Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3magix-vega...ws.zip
windows11-21h2-x64
1MAGIX Vega...t).zip
windows11-21h2-x64
1MAGIX Vega...ck.txt
windows11-21h2-x64
3MAGIX Vega...58.exe
windows11-21h2-x64
8Vegas Pro ...er.jpg
windows11-21h2-x64
3__ia_thumb.jpg
windows11-21h2-x64
3magix-vega...orrent
windows11-21h2-x64
3magix-vega...es.xml
windows11-21h2-x64
1magix-vega...sqlite
windows11-21h2-x64
3magix-vega...ta.xml
windows11-21h2-x64
1magix-vega...ws.xml
windows11-21h2-x64
1Analysis
-
max time kernel
517s -
max time network
478s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
29/08/2024, 09:25
Static task
static1
Behavioral task
behavioral1
Sample
magix-vegas-pro-19-build-458-64bit-windows.zip
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
MAGIX Vegas Pro 19.0 Build 458 RePack by KpoJIuK (64Bit).zip
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
MAGIX Vegas Pro 19.0 Build 458 RePack by KpoJIuK (64Bit)/Crack.txt
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
MAGIX Vegas Pro 19.0 Build 458 RePack by KpoJIuK (64Bit)/MAGIX.Vegas.Pro.v19.0.458.exe
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Vegas Pro 19 Cover.jpg
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
__ia_thumb.jpg
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
magix-vegas-pro-19-build-458-64bit-windows_archive.torrent
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
magix-vegas-pro-19-build-458-64bit-windows_files.xml
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
magix-vegas-pro-19-build-458-64bit-windows_meta.sqlite
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
magix-vegas-pro-19-build-458-64bit-windows_meta.xml
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
magix-vegas-pro-19-build-458-64bit-windows_reviews.xml
Resource
win11-20240802-en
General
-
Target
MAGIX Vegas Pro 19.0 Build 458 RePack by KpoJIuK (64Bit)/MAGIX.Vegas.Pro.v19.0.458.exe
-
Size
273.1MB
-
MD5
1bedeef92eebf22ff8877d4863896b5e
-
SHA1
53ee359f5e5413ba9eeba280af54815998ef1726
-
SHA256
b140c2036b2e57e71b72cdcf4cdd6df64d4b41180150b6b953db0c71fdf3f756
-
SHA512
0525c618c345d4cccb56b6f832c1a1bda13e31f52aced903b687ae218c7c72c5b49be2d2e5c1aefcc4c1137525fc103892e9ecae9db67b0a2d60822fe94cf9de
-
SSDEEP
6291456:gf+Vv7lueNfC3LOBF8JVfRC+oXGHrlJk4mjQsmL9sBGr3z30:LVv7ceJGOIVZaXGBJkisG7z30
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5868 powershell.exe 6080 powershell.exe 5472 powershell.exe 5868 powershell.exe 6080 powershell.exe 5472 powershell.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4944 netsh.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 24 IoCs
pid Process 920 vegas190.exe 4504 ErrorReportLauncher.exe 2300 vegas190.exe 3604 ErrorReportLauncher.exe 3680 PACK.EXE 1844 FileIOSurrogate.exe 4944 So4HardwareDetection.exe 4244 sfvstserver.exe 2876 ya.exe 1568 vegas190.exe 5236 ErrorReportLauncher.exe 2740 sfvstserver.exe 5964 vegas190.exe 5996 ErrorReportLauncher.exe 6012 sfvstserver.exe 6024 vegas190.exe 6068 ErrorReportLauncher.exe 5528 sfvstserver.exe 2224 vegas190.exe 2716 ErrorReportLauncher.exe 3668 sfvstserver.exe 5376 vegas190.exe 5128 ErrorReportLauncher.exe 4384 sfvstserver.exe -
Loads dropped DLL 64 IoCs
pid Process 2088 MAGIX.Vegas.Pro.v19.0.458.exe 2088 MAGIX.Vegas.Pro.v19.0.458.exe 2088 MAGIX.Vegas.Pro.v19.0.458.exe 2088 MAGIX.Vegas.Pro.v19.0.458.exe 2088 MAGIX.Vegas.Pro.v19.0.458.exe 2088 MAGIX.Vegas.Pro.v19.0.458.exe 2088 MAGIX.Vegas.Pro.v19.0.458.exe 2088 MAGIX.Vegas.Pro.v19.0.458.exe 3228 MsiExec.exe 3688 MsiExec.exe 3228 MsiExec.exe 3688 MsiExec.exe 5788 MsiExec.exe 5788 MsiExec.exe 5788 MsiExec.exe 5796 MsiExec.exe 5796 MsiExec.exe 5796 MsiExec.exe 5824 MsiExec.exe 5824 MsiExec.exe 5824 MsiExec.exe 5852 MsiExec.exe 5852 MsiExec.exe 5852 MsiExec.exe 5892 MsiExec.exe 5892 MsiExec.exe 5892 MsiExec.exe 5924 MsiExec.exe 5924 MsiExec.exe 5924 MsiExec.exe 5952 MsiExec.exe 5952 MsiExec.exe 5952 MsiExec.exe 5984 MsiExec.exe 5984 MsiExec.exe 5984 MsiExec.exe 6012 MsiExec.exe 6012 MsiExec.exe 6012 MsiExec.exe 6040 MsiExec.exe 6040 MsiExec.exe 6040 MsiExec.exe 6072 MsiExec.exe 6072 MsiExec.exe 6072 MsiExec.exe 6100 MsiExec.exe 6140 MsiExec.exe 3988 MsiExec.exe 2256 MsiExec.exe 2256 MsiExec.exe 4556 MsiExec.exe 920 vegas190.exe 920 vegas190.exe 920 vegas190.exe 920 vegas190.exe 920 vegas190.exe 920 vegas190.exe 920 vegas190.exe 920 vegas190.exe 920 vegas190.exe 3688 MsiExec.exe 4744 mscorsvw.exe 4744 mscorsvw.exe 4744 mscorsvw.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 pastebin.com 3 pastebin.com -
Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\CddbLangDE.dll msiexec.exe File created C:\Windows\SysWOW64\CddbLangES.dll msiexec.exe File created C:\Windows\SysWOW64\CddbLangFR.dll msiexec.exe File created C:\Windows\SysWOW64\CddbLangJA.dll msiexec.exe File created C:\Windows\SysWOW64\msvcr70.dll msiexec.exe File created C:\Windows\SysWOW64\msvcr71.dll msiexec.exe File created C:\Windows\SysWOW64\CDDBControl.dll msiexec.exe File created C:\Windows\SysWOW64\CDDBUI.dll msiexec.exe File created C:\Windows\SysWOW64\DLLDEV32i.dll msiexec.exe File created C:\Windows\SysWOW64\CddbLangRU.dll msiexec.exe File created C:\Windows\SysWOW64\msvcp71.dll msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Help\EN\contents1.gif msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OpenColorIO\configs\aces_1.2\luts\InvRRT.Rec.2020.Log2_48_nits_Shaper.spi3d msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OFX Video Plug-Ins\Stabilize.ofx.bundle\Contents\Resources\Stabilize.fr-FR.xml msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\pt-BR\ScriptPortal.MediaSoftware.Archive.resources.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Patchlists\Gate\Default.epl msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\Limiter\[Sys] Pop Maximizer +6dB (Transparent).efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OpenColorIO\configs\aces_1.2\luts\V3_LogC_400_to_linear.spi1d msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\de\ScriptPortal.MediaSoftware.TextGen.CoreGraphics.resources.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\Limiter\[Sys] Rock Maximizer +6dB.efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OpenColorIO\configs\aces_1.2\luts\V3_LogC_320_to_linear.spi1d msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\format_reader.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\CoreUI.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OFX Video Plug-Ins\Vfx1.ofx.bundle\Contents\Resources\AutoLooks\37.cube msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\TubeStage\[Sys] Warm Tube Preamp.efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\pt-BR\ScriptPortal.MediaSoftware.clrshared.resources.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\FileIO Plug-Ins\mxfplug\mc_mux_mp2.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\Compressor\[Sys] Black Face FET-Parallel Comp. Drum buss.efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\Compressor\[Sys] Black Face FET-Parallel Comp. Hairy.efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\TubeStage\[Sys] Vintage Organ Toolkit.efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\VocalStrip\[Sys] Breakbeats.efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Help\EN\eFX_Compressor.htm msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\fonts\Jasmine_and_Greentea.otf msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\FileIO Plug-Ins\mxfp2\mxfp2.chm msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\ScriptPortal.MediaSoftware.VideoEffectsUI.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OFX Video Plug-Ins\Vfx1.ofx.bundle\Contents\Resources\AutoLooks\16.cube msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OFX Video Plug-Ins\Vfx1.ofx.bundle\Contents\Resources\AutoLooks\41.cube msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\Compressor\[Sys] Classic Program Limiter.efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\Reverb\[Sys] Drum Plate.efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\sfcdix.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\sfld.ldd.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OpenColorIO\configs\aces_1.2\luts\V3_LogC_2560_to_linear.spi1d msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\Vidcap Plug-Ins\stl2plg\stl2plg.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\Script Menu\Stereo to Mono.cs msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\ScriptPortal.Vegas.Slideshow.xml msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Help\EN\29471.png msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\Limiter\[Sys] Drum Buss Fattener +6dB.efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\FileIO Plug-Ins\mxfxavc\mc_bc_dec_avc.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\sfcdix.cfg msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\FileIO Plug-Ins\mxhevcplug\SMDK-VC120-x64-4_10_0.dll msiexec.exe File opened for modification C:\Program Files\VEGAS\Vegas Pro 19\Language\local_es_ES.cfg msiexec.exe File created C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\mchammer_x64.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\ScriptPortal.Vegas.Slideshow.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OpenColorIO\configs\aces\luts\adx_adx16_to_cdd.spimtx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\networkhost.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OFX Video Plug-Ins\OfxStitch.ofx.bundle\Contents\Resources\VegasOfxStitch.zh-CN.xml msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\Online\MagixOFA-br.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OpenColorIO\configs\aces_1.2\luts\S-Log3_to_linear.spi1d msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\opencv_video453.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Help\EN\23822.png msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Help\EN\27667.png msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Help\EN\29477.png msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\sfvstwrap.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\Phaser\[Sys] Fast Vibrato.efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\Video Hardware Drivers\extviddev.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\Script Menu\Export EDL.js msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\fr\ScriptPortal.Capture.resources.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OFX Video Plug-Ins\Stabilize.ofx.bundle\Contents\Presets\PresetPackage.ru-RU.xml msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\bdmux\Vegmuxtw.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\MAGIX Plugins\essentialFX\Presets\StereoDelay\[Sys] Groove Digital.efx msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\FileIO Plug-Ins\mxfxavc\mxfxavc.chm msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OpenColorIO\configs\aces_1.2\luts\Log2_48_nits_Shaper.RRT.DCDM.spi3d msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\OpenColorIO\configs\aces_1.2\luts\V3_LogC_3200_to_linear.spi1d msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\RegModule_x64\mx_enc_mf_audio_x64.dll msiexec.exe File created C:\Program Files\VEGAS\Vegas Pro 19\FileIO Plug-Ins\mxhevcplug\So4Reader.dll msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Security\e56ab72b3cb799f6c8bc89580ba946ac\System.Security.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\2f4-0\System.Web.ApplicationServices.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\4d0-0\mux.net.dll mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.lock ngen.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Vegmuxmc\85ec9171388e8d1f197ef7402cc694df\Vegmuxmc.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1638-0\System.Drawing.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Vegmuxfc\965e9e613f1ea80cb57dc4ca4c262a64\Vegmuxfc.ni.dll.aux.tmp mscorsvw.exe File opened for modification C:\Windows\Installer\{FF4B234F-58D7-11EC-9A7B-00155DE88B8F}\sfpca.ico msiexec.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\ad8-0\System.Drawing.Design.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\78c-0\Vegmuxdw.dll mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat ngen.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\db18a77bfbda94df4646247ddf0dfa7c\System.Numerics.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#\c4b8b8fd8fb0bfdcc45bd23336395c65\System.Runtime.Remoting.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\474-0\System.ComponentModel.DataAnnotations.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Comp46f2b404#\13d2e1fafd59f9ba70f53229e240de2f\System.ComponentModel.DataAnnotations.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Vegmuxfa\d44f10cd86714912d283c801fc81a9ad\Vegmuxfa.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\11b0-0\Vegmuxfo.dll mscorsvw.exe File created C:\Windows\SystemTemp\~DF58C33797D8119CCF.TMP msiexec.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\dc4-0\System.Data.SqlXml.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1714-0\Accessibility.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Vegmuxfo\e55fff1bcdb4bf64835109f1bcaa3b49\Vegmuxfo.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\BdmuxServer\8391178d102352b7b0d2470817862b9b\BdmuxServer.ni.exe.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\38c-0\System.Design.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\c1c-0\System.DirectoryServices.Protocols.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\e74-0\System.ServiceModel.Internals.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Vegmuxdw\2425354ac11fe07931330146a551a529\Vegmuxdw.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\11dc-0\System.Runtime.Remoting.dll mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File created C:\Windows\SystemTemp\~DFDB13298153AA71F5.TMP msiexec.exe File created C:\Windows\Installer\{FF4B234F-58D7-11EC-9A7B-00155DE88B8F}\vegas.ico (new loc) msiexec.exe File created C:\Windows\Installer\{FF4B234F-58D7-11EC-9A7B-00155DE88B8F}\sfa.ico msiexec.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\cf1bb15a8adda62c0600239e31e87de1\System.Drawing.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1580-0\Microsoft.VisualC.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1478-0\System.EnterpriseServices.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\17c-0\System.Numerics.dll mscorsvw.exe File created C:\Windows\Installer\{FF4B234F-58D7-11EC-9A7B-00155DE88B8F}\vmspeproject.ico (new loc) msiexec.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1540-0\System.DirectoryServices.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1478-0\System.EnterpriseServices.Wrapper.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1408-0\System.Transactions.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1344-0\BdmuxServer.exe mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\16f4-0\Vegmuxfc.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\BdmuxInterface\bbf2ae1d81eb6eae33020d780541fa98\BdmuxInterface.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\2ac-0\System.ServiceProcess.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\628-0\Vegmuxdh.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Vegmuxrt\8ecbb0da34d090fa6fb38dca1e263ca1\Vegmuxrt.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\Installer\SourceHash{FF4B234F-58D7-11EC-9A7B-00155DE88B8F} msiexec.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\f4-0\System.Web.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\259047479675283cc6f4d28ff13d50a7\System.Configuration.Install.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\45c6202a7ea96c52643221352c836c4b\SMDiagnostics.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\1240-0\Microsoft.Build.Tasks.v4.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\f70b7c9f1fc4d6a6be7cac2cd5c0eb3a\System.Data.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Vegmuxtw\fc468015e40e9ad7be8ef37115d217cc\Vegmuxtw.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt19c51595#\058dade460402fda33db1e4d46f7fdd6\System.Runtime.Caching.ni.dll.aux.tmp mscorsvw.exe File opened for modification C:\Windows\Installer\{FF4B234F-58D7-11EC-9A7B-00155DE88B8F}\sfa.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI3342.tmp msiexec.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\17d4-0\System.Runtime.Serialization.Formatters.Soap.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\848-0\System.Data.OracleClient.dll mscorsvw.exe File created C:\Windows\SystemTemp\~DFAD813EF9F13BDE13.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5be859.msi msiexec.exe File created C:\Windows\Installer\{FF4B234F-58D7-11EC-9A7B-00155DE88B8F}\icon_veg.ico (new loc) msiexec.exe File created C:\Windows\Installer\e5be85e.msi msiexec.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\4ab6b86800d4391f78a1da9440138c33\System.Web.Services.ni.dll.aux.tmp mscorsvw.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sfvstserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sfvstserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sfvstserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sfvstserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ngen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sfvstserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileIOSurrogate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sfvstserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PACK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAGIX.Vegas.Pro.v19.0.458.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009a5c3185e018bce80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009a5c31850000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009a5c3185000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9a5c3185000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009a5c318500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies Control Panel 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001\Description = "Sony Application" vegas190.exe Set value (int) \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001\Version = "4294967295" vegas190.exe Key created \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001 vegas190.exe Key created \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Microsoft Input Devices vegas190.exe Key created \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Microsoft Input Devices\Mouse vegas190.exe Key created \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions vegas190.exe Set value (str) \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1001\Filename = "vegas190.exe" vegas190.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5F6A243-301B-11D3-B030-00C04F4C0826}\TypeLib\Version = "1.0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000008-0F56-11D2-9887-00A0C969725B}\Pins\Output\Types\{73647561-0000-0010-8000-00AA00389B71} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000000A-0F56-11D2-9887-00A0C969725B}\Pins\Output MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F432B4FF7D85CE11A9B70051D58EB8F8\SourceList\Media\13 = ";VEGAS Pro 19.0 19.0 Install Disc" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{39224540-6F92-11D0-AEBC-00A0C9053912} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0BB07B13-0CC8-11D3-B00E-00C04F4C0826}\TypeLib\ = "{B0528CD1-F67E-11D2-8F8E-00C04F4C3B9F}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FDB0D300-6F82-11D0-AEBC-00A0C9053912}\Pins\Output\Types\{73647561-0000-0010-8000-00AA00389B71} MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{23C9F225-40EC-11D2-9D36-00C04F8EDC1E} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Filter\{00000005-0F56-11D2-9887-00A0C969725B} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5F6A23D-301B-11D3-B030-00C04F4C0826}\TypeLib MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3904A18E-9F03-430F-9D80-D8FD9267DDC0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\vegas190_sfa\shell\Open\ = "Open" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{607682E0-6E21-11D0-AEBC-00A0C9053912}\Pins\Output\AllowedMany = "0" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{026D0AA0-9BB9-11D0-AEBC-00A0C9053912}\Pins\Output\AllowedZero = "0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B2C767ED-0E50-4A1D-AF6E-EAF1F16EB1C2}\ProxyStubClsid32 MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000002-0F56-11D2-9887-00A0C969725B}\Pins\Input\Direction = "0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControl.CddbExtData\CurVer MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5F6A23D-301B-11D3-B030-00C04F4C0826}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ogg\vegas190_ogg msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5F6A23B-301B-11D3-B030-00C04F4C0826}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F432B4FF7D85CE11A9B70051D58EB8F8\SourceList\Media\30 = ";VEGAS Pro 19.0 19.0 Install Disc" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F432B4FF7D85CE11A9B70051D58EB8F8\AC3DOWNLOADS msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControl.CddbCacheManager\CLSID MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000006-0F56-11D2-9887-00A0C969725B}\Merit = "2097152" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBUIControl.CddbUI2 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000006-0F56-11D2-9887-00A0C969725B} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAFF02-F907-11D2-8F8F-00C04F4C3B9F}\MiscStatus\1 MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0000000C-0F56-11D2-9887-00A0C969725B}\Merit = "2097152" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{8010C341-6D4C-4390-B828-E4D246C3DDB2}\FriendlyName = "VEGAS Wave Hammer Surround" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{869419DD-501F-11D3-8CDC-00C04F6B8E4C}\Pins\Input\ConnectsToPin = "Output" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000002-0F56-11D2-9887-00A0C969725B}\Pins\Output\Types\{73647561-0000-0010-8000-00AA00389B71} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000007-0F56-11D2-9887-00A0C969725B}\Pins MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8444E537-6C73-492C-BDD2-1B272D6463DB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F432B4FF7D85CE11A9B70051D58EB8F8\SourceList\Media\119 = ";VEGAS Pro 19.0 19.0 Install Disc" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF1A9404-6CA9-11D3-B053-00C04F4C0826}\InprocServer32\ = "C:\\Windows\\SysWow64\\CDDBControl.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F432B4FF7D85CE11A9B70051D58EB8F8\sfpaplug msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F196D33B-FC9F-420B-8C9F-A7F51F8F69A7}\ProgID MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D616F3E0-D622-11CE-AAC5-0020AF0B99A3}\Pins\Input\IsRendered = "0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39224541-6F92-11D0-AEBC-00A0C9053912}\ = "SfDistor Property Page" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6B179D-6E42-45EE-AAD0-13B0E698799D}\TypeLib\Version = "1.0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5F6A23F-301B-11D3-B030-00C04F4C0826}\TypeLib\ = "{B0528CD1-F67E-11D2-8F8E-00C04F4C3B9F}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01894669-BF86-482D-8FA2-BC0C7FFB1D38}\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vegas190_ogg\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000004-0F56-11D2-9887-00A0C969725B}\Pins\Input\IsRendered = "0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControl.CddbListManager\CLSID MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBF37B99-2F4F-11D3-B02F-00C04F4C0826} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3F901A20-79BE-11D0-AEBC-00A0C9053912} MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9E3E4540-8339-11D0-AEBC-00A0C9053912}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000006175647300001000800000aa00389b7100000000000000000000000000000000 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA97FC2A-0F62-11D2-9887-00A0C969725B} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40986926-0F56-11D2-9887-00A0C969725B}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBF37BA3-2F4F-11D3-B02F-00C04F4C0826}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Filter\{B97C0F23-196D-11D1-B99B-00A0C9053912}\ = "VEGAS Noise Gate" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA97FC2A-0F62-11D2-9887-00A0C969725B}\InprocServer32\ThreadingModel = "Both" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8448721-96FD-11D0-AEBC-00A0C9053912}\InprocServer32 MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{A8448720-96FD-11D0-AEBC-00A0C9053912}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000006175647300001000800000aa00389b7100000000000000000000000000000000 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F432B4FF7D85CE11A9B70051D58EB8F8\redplug msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F432B4FF7D85CE11A9B70051D58EB8F8\SourceList\Media\111 = ";VEGAS Pro 19.0 19.0 Install Disc" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{869419DD-501F-11D3-8CDC-00C04F6B8E4C}\Pins\Input\AllowedZero = "0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69E9B473-22E6-471D-8683-84BD1E4BECE1}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5F6A237-301B-11D3-B030-00C04F4C0826}\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8F918803-57F2-480A-9BF3-3B68F46C5B82}\ProxyStubClsid32 MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{00000003-0F56-11D2-9887-00A0C969725B}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000006175647300001000800000aa00389b7100000000000000000000000000000000 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C073A662-A344-4611-8632-06452280EBB0}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBF37B99-2F4F-11D3-B02F-00C04F4C0826}\ProxyStubClsid32 MsiExec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 vegas190.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a vegas190.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a vegas190.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3824 msiexec.exe 3824 msiexec.exe 1844 FileIOSurrogate.exe 1844 FileIOSurrogate.exe 5868 powershell.exe 5868 powershell.exe 6080 powershell.exe 6080 powershell.exe 4244 sfvstserver.exe 4244 sfvstserver.exe 5472 powershell.exe 5472 powershell.exe 2740 sfvstserver.exe 2740 sfvstserver.exe 6012 sfvstserver.exe 6012 sfvstserver.exe 5528 sfvstserver.exe 5528 sfvstserver.exe 3668 sfvstserver.exe 3668 sfvstserver.exe 4384 sfvstserver.exe 4384 sfvstserver.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2088 MAGIX.Vegas.Pro.v19.0.458.exe Token: SeShutdownPrivilege 4332 msiexec.exe Token: SeIncreaseQuotaPrivilege 4332 msiexec.exe Token: SeSecurityPrivilege 3824 msiexec.exe Token: SeCreateTokenPrivilege 4332 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4332 msiexec.exe Token: SeLockMemoryPrivilege 4332 msiexec.exe Token: SeIncreaseQuotaPrivilege 4332 msiexec.exe Token: SeMachineAccountPrivilege 4332 msiexec.exe Token: SeTcbPrivilege 4332 msiexec.exe Token: SeSecurityPrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeLoadDriverPrivilege 4332 msiexec.exe Token: SeSystemProfilePrivilege 4332 msiexec.exe Token: SeSystemtimePrivilege 4332 msiexec.exe Token: SeProfSingleProcessPrivilege 4332 msiexec.exe Token: SeIncBasePriorityPrivilege 4332 msiexec.exe Token: SeCreatePagefilePrivilege 4332 msiexec.exe Token: SeCreatePermanentPrivilege 4332 msiexec.exe Token: SeBackupPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeShutdownPrivilege 4332 msiexec.exe Token: SeDebugPrivilege 4332 msiexec.exe Token: SeAuditPrivilege 4332 msiexec.exe Token: SeSystemEnvironmentPrivilege 4332 msiexec.exe Token: SeChangeNotifyPrivilege 4332 msiexec.exe Token: SeRemoteShutdownPrivilege 4332 msiexec.exe Token: SeUndockPrivilege 4332 msiexec.exe Token: SeSyncAgentPrivilege 4332 msiexec.exe Token: SeEnableDelegationPrivilege 4332 msiexec.exe Token: SeManageVolumePrivilege 4332 msiexec.exe Token: SeImpersonatePrivilege 4332 msiexec.exe Token: SeCreateGlobalPrivilege 4332 msiexec.exe Token: SeShutdownPrivilege 904 msiexec.exe Token: SeIncreaseQuotaPrivilege 904 msiexec.exe Token: SeCreateTokenPrivilege 904 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 904 msiexec.exe Token: SeLockMemoryPrivilege 904 msiexec.exe Token: SeIncreaseQuotaPrivilege 904 msiexec.exe Token: SeMachineAccountPrivilege 904 msiexec.exe Token: SeTcbPrivilege 904 msiexec.exe Token: SeSecurityPrivilege 904 msiexec.exe Token: SeTakeOwnershipPrivilege 904 msiexec.exe Token: SeLoadDriverPrivilege 904 msiexec.exe Token: SeSystemProfilePrivilege 904 msiexec.exe Token: SeSystemtimePrivilege 904 msiexec.exe Token: SeProfSingleProcessPrivilege 904 msiexec.exe Token: SeIncBasePriorityPrivilege 904 msiexec.exe Token: SeCreatePagefilePrivilege 904 msiexec.exe Token: SeCreatePermanentPrivilege 904 msiexec.exe Token: SeBackupPrivilege 904 msiexec.exe Token: SeRestorePrivilege 904 msiexec.exe Token: SeShutdownPrivilege 904 msiexec.exe Token: SeDebugPrivilege 904 msiexec.exe Token: SeAuditPrivilege 904 msiexec.exe Token: SeSystemEnvironmentPrivilege 904 msiexec.exe Token: SeChangeNotifyPrivilege 904 msiexec.exe Token: SeRemoteShutdownPrivilege 904 msiexec.exe Token: SeUndockPrivilege 904 msiexec.exe Token: SeSyncAgentPrivilege 904 msiexec.exe Token: SeEnableDelegationPrivilege 904 msiexec.exe Token: SeManageVolumePrivilege 904 msiexec.exe Token: SeImpersonatePrivilege 904 msiexec.exe Token: SeCreateGlobalPrivilege 904 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 904 msiexec.exe 904 msiexec.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 920 vegas190.exe 2300 vegas190.exe 2876 ya.exe 1568 vegas190.exe 5964 vegas190.exe 6024 vegas190.exe 2224 vegas190.exe 5376 vegas190.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 4944 2088 MAGIX.Vegas.Pro.v19.0.458.exe 79 PID 2088 wrote to memory of 4944 2088 MAGIX.Vegas.Pro.v19.0.458.exe 79 PID 2088 wrote to memory of 4944 2088 MAGIX.Vegas.Pro.v19.0.458.exe 79 PID 2088 wrote to memory of 1200 2088 MAGIX.Vegas.Pro.v19.0.458.exe 81 PID 2088 wrote to memory of 1200 2088 MAGIX.Vegas.Pro.v19.0.458.exe 81 PID 2088 wrote to memory of 1200 2088 MAGIX.Vegas.Pro.v19.0.458.exe 81 PID 2088 wrote to memory of 4332 2088 MAGIX.Vegas.Pro.v19.0.458.exe 83 PID 2088 wrote to memory of 4332 2088 MAGIX.Vegas.Pro.v19.0.458.exe 83 PID 2088 wrote to memory of 4332 2088 MAGIX.Vegas.Pro.v19.0.458.exe 83 PID 2088 wrote to memory of 904 2088 MAGIX.Vegas.Pro.v19.0.458.exe 85 PID 2088 wrote to memory of 904 2088 MAGIX.Vegas.Pro.v19.0.458.exe 85 PID 2088 wrote to memory of 904 2088 MAGIX.Vegas.Pro.v19.0.458.exe 85 PID 3824 wrote to memory of 4528 3824 msiexec.exe 89 PID 3824 wrote to memory of 4528 3824 msiexec.exe 89 PID 3824 wrote to memory of 3228 3824 msiexec.exe 92 PID 3824 wrote to memory of 3228 3824 msiexec.exe 92 PID 3824 wrote to memory of 3228 3824 msiexec.exe 92 PID 3824 wrote to memory of 3688 3824 msiexec.exe 94 PID 3824 wrote to memory of 3688 3824 msiexec.exe 94 PID 3824 wrote to memory of 5788 3824 msiexec.exe 96 PID 3824 wrote to memory of 5788 3824 msiexec.exe 96 PID 3824 wrote to memory of 5796 3824 msiexec.exe 97 PID 3824 wrote to memory of 5796 3824 msiexec.exe 97 PID 3824 wrote to memory of 5824 3824 msiexec.exe 98 PID 3824 wrote to memory of 5824 3824 msiexec.exe 98 PID 3824 wrote to memory of 5852 3824 msiexec.exe 99 PID 3824 wrote to memory of 5852 3824 msiexec.exe 99 PID 3824 wrote to memory of 5892 3824 msiexec.exe 100 PID 3824 wrote to memory of 5892 3824 msiexec.exe 100 PID 3824 wrote to memory of 5924 3824 msiexec.exe 101 PID 3824 wrote to memory of 5924 3824 msiexec.exe 101 PID 3824 wrote to memory of 5952 3824 msiexec.exe 102 PID 3824 wrote to memory of 5952 3824 msiexec.exe 102 PID 3824 wrote to memory of 5984 3824 msiexec.exe 103 PID 3824 wrote to memory of 5984 3824 msiexec.exe 103 PID 3824 wrote to memory of 6012 3824 msiexec.exe 104 PID 3824 wrote to memory of 6012 3824 msiexec.exe 104 PID 3824 wrote to memory of 6040 3824 msiexec.exe 105 PID 3824 wrote to memory of 6040 3824 msiexec.exe 105 PID 3824 wrote to memory of 6072 3824 msiexec.exe 106 PID 3824 wrote to memory of 6072 3824 msiexec.exe 106 PID 3824 wrote to memory of 6100 3824 msiexec.exe 107 PID 3824 wrote to memory of 6100 3824 msiexec.exe 107 PID 3824 wrote to memory of 6100 3824 msiexec.exe 107 PID 3824 wrote to memory of 6140 3824 msiexec.exe 108 PID 3824 wrote to memory of 6140 3824 msiexec.exe 108 PID 3824 wrote to memory of 6140 3824 msiexec.exe 108 PID 3824 wrote to memory of 3988 3824 msiexec.exe 109 PID 3824 wrote to memory of 3988 3824 msiexec.exe 109 PID 3824 wrote to memory of 3988 3824 msiexec.exe 109 PID 3824 wrote to memory of 2256 3824 msiexec.exe 110 PID 3824 wrote to memory of 2256 3824 msiexec.exe 110 PID 3824 wrote to memory of 4556 3824 msiexec.exe 111 PID 3824 wrote to memory of 4556 3824 msiexec.exe 111 PID 3824 wrote to memory of 920 3824 msiexec.exe 112 PID 3824 wrote to memory of 920 3824 msiexec.exe 112 PID 920 wrote to memory of 4504 920 vegas190.exe 113 PID 920 wrote to memory of 4504 920 vegas190.exe 113 PID 3688 wrote to memory of 760 3688 MsiExec.exe 114 PID 3688 wrote to memory of 760 3688 MsiExec.exe 114 PID 3688 wrote to memory of 760 3688 MsiExec.exe 114 PID 760 wrote to memory of 4744 760 ngen.exe 116 PID 760 wrote to memory of 4744 760 ngen.exe 116 PID 760 wrote to memory of 4744 760 ngen.exe 116 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MAGIX Vegas Pro 19.0 Build 458 RePack by KpoJIuK (64Bit)\MAGIX.Vegas.Pro.v19.0.458.exe"C:\Users\Admin\AppData\Local\Temp\MAGIX Vegas Pro 19.0 Build 458 RePack by KpoJIuK (64Bit)\MAGIX.Vegas.Pro.v19.0.458.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\netsh.exenetsh.exe advfirewall firewall delete rule name="all" remoteip=95.141.193.1332⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4944
-
-
C:\Windows\SysWOW64\route.exeroute.exe delete 95.141.193.1332⤵
- System Location Discovery: System Language Discovery
PID:1200
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /x {FB6AD140-FA63-11EB-982B-00155DEA5CED} /qn2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\MVP19\vegas190.msi" /qb SF_INSTALL_DESKTOP_SHORTCUTS=1 APPDIR="C:\Program Files\VEGAS\Vegas Pro 19\"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:904
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PACK.EXE" -p1232⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\PACK.EXEC:\Users\Admin\AppData\Local\Temp\PACK.EXE -p1233⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3680 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5868
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147735505 -ThreatIDDefaultAction_Actions Allow -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6080
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147814523 -ThreatIDDefaultAction_Actions Allow -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5472
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ya.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\ya.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2876
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4528
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6EF10572D475BEB8CF3058423390029B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3228
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 3FE0FBCB8DEDBB2B917F9F531D98C35F2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe" Install "C:\Program Files\VEGAS\Vegas Pro 19\bdmux\BdMuxServer.exe"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 0 -NGENProcess 228 -Pipe 234 -Comment "NGen Worker Process"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4744
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 300 -Pipe 310 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4932
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 318 -Pipe 320 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1844
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 0 -NGENProcess 330 -Pipe 31c -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1232
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 0 -NGENProcess 328 -Pipe 230 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3804
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 0 -NGENProcess 2d0 -Pipe 2d8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3108
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 0 -NGENProcess 250 -Pipe 2e0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3524
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 364 -Pipe 344 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4916
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 0 -NGENProcess 364 -Pipe 2d4 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:380
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 0 -NGENProcess 340 -Pipe 37c -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5128
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 360 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5240
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 0 -NGENProcess 2e8 -Pipe 2c8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5440
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 0 -NGENProcess 368 -Pipe 38c -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4572
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 324 -Pipe 384 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:244
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 250 -Pipe 368 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5688
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 0 -NGENProcess 39c -Pipe 36c -Comment "NGen Worker Process"4⤵
- System Location Discovery: System Language Discovery
PID:5560
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 0 -NGENProcess 328 -Pipe 358 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:908
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 398 -Pipe 364 -Comment "NGen Worker Process"4⤵
- System Location Discovery: System Language Discovery
PID:5824
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 0 -NGENProcess 2e8 -Pipe 378 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5908
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 2e4 -Pipe 380 -Comment "NGen Worker Process"4⤵
- System Location Discovery: System Language Discovery
PID:5984
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 0 -NGENProcess 348 -Pipe 2d0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6100
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 0 -NGENProcess 324 -Pipe 348 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
PID:2120
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 0 -NGENProcess 388 -Pipe 370 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2776
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 0 -NGENProcess 330 -Pipe 398 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:756
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 0 -NGENProcess 354 -Pipe 304 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1140
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 0 -NGENProcess 324 -Pipe 328 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3100
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 0 -NGENProcess 3a0 -Pipe 330 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:684
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 0 -NGENProcess 2e8 -Pipe 3a8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 228 -Pipe 3ac -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3700
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 0 -NGENProcess 2e8 -Pipe 324 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3504
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 0 -NGENProcess 2e4 -Pipe 3a0 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2980
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 0 -NGENProcess 3a4 -Pipe 35c -Comment "NGen Worker Process"4⤵PID:1020
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 0 -NGENProcess 3c0 -Pipe 3c4 -Comment "NGen Worker Process"4⤵
- System Location Discovery: System Language Discovery
PID:5184
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 0 -NGENProcess 3d4 -Pipe 3b8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5352
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 3b0 -Pipe 228 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4672
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 0 -NGENProcess 39c -Pipe 390 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1932
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 0 -NGENProcess 3b0 -Pipe 3b4 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5504
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 238 -Pipe 354 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 33c -Pipe 3c8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 0 -NGENProcess 340 -Pipe 238 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2920
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 0 -NGENProcess 250 -Pipe 388 -Comment "NGen Worker Process"4⤵
- System Location Discovery: System Language Discovery
PID:4040
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 0 -NGENProcess 39c -Pipe 33c -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4528
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 0 -NGENProcess 394 -Pipe 3d4 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6068
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 340 -Pipe 3bc -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6040
-
-
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\mchammer_x64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:5788
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sffrgpnv_x64.dll"2⤵
- Loads dropped DLL
PID:5796
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack1_x64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:5824
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack2_x64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:5852
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack3_x64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:5892
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfresfilter_x64.dll"2⤵
- Loads dropped DLL
PID:5924
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sftrkfx1_x64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:5952
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx1_x64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:5984
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx2_x64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:6012
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx3_x64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:6040
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\xpvinyl_x64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:6072
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\CDDBControl.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6100
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\CDDBUI.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6140
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstproxystubx86.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3988
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\VEGAS\Vegas Pro 19\sfvstwrap.dll"2⤵
- Loads dropped DLL
PID:2256
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 85EC52855783ECF27E0D03BBF6C91E88 E Global\MSI00002⤵
- Loads dropped DLL
PID:4556
-
-
C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe" /register /user 10852⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"3⤵
- Executes dropped EXE
PID:4504
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3292
-
C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"1⤵
- Executes dropped EXE
- Modifies Control Panel
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2300 -
C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"2⤵
- Executes dropped EXE
PID:3604
-
-
C:\Program Files\VEGAS\Vegas Pro 19\x86\FileIOSurrogate.exe"C:\Program Files\VEGAS\Vegas Pro 19\x86\FileIOSurrogate.exe" 10332⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1844
-
-
C:\Program Files\VEGAS\Vegas Pro 19\So4HardwareDetection.exe"C:\Program Files\VEGAS\Vegas Pro 19\So4HardwareDetection.exe" -F C:\Users\Admin\AppData\Local\MAGIX\FileIO\1.0\So4HardwareDetectionOutput.xml -H INTEL|AMD|NVIDIA2⤵
- Executes dropped EXE
PID:4944
-
-
C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe"C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe" -Event MxVstServerEvent_2300 -Vendor "MAGIX" -Product "VEGAS Pro 19.0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4244
-
-
C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568 -
C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"2⤵
- Executes dropped EXE
PID:5236
-
-
C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe"C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe" -Event MxVstServerEvent_1568 -Vendor "MAGIX" -Product "VEGAS Pro 19.0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2740
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:5504
-
C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5964 -
C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"2⤵
- Executes dropped EXE
PID:5996
-
-
C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe"C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe" -Event MxVstServerEvent_5964 -Vendor "MAGIX" -Product "VEGAS Pro 19.0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6012
-
-
C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6024 -
C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"2⤵
- Executes dropped EXE
PID:6068
-
-
C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe"C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe" -Event MxVstServerEvent_6024 -Vendor "MAGIX" -Product "VEGAS Pro 19.0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5528
-
-
C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2224 -
C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"2⤵
- Executes dropped EXE
PID:2716
-
-
C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe"C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe" -Event MxVstServerEvent_2224 -Vendor "MAGIX" -Product "VEGAS Pro 19.0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3668
-
-
C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"C:\Program Files\VEGAS\Vegas Pro 19\vegas190.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5376 -
C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"C:\Program Files\VEGAS\Vegas Pro 19\ErrorReportLauncher.exe"2⤵
- Executes dropped EXE
PID:5128
-
-
C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe"C:\Program Files\VEGAS\Vegas Pro 19\x86\sfvstserver.exe" -Event MxVstServerEvent_5376 -Vendor "MAGIX" -Product "VEGAS Pro 19.0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5564
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
490KB
MD52ef0610e9b7431184f531b5c651613a4
SHA1d7426206e78e24feab889db3f76fa272577f4fb9
SHA2560f6217c5c3ea38b42dc83aa1768c47abf4d8ae42f106ef80764ca88107ec62b8
SHA5122f1e7a4f240cdb6aee1ac9f8030837b7cb518fc91bcedef4ed3f67c87f0b51ff6324fd8620be3cb7fe3e3846f680cc0cef1f431eb93ef97571fec3947632a1eb
-
Filesize
559KB
MD56f0f01a779c9c98c2ee93f00938c1b0f
SHA14696d49c9ffc567b5561531755311bdd42e9fee9
SHA2562bb7734a16e30da5a6e70dd4a646cd9dfc7164a314d051e9470bceac7fffd2a7
SHA512c56c71c67142e24e65df11dbde2dcbb6940ac18ab9ce4a4de6d1eae5a6ff7639ec3df53477f0fe201c5ec91941f081069aaaa86f860d6304ae2c4f0645391a2a
-
Filesize
833KB
MD53d5137c0af9fc365c5925e346a191eaa
SHA11752a35e4bfa23a2e7eaffbf99e832e85a67e5b5
SHA2566f46e8258679bf5bdbc194f2310e490fadf6bf3a83257a27e25a261b8aeea57e
SHA5125f553590c55c3dcbabad24b16423174ac0a661aea786621c683dff926185173f9974dbf33b22676db1f41a5d4da7b5f8efbe8a6df74db66126372825e81eafe9
-
Filesize
956KB
MD5c33e32e26efe7cc986eef53d2e3d9e71
SHA18c13a1b028cb4ce1792edbd2caea1e3429505388
SHA2569b8fbc98d0906f99039503f25737fc4c9aacfde1cb597b477af3a09f53064002
SHA512924f24ba7296fc74ad8c05f11c49630488be966a002c15a87bc69385b7a743cafaeb5eaac3e93447534d6fa181c94ca787dbe7475bae9bce078722cdfd678d40
-
Filesize
1.0MB
MD587ef9b25f0fd80bf7d96d4dba31057f9
SHA196b7ff6f6f71659c687abb5d07fd5b3f4241e34e
SHA2568a3f18a4dffa3c5bae8b8f20de122d9ecbbdfe319f3b88a1602c91104d9ab4b5
SHA5123decad40beeade189d64c27aa8609b6f9728137897d3959a8fd0127d1650b958ce77041236a955995bec365f302bd8fe342fbc493726b605c4051b88312fd50d
-
Filesize
320KB
MD55ba2c65c96662433fe83f0090b818cb7
SHA1ef5c67eae2cec05c3e57de73100dd5bf0e44f9ac
SHA256d4b813eacdb5d548b3c3f26c348f47037a39117db313036ac814462a7c95e4e6
SHA5128b745afb9f2521a4a392d942a9b1be9f0341001833a2f234a38c93c16fef2eb112f6526f3e749bdd3568bbceb45fca554bd5b4a9513f601134479f594fd99a64
-
Filesize
4.3MB
MD525654b68cb97cc3a38a178bc22931a57
SHA1370050ffb4ab143dd693ed5ea5ae84b73ccfdac9
SHA256d179d7fb863d8e44e04c353696b75bc21938f6eb93ed2e9721ac37f3a1c4f716
SHA51299fdfa40058d5a9b3997e7b243259ce65a61375e9352b3e98645f1a4f497b44bda3553edc84d8ce8cb84dec14678a96f6b05ab2935640d98faa367e264811bc4
-
Filesize
7.0MB
MD5fedaa0b67a8e5004151542889fc49129
SHA1c77273af5ae7e339b5248569159f5ac41df7cf57
SHA256d34d1e581a07301be3070454a1f29bd3b9d2de2683ea3b782649560511c08ae7
SHA5128c474dd7987771a217ba5df5b6982130e6a89f22b5f65c5b3bfd0a297a2a80091b9f6fb2d4e74c0e98b48de556d76d1897b2ead818cef14f25832bac6ae71d03
-
Filesize
6.1MB
MD53664280a8e488dcb10e5c899b4b83c43
SHA146ff56b2e9a651479ec268cf0ac1c3521ad4d591
SHA25648ce6e8072e8c064030bc3dd3f9330d9c661bbbecefe4b8d9df6426a23581340
SHA512befe3245e9e1487c24cae50a3de4ec1b532f27e63b72abe28c5178ba54ef123299dbdcf7277a995d4eeb0104ba70b38846a20b9817eb47b0b8f75d7c7eafc482
-
Filesize
128B
MD5238a743f0e97323ea57188d64dd03d69
SHA16c2efc48071d5749e84709f252306f9afe18dfd8
SHA256e7c29e324195c06eca9a2cc6300759985129169a25a082e7b45374f0250fead1
SHA512030022ac2d73bd5aa91d7c478bee565692e0b84a94de8e44332ff61ef31f2e03bfd866bad6bf5a246042b127ab7e4eb0859cabf00420499dded1a1f3a2caccc1
-
Filesize
1.3MB
MD5343c6a76a79ccb652d5c2397eff52168
SHA1ecb7e4c4ed3f43330470acbbdaea28b3ea67cb18
SHA256d608894292a4b8cec3fb8d5c1b43f1be71d8e3f3d58dd375a45b50afedb2d202
SHA5125e7c410aabce0963c1ea27961c3c60f4ed0a6f01ed76b695f259398f55e6648d8ae1295d00d181e0bf0c671a0a05962423f85b3c96ce3382124af2f69cee86b0
-
Filesize
13KB
MD52fb37ed278c98164d5dec6ccc639843e
SHA187d4ba46dcac7a928d7ec348b503f24345c94daa
SHA25689b6670db049baf2d2d9445c82491a15bd0a54afa114dc43251197724335544c
SHA512fdb6c74f8e2e0c18149213097995b0353173b2d7a025f4f2ad0067743aa29beb03e68362b86d971e3eb9e8c0d3e0fdf54b39d46d31460d1570d4e7f2739680b0
-
Filesize
168B
MD54615f0ef82e5d7f3bbb977e2e6a0f90f
SHA1933311a90aa098a9e9fdbd101fe61117098caaf1
SHA256bed5a7faf3ba04e172066ac91ec5c918a62710818f663b976f9aac48ff16e11d
SHA512eaaf5976be5727540a21d0ad2aa8460a39c958f51bc0225187ae6c2708b2e2f73ac4ccbcaa984864ad689a687443abda4b615c66443187ee717eaf0d41a6e7b6
-
Filesize
13KB
MD5312f6f0aa15479c72a82975412e08ee7
SHA173f9cbf2cf325f8b50dcfdd65d458db6d886802c
SHA2563f7bfe821771d24de69118ba25d6dfc462bdfa44a6ddc2e6d778c9f1f5d0ff03
SHA5121a3d9ecb3ce6cdd30d95b315c90ff0b6663e3a00534803e9b0598109053690ed72e5d0c3c9e28a879fcffe6365e596240bc94439a46b46c7eb7e61166ada991c
-
Filesize
13KB
MD5b4d957c18570bbbc36520cacb29bdd80
SHA185a4e7badd56c44495068d73e4b35648934fe0d4
SHA256272a686fede3b89802c998b8b67b2185dd85086ad880c9ca32fc3137ba9a8bc8
SHA51234cd23b0459137d93db47464a799492199c8411328bc38b8d0c498a0e95fab149a8e9e6a87b6ab711f2b9860ed8d1fbec7b6ddeb6621b444b64487a27bef953e
-
Filesize
13KB
MD5116952760bd739db0f3d412a8d34fd06
SHA1d0a254761976c812b942cdd05efd8cd1d0101c78
SHA2564385b687e745a4d5e40f2aa1ab140e5b48749309af95c91d601d6cb9cf0aeceb
SHA51202787e939a1873821565dfce4486e86cb1481fa0adc1e21ae087bb406dd5df0dcb7a076df062df09811ae67a341515b8670b99f9b1de786f1b8c0372f3c72ed7
-
Filesize
13KB
MD571b2fdccf02d3acb1b431ea711b38961
SHA18d77fe95d2092535e8d21953ab5c97d0424afe87
SHA25677d4a3c8a9453c4f9e4649fe238110e158b6d96a45bbb17798847f10a7fb0de2
SHA5124dde4417d1de97b0a9abb86b71259b06b445c8d7e06799479bff359fc2191fda8ccb4e63cfe13504ef4258ccba8797461e981bad8206bc7ce81f2e98cbef821e
-
Filesize
13KB
MD5edb531da2ce10d386b266e4fc0a00d26
SHA1103879c023ca0336a5344cde0c4332d349289293
SHA25685679e57a82c79f7dd6de73d9fe27ab0bbbf339c5e047b7fa99d17d7cb70a46c
SHA5129bbc126045ee89d934b450715c677cb68615b1106e47641779770c5ae089e8513de4c938aa51387d229eea162319246cc8b19dc17d63d649066835d2ade8ebe3
-
Filesize
852B
MD5690a4f43b703eaa77185b04a34b7046c
SHA12c75548f8a4b1e9da6fe512d7b2d76b7f4bae8fe
SHA256f4644e880807f77e96788068e929b124886f103c1bfc80a5eaf11a803a8cbaa1
SHA512f3ce37fc9bbedc2ccc5fdb5005b533b9c207c6387d35dd3311b4bd673a5388003a14bbdae5c3ad2589161c7976bf80b3df03f114212caeced9c7271532c109a4
-
Filesize
4KB
MD5a75bb752b8501aa225ae4532cd6edae2
SHA1b92b9bf7f03b4e5df905e271a557e4060ca92215
SHA2563e2d8bf3ca52f9458ac3c328723375d3be52e904a70cac000b9139d77f2e2198
SHA512ec1181422b902015f3854ff5a84da332174dbc0a0ebdacab30c68ccb415969561babaea602d5ef45af263b07d2f2170c5cd2d6b1a1f5c2b8f58c839a6024af74
-
Filesize
13KB
MD56ff1e8b81dd7766f58fe957127844e0c
SHA134fc27cc9ec4c7b673f45ed65f8c2be47ae7e11a
SHA2568085ee1789cdcfe8022c1972bb06307f81571e70e9599dcc0bc04ec150dfd325
SHA512d1f48a7c21c81665f7d1fdec3f2ab7718cbc69247b0e2eb1e38822f2b79af6bd5f2d521ae54d6814cfc08d83ff10b48d00339f8f7e13dba54e5a9de8a0723bf0
-
Filesize
55B
MD5afa7ee18ebf29250e6c1d58d117b0a8f
SHA182848e876d0559e24d95cdc27f4d81a20f96acd1
SHA256ba77806fa2c2ffe1f2c896b4340eb169fe0cd0f7ad0706e1b4d6cfe8dfbc03f6
SHA512054d13d69d68f8c3af0b9eed577d325877bc987699b29f622534f216a07c66f081edf16e6aa2c01635a0b9236191033abc7a904633fa918eefde87cb6baa61af
-
Filesize
728B
MD5fc86d688081c4bf09dba3a066433c1ff
SHA1879d015def134b14f9ac001207493a8bd1cee4d1
SHA256330a6f77d0ef56f14345f860df9f5fd8d4f41d5de4c61e147f87ffc3aa5756e4
SHA512c0c858fdfbc041419d51e2061aeae8de20cef583f0c50c44a3d1e4ac2d5bf18524ae2a0920b097aad99c00690b3e386a74362eaaa2ff6095131ee30729acdea4
-
C:\Program Files\VEGAS\Vegas Pro 19\OFX Video Plug-Ins\MagixAiFx.ofx.bundle\Contents\Presets\PresetPackage.ru-RU.xml
Filesize10KB
MD5efdcffe1d1f4bcce6cb47086d854e04d
SHA10ae2e73fffd9a12fdf98b6d5fccf4831601d5960
SHA256403d94bf4af8c645b1782a2b06964fa8a4472836f46074dab8b36817083ff4f0
SHA512fb1205972e8323085a3c5d14e07694b778faf898461a37f90a42b4aaf2ede46864762feb9b31698c1f41ef63dcb8f4021fa9e72bb1203621c08fa5ad605384ff
-
Filesize
76KB
MD567f295e9f8be3d15aa161031f3761b7c
SHA189fc2e9845ed297e16c05823b655520755a234fc
SHA2564aa8c8265b737c5dd8604408899ff7ee9f70780f8b0d49ead183b48699a19b5d
SHA5122dd2f2da4559a9f3e4f6363f5b96d3d94655026985f051889bb05fd6628d0051dc06632fff322e9057db9e2c71281d29ba1ee5a2ccab46813db26c558a7db3c6
-
Filesize
11KB
MD5f380d12cc48bb1b80f341d4893056766
SHA17c5b0f8bcb0d93162f90d9a70198574b2351350b
SHA256193812e7299e9f56a362ec98f943986d3a216fd15748ea6c563baf9a673001b4
SHA512a787ffd59a3ccedcde0bc394c6ce1967ec745939a063036f8e26fb84afb6cadf2a26d45598151e5f4e53c8b4d54584b5012722bf44eb8338fccc71f25e66158b
-
Filesize
710KB
MD5564341060fac0944843969b57c96cf17
SHA17ec68b81695cd01dbc65bfcc55307cb884a489bf
SHA2569f62c97466e0977d3f8e97526e3314d14e8d50d0a40770cb563b030ff73c4f9a
SHA51254f5dc52832cc8358d9cb13767ed974881be65587234f2c330a9f048fbec831dfaebdc680726f608eb973caa928ef41dee9cad9f89404801de0549a2118a91b5
-
Filesize
104KB
MD57c63423376c2f45b7d76537c933a95cc
SHA158561511026f8761d1a90a6bee79d4a152b420f0
SHA25657c478c62fb66a6dcc1281e1f92f741fedeb2e60ad42b4a06825336f1f3506eb
SHA512e15d075df3574bd7fc9191506cb113ed17767d1a50cc918ea1d7c75b22c5165a7b5ad33ddb453c5c7d4efa6ad182f90f2a1a1857c614acbbada34202e6c79a81
-
Filesize
176B
MD59cd00d095db8072516819f851b1e74d4
SHA140e71576e831a6b9db9297f9e841e9c6b4c1a1df
SHA2564cbf03024d77f25184bb60122653abe85dc7d50b4f8aae9c8bb6dd6b9ca52d16
SHA5121a6253945a97dc99bef658db862c851d108f34f9c77a5ddcbf38f07c17559a87ceabb5d615a1e0ce56cd8307ac33d57657e930cc37f4f13767d946882eb0f1b3
-
Filesize
1KB
MD5d6f844a71d79a4dc78514640f62488f9
SHA1c8ebdd90066384d5a2d769fe0dcb4648833162c9
SHA2561ca8e9ee357ef585f70b14966a5ff35972ba6a8ef01154429866afce32b503d9
SHA5124a7d931580894f951422bb8ce367f9b3820e0bb9f78637b192c7fd871d4a22ca2cbf8bd3c68762210af2225230ea991a513593f7ce5f39377577788e90917f4c
-
Filesize
3KB
MD56d5dc46f9bb6ca3b4991954c6ef4117c
SHA120a06a4ac4b1732ec0e676c507fc4a2860bea698
SHA2562519a81c7d217824efe2c734c940d6a29e752df20e134b64b777a1506f306d79
SHA5122abfb6431f3d42a785baff5dcf60b9798f0d9627ae47788cc31970a5c6c046412e47bd332d7b42b6e6bc5074eb22e17938a68921c1beb48a10c0d1365e01368d
-
Filesize
44.1MB
MD59c724aac54c433fc73f6b99a6b6a8d1a
SHA1c713866296d1ef70ac959f07a30082c9ef08e912
SHA256ffbf807e569d3c2bcea776d4bed677d18b38bf31f47d5e7182e0997e9e6b00b5
SHA512fa869ea538a6cacfaf14fd3fdb424484dcc9b45ce8f1ac7b4431911937b1a9f6b679d1061d88041291cd53b3a5b135835497c7078b8cbea821c1c4c7a61737c4
-
Filesize
604KB
MD5e34227582523dd5d6450d2a48e742d79
SHA10e7ad3795405d5eb2122fde5f0fc66ce74e1c855
SHA256883986d00df7669a1d573a76317f036521232b0ad80a1b5f9cefbbda788f8932
SHA512cf1ae9fa909655e7a639e382006cefd35ed29805cfdc92d48beec484794f79933313f6c7b13070bb9300e5c7829a63266048b5fdeaf84cf27ea27640f673531c
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\Shared Plug-Ins\Help Files\mchammer_x64_esp.chm
Filesize11KB
MD5174a41bafb43045e170b4419c3f518cb
SHA169150c318384d2109b286f5c195abee5212a7830
SHA256b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
SHA512e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\aifplug\aifplug_deu.chm
Filesize42KB
MD5bc7c77b1d2be14eea6a21cc561575117
SHA1feaa3909504867216508886eebdd15ef375c7592
SHA2561edb33ef5b285c2b064249c14256b83157f00c732b2f508fb23bd352a4aa1389
SHA512f6436c7d2ec14e28beda5d7bb87a6e0f37700626f1e0a7cc81ea0ea6291cf572b1917b6601fe33381c58a13991e2b74707626f00bb1ea6006a75f0f61fe49454
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\aifplug\aifplug_esp.chm
Filesize42KB
MD53465d53eaadb5281a6e4d365d8fc6840
SHA1a6d42c4a7e5decbc335c29a1e2dc0c5b26855d25
SHA256d1328fec9b03bd7789437e11cb084c67c9a3a31247809db8dae3c4f07508b704
SHA5126e6bb9c5d98c2f722dd282074495a0a712e6bb524e2d8c6f426c8567b1bcb80a7fb51bc70649e7668f40f38b1783ea80510f04fd844e0178a0587e827d468c2e
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\aifplug\aifplug_fra.chm
Filesize42KB
MD511e03a790ddfd1112587d020165d989a
SHA195fcdb8e9568d0d049aaf2da7b5b5ccb59a1cbe4
SHA25656f4882144e4d787c643208fa372496dea696065f96971edbf1220f7e1648228
SHA51205ce55290d203100f05d2aa293cc16fedab642e0cd13cc363fdd46bac49b21f7dcddab3df2c174c60e0a0b722fbf0567efdf0e45b8f385675fd94ca0bd56487f
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\aviplug\aviplug_deu.chm
Filesize17KB
MD5ccdcc9883fc82857d0f902ace6e7e595
SHA14d1fa7883f5a0ad659a25e60f4ae708e906677e1
SHA2560ca8100d78722bff734d4d7356339cab4f1c2431442897ff3443777771c15d9e
SHA512cdad2f29a64fe17675d23dc808b50dbca6003807cb715e54e8181e0daed904e0bf12f0b3be2c465047a7c9270de283334faa133e643b3a45df737914313e49e8
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\aviplug\aviplug_esp.chm
Filesize17KB
MD502358730ab66f7ab02a864b7d8ae8a99
SHA1661f1f5967f716c80848457d09314e37534866f9
SHA256ea974ba5ad3b22530d2836e6e9241d48e6e77aaa13fba35846412b77ce4eb021
SHA51242aaf5adbe0cb05c7d3ffff14548fa2366b6e5ff8afdffec74baa55bdeff78b389f7c6c3cae8dd62cac104a6e70284fd8b8884773d874aa6fc2f640ef403df62
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\aviplug\aviplug_fra.chm
Filesize17KB
MD5cd54957b73ec2737f42c9d7457ee7d69
SHA1cb8e837242c46563382c2efe421601c1d895eff7
SHA2564ebb2ee7cf1687df37d3ffcdf7fc31ca964f17e5b7dc41bca900c06a15c28d95
SHA512e34854bf1052637856e8e69dde6552cc2e1edba695b0652874a8d5c3912beae3190f2b52c687580c4f9a7d8bec467f931b556fd93437ebabc337c7645bc4c7ff
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\flacplug\flacplug_deu.chm
Filesize42KB
MD53b08e58784a7f356e449e07d5b9d4526
SHA1c9903483a16e6a2f6a5fa988bd366aaa4497ca56
SHA2563661aaad61fed831f4f58da250a293b6ae0c33a1538e946a77e3ab8da7c76ac0
SHA5125e2415b000cae2b43c76bed64d278af48f4550c164eeb4c12d35e17edda5c15c7783487c1fcbbe7d3635e8e2b7d1e5d264bd745103d1e76342aed921912c29f2
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\mp3plug2\mp3plug2_deu.chm
Filesize44KB
MD57b5bb057fa4b3da5ef30248ab58a6563
SHA1f5360bed393f2bbfefed4dbe603c749480145d11
SHA25670f20bd3e28ee8769e043cffd4dc2ce02ccc879a96ae526d24be4d77d1c188a8
SHA5124f7df546cb939f93b5151d8cf7103bd1c9d828f7ab0ffe2767a475d2edc2f4392fae9b034bd55b0dd40fcf918da36881c962f3dd70e5f9248c927caa0189bf09
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\mp3plug2\mp3plug2_esp.chm
Filesize44KB
MD51267f047f1f88203af4fbb62253378a4
SHA1d2877f7f674485a0c587a24f8ababecb1519db94
SHA256fc4c1d39ca62132f8d6ae83f71362fafa112717adaef7fc1282b7464df9eb1fd
SHA512e34a10e96aab66b0432f96ad8fcaeceb6b021aa11d1d9cc02945de1485aa66b195f62c3a2354485fd1d5c15c2a8b71e7d39a4dc667ad146a867478e3815c5076
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\mp3plug2\mp3plug2_fra.chm
Filesize44KB
MD50c6b3760d750733d5362542841d2782b
SHA1a7c10048e95af67ccd60db932465d09a549948b0
SHA2561bbbac23997364c5c652873dcb988cd806790a670ab71c3d01dcc7862bdecd41
SHA51227e08199dbe7d80023a22c278b0ab30141c2e5ea1e8cf8790f1e10da35e3c708168140f9eb130ec84e0940098001178d238a6434944474775b60da85784ea338
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\mxavcaacplug\mxavcaacplug.chm
Filesize43KB
MD50f1fb541827cc6bcc3dbb777c00ca3ed
SHA118e68b072c1f24eadb0fe10353ca2725eb1e6869
SHA2567c770fdb34b37cb6140c8adf3482613aa72dc51f989b9915ff7c45f882a1a81a
SHA512d26a6d94cafb33880c4bfaa67a687e3a3d68a3851ebacead9a590d611b23e8c1194bb99296f4ac540c0e39790716a80deda52686fb335a2b1611f6abc8c7f8f5
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\mxavcaacplug\mxavcaacplug_deu.chm
Filesize16KB
MD5b28fb870f7ac1fc58835cd538f0b3827
SHA16535d439db0938e9ca0779e07c6751a111c00183
SHA256a21893c188660edbfc3700f646316d496bcf7ded8603ef6c9f7852d02ed437ef
SHA51288fe27c5ee62293ea08f54d0e30d96e37123590ce80dc8b77dc4bb338e03e11c363dce7c75a41824596ea2e55e290bf4d69b9e48e66e870d6bb4e10323d2a78d
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\mxavcaacplug\mxavcaacplug_esp.chm
Filesize16KB
MD5d403b68f94df24047f1f5c06ceb438ff
SHA1fd41dd09cab1c9b522826715876fc050d3b444ae
SHA25648a9e9e9a1e5acb2d9afc5622b7decee6b9842a7c639b596247e3dee294b4421
SHA51245e080281977fad0ce4e2bd268824309d1edca0ff97720ba0aa10d11cab2c0699fbf8746fe68ffc97657787b4bd051a006f48cc28ceb7bd4a2b882eb19e498bc
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\mxavcaacplug\mxavcaacplug_fra.chm
Filesize16KB
MD524bacd15fc74bb26c48bc6d5b8ce4c98
SHA1d1f1366025fd2bf0dd5d0a0b3508bc352e77a940
SHA256c0ca2de16679f5b6f62359cd22bdf69bd5b92dbea96909d6d5537d08c426fc4f
SHA512fa714f4e227c4e0ab6bf055bf8df7c60f59e3c3dc9f36120c770894cba67eb258269d2a3a285f730b1cbd2544811f504aff64c318fd32fba0fbe562317193f0c
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\sctplug\sctplug_deu.chm
Filesize42KB
MD51e929ca85e3dc765a526b49539670127
SHA18aab29d49ea869f7121a6be329031ad0890be872
SHA256c29b8613590632c21f70bb6d32400ae1cf1760ca526e0a1d48c2096e460e56f0
SHA51258891066e771e101678de580d33a093f394b663e2c2eedb9f42a25d82d8efb28e96092a8c5938bd56cc213dedeca2c9807e527b71ca3615582668671965fbfbf
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\sctplug\sctplug_esp.chm
Filesize42KB
MD510a4b20af8e1388942588a25ba56acdf
SHA1f80e54c89645100d2b35b2ed6bcc5f7964b24edb
SHA256204fb8c34fba776ae2b29485cc6d98710ba8d7735f72605db510fe4ff03cc09a
SHA51202bf89b48a56d720f1d923bb7645b0e90eee56cdbd5feb389e173b5e4f0df9dbb71de44b62aa243e1ec0ed3faf4e0ffcc88c433292ab89e8f5492366c2051042
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\sctplug\sctplug_fra.chm
Filesize42KB
MD520f80f3fe237e1fa4063b87219fbed25
SHA1975aecb67ec38aa0dc3b75ad34572b184dc69386
SHA2564e38e5884cd64b2513e4cee4aad50afaee117faedf94833554248bdeff4a0bb9
SHA512386d7688a3d366117c010bf4d6130e2b2a3cc13cbce3be38c547a8b7b93b3591a7b591702ca4ddbc82f8a17a29b3cf3f6419f0a1c6bb3eb540c0a6d12645cb84
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\sfpaplug\sfpaplug_deu.chm
Filesize41KB
MD513e437907b6aa18d1bd14794fe5ac324
SHA17a85ae87f42eb8d584fa8021243940e836029c2a
SHA2568c6b12b2f7d2f8d0abee8a15ee2034171cc64dbe1b160b446134cbb1208b5ded
SHA5121d1af9fcbf6d1b5a360ad99da13ba33d649dfe3740e0c45a78cbcd0bdc440ec03bcd71a997968de73c7b9f20e8e51eb63c58671ac88c617f0fd6ce6dd29c8085
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\sfpaplug\sfpaplug_esp.chm
Filesize41KB
MD5be6375ac3be1544bee327e52a7a99c96
SHA1afca1a02d159572db83d39c2f13c44d93c33633d
SHA25640124498cb959e786d6f176a6659f50725b60060e3df721c2801fd377d988fa1
SHA512b0c2a10d1456a4d131cbfb6ce9e486df0604a746c59506f7e20efcf765c1040c4c61e967a7e820172172d1bdff10888a1d6d3f3291614a8f5e89fba0ba0bfeb4
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\sfpaplug\sfpaplug_fra.chm
Filesize41KB
MD5b4d48e7b424b2d0308474a188d953e75
SHA191eba39f0a46a0f84b9146f7bac454594fb67612
SHA2568e55be195707753cce43cedf0fc7f88c27ab65a756af913876ffee4f4747ffa5
SHA512f655ab2e2a5a0507562ad33ed9355bca1689778a617455e40de8cb0eeca4c3abcdadb5442d74978688ca839f6a83007e6767a0a21b8d954064649e2d6b1c740a
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\wavplug\wavplug_deu.chm
Filesize42KB
MD587da71108d725919b520f260785a1305
SHA1dd1235b503cab6f4eaede92770ebfb3904c1400b
SHA256a5e07081117ffdde589620992d02ac499f87a2e188f8d93c864968e48de43b4e
SHA5123d1d02e130c31442295e87f4d01d11627080c7b320a953888a41ccc87c959a5293293ae436b50d7952507601949848010549872263d3f5cc7d7d276647380b09
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\wavplug\wavplug_esp.chm
Filesize42KB
MD5360ac4a520088ce72feb7c8aa4446894
SHA1019b4edfb32a5b0baad3ca0a997132cc077ecd66
SHA2563f488cd71c5f84701f40f1ad88b264cd681c26f4334a706b9bb91dd10a488340
SHA512a9fa31d56728b1d3d88d52b64e1a614565b600421a9c044b4a459cb01090b61a8bcfac5bd175a743a7a420a1ccec44dd9d91f79ca63c8ebce40476370d7d21b8
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\FileIO Plug-Ins\wavplug\wavplug_fra.chm
Filesize42KB
MD555f546c178257400f935e4a1baf84849
SHA104c07d1219fd1863bcd089d332bba781b9f164eb
SHA25645e114995bca7f4d9a0ba5a8ba6c57a8eda516f2d1e53367e88513f230477af0
SHA5126c4a2cbdd67018743ee4f49b42d692fbbd7f55dd936eab5da8e1cc6f6f7cddf37a7106bc8fb181bd8274d5fcd622f4ff39d9535c827b9f3e473863482487dbaf
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\OFX Video Plug-Ins\TitlesAndText.ofx.bundle\Contents\Presets\PresetPackage.fr-FR.xml
Filesize123KB
MD597ea2689962ab8cf98f33493ea3f5452
SHA1ab98a4327552f8ec5f7f735e406355e714454a33
SHA256783bd330fb73ea7bbc07e5d68cb4ddb7f7e72baea0f2b03b33123b8acacd06fc
SHA512f0ba296ec3ed0c2637c7ed640f50f460d5ac9d7b17c704a2598ae977deb36fcbd623a135bd870f96c6c4a231f5c37b30fb1ceaa8bb9cc200698df801a8456a59
-
C:\Users\Admin\AppData\Local\Temp\MVP19\Program Files\VEGAS\VEGAS Pro 19.0\readme\Vegas_readme_esp.htm
Filesize39KB
MD575a99f02cd8a8dc0f8fb3268a4672075
SHA121401407916078b446b7fa3d4356b759e847abb6
SHA256aed2122e1e206089e01d726eb48327b4572c4d026883130e7e915a1cffb034cc
SHA51293c050c575d59a8dbdc3f4e9699d80dee36c4a28afb4e50a33c3cd90cf13b5a5684c9e34d83757c2f52351522a4fb539b408f18d3557355d40f254b8dde1689b
-
Filesize
3.2MB
MD59edd67a98c8551561d8aa6332230390c
SHA1266f20fbdd8c73c7c96c6a475a3a3f8a3c5054fe
SHA256039b83902e328c7a6ec9c47fcffeba591cee9cb80e027c502334db26b34762b4
SHA512e18c83636eedaa8f68278b11f2fc20c1e074c174fa6a62202f4db781ee949338ef300b8ee32322d047d3ba0567410d3acf98918ea41bded07a315515e22d313b
-
Filesize
170KB
MD50ee0cdbebe67f6b6578d67512cbb1920
SHA1c2b02ca87e379b28a109a132cc7d3ddfd71a2e22
SHA25621bc12b90edac883c6aacc927b5bded74344773f75fb644177fe7e2763d56493
SHA512df706b36091bd21d029b9af05500907dee2b16ff1d2057b588b245f80d3810ddf62a946ff49c305bd0904352c9402773bfafbba834602a745168ebca533144dd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5KB
MD5109b201717ab5ef9b5628a9f3efef36f
SHA198db1f0cc5f110438a02015b722778af84d50ea7
SHA25620e642707ef82852bcf153254cb94b629b93ee89a8e8a03f838eef6cbb493319
SHA512174e241863294c12d0705c9d2de92f177eb8f3d91125b183d8d4899c89b9a202a4c7a81e0a541029a4e52513eee98029196a4c3b8663b479e69116347e5de5b4
-
Filesize
12KB
MD58cf2ac271d7679b1d68eefc1ae0c5618
SHA17cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA2566950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
-
Filesize
24KB
MD5640bff73a5f8e37b202d911e4749b2e9
SHA19588dd7561ab7de3bca392b084bec91f3521c879
SHA256c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
SHA51239c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
-
Filesize
9KB
MD5ec9640b70e07141febbe2cd4cc42510f
SHA164a5e4b90e5fe62aa40e7ac9e16342ed066f0306
SHA256c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
SHA51247605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
-
Filesize
7KB
MD5f27689c513e7d12c7c974d5f8ef710d6
SHA1e305f2a2898d765a64c82c449dfb528665b4a892
SHA2561f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
SHA512734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc
-
Filesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
Filesize
12KB
MD5192639861e3dc2dc5c08bb8f8c7260d5
SHA158d30e460609e22fa0098bc27d928b689ef9af78
SHA25623d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
SHA5126e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
-
Filesize
2KB
MD5a4810068cc314ab5cee9472aefcfe257
SHA1abd188fa21519b4aba39d9d38522a36fc8ab0269
SHA256feedb551623d96c18f47e55d7eab69689945863bd28dbb15daf6d0d499558437
SHA51203d388d1184a9131e5d8f4bc297097f8bca5a53fe5744dd051a64e55228f452a62a5fa2d8e79646f503a30c93bd26561b9cdd9450feb473aee7ee42531307174
-
Filesize
14KB
MD592c33b5ed2b865fd5d1d505ff3452216
SHA11edb1ff802ab618b530bf8529567df5e53a3ce11
SHA25677202945b4c520111c92ece5de6f58ed5ce0943ec4cd579d32b1df1ac59f79f0
SHA5121cd31eee2f07c83e0a1ea0e730d9b60ccde69aca9397a5fab02f53611bd51f236170583c44df2235aa7374b3b2ac559d4cca06f35a17029e248cbe4465847798
-
Filesize
34KB
MD523216946ae74bcf7187514748bdb046f
SHA1f25b9559a3c439162f492a0fe27442238524ac92
SHA256a6f5f5c5258a4c707dfa3c17e6e090b2762e8488404126f6cfb16bf8bafb12ce
SHA512949de661118e78a87b17297a52f2021e0801753cbe11bf3bd6654360a3fc54278323f0b1ccbd262b95be4fed1285bc4996348411485caa0d842e2106a9e9fc88
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize6KB
MD57293cd6b53219c62c34cafb2e8b3f918
SHA120e5c4fa4223dcc52e86382e62e95159b557334d
SHA2560e466b4e95cfbf55d96641b2ec3f35c554744a88d6988dc80e1e4c72d9fb1c08
SHA512bbfa2bc1c1063688877284e1d9e93d725b50d32fa969d5e6c3a11d7c0936cfee76708ea96db94a18d6a695986ebe49767233e3a3212ee41bcf2039cf31c48a81
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize6KB
MD539491fdead2a3bdeb9fdaca7ef19376f
SHA1530b0202a537844069f7de37939d38401b2a1758
SHA256da87106b9a0069beed3c69124ca8afa89fdba07c7398f28427027b8d3ca2ffab
SHA51287f3dec3c245d3568ee7d7a82df9bde49a884bb104470e8cab5257d6b6318843e0d8b0634ee401ab95c1500976a788aaef0587f8416b6b3e682a0ff32c97a759
-
Filesize
123KB
MD55cb7ec6843aa69694096d98e467bc5e7
SHA1ade3a650ccfff23264c3e95819126c4be6eb57cb
SHA256c03b47bcbe6c28cfa612950814ca383dddd0d4a527cc17f1750b8385d4917aad
SHA512540e905256195ab904d1313b72811ca73f9dcbdb419c28cbbb83232e9fee966c3d80ca322f3701a0468e9bb545e4ca08e1106ae6254f59e100e703c139e40ce9
-
Filesize
1.7MB
MD5beac8693a2cc003c2609b2b69579d82f
SHA16e81ae73fc05a372e282794d9b47a0f98b18894a
SHA256e1c19ffc7d4c2521c385ed22955152b49d78cd19bbeccee36b3886a2262c5b14
SHA5129f66748a506ea4bd2ad3d72a924f5471d0c9b039cfffc9c38e5c52b7741cbb7661047259bf984984a4c6e2bb6460469f1c83d555f07db7d347bb3fcd6a0a591e
-
Filesize
46KB
MD5c9646b21a4c009296c96a20c4134749f
SHA170e92c14708bb41caf0306b74d83fe1557600812
SHA256b2165c38ffa47c7824a251fb73ca3a3ff8da618aadaa47fc3c6ef84b96e9b185
SHA5128a75671a25c2b523ba5493d8256fc9fdddcdbe6940029485483b2a0240524b3b54bb443489507c668089380676bff3b1f8f9e993c2780b217ccbf300c71560af