dbf06c88427b01a5d072700a5fb24604e59d

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\backNoChoke.jpg

Filesize
12KB

MD5
f51ff417c2d7583e33f03c7e73dd465d

SHA1
71a9d90226a85fb9a97e2f742b9466cb044738da

SHA256
48d48d6be5de4cd1b80a7daa5fc669ccbe371a3317fda08cc6d01c531037dd1c

SHA512
b576597459c388c91ba6f836478f72d699957911e969884212b98f92916bc59578c7ebc6e488c2689b442e3a225e2f42aa52ccc05204e42ef5037ef3fb014142

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\backWithChoke.jpg

Filesize
12KB

MD5
c9462ca73f26c31f811a5038ccf3e3bf

SHA1
635615f0252434e494d5c448bd8dd1b2c0d631df

SHA256
1b4fab41f7319d573c7d3ebc54330f21afd0b690603d3355e9e09f301e063b13

SHA512
fa77bcdd07eb22867e5972f34c98f83eddba29da1c074fe4cf5589a723bc87070fb8c6d46b9d02ef1cf3735c8a3b2f274515030c19c457f38dc4f1638969ced7

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\combscrubcontrol.gif

Filesize
2KB

MD5
2b4e4567ba8f3e2d5ef4dc1c4a16a9b3

SHA1
de09034f9b7541c968f99ee05fb9c72740ddbb79

SHA256
9323df1050c204268e39226d101b367f5db8d338f845bd62e3525798878e9736

SHA512
69ab13c7bc93b4a788ed30bb34dfbda95cd86d548679c9db7efef83be48ea26701a3c7968dc7d61c25087dca77dea82fa2f9193596ac741264474450abf513a0

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\combusesettings.gif

Filesize
21KB

MD5
5fe4ca31cdb29d0249fc95a539a4a18b

SHA1
9cc18e3de1e3f5a0e409ddbc487a2a930aa8f15d

SHA256
fed8065d2385a7343e77ca49bd858b7c3a466d80a3c391c747070d6f5b566083

SHA512
f937463d54d9fa230f8c82786377a8748cd18f0db2e4e55e47ce22e58246e436e7694472ac68d7c073b4f4c306115045ad44eeed29ca27107ba312ce26adce3d

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\fillInBG.jpg

Filesize
4KB

MD5
7f01fd0c0fa873335edd28da28474919

SHA1
b28b456d40e8f2bef79115b0a511cc6b6ad2244d

SHA256
7bf0951bcad8b65e557e82ab99d0abfc6476c708e4d54719ca8870413633bab9

SHA512
266f07d02ac4ce25cd23605389c75a3a34095d413aedd55dd394bb5432e1748332807e8fa61545cdd3021c3c890b202256448dd4757885a9638a5ff52916068e

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\hand.jpg

Filesize
5KB

MD5
4f0be83986aef1747336939a482cba1b

SHA1
e835a282e7f058787b5ff2c2f581b099b540da49

SHA256
4b968e7c36e64e1f91d85ceedbeb96c5c3a915beac3df688356169641a827c22

SHA512
bbd55a6a10bfccb937424f18e6a2780288d82405f0c8f13b988f46ad95594ba52f4ef63a92bce3282c2820ff2511a2c4a635f6c15c7250e0e99df0e021e5d87e

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\layers.jpg

Filesize
28KB

MD5
fdc5d812656c377d0617f5f4a5739564

SHA1
828144ad27bed0ae196b7df030b6efe570f40424

SHA256
2afdb0b56b8304e805b30880545d715643c80fb4ba33802db672a8837a8baaf8

SHA512
568a2b4ab01940a75a8050a29e32a36a63248357862eacda495fcaf5b33bf1e03f731b41c9816964dcb6ab93d3009aaed9c5ab8f6146c3b5c089d6ecacd44a56

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\lenny.gif

Filesize
3KB

MD5
0986e68f6d77ad189c68bc3479f04694

SHA1
7a6126c087d5a7ae0ff0a0dc8a86fdbde7d294cc

SHA256
a89fe3b0c7a65a6e9b03c82dca4e14a8dd9bb39fd96937d74f186f62eafcbb97

SHA512
785d6002afb2a8bee4f973c87c812bff391def0f9da6c7ea720e06ca524524b352a698b6e8adff7f0a100ac9be2692254e7dcca51d5da425212c51f74c42c8e1

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\matchvertices2.gif

Filesize
1KB

MD5
f4948aaf4970a50e152ab61ab6c13efc

SHA1
42f4d817b5f00315ba1628424193753dde067285

SHA256
2bdcc9dbb955e228ba95e90e2ed710d95af39e735f3e3eb4a3e38c9c624ac541

SHA512
9639c37ae35a9f8f0c9d5bd6fb4e1f481be81e05c92541d3b96ba197626ec3611df8989b9a81273c1cb84566e865359a76a15bdcfa72a2ad1eb409993ba9a07e

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\nolayers.jpg

Filesize
28KB

MD5
e3662a05b5d908d8c293ec73145a8357

SHA1
b9f0fb586c6e1df317fe8e0b8c0bd1c51f73fb06

SHA256
a7b2ff7e0faac5d2231c3b8e1a207f8e8c4f8de8f73fa91b8c724220bcfbae32

SHA512
13e45db8eac0060425c9daacae8df730d1de0affe15e62d6f2df47f344ecf23d9310e99739317c4fa9df7a86a403c4c834c7b294bb43a436c64d39af7741b22c

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\source.jpg

Filesize
13KB

MD5
8d1247af40eaf769af8690e339d7264f

SHA1
e3f7e531bd7c15d014f437dd7c66f5fb88112886

SHA256
2558b4966f9f107febe4fc9c07e4da9d66e22a92a7f2b7063d0b820a88dfdc16

SHA512
383cf519e6f394ce8050b971b19981fcc6c8e772eb7c0be4244ad1d78e9c685ea86ec6e82cceafc1717e1f2bb4e5c52ea4854f840149c37bbf8ce03f9e13fe62

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\trackPointMenu.gif

Filesize
12KB

MD5
db1f69db94700cba50f7750fd3c91eb6

SHA1
6543830d5a1215f303b176f18d4773938d1ca010

SHA256
3152dff7a6559f4e13c05e2d735a12ed8b90f55a9fc6942ec05c42e1b075777d

SHA512
a7d7baee864c728c81d5f888c3a08a76f4ca22cdf78719db0272dbc0a5e006b362a2ffcb0e4aedbcf3c3e76ed2916feb25b545235f229cd3cc01ca3e81590eab

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\MotionBlurReadMePix\twixorAEmasks2.gif

Filesize
40KB

MD5
e0b705390326d1e4c67bfc20915f50a2

SHA1
20468514fd3ca6b55ee741fe1638a8d853194e4c

SHA256
899affcf5f85b2c31673862d5b472a02f43b67c586b4a75efd7304802e1730b9

SHA512
e061d9c9d7dee640acb97ecd6c40a93c5814fc02900b384618b3540e9c1dc4f69f3350ad65c9934bb5ed03ea89a66de922d5048935193f0d10eeed269db95b4c

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\RSMBProUsersManual.htm

Filesize
27KB

MD5
7f825d756c3a0aa1a208c16e75e9d7a1

SHA1
25ee2e1d12aa4ad578740f4c7d123b02650f499c

SHA256
f7eb58f381a1dec796070d065b043acf015e922099ad1c7022177866e6339df2

SHA512
d58e896712be8c9550a7b2731855b82868f8bbf72d2c4a5f8a55416cbb5f6cb525e4ed43b70b02634155e8f7e9bf0cd0340d604b6f34d2c1e9597d2bf3c72f74

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\RSMBProVector.htm

Filesize
9KB

MD5
c7d2cf3cfa24e612332d77e3b1928ca3

SHA1
a596d594a8754454fcbbc52e34e9ea5e4836098d

SHA256
f0256dedde4ad8d786c391478cf6566167caee215864ce8011018dba4c164273

SHA512
4bbf8b63f450a47a2ea37e9d6e0b4e8a35791fcfe6efb88fc97bc0a28f6db70ca21c7ec15f7366760186d8e0d523ce54b5713ef8a968146d1219ebfbacaa9262

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\RSMB6AEManual\RSMBUsersManual.htm

Filesize
19KB

MD5
b4929cc78d6a0b330544ca4af037bee1

SHA1
c5f57f1dea5da68403baf094c2b8cd6a7b61581c

SHA256
163de5b34b6c3d046f4f1779d855f2bacc37c4ecba803a3d7f22137637ad2d2c

SHA512
9a37d3e82866406d2a04fc532b81c5b820781d67abd58e85583ca3585b643a47c8f04f0bc4d408380e5e7109bda794c005901a23fc2e1ffaa89570f2d74d90a0

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\uninstall\uninstbr.000

Filesize
5.9MB

MD5
9e8452f8a15502b00b6dc6ddeeb64045

SHA1
ea953bb0bdb2cd1acffeb98a9acc3b6ecdcd16b3

SHA256
cc23090623a8b5472a705b7ce8f1fd0f2ddf0297e1c41a84532332491a24e246

SHA512
62d0a1d9f76ace8ba1c79d160c456957e031f02995d6e66ba2fcb40eb0e935d3b2b5a361a907291652e14d454a257e695529584557819a1d8dde48e29c5569d9

Download Submit
C:\Program Files\REVisionEffects\RSMB6AE\vcredist_x64.exe

Filesize
6.9MB

MD5
96b61b8e069832e6b809f24ea74567ba

SHA1
8bf41ba9eef02d30635a10433817dbb6886da5a2

SHA256
e554425243e3e8ca1cd5fe550db41e6fa58a007c74fad400274b128452f38fb8

SHA512
3a55dce14bbd455808bd939a5008b67c9c7111cab61b1339528308022e587726954f8c55a597c6974dc543964bdb6532fe433556fbeeaf9f8cb4d95f2bbffc12

Download Submit
C:\Users\Admin\AppData\Local\Temp\BR6136.tmp

Filesize
121KB

MD5
1199bfa06b996be79b987c6506328a22

SHA1
e04d52d1d40bf161e7d64a5143b6908aac3be772

SHA256
481f2fa60cc99ba5784af304906acb4e356a704e440d6d141054d8226e73c56d

SHA512
354c977c63bbd8659969babb46f3a05b04396c91a8c1905fe76d45d2ab1d9b2d49e67630aed310921c3e3d64164424e2915c5a4868757e7c75758c655c085786

Download Submit
C:\Users\Admin\AppData\Local\Temp\BR61D4.tmp

Filesize
72KB

MD5
c04970b55bcf614f24ca75b1de641ae2

SHA1
52b182caef513ed1c36f28eb45cedb257fa8ce40

SHA256
5ddee4aab3cf33e505f52199d64809125b26de04fb9970ca589cd8619c859d80

SHA512
a5f2660e336bf74a1936fb2e1c724220d862632907f5fd690b365009ac3e1bf35fa6689071f3da4049e495f340ff83f8438b79079ef1f248b9dcaedbdd5d3e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\BR6510.tmp

Filesize
74KB

MD5
924b90c3d9e645dfad53f61ea4e91942

SHA1
65d397199ff191e5078095036e49f08376f9ae4e

SHA256
41788435f245133ec5511111e2c5d52f7515e359876180067e0b5ba85c729322

SHA512
76833708828c8f3fad941abeea158317aff98cf0691b5d5dfa4bca15279cdad1cc23a771258e4de41cf12a58f7033a3ee08b0b5eb834d22be568ea98b183ccd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\BR659E.tmp

Filesize
24KB

MD5
4cf27e0747e5719a5478aa2624f6b996

SHA1
13df901e34f77e5ea11f36c0afedda7f86a2c003

SHA256
e69a9d06f2c17cc021ebf9b62ca110548facdc147b67dea4846e09865043d2d9

SHA512
4b0ddcbd7321128f977e1dbbe18cc76c7e489d4ee84b7775989e99778b5a60daa683c6063c5b700794b7f2070ae381fef20b19b3cb35c1babef9be79ff264941

Download Submit
C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.be\vcredist_x64.exe

Filesize
450KB

MD5
e16e6d68ce1949c9721656390f47ce07

SHA1
9009cca5dc05e22f4cf0d8529a473f19b363103b

SHA256
18e6d3d96fcd39ba069c0e6ebc108881ec5bb07e29a24b0177688ce391dac526

SHA512
63a179e4db0cb7954ddc9aee9e3c7aecae9e160154243b248b94647eb8defafb7041ee291f6f880dc3ca7f298dd548e4b3cf0b650e9a7e34f34d2d2f0dd36127

Download Submit
\Users\Admin\AppData\Local\Temp\BR5EE2.tmp

Filesize
43KB

MD5
043912c143bd6bc1a55fcd1acf8e368c

SHA1
042f241324989a21d1a61eee543e935ae1b9f163

SHA256
f7396330d3aef2201766cd94e90d7ada1bebc2092a3b177274b546488dd21955

SHA512
9dcdeade6e9e56e5763842b55f5d3258f7488098f964e1e882e9415dd490273bd2a44ac1cdbb2e352f1feea6aabf0b1a75f29441ad70ff898f636ee67b819156

Download Submit
\Users\Admin\AppData\Local\Temp\BR5FAE.tmp

Filesize
403KB

MD5
a210f1ac135e5331c314ce5f394fb5a5

SHA1
355afc1c61e1f65834472b16a4ca718e61537dc2

SHA256
65b32ea2982078fb9a18e88feec238cb76ed2ae6c2bb4ddb0f6a9c4f57b1d62b

SHA512
e4e70ef75e2f7897837f6772b9a0dcaaf4515d8be4210b28509f12cdde9d85bd7bed604ad5a9ee587356971f75e6f79874dbdb974cec4996262295e255501cf4

Download Submit
\Users\Admin\AppData\Local\Temp\BR60D7.tmp

Filesize
35KB

MD5
08ad4cd2a940379f1dcdbdb9884a1375

SHA1
c302b7589ba4f05c6429e7f89ad0cb84dd9dfbac

SHA256
78827e2b1ef0aad4f8b1b42d0964064819aa22bfcd537ebaacb30d817edc06d8

SHA512
f37bd071994c31b361090a149999e8b2d4a7839f19ea63e1d4563aada1371be37f2bfcc474e24de95ff77ca4124a39580c9f711e2fbe54265713ab76f631835a

Download Submit
\Users\Admin\AppData\Local\Temp\BR6166.tmp

Filesize
400KB

MD5
027491b39a7b16b116e780f55abc288e

SHA1
62c0ab7c3e374d5fc9920983ee62baa4421076b4

SHA256
eef69d005bf1c0b715c8d6205400d4755c261dd38ddfbbfe918e6ee91f21f1f0

SHA512
fe0ba835d9af2a2c297a545bb7e30d315b580273bb1f558f16d9cba59755200a4735f75b1672e5e5fbed449eb7a5abb6d905696674c181b742bf637028953194

Download Submit
\Users\Admin\AppData\Local\Temp\BR6540.tmp

Filesize
102KB

MD5
cd326d958ad1eeb46b99b7aaccab5edb

SHA1
c424d750fa5c85cccb10ee42acf43e640e9ffc56

SHA256
b966b6e0cf704e65627b74d9f4e4b7af31a9ce5d9564d00cfef822af427ec88d

SHA512
5bf45cebdf56cb66cdfad4be14ab3a2db93098d90c753018e2a257aa1ab4cf033db2d23a18ef20ef0b20a19d3dde8d2b274fcbdd2d77dd6844ab48259212c01c

Download Submit
\Users\Admin\AppData\Local\Temp\BR65AF.tmp

Filesize
24KB

MD5
124e89d0fcc409ede3595a253b788708

SHA1
bc88e037c3edea02dd20aeff10818105be9f4033

SHA256
27ea1b57a3024aec4a03188e80fdb2aa301fa5179c19be9c8b0dfc2aac73a114

SHA512
7cd0ca268a5dbd2aa22dbce1f253a2d067ca30c5195e059c3f431d546a20d1811592f8bd8fe88b6ad9cb5c6fdd6a4666ff451b84a5e790a9d5058865d48790b1

Download Submit
\Users\Admin\AppData\Local\Temp\BR65CF.tmp

Filesize
100KB

MD5
606f13d4d580b1f322b3f3d3df423bba

SHA1
02cb375e13b415edc8b5360dffdba531e47827ed

SHA256
c71a16b1056e522cd0365449448116d06f37a3273d77694d170340064511dd25

SHA512
867a45dc15e99148f24fc528fbc9255582e5534bb4696700292b70163fddb15f35ddf2acd0536a9cd78b4d8f9d827bf7530d2303bfd7e428f11573b381a0986c

Download Submit
\Users\Admin\AppData\Local\Temp\BR65FF.tmp

Filesize
56KB

MD5
145d5c49fe34a44662beaffe641d58c7

SHA1
95d5e92523990b614125d66fa3fa395170a73bfe

SHA256
59182f092b59a3005ada6b2f2855c7e860e53e8adf6e41cd8cd515578ae7815a

SHA512
48cb0048f4fcf460e791a5b0beca40dbf2399b70f1784236b6d1f17835201d70dfa64c498814b872f57e527793c58a5959230fe40ddf5ebdcb0b1de57e9c53ef

Download Submit
\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
memory/2152-103-0x0000000000CB0000-0x0000000000F6E000-memory.dmp

Filesize
2.7MB

Download
memory/2152-668-0x0000000000CB0000-0x0000000000F6E000-memory.dmp

Filesize
2.7MB

Download
memory/2152-105-0x0000000000CB0000-0x0000000000F6E000-memory.dmp

Filesize
2.7MB

Download
memory/2152-109-0x0000000000CB0000-0x0000000000F6E000-memory.dmp

Filesize
2.7MB

Download
memory/2152-682-0x0000000000CB0000-0x0000000000F6E000-memory.dmp

Filesize
2.7MB

Download
memory/2152-684-0x0000000000CB0000-0x0000000000F6E000-memory.dmp

Filesize
2.7MB

Download
memory/2152-101-0x0000000000CB0000-0x0000000000F6E000-memory.dmp

Filesize
2.7MB

Download
memory/2152-99-0x0000000000CB0000-0x0000000000F6E000-memory.dmp

Filesize
2.7MB

Download
memory/2152-100-0x00000000746E0000-0x00000000746EE000-memory.dmp

Filesize
56KB

Download
memory/2152-732-0x0000000000CB0000-0x0000000000F6E000-memory.dmp

Filesize
2.7MB

Download
memory/2152-107-0x0000000000CB0000-0x0000000000F6E000-memory.dmp

Filesize
2.7MB

Download
memory/2152-757-0x0000000000CB0000-0x0000000000F6E000-memory.dmp

Filesize
2.7MB

Download
memory/2940-744-0x0000000003740000-0x0000000003750000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads