Analysis
-
max time kernel
317s -
max time network
307s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-08-2024 15:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/1AUJi-R5ELmduZHgLe9LKCsZ9vuUDJuHk/view?usp=drive_link
Resource
win11-20240802-en
General
-
Target
https://drive.google.com/file/d/1AUJi-R5ELmduZHgLe9LKCsZ9vuUDJuHk/view?usp=drive_link
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 30 IoCs
pid Process 692 VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe 1556 VEGAS_Pro_22_setup.exe 4748 vcredist_x86.exe 3484 vcredist_x86.exe 3184 vcredist_x64.exe 3404 vcredist_x64.exe 1812 VC_redist.x86.exe 2240 VC_redist.x86.exe 4196 VC_redist.x86.exe 3900 VC_redist.x64.exe 428 VC_redist.x64.exe 3824 VC_redist.x64.exe 988 MicrosoftEdgeWebView2RuntimeInstallerX64.exe 2064 MicrosoftEdgeUpdate.exe 3484 MicrosoftEdgeUpdate.exe 3744 MicrosoftEdgeUpdate.exe 3824 MicrosoftEdgeUpdateComRegisterShell64.exe 3132 MicrosoftEdgeUpdateComRegisterShell64.exe 780 MicrosoftEdgeUpdateComRegisterShell64.exe 2976 MicrosoftEdgeUpdate.exe 428 MicrosoftEdgeUpdate.exe 3408 MicrosoftEdgeUpdate.exe 1136 MicrosoftEdgeUpdate.exe 4048 MicrosoftEdgeWebview_X64_98.0.1108.43.exe 2980 setup.exe 3944 MicrosoftEdgeUpdate.exe 4404 vegas220.exe 3156 ErrorReportLauncher.exe 2596 vegas220.exe 2456 ErrorReportLauncher.exe -
Loads dropped DLL 64 IoCs
pid Process 3484 vcredist_x86.exe 2368 vcredist_x86.exe 3404 vcredist_x64.exe 1252 vcredist_x64.exe 2240 VC_redist.x86.exe 4888 VC_redist.x86.exe 428 VC_redist.x64.exe 1436 VC_redist.x64.exe 2064 MicrosoftEdgeUpdate.exe 3484 MicrosoftEdgeUpdate.exe 3744 MicrosoftEdgeUpdate.exe 3824 MicrosoftEdgeUpdateComRegisterShell64.exe 3744 MicrosoftEdgeUpdate.exe 3132 MicrosoftEdgeUpdateComRegisterShell64.exe 3744 MicrosoftEdgeUpdate.exe 780 MicrosoftEdgeUpdateComRegisterShell64.exe 3744 MicrosoftEdgeUpdate.exe 2976 MicrosoftEdgeUpdate.exe 428 MicrosoftEdgeUpdate.exe 3408 MicrosoftEdgeUpdate.exe 3408 MicrosoftEdgeUpdate.exe 428 MicrosoftEdgeUpdate.exe 1136 MicrosoftEdgeUpdate.exe 3944 MicrosoftEdgeUpdate.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 412 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4224 MsiExec.exe 4404 vegas220.exe 4404 vegas220.exe 4404 vegas220.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8bdfe669-9705-4184-9368-db9ce581e0e7} = "\"C:\\ProgramData\\Package Cache\\{8bdfe669-9705-4184-9368-db9ce581e0e7}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} = "\"C:\\ProgramData\\Package Cache\\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\\vcredist_x86.exe\" /burn.runonce" vcredist_x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7} = "\"C:\\ProgramData\\Package Cache\\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\\vcredist_x64.exe\" /burn.runonce" vcredist_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{410c0ee1-00bb-41b6-9772-e12c2828b02f} = "\"C:\\ProgramData\\Package Cache\\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\\VC_redist.x86.exe\" /burn.runonce" VC_redist.x86.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: VEGAS_Pro_22_setup.exe File opened (read-only) \??\X: VEGAS_Pro_22_setup.exe File opened (read-only) \??\Y: VEGAS_Pro_22_setup.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: VEGAS_Pro_22_setup.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: VEGAS_Pro_22_setup.exe File opened (read-only) \??\R: VEGAS_Pro_22_setup.exe File opened (read-only) \??\W: VEGAS_Pro_22_setup.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: VEGAS_Pro_22_setup.exe File opened (read-only) \??\J: VEGAS_Pro_22_setup.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: VEGAS_Pro_22_setup.exe File opened (read-only) \??\U: VEGAS_Pro_22_setup.exe File opened (read-only) \??\V: VEGAS_Pro_22_setup.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: VEGAS_Pro_22_setup.exe File opened (read-only) \??\H: VEGAS_Pro_22_setup.exe File opened (read-only) \??\K: VEGAS_Pro_22_setup.exe File opened (read-only) \??\O: VEGAS_Pro_22_setup.exe File opened (read-only) \??\P: VEGAS_Pro_22_setup.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: VEGAS_Pro_22_setup.exe File opened (read-only) \??\I: VEGAS_Pro_22_setup.exe File opened (read-only) \??\T: VEGAS_Pro_22_setup.exe File opened (read-only) \??\Z: VEGAS_Pro_22_setup.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: VEGAS_Pro_22_setup.exe File opened (read-only) \??\M: VEGAS_Pro_22_setup.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 drive.google.com 4 drive.google.com -
Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mfc140esn.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140deu.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 vegas220.exe File created C:\Windows\SysWOW64\vcamp120.dll msiexec.exe File created C:\Windows\system32\mfc120cht.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vcamp140.dll msiexec.exe File created C:\Windows\SysWOW64\vcruntime140.dll msiexec.exe File created C:\Windows\system32\mfcm120u.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File created C:\Windows\system32\msvcr120.dll msiexec.exe File created C:\Windows\SysWOW64\vcomp140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc120esn.dll msiexec.exe File created C:\Windows\system32\mfc120u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140chs.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm120.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120jpn.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp120.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120ita.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_BD094DBD6C208A0E1DA0426D465799ED vegas220.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\SysWOW64\vcomp120.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140u.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA vegas220.exe File created C:\Windows\SysWOW64\mfc140esn.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\SysWOW64\mfc120u.dll msiexec.exe File created C:\Windows\SysWOW64\mfcm120.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm140.dll msiexec.exe File created C:\Windows\SysWOW64\mfc120cht.dll msiexec.exe File created C:\Windows\system32\mfc120ita.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\DLLDEV32i.dll vegas220.exe File opened for modification C:\Windows\SysWOW64\mfc120cht.dll msiexec.exe File created C:\Windows\SysWOW64\mfc120deu.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120chs.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140kor.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140rus.dll msiexec.exe File created C:\Windows\SysWOW64\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\msvcp120.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120rus.dll msiexec.exe File created C:\Windows\system32\mfc120fra.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\concrt140.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File created C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\SysWOW64\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4404 vegas220.exe 2596 vegas220.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VEGAS\VEGAS Pro 22.0\MAGIX Plugins\essentialFX\Presets\Compressor\[Sys] Compressor_Electric_Guitar.efx msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\FileIO Plug-Ins\mcaacplug\mcaacplug.chm msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\UPS\translations\qtwebengine_locales\pt-BR.pak msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\98.0.1108.43\Trust Protection Lists\Sigma\Entities setup.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\FileIO Plug-Ins\wmfplug4\wmfplug4.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Online\MagixOFA_u.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OFX Video Plug-Ins\TitlesAndText.ofx.bundle\Contents\Presets\PresetPackage.ja-JP.xml msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OFX Video Plug-Ins\ofxStitch.ofx.bundle\Contents\Win64\VrDualStitch.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\MAGIX Plugins\essentialFX\Presets\VocalStrip\[Sys] Female Up-Front.efx msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OFX Video Plug-Ins\Vfx1.ofx.bundle\Contents\Resources\AutoLooks\2.cube msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\DriverUpdate.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OFX Video Plug-Ins\MagixCVFx.ofx.bundle\Contents\Resources\MagixCVFx.ko-KR.xml msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Video Plug-Ins\PluginWrapper.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OpenColorIO\configs\aces_0.7.1\luts\slog2.py msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Icons\vorbis.ico msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\98.0.1108.43\Locales\fa.pak setup.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\Forms\UnlockFormServiceCenter_en_II.rtf msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OpenColorIO\configs\aces_1.2\luts\V-Log_to_linear.spi1d msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Online\MagixOFA-fr.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\FileIO Plug-Ins\mp3plug2\mp3sDeclib.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\readme\_msi_keyfile_m5cekti4xzmnzp2qmtvc8a6m6 msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Microsoft.Extensions.Configuration.Abstractions.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\FileIO Plug-Ins\sfpaplug\sfpaplug_fra.chm msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\sfspti.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\Resource\UnlockDialog_NL.ini msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Microsoft.Toolkit.Forms.UI.Controls.WebView.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OpenColorIO\configs\aces_1.2\luts\InvRRT.Rec.709__D60_sim._.Log2_48_nits_Shaper.spi3d msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\MAGIX Plugins\essentialFX\Help\DE\minus.gif msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\UPS\translations\qtwebengine_locales\nl.pak msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OFX Video Plug-Ins\ofx360Stabilizer.ofx.bundle\Contents\Resources\ofx360Stabilizer.de-DE.xml msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\UPS\Qt5PrintSupportMx64Qt5.15.1.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\pt-BR\ScriptPortal.MediaSoftware.TextGen.OFXInterop.resources.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OFX Video Plug-Ins\ofxRotation.ofx.bundle\Contents\Resources\VegasOfxRotation.es-ES.xml msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OpenColorIO\configs\aces_1.2\luts\Dolby_PQ_108_nits_Shaper_to_linear.spi1d msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OFX Video Plug-Ins\spica_cutout.ofx.bundle\Contents\Resources\spica_cutout.fr-FR.xml msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\MAGIX Plugins\essentialFX\Help\FR\stylesheet.css msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OpenColorIO\configs\aces_0.7.1\luts\adx_adx16_to_cdd.spimtx msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\MAGIX Plugins\essentialFX\Help\FR\search2.gif msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\UPS\languages\UpdateService_tr.qm msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\UPS\fonts\OFL.txt msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\UPS\Qt5WinExtrasMx64Qt5.15.1.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OFX Video Plug-Ins\MagixCVFx.ofx.bundle\Contents\Resources\MagixCVFx.xml msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\98.0.1108.43\Locales\nb.pak setup.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\FileIO Plug-Ins\aviplug\aviplug.chm msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\VEGASCapture\LICENSE msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\es\ScriptPortal.MediaSoftware.DeviceExp.resources.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\es\ScriptPortal.MediaSoftware.XDCAMExp.resources.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\UPS\languages\UpdateService_cs.qm msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\98.0.1108.43\identity_helper.exe setup.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\UPS\translations\qtwebengine_locales\nb.pak msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OFX Video Plug-Ins\Vfx1.ofx.bundle\Contents\Resources\Vfx1.pl-PL.xml msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\98.0.1108.43\Locales\or.pak setup.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\UPS\libssl-1_1-x64.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Online\MagixOFA_u_x64.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\Resource\UnlockDialog_RU.ini msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\MAGIX Plugins\essentialFX\Help\FR\dhtml_search.js msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\MAGIX Plugins\essentialFX\Help\DE\27670.htm msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Project Templates\HDV 3840x2160-30p.vqpt msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\FileIO Plug-Ins\mp3plug2\mp3plug2.dll msiexec.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\FileIO Plug-Ins\so4compoundplug\So4Reader.dll msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\98.0.1108.43\Locales\ne.pak setup.exe File created C:\Program Files\VEGAS\VEGAS Pro 22.0\OFX Video Plug-Ins\spica_cutout.ofx.bundle\Contents\Win64\spica_cutout.ofx msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\98.0.1108.43\Locales\zh-TW.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\98.0.1108.43\Trust Protection Lists\Mu\CompatExceptions setup.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFABDEF8779B90D4F2.TMP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120cht_x86 msiexec.exe File created C:\Windows\SystemTemp\~DF8EC16CC1B6BE6EED.TMP msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120u_x64 msiexec.exe File opened for modification C:\Windows\Installer\{1856086B-7BD2-45FA-A9D8-8AB68ED66B7F}\ProgramIcon.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB2AD.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120esn_x64 msiexec.exe File opened for modification C:\Windows\Installer\MSI5AE9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC5AE.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120chs_x64 msiexec.exe File opened for modification C:\Windows\Installer\MSI95B1.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFD0939750D853BCBE.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI90B4.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcamp120_x86 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vccorlib120_x86 msiexec.exe File created C:\Windows\Installer\SourceHash{1856086B-7BD2-45FA-A9D8-8AB68ED66B7F} msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfcm120u_x86 msiexec.exe File created C:\Windows\SystemTemp\~DF60A7A934D9583EEC.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3F39.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120chs_x86 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120ita_x86 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\CacheSize.txt msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120fra_x64 msiexec.exe File created C:\Windows\SystemTemp\~DF434B3BA5C47A8C5C.TMP msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120rus_x86 msiexec.exe File created C:\Windows\SystemTemp\~DF373EFCFEB7E5560A.TMP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\CacheSize.txt msiexec.exe File created C:\Windows\Installer\e59aff9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7EEB.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120jpn_x86 msiexec.exe File created C:\Windows\Installer\e59b022.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3EB9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5845.tmp msiexec.exe File created C:\Windows\Installer\e59af6a.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120kor_x86 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120deu_x64 msiexec.exe File created C:\Windows\Installer\e59afe3.msi msiexec.exe File created C:\Windows\SystemTemp\~DF9E7F107EDFF72C81.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE08F.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF20A6BABA6106E69E.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59af61.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcomp120_x86 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\CacheSize.txt msiexec.exe File created C:\Windows\SystemTemp\~DFB910DF392D0F609F.TMP msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120u_x86 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120kor_x64 msiexec.exe File created C:\Windows\Installer\SourceHash{D5D19E2F-7189-42FE-8103-92CD1FA457C2} msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcamp120_x86 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcomp120_x86 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120u_x64 msiexec.exe File opened for modification C:\Windows\Installer\MSID3BA.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF84D102938C809260.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF0207AEA5AA9E7C13.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFB79CB14937E04C29.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI5B97.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFEF496FDA1F4E95BE.TMP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120_x64 msiexec.exe File created C:\Windows\SystemTemp\~DFA0E17A7138B28DE6.TMP msiexec.exe File created C:\Windows\Installer\e59b00b.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcomp120_x64 msiexec.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe:Zone.Identifier msedge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 45 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEGAS_Pro_22_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeWebView2RuntimeInstallerX64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2976 MicrosoftEdgeUpdate.exe 1136 MicrosoftEdgeUpdate.exe 3944 MicrosoftEdgeUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000700a100e0a6bdd5f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000700a100e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900700a100e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d700a100e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000700a100e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates vegas220.exe Key created \REGISTRY\USER\.DEFAULT\CLSID\{8BF0126F-A5B7-4720-ABB2-2414A0AF5474}\edb08eb42241e68fb770823fa3e31927 vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\VEGAS Creative Software\VEGAS Pro\22.0\Metrics\Kernel regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\VEGAS Creative Software\VEGAS Pro\22.0\Metrics\Kernel regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust vegas220.exe Set value (str) \REGISTRY\USER\.DEFAULT\CLSID\{8BF0126F-A5B7-4720-ABB2-2414A0AF5474}\edb08eb42241e68fb770823fa3e31927\CID = "99658ee5-63cf-4818-a5a9-e8c6278a6280" vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My vegas220.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates vegas220.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" vegas220.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\lastrun = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\VEGAS Creative Software vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\VEGAS Creative Software\VEGAS Pro\22.0 vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs vegas220.exe Set value (str) \REGISTRY\USER\.DEFAULT\CLSID\{8BF0126F-A5B7-4720-ABB2-2414A0AF5474}\85b1e199f3cd856740d4927fcd818137\CID = "99658ee5-63cf-4818-a5a9-e8c6278a6280" vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\VEGAS Creative Software\VEGAS Pro\22.0\Metrics\Kernel regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\VEGAS Creative Software\VEGAS Pro\22.0\Metrics\Kernel regsvr32.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs vegas220.exe Key created \REGISTRY\USER\.DEFAULT\CLSID\{8BF0126F-A5B7-4720-ABB2-2414A0AF5474}\85b1e199f3cd856740d4927fcd818137 vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\VEGAS Creative Software\VEGAS Pro\22.0\Metrics\Kernel regsvr32.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\VEGAS Creative Software\VEGAS Pro\22.0\Metrics\Kernel regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ vegas220.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing vegas220.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" vegas220.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople vegas220.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" vegas220.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\VEGAS Creative Software\VEGAS Pro\22.0\Metrics\Kernel regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software vegas220.exe Key created \REGISTRY\USER\.DEFAULT\Software\VEGAS Creative Software\VEGAS Pro\22.0\Metrics vegas220.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A939559-AF8E-3CCE-B8D3-8C455FEC04D7}\LocalServer32\ = "C:\\Program Files\\VEGAS\\VEGAS Pro 22.0\\vegas220.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{607682E0-6E21-11D0-AEBC-00A0C9053912}\Pins\Output\ConnectsToPin = "Input" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8448720-96FD-11D0-AEBC-00A0C9053912}\Pins\Input regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000005-0F56-11D2-9887-00A0C969725B}\Pins\Output\Direction = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vegas220_sfa msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE38CA88-D78E-4BFB-B05E-577892730C83}\Pins\Input\Types\{73647561-0000-0010-8000-00AA00389B71} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54F29260-79B1-11D0-AEBC-00A0C9053912} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{026D0AA0-9BB9-11D0-AEBC-00A0C9053912}\CLSID = "{026D0AA0-9BB9-11D0-AEBC-00A0C9053912}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{869419DE-501F-11D3-8CDC-00C04F6B8E4C}\ = "SfTNoisg Property Page" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4495A74-B5C4-401E-95B8-77A5FDF5D59A} vegas220.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vegas220_ogg\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\vegas220_vf\DefaultIcon\ = "C:\\Program Files\\VEGAS\\VEGAS Pro 22.0\\icons\\vmspeproject.ico,0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{0000000C-0F56-11D2-9887-00A0C969725B}\CLSID = "{0000000C-0F56-11D2-9887-00A0C969725B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\ = "Microsoft Edge Update CredentialDialog" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D616F3E0-D622-11CE-AAC5-0020AF0B99A3}\InprocServer32\ = "C:\\Program Files (x86)\\VEGAS\\Shared Plug-Ins\\Audio_x64\\sfppack2_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\PackageCode = "1670FAE368D173749B9C4C5C64DAEC3D" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE38CA88-D78E-4BFB-B05E-577892730C83}\Pins regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE38CA88-D78E-4BFB-B05E-577892730C83}\Pins\Output\Types regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6802BA0-A056-11D0-AEBC-00A0C9053912}\Pins\Output\ConnectsToPin = "Input" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{23C9F225-40EC-11D2-9D36-00C04F8EDC1E}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000006175647300001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vegas220 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8448721-96FD-11D0-AEBC-00A0C9053912}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreClass" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B97C0F23-196D-11D1-B99B-00A0C9053912}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000000B-0F56-11D2-9887-00A0C969725B}\Pins\Input regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE38CA88-D78E-4BFB-B05E-577892730C83}\ = "Volume" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12\DisplayName = "Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40664" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D22D5B4-96F3-4061-8EE5-72D35A140205} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83} MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F3B8E880-B4E0-11D0-AEBC-00A0C9053912} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000003-0F56-11D2-9887-00A0C969725B}\Pins\Output\Types\{73647561-0000-0010-8000-00AA00389B71} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A807D72D-4267-43FA-8217-07C9FDCDBFF6}\ID2 = "3640992109" vegas220.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.155.77\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ = "Microsoft Edge Update Process Launcher Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\vegas220_sfa\shell\Open\ = "Open" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8834A25A-B03E-465C-95AC-F362BB0E5C36} vegas220.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vegas220_vf\shell\Open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D616F3E0-D622-11CE-AAC5-0020AF0B99A3}\Pins\Output\IsRendered = "0" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000002-0F56-11D2-9887-00A0C969725B}\Pins\Output\AllowedMany = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40986926-0F56-11D2-9887-00A0C969725B}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{09F4E6FE-F1D3-4E5C-B4CF-25D9C378961D}" MicrosoftEdgeUpdateComRegisterShell64.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a vegas220.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 vegas220.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a vegas220.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 90644.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe:Zone.Identifier msedge.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 1536 msedge.exe 1536 msedge.exe 3320 msedge.exe 3320 msedge.exe 496 identity_helper.exe 496 identity_helper.exe 4560 msedge.exe 4560 msedge.exe 1984 msedge.exe 1984 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 4644 msedge.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 1124 msiexec.exe 2064 MicrosoftEdgeUpdate.exe 2064 MicrosoftEdgeUpdate.exe 2064 MicrosoftEdgeUpdate.exe 2064 MicrosoftEdgeUpdate.exe 2064 MicrosoftEdgeUpdate.exe 2064 MicrosoftEdgeUpdate.exe 1124 msiexec.exe 1124 msiexec.exe 1660 chrome.exe 1660 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
pid Process 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 1124 msiexec.exe Token: SeCreateTokenPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeAssignPrimaryTokenPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeLockMemoryPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeIncreaseQuotaPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeMachineAccountPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeTcbPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeSecurityPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeTakeOwnershipPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeLoadDriverPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeSystemProfilePrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeSystemtimePrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeProfSingleProcessPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeIncBasePriorityPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeCreatePagefilePrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeCreatePermanentPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeBackupPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeRestorePrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeShutdownPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeDebugPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeAuditPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeSystemEnvironmentPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeChangeNotifyPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeRemoteShutdownPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeUndockPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeSyncAgentPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeEnableDelegationPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeManageVolumePrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeImpersonatePrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeCreateGlobalPrivilege 1556 VEGAS_Pro_22_setup.exe Token: SeBackupPrivilege 668 vssvc.exe Token: SeRestorePrivilege 668 vssvc.exe Token: SeAuditPrivilege 668 vssvc.exe Token: SeShutdownPrivilege 4748 vcredist_x86.exe Token: SeIncreaseQuotaPrivilege 4748 vcredist_x86.exe Token: SeCreateTokenPrivilege 4748 vcredist_x86.exe Token: SeAssignPrimaryTokenPrivilege 4748 vcredist_x86.exe Token: SeLockMemoryPrivilege 4748 vcredist_x86.exe Token: SeIncreaseQuotaPrivilege 4748 vcredist_x86.exe Token: SeMachineAccountPrivilege 4748 vcredist_x86.exe Token: SeTcbPrivilege 4748 vcredist_x86.exe Token: SeSecurityPrivilege 4748 vcredist_x86.exe Token: SeTakeOwnershipPrivilege 4748 vcredist_x86.exe Token: SeLoadDriverPrivilege 4748 vcredist_x86.exe Token: SeSystemProfilePrivilege 4748 vcredist_x86.exe Token: SeSystemtimePrivilege 4748 vcredist_x86.exe Token: SeProfSingleProcessPrivilege 4748 vcredist_x86.exe Token: SeIncBasePriorityPrivilege 4748 vcredist_x86.exe Token: SeCreatePagefilePrivilege 4748 vcredist_x86.exe Token: SeCreatePermanentPrivilege 4748 vcredist_x86.exe Token: SeBackupPrivilege 4748 vcredist_x86.exe Token: SeRestorePrivilege 4748 vcredist_x86.exe Token: SeShutdownPrivilege 4748 vcredist_x86.exe Token: SeDebugPrivilege 4748 vcredist_x86.exe Token: SeAuditPrivilege 4748 vcredist_x86.exe Token: SeSystemEnvironmentPrivilege 4748 vcredist_x86.exe Token: SeChangeNotifyPrivilege 4748 vcredist_x86.exe Token: SeRemoteShutdownPrivilege 4748 vcredist_x86.exe Token: SeUndockPrivilege 4748 vcredist_x86.exe Token: SeSyncAgentPrivilege 4748 vcredist_x86.exe Token: SeEnableDelegationPrivilege 4748 vcredist_x86.exe Token: SeManageVolumePrivilege 4748 vcredist_x86.exe Token: SeImpersonatePrivilege 4748 vcredist_x86.exe Token: SeCreateGlobalPrivilege 4748 vcredist_x86.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe -
Suspicious use of SendNotifyMessage 28 IoCs
pid Process 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 1660 chrome.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 692 VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe 692 VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe 692 VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe 692 VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe 692 VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe 1556 VEGAS_Pro_22_setup.exe 1556 VEGAS_Pro_22_setup.exe 1556 VEGAS_Pro_22_setup.exe 1556 VEGAS_Pro_22_setup.exe 1556 VEGAS_Pro_22_setup.exe 4748 vcredist_x86.exe 3484 vcredist_x86.exe 760 vcredist_x86.exe 2368 vcredist_x86.exe 3184 vcredist_x64.exe 3404 vcredist_x64.exe 2016 vcredist_x64.exe 1252 vcredist_x64.exe 1812 VC_redist.x86.exe 2240 VC_redist.x86.exe 4196 VC_redist.x86.exe 1608 VC_redist.x86.exe 4888 VC_redist.x86.exe 3400 VC_redist.x86.exe 3900 VC_redist.x64.exe 428 VC_redist.x64.exe 3824 VC_redist.x64.exe 4944 VC_redist.x64.exe 1436 VC_redist.x64.exe 5096 VC_redist.x64.exe 988 MicrosoftEdgeWebView2RuntimeInstallerX64.exe 2064 MicrosoftEdgeUpdate.exe 3484 MicrosoftEdgeUpdate.exe 3744 MicrosoftEdgeUpdate.exe 2976 MicrosoftEdgeUpdate.exe 428 MicrosoftEdgeUpdate.exe 4404 vegas220.exe 4404 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe 2596 vegas220.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3320 wrote to memory of 1432 3320 msedge.exe 78 PID 3320 wrote to memory of 1432 3320 msedge.exe 78 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 336 3320 msedge.exe 79 PID 3320 wrote to memory of 1536 3320 msedge.exe 80 PID 3320 wrote to memory of 1536 3320 msedge.exe 80 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 PID 3320 wrote to memory of 3116 3320 msedge.exe 81 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1AUJi-R5ELmduZHgLe9LKCsZ9vuUDJuHk/view?usp=drive_link1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b9b23cb8,0x7ff8b9b23cc8,0x7ff8b9b23cd82⤵PID:1432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:82⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:12⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:12⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:12⤵PID:3764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:12⤵PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:12⤵PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:12⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6512 /prefetch:82⤵PID:4736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:12⤵PID:2840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:12⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6308 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1984
-
-
C:\Users\Admin\Downloads\VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe"C:\Users\Admin\Downloads\VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:692 -
C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\product\VEGAS_Pro_22_setup.exe"C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\product\VEGAS_Pro_22_setup.exe" -m C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\SetupValues.dat3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2013_12.0.40664\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2013_12.0.40664\vcredist_x86.exe" /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\001#Install#vcredist2013_12_0_40664_x86.txt"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2013_12.0.40664\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2013_12.0.40664\vcredist_x86.exe" /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\001#Install#vcredist2013_12_0_40664_x86.txt" -burn.unelevated BurnPipe.{EC91E69E-C818-4CCE-9560-6075F867063D} {AACE4495-9AAD-4A3E-A38B-3271B1FAC02A} 47485⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3484
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} -burn.embedded BurnPipe.{EE607429-1E5F-45FD-A987-C01C1E72A1BB} {F290B986-FCBA-43A6-A39A-3D26C7149318} 47485⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:760 -
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} -burn.embedded BurnPipe.{EE607429-1E5F-45FD-A987-C01C1E72A1BB} {F290B986-FCBA-43A6-A39A-3D26C7149318} 4748 -burn.unelevated BurnPipe.{C42BAC5E-D167-4F86-AAAD-D6C4AC5E5E81} {88527D4F-F131-4D49-901C-048C71695C49} 7606⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2368
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2013_12.0.40664\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2013_12.0.40664\vcredist_x64.exe" /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\002#Install#vcredist2013_12_0_40664_x64.txt"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2013_12.0.40664\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2013_12.0.40664\vcredist_x64.exe" /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\002#Install#vcredist2013_12_0_40664_x64.txt" -burn.unelevated BurnPipe.{5F2C2F54-182E-4066-B20A-B348973BD5EF} {5C1819E6-B0DF-4162-B9E2-BEB3E2973BA7} 31845⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3404
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{560AF87B-F5B1-4D68-9C3C-E65D4F466393} {DFB381A2-EFC2-4C67-A3B4-A1523B6ED5B8} 31845⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2016 -
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{560AF87B-F5B1-4D68-9C3C-E65D4F466393} {DFB381A2-EFC2-4C67-A3B4-A1523B6ED5B8} 3184 -burn.unelevated BurnPipe.{C0D0D2A8-BA55-4702-8CAA-FBC909DCA4D2} {63B6B197-6A33-449B-82CF-E6CD59043F99} 20166⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1252
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2022-2015_14.36.32532\VC_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2022-2015_14.36.32532\VC_redist.x86.exe" /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\003#Install#vcredist2022_2015_14_36_32532_x86.txt"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1812 -
C:\Windows\Temp\{07735414-6A48-49B2-B20E-DB3A20AF5D57}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{07735414-6A48-49B2-B20E-DB3A20AF5D57}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2022-2015_14.36.32532\VC_redist.x86.exe" -burn.filehandle.attached=592 -burn.filehandle.self=600 /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\003#Install#vcredist2022_2015_14_36_32532_x86.txt"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2240 -
C:\Windows\Temp\{47122853-CD0D-4FB1-8160-56141502B892}\.be\VC_redist.x86.exe"C:\Windows\Temp\{47122853-CD0D-4FB1-8160-56141502B892}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{1ECCDA9B-C0E7-4751-855E-6D026014703D} {33973B60-D602-408E-A38C-F325217CA829} 22406⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4196 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={410c0ee1-00bb-41b6-9772-e12c2828b02f} -burn.filehandle.self=996 -burn.embedded BurnPipe.{BC1896BB-953D-4356-AFD2-919FC4BCDE1D} {44FAA68F-0A4C-4FBA-8803-7A9435043C88} 41967⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1608 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 -uninstall -quiet -burn.related.upgrade -burn.ancestors={410c0ee1-00bb-41b6-9772-e12c2828b02f} -burn.filehandle.self=996 -burn.embedded BurnPipe.{BC1896BB-953D-4356-AFD2-919FC4BCDE1D} {44FAA68F-0A4C-4FBA-8803-7A9435043C88} 41968⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4888 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{84F204E2-F86D-4572-B6F3-FE2EFA08D599} {972A6D93-45B4-4493-AD7C-2B1C8E0FF9F2} 48889⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3400
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2022-2015_14.36.32532\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2022-2015_14.36.32532\VC_redist.x64.exe" /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\004#Install#vcredist2022_2015_14_36_32532_x64.txt"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3900 -
C:\Windows\Temp\{2AD33228-1976-4360-898D-FBE3034BF27B}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{2AD33228-1976-4360-898D-FBE3034BF27B}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\vcredist2022-2015_14.36.32532\VC_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=712 /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\004#Install#vcredist2022_2015_14_36_32532_x64.txt"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:428 -
C:\Windows\Temp\{7642EB70-A150-47A8-B40B-EF4CDB5C98D5}\.be\VC_redist.x64.exe"C:\Windows\Temp\{7642EB70-A150-47A8-B40B-EF4CDB5C98D5}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{134B69E0-E36B-4777-AE9E-E3B37FCA50BB} {D2570F06-6E71-4A00-B431-07EC2C009107} 4286⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3824 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=952 -burn.embedded BurnPipe.{701F4810-629B-4773-B629-D11DA2BF4DD3} {D79AEE41-853A-4224-B781-453B8CEFD7F1} 38247⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4944 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=952 -burn.embedded BurnPipe.{701F4810-629B-4773-B629-D11DA2BF4DD3} {D79AEE41-853A-4224-B781-453B8CEFD7F1} 38248⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1436 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{DA02C797-463A-4338-92AA-5DE52396FE50} {3530FC3A-2602-4D00-BD6F-4F844A6A9950} 14369⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5096
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\WebView2\MicrosoftEdgeWebView2RuntimeInstallerX64.exe"C:\Users\Admin\AppData\Local\Temp\mgxmc0vgk5u\addon\WebView2\MicrosoftEdgeWebView2RuntimeInstallerX64.exe" /silent /install4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:988 -
C:\Program Files (x86)\Microsoft\Temp\EUEE1F.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUEE1F.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"5⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2064 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3484
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3744 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3824
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3132
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.77\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:780
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTUuNzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNTUuNzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDc3NUE1MTgtNDNBRi00OUI1LUJENDctNkRFMDAxODlBRjJBfSIgdXNlcmlkPSJ7ODcxMDk3MzAtOTBFQy00MDNGLTkxN0YtNjUyREM5NEM0ODM2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins1MTNDQzQxQi05MzhBLTQwRTQtQTc0Mi05RTE1MTkyRDExQzl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDMuNTciIG5leHR2ZXJzaW9uPSIxLjMuMTU1Ljc3IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjYzOCIvPjwvYXBwPjwvcmVxdWVzdD46⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
PID:2976
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers" /installsource offline /sessionid "{4775A518-43AF-49B5-BD47-6DE00189AF2A}" /silent /offlinedir "{89E5CA30-257D-4A06-8E8B-4CB78C7B9C34}"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:428
-
-
-
-
C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe"C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2596 -
C:\Program Files\VEGAS\VEGAS Pro 22.0\ErrorReportLauncher.exe"C:\Program Files\VEGAS\VEGAS Pro 22.0\ErrorReportLauncher.exe"5⤵
- Executes dropped EXE
PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.magix.com/user/register/product_registration/login_screen.php3?VARPROGRAM=VEGAS_Pro_22_trial&VARCHARGE=22.0.93.0&VARREGISTER=register&VARLAND=US&phash=yq6gAjDYooPbkP5i&email=&trialkey=TRIAL-96130-01997-31457-96492-969465⤵PID:3992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b9b23cb8,0x7ff8b9b23cc8,0x7ff8b9b23cd86⤵PID:5088
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6196 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:12⤵PID:784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:1376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:12⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1900,18403372821734536992,11613343897045654431,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5668 /prefetch:82⤵PID:2156
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:960
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0CF689581A7592AEBBEE9808CF7384BA2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:412
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4AC0CD87EC84671263FCED63DDCF39DC E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4224 -
C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe"C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe" /register /user 10853⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4404 -
C:\Program Files\VEGAS\VEGAS Pro 22.0\ErrorReportLauncher.exe"C:\Program Files\VEGAS\VEGAS Pro 22.0\ErrorReportLauncher.exe"4⤵
- Executes dropped EXE
PID:3156
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\mchammer_x64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:1584 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\mchammer_x64.dll"4⤵
- Modifies data under HKEY_USERS
PID:236
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sffrgpnv_x64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:4720 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sffrgpnv_x64.dll"4⤵
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2240
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack1_x64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack1_x64.dll"4⤵
- Modifies registry class
PID:3744
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack2_x64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:436 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack2_x64.dll"4⤵
- Modifies registry class
PID:4964
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack3_x64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:224 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack3_x64.dll"4⤵
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1924
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sftrkfx1_x64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:3400 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sftrkfx1_x64.dll"4⤵
- Modifies data under HKEY_USERS
- Modifies registry class
PID:3276
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfresfilter_x64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfresfilter_x64.dll"4⤵PID:612
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx1_x64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:1508 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx1_x64.dll"4⤵
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2064
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx2_x64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx2_x64.dll"4⤵
- Modifies registry class
PID:3152
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx3_x64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:4920 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx3_x64.dll"4⤵
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1704
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\xpvinyl_x64.dll"3⤵
- System Location Discovery: System Language Discovery
PID:1940 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\xpvinyl_x64.dll"4⤵
- Modifies registry class
PID:5104
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files\VEGAS\VEGAS Pro 22.0\sfvstwrap.dll"3⤵
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\VEGAS\VEGAS Pro 22.0\sfvstwrap.dll"4⤵
- Modifies data under HKEY_USERS
PID:2568
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:668
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:3960
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3408 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTUuNzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNTUuNzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDc3NUE1MTgtNDNBRi00OUI1LUJENDctNkRFMDAxODlBRjJBfSIgdXNlcmlkPSJ7ODcxMDk3MzAtOTBFQy00MDNGLTkxN0YtNjUyREM5NEM0ODM2fSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7QjdFMEEwMEEtOUZCMS00OEI0LThBRDctRTAxOEM4REMyQzdCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxMiIgaW5zdGFsbGRhdGU9Ii00IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjI2MTE5MDIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1136
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C79E3BB-0E8D-4C72-8A74-BB905A31CDAE}\MicrosoftEdgeWebview_X64_98.0.1108.43.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C79E3BB-0E8D-4C72-8A74-BB905A31CDAE}\MicrosoftEdgeWebview_X64_98.0.1108.43.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:4048 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C79E3BB-0E8D-4C72-8A74-BB905A31CDAE}\EDGEMITMP_8CBA9.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C79E3BB-0E8D-4C72-8A74-BB905A31CDAE}\EDGEMITMP_8CBA9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6C79E3BB-0E8D-4C72-8A74-BB905A31CDAE}\EDGEMITMP_8CBA9.tmp\MSEDGE.PACKED.7Z" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2980
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTUuNzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNTUuNzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDc3NUE1MTgtNDNBRi00OUI1LUJENDctNkRFMDAxODlBRjJBfSIgdXNlcmlkPSJ7ODcxMDk3MzAtOTBFQy00MDNGLTkxN0YtNjUyREM5NEM0ODM2fSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7NkNEOEREMjUtODY4RC00NjIxLTkyRTAtREZGNjdBRkU2NTA5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249Ijk4LjAuMTEwOC40MyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjYwOCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlZD0iMTE3Mjc4MTEyIiB0b3RhbD0iMTE3Mjc4MTEyIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMSIgaW5zdGFsbF90aW1lX21zPSI5Mzc4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3944
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵PID:2876
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:1660 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a1c5cc40,0x7ff8a1c5cc4c,0x7ff8a1c5cc582⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1752,i,10330340164466177002,5206962426974136862,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1748 /prefetch:22⤵PID:1308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1436,i,10330340164466177002,5206962426974136862,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2116 /prefetch:32⤵PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,10330340164466177002,5206962426974136862,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2168 /prefetch:82⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,10330340164466177002,5206962426974136862,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3116 /prefetch:12⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3348,i,10330340164466177002,5206962426974136862,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4440,i,10330340164466177002,5206962426974136862,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4384 /prefetch:12⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=212,i,10330340164466177002,5206962426974136862,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4840 /prefetch:82⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4848,i,10330340164466177002,5206962426974136862,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4832 /prefetch:82⤵PID:2124
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3884
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD58be4379ab812118043e16071c53d657c
SHA15edb9c62ff180d36837002d4a6211cfa98a92087
SHA256c74d7cf186671e58b5690710938fd7bce1a3b7684fe552968b156b1c5e3d6318
SHA512fb1d8f6da3cbca1b637ff799f730d823962dfc0b5d1bc7cf4aa107cd9b62c2ec91a301053392c5b9d5833b3369ef048fd2e5ccfbea49bb2ed68cf91b57af0dd5
-
Filesize
13KB
MD5ed97b12ea5aa2bade28cce60ae27ef22
SHA1233dac3cdc3cd6731a9519ba61fb5797f9da6f80
SHA2562f1bd45738a2796992c8b9b307ef587d98ca617e18c1723061b1b80444469bab
SHA51270a488d8e26daa68256284607044a8428d3aded756ceeb3ca187b4fcf7759eedcd528d404ff333f753b9da89c5d2d648a45e997225889b18ddb793d1c8db7274
-
Filesize
444KB
MD5a883c95684eff25e71c3b644912c73a5
SHA13f541023690680d002a22f64153ea4e000e5561b
SHA256d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
SHA5125a47c138d50690828303b1a01b28e6ef67cfe48215d16ed8a70f2bc8dbb4a73a42c37d02ccae416dc5bd12b7ed14ff692369bc294259b46dbf02dc1073f0cb52
-
Filesize
948KB
MD52fb20c782c237f8b23df112326048479
SHA1b2d5a8b5c0fd735038267914b5080aab57b78243
SHA256e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
SHA5124c1a67da2a56bc910436f9e339203d939f0bf854b589e26d3f4086277f2bec3dfce8b1f60193418c2544ef0c55713c90f6997df2bfb43f1429f3d00ba46b39b0
-
Filesize
331KB
MD569004e08c1eb19fcf709908103c002fd
SHA1d59459f9a18b2e9a06e5af2b88f4fecb0ce690d5
SHA256c1b61dd24dc2dd5efd5cd548c0cd74fac112358e9e580df4d780d2c125474dad
SHA5123fc67a5fccb252a67285e19d62057fb4e3c63e702f4be91e552f93d9827cc746b8fb43b4a3b24b7fd5c48832d18a1dae26c1bd237f40b7b88618d402fdac1a76
-
Filesize
242KB
MD5c7739dd4212d084d299df68f0a0debc3
SHA1cba81d847d91bfea5c03279c0ca03fb1aacd4ae9
SHA2561d67a8464991a03fc190d87b43591764f231d7a7a71a72ffc51d982b26691153
SHA5125b8e98e6764460f9afbfa6dd34c12ad59284003eea99997c9e1db9b4a85ba30ac8b6a699b2888388dc424c547918137d42984bf040ac3d292e612bc433368fb3
-
Filesize
117KB
MD590419039c035404fb1dc38c3fb406f65
SHA167884b612d143aa08a307110cee7069bddb989a0
SHA25662287589fc0b577398005f7ac07256d9fe671cdd3e5369faf74b9f64cb572317
SHA512e632c78c941861e61fbec68e333e6549cd4bec683593db92c2522e162176bd64160dba37d4226c1599cfe1d77b36d5d4c452dd2f453c291a15310dfb607f3414
-
Filesize
3B
MD521438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
Filesize
26KB
MD533370d240e212eeb64c5692af369e8e7
SHA111890bd5a23331e4bdee3bccfcf2b559f3bd5763
SHA256f74f0260210440167d5b8204b629358024d319e6405a170cde3c75455e2b240d
SHA512a422d5ae6e4e4747f3b4610956d79c6144e2fbf37d5f11f9062041779e8055e718399a74afefec65c29b4233e402051c7b121b134dbc5e59aa91aa30a7c6df11
-
Filesize
22KB
MD5ff7eb3b4603fa497b490e83186c06a24
SHA1e03355462cb65d3169e19faa598ed3a82390c12c
SHA256aac37e05c251102f65fdd2a679b9e39f164f4448d388cc2a04203f5e3a2c257b
SHA51290834c67c6f29f4cf699ce890e0c541aae7a10906a656f188c7d61282d3b6f36958b355121f4d48bb4dbf3bbf6105aefde0e89204492e54641c2bb9c00cb7e4b
-
Filesize
45KB
MD52f7c88c43a8966882ca89ce4981e3cde
SHA1588bdeae6eab1f447771bd6963b5b3329196e686
SHA2565e7331a6adeb9d4252531ade800d47b8ddf020b97cfedc58de85386b3ae64e76
SHA5123f2eca126fc821e36aaf4430a0f41af1a060396f52cfb2efd1c3be2ab9d69cfac870121c646776c8b15e8561938ac30367bc5687bb9a79f0c19156c3b56249a7
-
Filesize
45KB
MD570bbafa7c8b0aeba0e25e27c440a6038
SHA144a5e06229ae4f6ce6d3b2b57cb3b6050667def2
SHA2569eec79bd4af04bba1e11fc24c64d94f30c22985c8ebbce3e0b411a61a1edbabe
SHA5122e9b8696c1b4ab8e721fa07b6c81fe30613f0d188250991c573af95263688b7db6e25ebc4c030825724248c9713d9c5b772f199369785ac615ad2d2fdf527f8a
-
Filesize
73KB
MD509936f1f2ad5ae9d0663b6e8709527c7
SHA1f0e5945663e65405d94c394db83880f713295104
SHA256550f6c9f16fe85a8338b04f1bec43de3babeac60ff257197625f2802907007b8
SHA5123e95e1e3f2043e1f0a4baf1267e82f912bcd5830ae6c5abc750a38a0666b1a6b9e1169dadb58bc2eafae00a2e11bcf574ea805f3a1f07f77d5450d1265e8e7f6
-
Filesize
63KB
MD59becefa155c8c9f5ef5bf9d537c0a258
SHA14f33f6d08685d50ce799df6369cb5efc51673e12
SHA256d1dbc7677010f9af7b680ea2efa28c964154997bddbf6c8d9d65ea225a5ec613
SHA5125e9972cfe26c0fc6a0ea38643c644b5ac33e4ddfc1cff5b25017c81f3121ec7732565554f43c1916e9f8e2b1d84226aacd2cc4d6805425c2f1f1e7683e506ff4
-
Filesize
72KB
MD530281f2891b6deae8c0deb122b5906c7
SHA143ed0c7bf45839ba07501c1013ba74c97b4d0beb
SHA25687e5c496e038c337ca1acee52c145d8f4bdb3e74261b13e1feb740c4e2124e0a
SHA512cb0e3f3cf89af55e4b849b3f4f883d8348fc8f806690db4fff238ee54bc5f80a34e53c7e8a22dd9d1dc57c1a60c69d3e25ad9cc52ac66628613cdf358e7aa537
-
Filesize
73KB
MD5b41aa9a167ac3d6c11b5c2e1e183c11b
SHA1ac8efa5f7b8211e4dc0d0d0e6bc7717f88d2c0ac
SHA256b098ed9a5f44052b9ab5ceee82ab4cea5c6d9a14a61816882ef996a0599838b2
SHA512de667f1fe0bcb0ddf8f59054a2d5c516ec47ab59f7e78e29ec8a2cc756c72aae65bb73ea03701c67c978166649d69278fb0269e9588d968f630165bcfa6f40f8
-
Filesize
71KB
MD52bcf9a28e5fe7a3fefd16a9c03d35dbb
SHA17c1446d8ca4d2c6890d62c02308daccb8be5475f
SHA256271abe43d14cbd8c80b85ec804787272522bc06c45b7f93244b718ab0c08a289
SHA512445ef027eeecda4361834334706079053ce9a735cbeeadaec37f28c4f9a485b07ba156178c2cdb1f012d1760d0495d041deceb6372921eb94d18241eb304eafa
-
Filesize
52KB
MD534b5ae129703de4a4bb5f52f4306fdf6
SHA1601ba6cc73cbbe6d7014519a885fde2c9e9c2fba
SHA25643cd9fdf714b7dfca4b2a8f54bc25ceeddc7a6212ba59233d89a03c650053407
SHA512016dae93356e42a19f4fb4d34efa04e93f802e5de3157c29ce940d9637d697d2b7a4f61b705b5b5df271b97d942cb81265d0fe7c9561c0ef3c46c249b8b7fb9c
-
Filesize
52KB
MD5f89147c034de186e3ab79326523888b8
SHA1d3e6c00363a429eae066953f7c187e33c687ec6b
SHA25632dfe0f26b5024ec900a31f0dde736ca62769dc5de48238b485f4322cd367e7d
SHA512d7842681f67b46f67233ad0f7c57c7155f152dc25ef546a08fb91914ee54984b87f9ccbd8da3e40d012b251fffade838f2d779681afa84c383ea7982f0ad1cfe
-
Filesize
69KB
MD5d7f2e87512d19d01328840187fc7cb04
SHA17a312b677b76d7303e01da6064f1a5e0fb26c604
SHA2561154c537bd700ebbda599a5c2923e73d098c3eaa930fd0f4d415583ff90eea67
SHA5128a00cae2dc0d59e530cd43bf84f33301f53ccdd96477787805b487ffdf6869223621414cf180a1aafb6b8910ba19684c02c60226a651d051eacc4cac1fbd8c2b
-
Filesize
4.2MB
MD5293002e4332f01c74c2a843b5c638a90
SHA12e412f945ac4353b4908c87e31b847415b3ec19b
SHA2566130ad7d21a492cd3f3924bed43d954f80b6b6920374934b9eed057f27130e15
SHA51249eaf5633debad535ffc6584c8383e21c99f7a3a81a0b3496943af0e79853399649706ceda9da9990c259d605ab163c22c08f641b91e80c8a14d519837a595ce
-
Filesize
4.2MB
MD5e1629a36f15824346bb54a9ebe9b622f
SHA1ee5d55315ffb351e24b7c918c82e6ce4ec17a645
SHA25668df186e26151313a0df2adb0ef5f3a45ebba3cb02229bd8723a29dee60e278d
SHA5120301ed7ad473015478f32afd3e41dafd045eab26ad42080bad6030324564a7ed09a7516b8d362b5cb2201d087eb25f2bb7ac5fc809a387f49f893ac3df8814bb
-
Filesize
81KB
MD536ca9bc41425660ad80f23933e6e9f1f
SHA13206186f932cd5948062a837b5fc2094ddb1c8b7
SHA2568c82f149507c3415250e52bf4c7fe937946a60d51f07492a1e36ab3e14482187
SHA512a58eee2824bad90ea0790bdf55c5b58a6eec5f3e87bebf5a941a6dbcb8106c6d96b7eee0a022c4a16f35d80e38501fed54d88127f30de0e9fdd22e4df8fa2ea5
-
Filesize
81KB
MD59b73043d5646be7b544e3ac3d49b7744
SHA1a3eecb1a85c244d5428a012041eee947462e7a09
SHA256d6d2ba4ac1606e825216a25ab401d26d77c4300299e957cfadab3b0b945d065a
SHA5128f339c23f8d1e8eed1bd055a31c027e5da03d916769468394ba1befe7b4f2586e67e8dcf29326ff40abb0d879a45f886398d5d733c988c507860d1ece16ed83a
-
Filesize
18KB
MD583283f5c4dfd31661a377d9e51726b5d
SHA19db2fae09e1f5a94712d5b5a58719b029df31b89
SHA2569277065e160122714f01553f1a1c5675ccc074059b6844130fd490f5adb8c25b
SHA512b2fc3bc2085f3b4a1cbe95aa7aa779952dbee3b30743fe96eb02b89c79cee7f8408b5967f0574f678dd0f8ec4ca7c2a9d20398f258958a86a1995d65762a0bb6
-
Filesize
14KB
MD509c5c04bfa9272390043a7f4303b5d3d
SHA11858844c84ab3b920e3487044e4e8aead7380dda
SHA256bf68fea49ecf6ec7f2a12d9109803966e9a03a09fa1655782b4f4a61dad06ece
SHA51242160576d23b38e234d08d5ae22ccdff494795f136d7ec42254c2d453ad4174784d58820c00b55c84c0f6f2d11948fd5f9b767272e5dbb2972bfa2ab371fe77b
-
Filesize
644KB
MD5edef53778eaafe476ee523be5c2ab67f
SHA158c416508913045f99cdf559f31e71f88626f6de
SHA25692faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
SHA5127fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8
-
Filesize
940KB
MD5aeb29ccc27e16c4fd223a00189b44524
SHA145a6671c64f353c79c0060bdafea0ceb5ad889be
SHA256d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
SHA5122ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006
-
Filesize
470KB
MD5f0ec8a3ddf8e0534983a05a52bce8924
SHA15f6d0265273f00ffe8e30cf507f0d05d330ff296
SHA25688a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b
SHA512d7b084d7f20de29ff16341df2756861bb7ac22eab0711869b3e77a84d841fb76a898d7459ca1be62eed522caa1f022c891a7d30c94bf0fff1bb4d016be8aa9bb
-
Filesize
348KB
MD5ea1e99dec990691d41f938085f68bcc7
SHA15fdcbcd777e10e765d593994dc66f930c1377b0e
SHA2561b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc
SHA512e90a40bd8e20bbca3c6188a78ad75578e51d88aa638e0bbfed4f6f6efdd0917e92b08ef4b0ccc2dee08774f08658b189e25234270e8ce1ca60a7e0ec8e3fbcf8
-
Filesize
134KB
MD5d7dbc7c92177837431ae2fd7fb569e2c
SHA1c26140204a6db421842ad36599326a5369fd1b5d
SHA25622d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70
SHA5124f2b197ea912b5ea1a82ac84e1c15ca8e3787460cd79a32733ea920dcf3b1db5cf0507ad7c94f4e4ccab9dfc6773a9d05a8eeaa7bd7c61b63d780b69ed7ae0d8
-
Filesize
27KB
MD5956d501ece46086fb64daaaa8de1fad1
SHA1ea0bf8861575e0a50f3b514a3afead123783a742
SHA25692127820a824002919511a1ccf921a6ac22ca21fc8b5e3ce892f63030b74507a
SHA512f7345e551b112d856373ad8caa5213705cc0e4ffca54032fb22ce1857b554587a86df8949d63b2dda37aec9261b4db5847d81de2ab3b06b0f493b0bdef785915
-
Filesize
22KB
MD52e8a1f3de8a6514779baeac87b12d7d8
SHA1493cc8485fd03cf776ef2e5f619fb511f751ce52
SHA25639c5098d230f41221b14c679d9256648701708f8062280576f718ad69068f76f
SHA512078f6228f8849ca60fdda14f11723470763a4f1e02659503bcf8c5fd8803ee7632bc108fdf3e91cbde8876d92ef3933a6e9110a8a438b1bffb6d787fc6d81373
-
Filesize
45KB
MD5f96a9a88487a27de7b3e15c733cf1fe1
SHA10a4157f064349b0370b8ee3f244f44debd04b4c0
SHA256cb531679be2881677a93d11067c71274ec30b30aadf1cdcf1543dddd6b1d7b61
SHA512df5390b235157e65efa3a9385a7ffd6d5f4f2471306625f01370ed463c65b81c4274370f93b5b0d04d44175c57322d2f2fb1cdd2bcbc123997f4ae4ae9557f0b
-
Filesize
45KB
MD56a5e17d5a4b24e5c2b947a343a182949
SHA1ddf5ed505953e073f09b17e8e2bdecf2766c6a4b
SHA2560301c5dc6e762788891356987e9c8cd0d40b262df06e8384bf5796b1f20f083e
SHA5128a383192f9f6e6c4fab24645cf7c30fa927881451f0e65175b724717151cca6fcc49ed3394cc689407f19a7b1afd6b462688bccb898912762b804eeeb7cd8d97
-
Filesize
73KB
MD5bfc853c578252e29698ff6b770794e6a
SHA11091dced7b18bdd7eda2be4d095ac43cfd342b7d
SHA25680e0f29ff6b7ada892f23927f17021783575ad80f9f6c8a268a6c2a7ce35e5d6
SHA512306445384614b48d3182a91c8adf8d8206c36efd88abf23753800566f9650518af382164ca1a17ed000888e6a99c175478ad621d0a0d46c9bc7d5359113e05fb
-
Filesize
63KB
MD519b7b852ac2dec695e6a52801e59c421
SHA1cd72265e1a6a64c761984980895d92cb93bc61b7
SHA256e463f38fa6b6157398ad224a462538bd8e36b75031fa711e567c5505a9092df6
SHA512d0fd9f75820d3dbdc4001ed6262a940f062655ebb5f31f3d45d984e38b1bae2e5a958665b79b5b4aeb899e39348ba987c82148bfd85477e69249d3a59a076017
-
Filesize
72KB
MD59ef2dc352d20b615a556be53b449b17c
SHA1933b2a39f3d730c6b5d437558d0db68c5d2c22b7
SHA256db4fc3652d24224d5375d1a5696144ac8881332cc20f5992ed1488236e64c120
SHA5128031a4d0e44beb290c48292a0987108ed6d6f56950dfb17ee4671e692407fcbb8dc652d82907d8f98db2f841689f9480aee6fbce60cf2bfa1d0d6294c3f6da91
-
Filesize
73KB
MD506473191b67c8b3d1a26b76474c5daeb
SHA194c72bb597c365cb77f621e6e2cf3920954df2d7
SHA256e7cb6c2818ca27c864bda635d5b5d9f7bdb308f4b5d4bbc206ee1e135b7dbbf7
SHA512237c144cd3cd78c4a4eeb5c6a22043a8e604bdbd7182b89bacb81135b1e3de08780061dfa3664508cfbdc01e918fa2610e317f9441b10c4df8def1ca444de4eb
-
Filesize
71KB
MD5713e30e13c1998e035cf4ace66b03230
SHA12d244e01c2bd9f3f17dfa0b74c19ce6bc512e1b5
SHA2569cfc5985440df4e70b57869b32c8ee69eb6fc570a98cc94a53141a0dc7535e10
SHA5128a2581aaa125eb45543e679e58be7040d151cfcfe0625f6e62dccc3fcf87872d3504b30082036d5219dc4c8493600838d31b2ddfde3ba0bc1b2b6ef97078e29a
-
Filesize
52KB
MD5689b5f0061a67ac95f59a64744702186
SHA152227dd2c8a66c0528bff28475846faf7036340f
SHA25683fb72fd2142d54bff6280e7c4d4ff22d43c3a81fa4ff8881003abbe5e21ec3b
SHA51230b4e01d20c6c3ac1b799dd4d23fda3ca988eadb59356f84aff0a0760572b5c4119ef21467494e47a7d74dd6b136633a6ae40f45ec051d5cacbe44b5d6255d42
-
Filesize
52KB
MD57d03ffc6a8fb686abd660efdc3aaf223
SHA13d04c53971a525cc3255ff1eab05ff0cbad75bb7
SHA256b2c7fc2c95b13bac36316d298c94d842dd2574f78e9c22e4d4e4af1c3fcc0fd9
SHA512b5d41294630e342f2242a91c9dcf9085cddbd2389860e14c741147cb695425971cf79339b523d28fd3189589e5f948115359b89f59a03186e3c6a103f854f4e1
-
Filesize
69KB
MD5a99ad214ccd1e7bc1f609b972467b0ca
SHA19ee79954fdb2338026c3c81da00ab6e7e6c2e1ff
SHA2563238676035d9c1595248ef65ef5b044384b473ab9bdfe8d1077e10e4fe7bc983
SHA512da1f8a4dd82559635ea53dfeac1817a9ced1d247a170a8153a54c05c371fc80aa2fa958bc5c515c026815c505f70fb374178f8ccf94836b66c4a7e23dab1c083
-
Filesize
5.4MB
MD5ee4af4ceb4b7fded7cdda37faef69704
SHA15ab8f2ace2f4a1892ea4a2a26df5ee7e9cd497b2
SHA25675497de4aec4b5f0f258164672db2eb55eef5138c028317860e05f11030f7b7c
SHA5124f807157e6bd57ac37bd1d8a52ffdc38e330e517101a1ea603096d8728b04c9c2ae96e510b961c87536e957587ce169fdece6bc3ed5e5025aa87c0f276da0ece
-
Filesize
5.3MB
MD5a6d08e8e290c80822842015cd877d405
SHA12ee9d28e20a73facff20be87092e482b562dad41
SHA256950ff7746d747de51cc09c1aaaf88fbc2fc97c59865f574cc3fb10243ae7b906
SHA512b6dfc3d0ef4f57c116d44b201fae187c9427d4fe7cad969f50f9408af40071d811e88698134491f479923b259a47d0b528e7ea23790248314e902ee24d0b93a2
-
Filesize
89KB
MD543aae7bfb0c911e7e98003e2b45667e6
SHA10c6c7d96cd0eca734e425b1ddef178c3ab6c31ce
SHA256a78e7988c9f99bcbe02d29441b0dcbdebafa616d2a4652aad867b81f554a0476
SHA51233d1293a7905ee9ec58b9a7744981006d6dadafb75ef64769723de02ba273f344a20e20d206d64d2453746549fe471328a035e2b5cc8e485e7cfd2c2fbc7c6a9
-
Filesize
89KB
MD50d5451a0050f7acc970ca02459c63d9a
SHA12de9febca0b1d48014081907e835237c832c65b0
SHA256864958960b8dd2890d47f2774ba836954f2c4f5ad6e4d529b13138caefcce73e
SHA5124d0b3d3d494c1774ae4575eb945f3c0742b723d6583d98dd36cc51a1d099b8f1a090d4b18c54897d1d58a67381b800604724cb609447860105bc2e0e8d5094a8
-
Filesize
16KB
MD5c1b33e368e538c4408caa388301230d0
SHA13bd2761bedc7d3dacd81c0c09bfa080e2396116c
SHA256ac6ce635a516d7fb502024395fdbcf6a7e327efcda8c9be67b2004e45eeef3ce
SHA51268ae8a81d3b8778253a92b69e8c2fbe8c75a0e506de345b01c1b3517473bf573626f4697c2616d71d82ddc76b4efb3c0e5acd7a8fc297d5f35843db32d84106c
-
Filesize
18KB
MD52572914968db35bc4aea58ba6ee01330
SHA1fcacf6ce173795b16d365c870198739626d7393a
SHA2562ad9d540e7d8228eeadcbb3034f789689cf5741ce13708cf33cae6d2c5ffc752
SHA512116e3cb31d6619c1b36e856cb7d46996f0829483234d561bb2b86e50124295a12304c73d7ce554a4ba456fc8fb4116918b8f5edf5e0343c628c3e93bacbe8ca3
-
Filesize
20KB
MD552eee6809819ba098a16826d2a9c637e
SHA186964008d7cb34407c246a7e12c2d768d2b1ead7
SHA25686b6e5f0596d6ae2f12aea0ebd1bf1d752bfde21ca3f351b9bc24cf4674789b9
SHA512a1d7150b5c8f4acc2b06f7ad1d6132d04954271fc69ac77b00759bf98c487f2b7ecf3e5ed7f96ca4959895f99a9112ca7dc200a96e03259d576f4d44fb05d6e1
-
Filesize
19KB
MD5358bb5370c11758532008bdbcdb301bb
SHA11f62f43c0bafd1ecdef1f348445104f549d793a6
SHA2560fed9544f08d093c864c0bb829a1179eb02d276f9424fa27d20ed35cf46fe665
SHA512d5811006b78a37261d105038c763ccc86131de323aaeeca61c88f630e2946c825b81f8f9493971e28b756144bff1dfecf9e427d97ba743f471d0fe3ea4cb4074
-
Filesize
19KB
MD5bed99a53e49519a350f8a8379fd4371e
SHA126e98efe8f40df2c903d5acb35f49d81ad37f8b5
SHA256026cb372fe9889fbae83b12e85ea57d4368306cce0a9da1bf512f13d1ca68bef
SHA512d1bcee52fce9a552d092c14c168e8cc4a44137a7518636ea5fd137f498fd4060a0994e8f10a6b69cc71f23fc59ede9d981cfa4990fe77928469ae1288793037b
-
Filesize
19KB
MD5472e81f6675d2caa6e6fe770b676951e
SHA10af655a920c133ceace4af6edcab0a580b233429
SHA2565c9e57dfd67c36f5c6f14dcf26efd563b280fb6a2c53573e334f97943cdcc545
SHA5125dedd931ef548a731e1bcc61a8be2d8a35e7d459a494fe117d786a0a54b34e96dc2032d5b612682e51166a914e903a4079a9ef0a184bd3b8ac199131e2a5248c
-
Filesize
21KB
MD5e934601d1c04b27275951f3f05535036
SHA1be8fa2c10a871304e5b2a4626d950d3f55793c18
SHA256e09d79c6b126b4013473a1dc44b05cab135422411795be3bcb81384d7d694aef
SHA512ccbb6c9526b921ef1aadddd38b81cfe008ad91a498916688f247eb8b8c4d31351a4e44b288401314c341791c71863e56c417f426d8d272ae357213e4540c4629
-
Filesize
21KB
MD56545662d769d8e5e49ec41715535f0af
SHA178dea1b472a05744129f242b1a2e399b68d9731c
SHA2565698c306e3de2d2cb7e0e18de3254f3b55689ab363b2ffcd8b15c870ac6ba762
SHA512c8914f78e872d56a042e7ea174fc193a375bd59d11c537257c3e527e6e09476913744a0510e95d7ad626e35b0b765b772a1b7f6fd686b0a58d77ce26f0d15c56
-
Filesize
15.5MB
MD5fe8a50c92156d2269d34726aec296055
SHA1c969efc528ccd05a05bfce10327770bf581956ad
SHA2562fad1fa5399fd0c9ce4afaeb33a1ca34cef888c6bc7da261d4e33b992c44d6c8
SHA512c018e4557b1562705308097f84eee926b9648700f1cf89c93a1a25d9ab9a7a2a66a162d373712d05709858a923bd3658b9857fb3a6c3be7ee4b74fadf47de2bb
-
C:\Program Files (x86)\Common Files\VEGAS Services\Uninstall\{1856086B-7BD2-45FA-A9D8-8AB68ED66B7F}\VEGAS_Pro_22_SetupInfo.ini
Filesize2KB
MD5036e19e1359c1c39bf08fd823da09ff1
SHA1f5b4f8f03db544babf56feca5354385b62bb8940
SHA25619dcf0b710d45bea0b34f2fd98958a2a7288fc7210e59f93a664134a3948a65e
SHA5122aa67782741469f0e06f7c5d6effa88a67f424ed721361c12c42944a85243c517fb2303b313a5cf93c89f311273827e1e39ed448e342362f1071855cf3a15acc
-
Filesize
3.0MB
MD5c0af69fc8e601eb1d3123889fc3bc613
SHA157a863ac53499034e287c0697a8a35b828e724b2
SHA25693da62653499196cb002fc418d93944cd2ee9468532a43775337b502b7d78c80
SHA5122b68d697980260eceff105ab41f6a10d35df2c3f7ded7e0dd9bd3aabe9237715dd3688b3495a2f1c3b629b7d2fb8692e0002ba558df952282169d74f683e1d54
-
Filesize
209KB
MD50032498af2ebc50357cb31f1024c87fb
SHA19818522c47ec379ff7bddf92ea72cd831691d094
SHA256c6bdf041b02561700c71c6275df4704a52d1fed4ba6a1bec98a602c6c325d6e7
SHA512f83fc43ca54e87a67d949666ca8c30721f372312042be978b01dcdccd530ce5db4d3d9d6ddc934a92c079825b91fd988f362cd481dd87fa09ddf2cfac85c05c3
-
C:\Program Files\VEGAS\VEGAS Pro 22.0\OFX Video Plug-Ins\TitlesAndText.ofx.bundle\Contents\Presets\PresetPackage.ko-KR.xml
Filesize120KB
MD536d4f22284a603586e7d0f77d62a518e
SHA16d3007d8f80c4fa93c6f0b3e059d61cbdb74ceb6
SHA2561f804e0e9a2a96673980ed460f08ddd9cbc2391360efda59302fdc1bd5f979fa
SHA512c83b91b24d651da0b7439b60e6c531c9b774fff823632ee91e58dc3734107ae2a340de44160c2c9543be58a72d91f81c6790367eab911414fcac62f13bcde08d
-
Filesize
2KB
MD5fa703609338cc05f182d4d0d7d07fb1c
SHA1cc34fc7d8282a2fc2bc4610ac671dce0b82661f7
SHA2565a31feaa4bdbc96da11a4f68a7fcb36bb791dc073b41e109f7d085dd008790bc
SHA51205e30eed8c0d921e721d3382dc26bbbef047ce77564c5926c122477500f28ae11e63522e93dd119436717878fa065d4d83e02f33d2c4e71c2c9eb1ca73412e08
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
1KB
MD54c1e0555a650f8ca212ea1ea48cda5af
SHA18f5bfe9356452b3d703bb9a6f299b3c0406ca7dc
SHA25646d81216fdac1d3cdd434535d0130765c8d16d2aa18e6242e093418d0ad3a2ac
SHA512887c73dfa2c4193cefb63c135acb3fd281e9812d8293983b25c8766e6d17f5f04be4e818bb2a1c91a7d7bfae6ec260d8f3c1fb225a310c36c835e7f339c5d33e
-
Filesize
1KB
MD5445c3627f5acde9569e76c45a2bce0cb
SHA1da872a71456cdcddca41590704b294c53be32974
SHA25661b432fa5e7340425024cfca4eb8fee60bf87d73b062516f32a077bb8d56ef69
SHA5128ed14c299c333ce2230381d79f0a006739b1b581c3f65d460aa360c1ff89ecbc6f4576d51efbd6d2376f2b12b49f454c21994ccf0d4d072913e48d2e4864250c
-
Filesize
1KB
MD52c1a85a9d585d05191ebb5289cc5cab0
SHA14a92ad15a7767b778b1c348517644fa8f09e5c2d
SHA256fe5c6b27713c7729bdb6c6fe5dc0a295404154efb00adc2fc9d653a6130e9e84
SHA512adcbb3d5051875ee8d13aee99ad144f3fb8b798f5cda89be7f5620fbf78ef0966f19be19df48ffb951dd99ef0058d325c34647a3c453418aa77c4d82ac5c0329
-
Filesize
1KB
MD5f76e282a18b9f14b9afe4b109392fd25
SHA14a92d587c47a20af9e4a767191d9bd9ed2ea224c
SHA25602b31f10f29a38498d0e91a8dd35a679a124c1b78772a42e9036ce6d664bfd07
SHA51243cbd364164e3a451cb3f3e0ac7d76c8a6aa3a8bb0061317d689f1df826aadad6dd1ebe987ea2403f5db2e184bfc763ef2c092e3380cbd03f14b420de0d1bf37
-
Filesize
2KB
MD5234e6cf2ce5bad202956cec682571852
SHA19003dca2f737c81c68abf4ba76d449e023b61ad9
SHA256ecb1355edf4b2fb65a90a02dd46c0b0b984748ca1f496074632edb2a9c2bac82
SHA5127c6df00c05fd0df0f10c03bf2508b10a5b2b3aeefaf3c148bcb70828f331382b9987c7362dfa109f46b7e77b85fd3e498f1426abb2d0af771d6c019d6f6d96ab
-
Filesize
4KB
MD56ead5a5ec05f279c101a5dd9a604ace8
SHA114e8f4055ad1b02612dc3454e632e4f55a68a1b8
SHA256cfcdb84b565d3134bc630661e9f1e3004acbbee4c4f36ceb7cda6acada83ff3d
SHA512505e9cae38c52bab41280b3b26ed99ca7a1434a76f98cfbf2ad309dc3a2e27eb9572167677cf6c0ab8c36bdc27240570366afd0a8291938bc4d2344833d6de71
-
Filesize
662B
MD540545df3f3db0c67f244271b074dd71e
SHA1ae3885c66d71ae8254cee4098ca2ccd4b62dce41
SHA256efc2c3fb9f9e953d16b51eacd3720f5840370921d574d231ff7c808e0a782ec6
SHA512c95d8c5f698e3a2d5f7120bccb63d8fb32039ead709dd890385d18f92d088ac3ff02b87bb02eb5d9baefd24db385229993af736be2fdc7eae636cc5129da979f
-
Filesize
1KB
MD52c03697b63be8586c952ce66c9b31f32
SHA1f514ab2b093308e03d32ae8d2a598da25d05312c
SHA256dc4aaf0d88d7e8337b849ef1bb2b96a8d6161b389490dfa693153e19853cd69e
SHA512f98439e65f5b42517e0929a6687dc8639cbfdf1502a188440b8ac20cb1e7001bee8e0448487e7c5e2e6c7021ba6b83ad0f6c496233a9084b1117cd8d6dd3acf7
-
Filesize
2KB
MD58ce93ff56598045167b63576c5ca8801
SHA1ac856f76cb3933f014d2dc2b122b005306ef0e9e
SHA2567a96650810701bdd095ac56eaf7aa0d1ed367a91b1a7acbcb3e8b490e9373692
SHA512b878fd3bd9766c11d014167c5d92ce12dcf83de6fe0e8fe8ecdf7f423006d855e117091827ec261367725b7b44d51d3260c9561955f614fe32ccbea1ac38a52b
-
Filesize
4KB
MD542a635eab090bdbea253ee3282f62c53
SHA14eb87bfd2d66c328e8ae5f4fc7105f6ca1c1c588
SHA256500bd9e80850e37835aa7e383031094e80570576c00f4f5486b1ae13bf8aecce
SHA5122476dac3135925f5bb5aa334013fe12493db5f9835c9f44678a2fb6ff865680c266de792838ad5931560268f19243750a5f164e6dec134767e89cf6921e1b229
-
Filesize
4KB
MD59442b31e1521fa735ff33086103f0e46
SHA1d202ada1ec67437aa0c3b7031a4f50d6a72b713e
SHA25656d5a35d85233d37a5bca66947d230bbc2ce4b0f16a8bbaa7894b1949cb0f407
SHA5120cf33bdfdacd994f828cfc60fec382662ba4df665452569cac2c8b9d9c8613fbd713589b8cdbbdb5dbbbd14dec34c832a29ce3cc60885f362977947dea200764
-
Filesize
1KB
MD5d95957b85ccdc440c50315d1ed6f6998
SHA1e3ab2968320f56465c0ef113c8009c3512ffc29a
SHA25630c6396433999f57113786001b336ebff7c72f3a648f87e121454283dd8db8a6
SHA5122d6056c649caba408a5ae85545ef0360b3e6ca6989bc72f4e80cad6c3aac564b115ef7915daf8ae50b10a3060efdbc5163c734981ca02f45f46e13441086f6ac
-
Filesize
3KB
MD5d1b7709190c50d6100b0e880a768b303
SHA1b31d6f2227e9aef9e1bca544a951c2309f2db19a
SHA25691d26f97fdd817b07e7e294a459155f9545c9344b5ef3085b245b9db06c7e80c
SHA512e4428de0d6e02bb3fe6307b7ae63226ff5ae43365c0c9f398374a76880346fca01c19fe02cb625bac99424e70bf346a2b9b21bc4fc8b1814ca50781a11f8e9dd
-
Filesize
4KB
MD507fdb450e75d503dab24b12e604b3d4b
SHA1677f84477923c72912645bf6c16941d8548f9025
SHA256ac2c0bcb67f0efc019a72b1583672035d74b12d58bd2c3200bf864a99c0619d2
SHA512d4baf7d25dc22ae1f842319849fe33430817b81e8083663f79833defac22c5a6c2c6d97eb89454a5330510545e14db488a7ddf93b27a52624341905a5a980a73
-
Filesize
332B
MD5582f7da0c3878327a6ff1a62dd89e587
SHA17c9f2ffa2405ad846d1ff9091c2fa3128a746b2a
SHA2568e67abfb982a63e8b69e6d49fa94f168446a828107fe93b2222c4516530ccc3e
SHA512622cf379ba7033f622010d6ca3e145071b99104fd7683d4b5bcfe6a84ca529b029c3920cec7f96186cbddd7f3fb13b6ccc7cc8896e9577f02e50a44719a2ff81
-
Filesize
994B
MD5a7bff7d47d5076476941f3ad791404dd
SHA1ed926b63e28647e58d633b502a5923e895f72d36
SHA25604f1de790799f8fabd171f1fd566e24042f38d5b4dc34048ba5a01d4f1f7cd06
SHA5129f8d187b1e9fb8ca4631e7749a948de9574a58acba0030c6bbdb7e7a516d4166009841ee55c887fb60de12be39eaa139786a01a6e11e7966451d7a1a531da76b
-
Filesize
2KB
MD5ee7ea326ca3e3700d6cdcea817194ac9
SHA11ad0ff7b2ad5ef609f4374625a66e19040ff2c64
SHA25631b1c5f392c903ec95e667603fa1ef14e343467248f80913e88a1f909553f215
SHA512e9e6fb59a39497c6f7d0ccf7389975d391c7bcd0f7e9e65eed3076c24242a05f7cad87c2a11f062d1d104a098cc61afc88ab23a9e07ef3fd928ec52e671cafde
-
Filesize
2KB
MD53ec8e9b577301a12aa89b99782bedf8f
SHA14cd648dba87087dfe1aa52f55063513a8eb56387
SHA25676b6822046b3bb6a3b2b171f6844a2424d2cad94bf88e72331c4df5af8fe3306
SHA512fed6786bf5d32e6439aa8e9102f091fc6674311db1d92c48e56d58d7c85c39024e00eeca3e32b7f542619ca3b659302a0200c0a7ef40fe5bce636e7763400ec8
-
Filesize
4KB
MD5117f34f580a12f360c0b27424ef15067
SHA1328790bb149001767ed2370334e99ce17ed8ec8a
SHA256d842b99af61c51ba5ff9fe222b3028d2e5a3874a32e200ccdeb60cbd989d450d
SHA5121b95a7f2948735e6229e325934a47e1b959751ade348d0fb0c8667476cfc69ec989f339ec56a94b9a36618e33c5f4f4a94423e1b5c88665b9180bc8de17a5eed
-
Filesize
17KB
MD519ac7718e0badb0536c03268ef37c236
SHA1c80eda1177298aab104de02091d70133fcdc0e71
SHA256785751ead089cda8e49cc53bff3fa3908634b1daad317715e3bf12cfbef30545
SHA512ed3f8b690d36da3ce035166d006df1c903f380e2c751368799b207296673d220f99d3d25958e60fafc0fc2a2ae6b2dd58261e7e1eeaf2e3b6e8170afa91a551d
-
Filesize
16KB
MD5600f2086bb51170992f2db46c62d4dbf
SHA15389b6b75dcb6c51cc4f0e8d4b17f4b734698755
SHA2564a1dfbf57a4b9c0fcc5c43ca3539383e1fd3e0f5b94dde2e1886c439e2908c62
SHA512d22764a0234ee59217d1d92d5df53c2ef8a362dc2400e8d7ebf6fdf21aae344effb03a7d5dcaea6ed7e19db6b68dcf100104243d421cb7dfb6aa032dc3090647
-
Filesize
788B
MD5ddf0e6476d705472a8620eeddce69555
SHA14b06704bd168638f960ea7976cec726543836a3d
SHA25642e8208d78809e8fd3a70101fc569b95138738a1d0c95ce66739a7bf73ad673c
SHA5127b6ced6d5c6950e73caf2999af81fff66b99a836af2bf7de72177c1a773ad7b8ddcdd4cd4d67cf6fb47b12fb602c03979c74d2c915aa818bd87deb5ecc1b40c1
-
Filesize
402B
MD575c1da3bc88e29cf2c9045c860eaa356
SHA184cee4214d28959e102b71e7e10ca9e1f6cbe017
SHA256fae7030cc5a184a083b7428740d884c9b7f9bc1b8807b28bd725766dce9b8546
SHA51236258411d566d17914cb7f87209a75d4cf7022308470f1906b3fbd40656d5b8403bb7741800f34a6122e6986ed129bec7a15e0748f02257ddbdbd74aa9b76a1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BDDC098DE62E49F0BD049228CF395F1A
Filesize727B
MD58647c107b25fbfac278df5e6b38bb56f
SHA17ff876ac4e68501457f02ff52d52a53193b51fe2
SHA2561ff66c41f815b685288c72fa01e6e0cde26dcd976d79e7c005a8005787e6e984
SHA512385c410121ee4a351c28d8964c0a69f450ca8c5f3b871cb75dfd72c4f22162359f617f65755a2805f85372d9df717a9be43f4193249bbdb3b13cb6de46896230
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD583eda71526511d045d72c2431b2465ea
SHA18e12f073b8cbc07ff2021c266a04fb7dab12f5ce
SHA25635f15adc730ad1bace8d71b88fb91d8f791570bcc6d84c625abf0a2d1c3eb982
SHA512f221fb79203fe369c88f1d9014dda3279c5251962c3bafbe722631de1b87ace711a76208fca8e002f9278312557030fed2f133a62e89764a92a2c20fca02da09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_BDDC098DE62E49F0BD049228CF395F1A
Filesize408B
MD5160e3ea674c6c9d6dcbe5e841c20fe52
SHA1cd68cff11ad371d03485fe41cf29fc2bed94f3db
SHA2561f02ea4a9786ad410896a1f27acf3ab0abbb8c37a7b7dbf2e154714a71c34c2b
SHA5124b86fbbe70a135b476e9d0bfb84b3e3a42599b4e78ea8c6eaecf78a9d08c851c36ee4a5f26d1833750f46f9a34c85ff2b3e7ba0c82a302547f27f3361ebd0bff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD5840d8f0a10a0eb45dd6a20650b2781d4
SHA12100babfa2510eadf8e558498c5916a191827559
SHA256f328665de81f8863bbc48b697f37abf78b8e2d31a68c05e7887b01bf0f292dc1
SHA512e7d6aea39269c9128c9ab13baa4571bd98f74326c710d52338548cdb341514bfb83cc667a38b74abb22bac68e89471da8d3e2ec244818936f453ed7de00cf17a
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
354B
MD509abadbf7ce01635000b7232ee655f43
SHA14c77431f35f0a2eaf281c88af9b40d57317b5d4d
SHA2564e9f1a8b3c9aa77880c52663416250a0411a3b267b2c8456dd7b9ebb6ea4579e
SHA5122d902b3ecc305bb5187bbe3bba8e8dacc8702db5cbb12a6a01d090781db8b17911ed82d0ab1cb67fc196443884f8e0937a843e842a2dcbf67266d41a6d933319
-
Filesize
8KB
MD5d3d33e2b42d4a8d22ffce1cd0cd44b02
SHA1c4344cdaceea8f65da77c819879fd53d84b2e4ac
SHA256fd0e1dac4e77e4a153150ee3289915ed094c5761f0e0c4f81b0c51e630fd00b1
SHA512acfd00c6c0792c4af28e64bc2f70cce81aaf4a06107c94f03c97e68dadfb2024fb3a11d0c99a48f4b7990bb43181163dd2d177be18191f9eb16e5435e3b4f1fa
-
Filesize
8KB
MD5e6f13b170b38490d56fc1fd7f92d93df
SHA1ed8da451072fc6e6d4292535c99a8081b13161c6
SHA2569af0df8816593d9af38c366219c34a0705ec30f7f6680200bddce60fb6551b4c
SHA5128886c33dd97ea044d6291aad2087477bc90bded219d5e786d273b593c0d253a2f0f2b255a45fa36d061c826e02c8b8e4ff9740c0cfd708cf230839d8929bd498
-
Filesize
196KB
MD51dccf5aec541803213f425f60fc35d19
SHA1d0d1007aee1c3b7f8ecb3f944e996c11007c6e73
SHA2569c545626e98540211b358c8b056675d092c234237f1873c7b8e45a6550f4f7c2
SHA512f9fe8f20a7c0b70e6976f8c36b7f04cefeccbff7ac188300afed76056e1d7c9b88413fdcd7f747f8c862e6354fb7c76d617f49d16e8dd71c9559d6ec6cea7999
-
Filesize
197KB
MD53e36f3e5cf9978e72dce349cd480bfd4
SHA1a0acada9053c69110bc814568d7dd64a7f4c0169
SHA256d0a5d4f2501d303111c3f8a80d1ddbcc2f13477a6f42aa0c6d5d9d3b2c21d5d6
SHA512415bea6b3e4aaa0558e2251ea4c112a958f4b0abe406a31847b9c3c5a89e92564082dbb5a9873e215cdf6ea7d5a457483a404d552b92e307d465e809ca35eabd
-
Filesize
152B
MD5b4ae6009e2df12ce252d03722e8f4288
SHA144de96f65d69cbae416767040f887f68f8035928
SHA2567778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d
SHA512bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1
-
Filesize
152B
MD54bf4b59c3deb1688a480f8e56aab059d
SHA1612c83e7027b3bfb0e9d2c9efad43c5318e731bb
SHA256867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82
SHA5122ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize384B
MD5bfdd895ac72b85459f5e349f23af2abe
SHA1c052b006724c5cf3442c8f28e808f933b58f69c6
SHA256204b85f079440c60767504dc1801e60a5b0ebfbf5217cb59447a900e80210533
SHA512581cbbd22b96823abd92a52f1c396e53de18ef08a8e4312f03e39be4da7cd3c72991e82094c7b00ad198ec64070a762cec32212ab191012c37cb3751fc26735b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize408B
MD505252d1b83cc4c27be19b530eb4c08f9
SHA1bc634d88bf92e7fb4e807d6fae3923abab2e11dc
SHA256fb14568ffa8a6e99df00445c924ae453ff08b80113f6e08eff3787156add71da
SHA512cc3d7d0d4ffcda21db7cc999a5943b0e97a8341add4df88af57c34d66aec37852a0c649c72a0f58484158e445ac6022a08799eec546c79d8bd6e40207cc541b8
-
Filesize
3KB
MD58f28b2215d0e4882583877d839dca4d5
SHA14d1e1acccdb8b7adfbfbd29d27e9b45ae673f96a
SHA25653cfbbc9d56219fef08c0dafd24413b85290ec68b435ee5b093e313b5ced749a
SHA512012245f221b94216d79188ad72a0272db6773fcbb66b21b435519c801eb2f30e6b46a4dd65acdfe2f0685bd038808cafda36e6321c192e47b10612c7ee0ca71e
-
Filesize
3KB
MD551cc6f40b7bd862208e2c11e233b4913
SHA15a78e8a378fa1800c48644771d1ff9babd6f012e
SHA256d0ab9afbc66c50df1e2396e8daaf91ce6df3985c2a20fb2c2ad18c41a9d95a17
SHA512154cb3bf8bd355e012435562f49febf1f44ee9a55220a32e0925a5266b633f7143c96226847602166c2d401e8e5939bd7d9266e659e588230829b076e02200ec
-
Filesize
3KB
MD595031cf4e51f435fe025c7ca34b628aa
SHA197d86f5f21e8d5d34a122d2ef96c86270f7f66b2
SHA2561435fbf0dfcc390af543af1630c77e29c2380480529b17e7f95408950932e44c
SHA512b36139b82d593137f363ca7d1f197d99be7d35070d343175c167ef8e84466e7a6bc4d94b2239e0f5bcdf5e5335513b9984ba59bb526748be6aeb78948fb146b5
-
Filesize
3KB
MD596b3de4862445677e2a0da811a6e3a01
SHA17d81842076c2e6b8060ce5f8d6a524b18d778577
SHA2566bbe068e061a27458c54c9c0dc4e6de56ccfef0d851ae402d1a4b04f1d44389e
SHA51219fe86c9cd21b5147f512aaf5c58a061db215c7d7cb2798fd6ecdee45ea76b5ae8e783a4b49fb68630a2fb7765947ff1dbf229171464f5849eb0857abb0e5f48
-
Filesize
5KB
MD5c9813f00e4e9094c746682d41d309a07
SHA199b5144adc6d7d61da3e744a0d84c598f929d0f2
SHA25665343571dbec1fe54dcc1c0c00743a2a2ff4003093b1fa2452c02ac2aa02b1d7
SHA51252f1064c1c33a113dc86fcebcc1fbf2284ba0517dd85b221418470487a1357b09c4c1b8ea907c4080e21cbfdf6e0cf60f40eff5d0786a1a3d69a064d611a71d3
-
Filesize
6KB
MD5c04661af1bf618c7f26feef14192b7ad
SHA1ee276068e72b2d9c9ea3f8ddce52f17a250c35f1
SHA256ee8ac7a294ccc74b06e15c9604b1747b8c317eaf31b590b802a6dfadf78f413f
SHA512a0bf0b27700ac44e98eee3dd8eca727063ef59ff8a9a8cdc4770d8480846225d497933a4c43bf62a58a5ec6302462d91f1bcdb83781ca30c27b1dfead4f4c765
-
Filesize
6KB
MD5e24c745a9301b194fe377645a289c253
SHA19606d41b51ddebb618f0587369f3bac63addff63
SHA25666df2f8efbd0b94112b0dd80bb64744ac150adee4df8dadbabab474ba074f502
SHA512f229d32007f79465ed2fcecd8051598cc8ba3ad1e8f19886fec79d820592b96f3723f6f9e880d2b15d3241aea1f6569edffae491d65b1cb49824a93fc9312f2d
-
Filesize
6KB
MD506d5f0b47b789a1b11ff0947c9b67c09
SHA15ceedd074967a6e3164b2aa1bfdb96ac8bc4fe27
SHA2562498c8096da16539c0209e4f48030e8a950f3270ae8ff33750e7cb33e0c30f86
SHA512aff3ca63f767317617fe3d2ee70901e93a17b2ca57dd94aa8bbf4b1a545984add839e5b179eecf41e1e12cd885228377ec0ba00b9cd883c2b16fe7466202b427
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD568d9c54e6a1e8b9b26424567ba291685
SHA19bfc824b2f0c66e30ed5b455af4734123dfcee89
SHA2561547ee51c0178aa79a55a2db504605b5af011dc56612667ebdf06b4677c99985
SHA512028fc6cdd9c9438bb12dd3387be725281fea476fbb4e08d7ef68bb566f11dad7831bd40eec160b4da5eb33beadfbc0eed4459ddce30638cfecf7fc05bfb2d8eb
-
Filesize
11KB
MD50e1606e1ef37a14b869a03b790b40345
SHA169e57a6fe270f8449eb7a1bde46b46bd25611d2e
SHA2561287d568b54df51004029537848c470a59ce113e9fbfeefc3622f65a8aff08fd
SHA5128529dcf977e086508108d7a5df99d4b91f222db2474c311195bc6f41d792b4b94045e95da07442a4b47da7083acce0d0c2f2e644a6c386433e1b6d73f2355bfa
-
Filesize
11KB
MD56c8b5908396d5831dcd56b03f3687657
SHA10f4d125557fd570805854d94b71b18c8ef6b7340
SHA2560c73c4354aa6c8eca188a1ebefa915aef48a09765385ad512361f106a725a00c
SHA51247f08bc0455cf464bef419d8376be1d5bbc220e71c10f8c751ec9a8954e2a152393a64acd062a72ad55d0f970e54852d4ee060969ae24ea3c4e80cbf1ada8fbc
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD516bd82faa03cd38c2cf37a321728d9ae
SHA14196c1d37ee4201c50ed9754d77d33688840499d
SHA2568a0adab6909eabc993c66a823f82de89c8c8d00a3997d54bf67a618a269ba057
SHA5128271400bcb9aa6f5911f1bf6217fc9f5fde6880c570f109eb09532ccdffb55597ed7ebd41a20f1ba95a44769466fbd7054c0924dc408885ddc0ca09026b6b6a4
-
C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\001#Install#vcredist2013_12_0_40664_x86_000_vcRuntimeMinimum_x86.txt
Filesize4KB
MD5cf7d70b19f6f7bf6b995d6297780e326
SHA1d9f492ad9537c5825bc3ec6e8aadead59c385bc9
SHA25679a936d2ba3564290edc282cc676630659f5def86083a611c337d5369ae55b9a
SHA5128d3d0e945249e54ee067e744997cb6f0599d6c4ddea7c0a08e33cafd6bfebc30191a69056b77fa9014a4cfd24f5f2f5e601e0509e1520330a9a41f6be4d3bccc
-
C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\001#Install#vcredist2013_12_0_40664_x86_001_vcRuntimeAdditional_x86.txt
Filesize2KB
MD533acda0f1aa77aa9a050539b9aed7392
SHA19ad69e240df2e026907406d042213fa2bc83f2ac
SHA256bb8705b282c04b4293d015165943190db2e0cfb7ee3e9539492ffdeb519fd030
SHA512a6b28ea3f9913bcf31a9e8a32aba49c4b3f1ec451730f93f00dfccdff4e557d7a5894d5e57f0a0dee35789882a3c6e73d71cd8ccc4d8be9594cff4425119234a
-
C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\002#Install#vcredist2013_12_0_40664_x64_000_vcRuntimeMinimum_x64.txt
Filesize3KB
MD53e79bc287a562ad52e59aec6e80004ff
SHA1b1dbd566d3d54b32b1e5b84238c5a69333ca6990
SHA256109ed184a472a0e8a0a5836eab6030e5c444a9270e13ac866ba374c0d77cbf40
SHA512dccb1965a87166cc536f0e3962f82eab3538cb03f01a6c2e52c1c63cc1eb60e38d820d90a112101c3ec60577c1a1e99269e811a7ce4460dd8739f1de9877e063
-
C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_22_20240815_150356\002#Install#vcredist2013_12_0_40664_x64_001_vcRuntimeAdditional_x64.txt
Filesize2KB
MD5fc9e206bc79746f97377700d86b7d3c1
SHA1bf186de221612a8e2e3fa1d49f3daa4690b78d54
SHA256d6fdd69ee5483ddce44d26c40fc8cb7d1793dd87d9ca4f41b9a13697af24129c
SHA512a91c518b0126ad49864a37a5d6b47119294d1aec31f7a902fcd96aa1d496dc20dbb111fd7033b76e41d4675772a028eef07683a8d15c70a37d42aee4b399642e
-
Filesize
6.9MB
MD549b1164f8e95ec6409ea83cdb352d8da
SHA11194e6bf4153fa88f20b2a70ac15bc359ada4ee2
SHA256a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
SHA51229b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60
-
Filesize
6.2MB
MD538a1b890ce847167d16567cf7b7a5642
SHA10f5d66bcaf120f2d3f340e448a268fe4bbf7709d
SHA25653b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd
SHA512907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd
-
Filesize
24.2MB
MD5077f0abdc2a3881d5c6c774af821f787
SHA1c483f66c48ba83e99c764d957729789317b09c6b
SHA256917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888
SHA51270a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939
-
Filesize
13.2MB
MD5ae427c1329c3b211a6d09f8d9506eb74
SHA1c9b5b7969e499a4fd9e580ef4187322778e1936a
SHA2565365a927487945ecb040e143ea770adbb296074ece4021b1d14213bde538c490
SHA512ec70786704ead0494fab8f7a9f46554feaca45c79b831c5963ecc20243fa0f31053b6e0ceb450f86c16e67e739c4be53ad202c2397c8541365b7252904169b41
-
Filesize
2KB
MD5cbfb5edd69ac95113354a39b12f9776a
SHA1423e88dd702be816d09d297fd2c939629da6ca06
SHA2569399f26819190a666592107a316f4734155678d3423e8d8f8d47b97e0b66d1a1
SHA51280d43b57cfd8d4d775190b6309541cf63ac64f9a7033049d588a25a3d6b8a5144ef09c986022023ce55e4f122c238e983a01bdfe8d4a5d7a7930317f1d9a7db5
-
Filesize
3.2MB
MD55e833844489ec49782558a37ef73807c
SHA17095c9fc89025055d830ab8b22ad3159299f8cb5
SHA256dfd0c9bdf53d7abc83f43246b45b675f359769886922827c94b7c5f430448f9d
SHA512dc00e03aa51648b7a870b6f3fe55954e42f8cb46ee64b319e84a9d8e66f959fffad9864a9855635fc1ef0c6510e08b8837c7cb87c5f7ee283d56977d873deffa
-
Filesize
56KB
MD53d72aa6cdd7de2aad3264ae0810bf569
SHA181f7bbd6448b259bbd33c022a8e3f40eab348c84
SHA2565187d036bd90dfd9a4728133335d829d8fda0870ee81a072e09a7843051bcdc6
SHA5129226306a03301601bf2bdab4ea03518dc6b95d5b7fe22720f54e96afbe85985f9f70e9cf191777d50f65640c7d79c62dcb5c9db67690ca63484b8676184d1273
-
Filesize
56KB
MD5bf1430f5b3449ce3f8944fed4e994142
SHA11325f877c0100f5264c8c3d9da085af1dd45de5c
SHA2561c9a57dab22cffc1058ff8f62bddb21861946dec80ba8be75af0b8fab1a404fd
SHA512edccd7509c12611a94eeb92421d830b655c90bad8dff9451d5bc72d6df3dec6cd68f5baa4f07d7442dacb86cbcbcbc7ff2421f8f6eccf7d2a9b5fdec280c0b7d
-
Filesize
60KB
MD53cd4f646eb230d381e89dc572d6bedfa
SHA17732d71ec108e311917b654ca1ce964b6d6c8204
SHA256c331ab8ab8ff0ed7fb2d0900295ce3e181abdd9bd9291f19b3bec55de951ebe6
SHA51282d065e93180afa61e08b236dbf6a20353e351e65bff314fc543e69415e96eba7e6f24a728da06bbda956c98865d14363a6d0ceba4fc4816350fffcd5d4536a8
-
Filesize
4.6MB
MD5696db165214020ade1f0c0d07a527364
SHA1c75b6173f7618e691df452240da332e36d32beec
SHA2561d3238434891d3c8a15f05dd0b576b0a77049aca9933f1cea12ed8a14bee8927
SHA5128c1d1c76c14e2615d7eb090df4d2ded0254887574e62b26c483b7d807ba6ab59751f5a97c8b83761fc8eccb8923ed56ea690fc8f07ba9ac6beec46bfb96fa931
-
Filesize
5KB
MD5e1ed5908400c5e9d0d8795aec5e6725f
SHA1a0b5ae4dfac6eed4f04aa5b0218d874637c33bab
SHA2566473665a46646317c8ca29494c26cf812abd0cb67e3b38d85174390268375fcf
SHA512fbc0ec805a54f0f750c5a4211ebe3252039c782daac19e2e85e5d6ae28ef343bb90d3e976bc0e9aad7845e25d2448d01528b3d522d8925f47e85a5e7fdf43c5a
-
Filesize
2.7MB
MD53e11413c1ebbd43d00414973d86bcded
SHA130af918687bb8833a05a96f869de0addd41310ec
SHA256c6020ed0616af3b37b792cb2841e69e6a16e8b329d418f946f1640bc80246aae
SHA5123ee8896583af9265995a5b935f968e38ba5a015c09fb289f47c3c3c59bdeb683ede1018970f331c042f0b7cbc8c49eea00e48ef0bb3d303d87227e2a185319fd
-
Filesize
36B
MD58708699d2c73bed30a0a08d80f96d6d7
SHA1684cb9d317146553e8c5269c8afb1539565f4f78
SHA256a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
SHA51238ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264
-
Filesize
6KB
MD51e47ee7b71b22488068343df4ce30534
SHA1deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
SHA2568518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
SHA512c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
-
Filesize
2KB
MD5fbfcbc4dacc566a3c426f43ce10907b6
SHA163c45f9a771161740e100faf710f30eed017d723
SHA25670400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
SHA512063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
-
Filesize
5KB
MD50056f10a42638ea8b4befc614741ddd6
SHA161d488cfbea063e028a947cb1610ee372d873c9f
SHA2566b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
SHA5125764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
-
Filesize
455KB
MD53284088a2d414d65e865004fdb641936
SHA17f3e9180d9025fc14c8a7868b763b0c3e7a900b4
SHA256102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6
SHA5126786fb431addf05df256d0e1383501f96356aa78f66482db9772c58334aead59838abb7db0ea793d4a17627a357598266681c28328485489a21bc2985e751b62
-
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Filesize5.3MB
MD5f5879f5f3ffa839a280ab853338de872
SHA13b4366abb2da245416531925ebd8c76adc3e90ef
SHA2561f2f8f5d60dadbc6e4d3d36c88cc54f22af0a615b609609e748782dc26231174
SHA51296a88601cedf859c9fcd388d9e8d2fd6139f6e69ab6b05b0e044d1a598cd1a066d27a0f7a7c71bd77576dcdd083dec7a55f2cd9de52ff95aac23171c9f9670de
-
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab5046A8AB272BF37297BB7928664C9503
Filesize1010KB
MD5361903c5ff86511786d7b450301dd640
SHA1c9fc04a718a388294658590f1240d8c7e9ee4f82
SHA256e95d29cbb06bb323d9d43fc2ce61d4565b0866622a83d93df76430a0c252b433
SHA51278ceaaaa7f3e1a40ac2528e2f169416d6ebfaba54301754035f2a62f845421c8cddaed84770182e51794c9fb32720aec998d453de2bef621de7a7e2b3b35af20
-
Filesize
140KB
MD54f782799f84cd006f7f1c750afb04d8c
SHA10cd219d326fd40665d2f1b22569e2517792edfd9
SHA2568909e5c1d917064983595a4e4717f758c2a8df8f59d7b31a5b79b2f95bd8f7cc
SHA512cfddad551aa5a35b032b7006b167fd322aff46ec8a2934632c087882b24404ee48083ee38b9110add9846880b1ae0bed136bb21ae751e1d3cde9dc27eaed5915
-
Filesize
140KB
MD587b74c694f295830ffe516ba20de0b93
SHA1e6996d47bb76ad25954b793f73211524490f55a9
SHA256e88d0915814e622cd1deca849efa23a0d58d5d756be44ebbb4d460d3dac9e816
SHA512d0fd7f8c8964a99ce7a9d187640acdbff4ca3d16f02e44696706d6107b58890e763a18857bec2b94f92ca559510fea0ae5515ce3de20aa4371aebb38006c05eb
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
117KB
MD5a52e5220efb60813b31a82d101a97dcb
SHA156e16e4df0944cb07e73a01301886644f062d79b
SHA256e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
SHA512d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
-
Filesize
455KB
MD50ce624d3a5a586c2bdda26b748da78d7
SHA1b9ed0a86eae645ba19ed08327888a4474c95e34a
SHA256fd597b58a578cfa46e1818b3b4b795ca6d25225dc11ee86cd491f3d55d7b235d
SHA512e5bc577bd319eb3ac70c527acfb313fac817e63f5184e6581f6d813491ca0f1a0f80583c14c2b9f2b8fa1df5938c2ae3318a91bda41171c63cd1670c55a85b7f
-
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\cab54A5CABBE7274D8A22EB58060AAB7623
Filesize973KB
MD5258b65eb9fed187051d5fcec7ce65dc5
SHA1b9afc5fcd8c6ca2ee3dfe9507e9adabdd9ded039
SHA25680a29d5ce27c6794b9a38e5d5b98d535f877ac3363f450ee7ac0be9394426e49
SHA5128d5b4c14deb07cc1bf70abfd6e04573822eff3b3937fb3867f5300d97c46f900f2446f923334d1cf5b51b17eeef063d6d59e8540456f310edecd98d223125bb1
-
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\cabB3E1576D1FEFBB979E13B1A5379E0B16
Filesize4.7MB
MD57fe64755ed8427ee4512760b69cfaee1
SHA130b8c69a5eb83a1804975f04fd0e701e2e9d98cc
SHA256e12efc1bc0c61a7b9ba10a07502ef6833297d028368760da26e63218b744da79
SHA512dc6c9dc1cb0502be87281ad5bae3ed54c5cfc7cbc4434880f1ba7a33599fc5503d8192ce6afbcf8ffcc142955f593e9830e49e72c0d5c9a7aac5f91024eac38f
-
Filesize
140KB
MD5b547a22dcdcf3d035a56f52f1b16c2b5
SHA1ec9e2fbee0a5c43c021365a35d1d6d04eea335b3
SHA2567cef0419f52c47f41b9546065e6788f20de07a7f1e647589ab52d88f6c7e50a5
SHA5126d49cd8266575f3a9cac205425f1fc11b70a58b0a657ba3e4ebafab43cc37ccaf54f551cbf367c8c08b2a6710f82a18ccffb3870683a9b922c91cff19ea7b65a
-
Filesize
140KB
MD589d36fccb34b319b60d1850863e0560b
SHA1f356410e3946063b85750f54998582510b9672c8
SHA25660714fcdac0a7cbfc45e6ed9bc6d4b7f8536947f630016e5faca5cce1745adcf
SHA51224e167d0305811409e433c8d78716e9b3af4bce4b3f372276f4730ae7c802b8be8f193a70ac0d44ad6e083a35f03fcfdb2faaae4a9975c9e2ef1254285b0309f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3007475212-2160282277-2943627620-1000\0f5007522459c86e95ffcc62f32308f1_4880fff3-ce96-47a8-956d-b60b04225313
Filesize1KB
MD59fdbbbd45597376a4bd9ec61c9b2b8b7
SHA122c05373dcb7e8c3e568582fcb378f7cfdee824c
SHA256e6d596417ab11c9b1297dcbc7715fca78a724ad84557a6b83d7f02ab9da3b3bb
SHA5128dd96828986655365d875efe7558eba48359aab52058dd2d9a88fbea109064f79c456070e83c1dd06a56c5e87884a34836abeb74ade3ac6cb9c9c6afb01e916c
-
C:\Users\Admin\Downloads\VEGAS_Pro_22.0.0.93_x64_RELEASE_DLV_DE-EN-FR-ES-BR_240723_08-58_22_0_0_93.exe:Zone.Identifier
Filesize26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
1.7MB
MD52b392cc9cc228b652d76ee7013019603
SHA1b581b943568af8c17057bc9dc23903faf47e89d9
SHA256cbd0d15e67ba7e676aeb4af3e25e8c190b0299935d35825b93c529f969937c95
SHA5125405090e03f7cc0eb97d26e9874094427844da5664b22cf633fc96b35d07df85d3d45dada3d189bf4abbc77e3c2fab48929a06c4bb5cb954b32944f1c5aa0594
-
Filesize
188KB
MD5bff77d20a5181bc37f28a29b182af601
SHA1e795871197ffa6aaa752058546b9625f1220ef81
SHA256f5210d7102cd49ffa4d6609e2e73c84d1824a86dc26d4dea5a98b816d20c1bdd
SHA512a15aacfd3244fe19506c5392e25d1f78b19138e143f4630741dc96af9043e7ed7bdeff527cd79fd2d50ac2e02eee6bd8a8eda8aa2f562bc2024e2bebfa56129a
-
Filesize
352KB
MD510d5ea3851a387483ab1e57175aa7c00
SHA1e22c75f1242f8fec90a79b48987afeeea98c4586
SHA2564b3107ddff5ed64f39f315ea015fe55d3e1f62146e82b6441b33397edac9f3b4
SHA512748fddbbf3b4385985caeeb837648ce5ad649577782b197cf8dc9aaefe38eb4c2c013847f657db6a39530394100f57523642b51dc4dcb63977a5d441c100918d
-
Filesize
117KB
MD5af365693533fe415bb498ee3e3c97052
SHA1c6d72bc726f9ac96a968158fbdcf94cffebb4cad
SHA25668d2120f14df1077ca938484c323a1e3b28bde496e8d77a4b01a907c749833a6
SHA5128e35033a3645c79a0f7927cdd70fb70f058ebb13919b4315e0d93baf595ace99281a61f9589232b26cedccf1698377d65f86de158cce7121dd00f46cf4a46812
-
Filesize
634KB
MD5415e8d504ea08ee2d8515fe87b820910
SHA1e90f591c730bd39b8343ca3689b2c0ee85aaea5f
SHA256e0e642106c94fd585782b75d1f942872d2bf99d870bed4216e5001e4ba3374c0
SHA512e51f185c0e9d3eb4950a4c615285c6610a4977a696ed9f3297a551835097b2122566122231437002c82e2c5cf72a7a8f67362bff16b24c0abe05fe35dddbf6a1
-
Filesize
9KB
MD504b33f0a9081c10e85d0e495a1294f83
SHA11efe2fb2d014a731b752672745f9ffecdd716412
SHA2568099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
SHA512d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
-
Filesize
8KB
MD5f62729c6d2540015e072514226c121c7
SHA1c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA256f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
SHA512cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
-
Filesize
635KB
MD535e545dac78234e4040a99cbb53000ac
SHA1ae674cc167601bd94e12d7ae190156e2c8913dc5
SHA2569a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6
SHA512bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2