Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
205s -
max time network
224s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
17/10/2024, 12:38
Static task
static1
Behavioral task
behavioral1
Sample
TopazVideoAI-5.3.4.msi
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
TopazVideoAI-5.3.4.msi
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
TopazVideoAI-5.3.4.msi
Resource
win11-20241007-en
General
-
Target
TopazVideoAI-5.3.4.msi
-
Size
676.4MB
-
MD5
a13523c5b43d371a6791d32bd67e55db
-
SHA1
359d05200cdc797abb09640b63b8f82cf0472bb2
-
SHA256
f002752c85cbda6371a3d68916a74e1186270cd3783bf552db4dafe29cb17c0e
-
SHA512
2a29aba7497da31e433b251bfd476374abaafc37c8f7464971af9d539d10a6e7c4bd263edfa1f9831cd375616dfc3daed690f3d6f72cc6e355890b20490fd839
-
SSDEEP
12582912:0j2ZWz2d51iVGgefx5xYa+gFb3mHbYu/d+0CKEF+xDFqMV9DYzpRcFPgBBwZ7jU2:/jd51i2f7KtGCHUubCKE4xDwMVNY0FPR
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 988 msiexec.exe 5 988 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Basic\HorizontalHeaderView.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\videoai.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Basic\SplitView.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Universal\Switch.qml msiexec.exe File created C:\Program Files\Common Files\OFX\Plugins\Topaz Video AI.ofx.bundle\Contents\Win64\onnxruntime-topaz.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Basic\Switch.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Universal\ApplicationWindow.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\share\ffmpeg\examples\demux_decode.c msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\Qt6LabsFolderListModel.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\Qt6Test.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Material\VerticalHeaderView.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Imagine\impl\qmldir msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Templates\qmldir msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Imagine\impl\qtquickcontrols2imaginestyleimplplugin.qmltypes msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\impl\plugins.qmltypes msiexec.exe File created C:\Program Files\Common Files\OFX\Plugins\Topaz Video AIframeinterpolation.ofx.bundle\Contents\Win64\tbbmalloc.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Windows\GroupBox.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\Qt6QuickDialogs2QuickImpl.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Basic\Pane.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\translations\qt_gd.qm msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\share\doc\ffmpeg\libavcodec.html msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\translations\qt_lv.qm msiexec.exe File created C:\Program Files\Common Files\OFX\Plugins\Topaz Video AI.ofx.bundle\Contents\Win64\tbbbind_2_5.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Dialogs\quickimpl\qml\FolderBreadcrumbBar.qml msiexec.exe File created C:\Program Files\Common Files\OFX\Plugins\Topaz Video AI.ofx.bundle\Contents\Win64\videoai.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Window\quickwindowplugin.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\NativeStyle\controls\DefaultGroupBox.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtTest\testlogger.js msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQml\Models\modelsplugin.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Basic\RangeSlider.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Universal\MenuSeparator.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Material\SwipeView.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Imagine\Label.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Windows\TextField.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Imagine\StackView.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\D3Dcompiler_47.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\share\doc\ffmpeg\ffmpeg.html msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Material\ApplicationWindow.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\Qt\labs\folderlistmodel\qmldir msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\imageformats\qjpeg.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Imagine\impl\qtquickcontrols2imaginestyleimplplugin.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\imageformats\qwbmp.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Basic\SwipeView.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\share\man\man1\ffmpeg-devices.1 msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Basic\CheckDelegate.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\translations\qt_es.qm msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Universal\ScrollView.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Fusion\ScrollView.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\share\doc\ffmpeg\ffprobe-all.html msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\translations\qt_pt_BR.qm msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Fusion\impl\plugins.qmltypes msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Material\SwipeDelegate.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Imagine\HorizontalHeaderView.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Material\DialogButtonBox.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Material\impl\qmldir msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\share\man\man1\ffmpeg-scaler.1 msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\translations\qt_en.qm msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Dialogs\quickimpl\qml\MessageDialog.qml msiexec.exe File created C:\Program Files\Common Files\OFX\Plugins\Topaz Video AIframeinterpolation.ofx.bundle\Contents\Win64\videoai.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Fusion\MenuItem.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Windows\Frame.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Universal\VerticalHeaderView.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQuick\Controls\Universal\SpinBox.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Video AI\qml\QtQml\Base\qmldir msiexec.exe -
Drops file in Windows directory 41 IoCs
description ioc Process File created C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\{E0869EBB-A9EE-4B6B-B32C-AA47B8476FA3}\mainapp.exe msiexec.exe File created C:\Windows\Installer\SourceHash{E0869EBB-A9EE-4B6B-B32C-AA47B8476FA3} msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\{E0869EBB-A9EE-4B6B-B32C-AA47B8476FA3}\mainapp.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI53AA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5F15.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\e584793.msi msiexec.exe File created C:\Windows\Fonts\Inter-Regular.ttf msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSIB661.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSIB71D.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI6178.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSIBB25.tmp msiexec.exe File created C:\Windows\Installer\e584793.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI534B.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\DerandomizedSymbolicLinksForSourceLists\TopazVideoAI-5.3.4.msi MsiExec.exe File created C:\Windows\Fonts\Inter-SemiBold.ttf msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5F93.tmp msiexec.exe File created C:\Windows\Fonts\Inter-Medium.ttf msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BBE9680EEE9AB6B43BC2AA748B74F63A\5.3.4\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\e584795.msi msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 820 Topaz Video AI.exe 4428 crashpad_handler.exe -
Loads dropped DLL 64 IoCs
pid Process 3144 MsiExec.exe 5084 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 4492 MsiExec.exe 3284 MsiExec.exe 3284 MsiExec.exe 3284 MsiExec.exe 5084 MsiExec.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe 820 Topaz Video AI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 988 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe -
Modifies registry class 30 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\ProductIcon = "C:\\Windows\\Installer\\{E0869EBB-A9EE-4B6B-B32C-AA47B8476FA3}\\mainapp.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\SourceList\Net\2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\SourceList\Net\1 = "C:\\Windows\\Installer\\DerandomizedSymbolicLinksForSourceLists\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BBE9680EEE9AB6B43BC2AA748B74F63A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BBE9680EEE9AB6B43BC2AA748B74F63A\AEPlugin = "\x06Complete" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BBE9680EEE9AB6B43BC2AA748B74F63A\Complete msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BBE9680EEE9AB6B43BC2AA748B74F63A\OFXPlugin = "Complete" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\SourceList\Media\DiskPrompt = "Topaz Video AI Installer Package" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\PackageCode = "B6A92B37D543A344998799454D6BEA61" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\Version = "84082692" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\SourceList\PackageName = "TopazVideoAI-5.3.4.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BBE9680EEE9AB6B43BC2AA748B74F63A\VCRedist msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\13CD821E8711F6B4086A161E2B55ACDE msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\ProductName = "Topaz Video AI" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\SourceList\Media\1 = ";Installer Package" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BBE9680EEE9AB6B43BC2AA748B74F63A\SourceList\LastUsedSource = "n;2;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\13CD821E8711F6B4086A161E2B55ACDE\BBE9680EEE9AB6B43BC2AA748B74F63A msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 820 Topaz Video AI.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 788 msiexec.exe 788 msiexec.exe 4428 crashpad_handler.exe 4428 crashpad_handler.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 988 msiexec.exe Token: SeIncreaseQuotaPrivilege 988 msiexec.exe Token: SeSecurityPrivilege 788 msiexec.exe Token: SeCreateTokenPrivilege 988 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 988 msiexec.exe Token: SeLockMemoryPrivilege 988 msiexec.exe Token: SeIncreaseQuotaPrivilege 988 msiexec.exe Token: SeMachineAccountPrivilege 988 msiexec.exe Token: SeTcbPrivilege 988 msiexec.exe Token: SeSecurityPrivilege 988 msiexec.exe Token: SeTakeOwnershipPrivilege 988 msiexec.exe Token: SeLoadDriverPrivilege 988 msiexec.exe Token: SeSystemProfilePrivilege 988 msiexec.exe Token: SeSystemtimePrivilege 988 msiexec.exe Token: SeProfSingleProcessPrivilege 988 msiexec.exe Token: SeIncBasePriorityPrivilege 988 msiexec.exe Token: SeCreatePagefilePrivilege 988 msiexec.exe Token: SeCreatePermanentPrivilege 988 msiexec.exe Token: SeBackupPrivilege 988 msiexec.exe Token: SeRestorePrivilege 988 msiexec.exe Token: SeShutdownPrivilege 988 msiexec.exe Token: SeDebugPrivilege 988 msiexec.exe Token: SeAuditPrivilege 988 msiexec.exe Token: SeSystemEnvironmentPrivilege 988 msiexec.exe Token: SeChangeNotifyPrivilege 988 msiexec.exe Token: SeRemoteShutdownPrivilege 988 msiexec.exe Token: SeUndockPrivilege 988 msiexec.exe Token: SeSyncAgentPrivilege 988 msiexec.exe Token: SeEnableDelegationPrivilege 988 msiexec.exe Token: SeManageVolumePrivilege 988 msiexec.exe Token: SeImpersonatePrivilege 988 msiexec.exe Token: SeCreateGlobalPrivilege 988 msiexec.exe Token: SeCreateTokenPrivilege 988 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 988 msiexec.exe Token: SeLockMemoryPrivilege 988 msiexec.exe Token: SeIncreaseQuotaPrivilege 988 msiexec.exe Token: SeMachineAccountPrivilege 988 msiexec.exe Token: SeTcbPrivilege 988 msiexec.exe Token: SeSecurityPrivilege 988 msiexec.exe Token: SeTakeOwnershipPrivilege 988 msiexec.exe Token: SeLoadDriverPrivilege 988 msiexec.exe Token: SeSystemProfilePrivilege 988 msiexec.exe Token: SeSystemtimePrivilege 988 msiexec.exe Token: SeProfSingleProcessPrivilege 988 msiexec.exe Token: SeIncBasePriorityPrivilege 988 msiexec.exe Token: SeCreatePagefilePrivilege 988 msiexec.exe Token: SeCreatePermanentPrivilege 988 msiexec.exe Token: SeBackupPrivilege 988 msiexec.exe Token: SeRestorePrivilege 988 msiexec.exe Token: SeShutdownPrivilege 988 msiexec.exe Token: SeDebugPrivilege 988 msiexec.exe Token: SeAuditPrivilege 988 msiexec.exe Token: SeSystemEnvironmentPrivilege 988 msiexec.exe Token: SeChangeNotifyPrivilege 988 msiexec.exe Token: SeRemoteShutdownPrivilege 988 msiexec.exe Token: SeUndockPrivilege 988 msiexec.exe Token: SeSyncAgentPrivilege 988 msiexec.exe Token: SeEnableDelegationPrivilege 988 msiexec.exe Token: SeManageVolumePrivilege 988 msiexec.exe Token: SeImpersonatePrivilege 988 msiexec.exe Token: SeCreateGlobalPrivilege 988 msiexec.exe Token: SeCreateTokenPrivilege 988 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 988 msiexec.exe Token: SeLockMemoryPrivilege 988 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 988 msiexec.exe 988 msiexec.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 788 wrote to memory of 3144 788 msiexec.exe 77 PID 788 wrote to memory of 3144 788 msiexec.exe 77 PID 788 wrote to memory of 5084 788 msiexec.exe 78 PID 788 wrote to memory of 5084 788 msiexec.exe 78 PID 788 wrote to memory of 5084 788 msiexec.exe 78 PID 788 wrote to memory of 4492 788 msiexec.exe 79 PID 788 wrote to memory of 4492 788 msiexec.exe 79 PID 788 wrote to memory of 3284 788 msiexec.exe 80 PID 788 wrote to memory of 3284 788 msiexec.exe 80 PID 5084 wrote to memory of 820 5084 MsiExec.exe 82 PID 5084 wrote to memory of 820 5084 MsiExec.exe 82 PID 820 wrote to memory of 4428 820 Topaz Video AI.exe 83 PID 820 wrote to memory of 4428 820 Topaz Video AI.exe 83
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\TopazVideoAI-5.3.4.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:988
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 040CBE3CBE092F8B6F400553AB3CB909 C2⤵
- Loads dropped DLL
PID:3144
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5D167B01C38D2626E14B01FC0B58EE0B C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Program Files\Topaz Labs LLC\Topaz Video AI\Topaz Video AI.exe"C:\Program Files\Topaz Labs LLC\Topaz Video AI\Topaz Video AI.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Program Files\Topaz Labs LLC\Topaz Video AI\crashpad_handler.exe"C:/Program Files/Topaz Labs LLC/Topaz Video AI/crashpad_handler.exe" "--attachment=main.tzlog=C:/Users/Admin/AppData/Roaming/Topaz Labs LLC/Topaz Video AI/logs/2024-10-17-12-42-47-Main.tzlog" "--database=C:/Users/Admin/AppData/Local/Temp/Topaz Labs LLC/Topaz Video AI/Crashes/db" "--metrics-dir=C:/Users/Admin/AppData/Local/Temp/Topaz Labs LLC/Topaz Video AI/Crashes/db" --url=https://submit.backtrace.io/topazlabs/b060552e9793d86dec356a038dee056ebd3b4d539c702a0e5c8f3760d7a99f98/minidump "--annotation=appName=Topaz Video AI" --annotation=appVersion=5.3.4 --annotation=email=Unspecified --annotation=format=minidump --annotation=machineId=9251837d-e9a5-4229-9a78-b1085d98b1bb --annotation=token=b060552e9793d86dec356a038dee056ebd3b4d539c702a0e5c8f3760d7a99f98 --initial-client-data=0x790,0x76c,0x778,0x78c,0x794,0x7ff625d53aa0,0x7ff625d53ab8,0x7ff625d53ad04⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4428
-
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D0B775AECC3D9017DA128E95B72E7C762⤵
- Loads dropped DLL
PID:4492
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding FC2F1C94B0F9AD6C1E28A3C6CF65057E E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:3284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD50feab4b747d01f59822a306925873c08
SHA197b39141728adc6efcfd92b84eeaed68c2507d01
SHA256254214426d7e612574c75c19aca77d23e39a6c866ae18165f1cdc15c69446892
SHA51289802d0d7bd32df612f43a0a4f5bd63ab2eef6b0ddfa2d7b4f7c9b96283f8a78610002b8b6ea5949f3249f702d862db00436e171f5338cbf51d144427f2dd288
-
Filesize
15KB
MD51610854027fc71a76df7167339dde9b8
SHA1e8563d6f42b1835a058bcc58ed440f5fdb5952d4
SHA2560399ac6728d5e1be09657fe1662a6a8749da42c126a2c15c8150f0291fec1ec2
SHA512df20826a27792474dfeae5820ca84d6d9100ac42a587552696af99fcbeba7ac85c918d93c9f5dacdc5414334a2041ab15282d020de91873944d3b4ef5a4fda7b
-
Filesize
16KB
MD50d1081b4a3dbeca79b7baaa902e98a6b
SHA173f28a30c69fc95ae72f70249df4f62537b8ecfa
SHA2564ae91c274902484463c53897aac04ace84fcdc30824999fbc202c1e276de1715
SHA512527c87edceffa0151aa48f56a88005f9134b3f52768f30b36ce5be2cb86f0cc6eb774aee00f6f094c48f8b46d8771c2a496e9c3dbf5753969e65808db24e0acd
-
Filesize
16KB
MD5b75b78c0e10f0d1835c6e0c539f42be8
SHA1a841b606fcb8b1349717eb84d5a80ddb4118c320
SHA25636dc97d474febe9142e4b2525c725ec07198b6e8c44bab314358836527153345
SHA512ca7e5c38dd3545c7caab95879ea1a2f0275461ddbe8b0f814f7a1f81ec93ae31359189758c334855caa3848b1eaac4569b08ed3b30d227f080aa9556279a591a
-
Filesize
16KB
MD5e4eeaf36b102ab7a3c666a216133a2ad
SHA1b5b798e58035416012168768b11bb0b0dbd6a918
SHA2561836feeacf231b57d46d9cbed760b70fb273c94cc87e052fb10ab7c8350b4cb6
SHA51235ee5da512381a70718896e10a2990ea3c98058031be0b2104c975310ce3512507504ee5d9b781e9a242b57770c6d8dd51f87bf835da0c1825158f4595481f98
-
Filesize
15KB
MD5bcfaae93e32666a6bfeb5bd62a5cd408
SHA18ef62d0a95f8ca511521efe23133bf31dbaef7b4
SHA25696cfaf32c4d3d18468c8da244145e05c740b79e03edf30f7312e148a1e373357
SHA512d594868b248d4b7c9630adc4262c803fdb211031b718bb1149c2d775ecf4899ea4ddd7ad577c320b9e9cff13330f629c4db5a60e2116a8fad866e7f330e4f261
-
Filesize
3KB
MD50a88e12fab493f179e0ede27497c1515
SHA1bffcb270bec3ebcc9b7d43357f1f7e6675b743e1
SHA2569aa197d49597b4029000785b9eee8165a0dac3cc1e6652b40741e47f5a1a240a
SHA512b954287025e90568eb3429fe739fae9a921fdac510ffff67f4e439b01be06fc0658f82db0001d3566d7a96824d211596825b74cd07d7f1b7101c61cc44679811
-
Filesize
3KB
MD5c832cfdc8357e96f7712007268f23479
SHA1de1e62480159978ce68e52a1fe77b4b2f302562d
SHA256612bcff872084f9cd29508d77e3e88a27c83d26b8914308bcc9a653343783f75
SHA5124b7625d2f48d43a1780109ddda830f8c17303518376ff1f9cecfab0dd1707e620f69d474a414e14f2f88029b2ba0205442976cd7b4e0249e7ea741fdbe7c4b62
-
Filesize
16KB
MD55efe764232a292abbf644da2fe6efa90
SHA1bf12545035e54969c3711b0425444a39286e97e8
SHA2563292cb0b65e4e754a89aec2183b352da6eb53df3fc7940ca84f19160cf204c57
SHA512ac29f31559828bcee57c5a00209070592566d92c4816da453805732143779e286472aacbbc2e2c6fe99388cb42f9ca62ebc58fff48ebc79e228a87d7a0155627
-
Filesize
16KB
MD5d23f1d42181982faa4e48cdd0b48650e
SHA1861249a5948b8f8f434375d9dd3ebaf7c7093967
SHA2563e1e9d2f48b7211d922c354fa7fcb7492f37ecaf33cd3868779dc2af55d4f8ac
SHA51234384b21aca9d6373ecbba6b31375dad3c34daf5b5d20535d7851c4f6c952a52b0ef27f2d0071f05d626511581c954f8c5f676338d35ee7b01836fee2a3008e9
-
Filesize
15KB
MD51f8823a728afae14330023e9a29e7011
SHA1b663d6dc0b2aed97d57b9e3c35c2eb4563f9e6d7
SHA25605120e787e47c9dd873b6a90fdee90f539535a746b0321369511a10bd4b52755
SHA51219d5ba1a1f3b6bf6b733980bf241c28a7c5e3722568990e57f245491ff586a83d987112dc4586bd629cf3112ed5e41c8552d34e2378283feaebf1501738c915a
-
Filesize
16KB
MD57a7d4bac805bfa090eb67134ec0a679e
SHA110dd84bdc6451bfcdbc3572b916b2f8becdd2ba9
SHA256d505ae55bbcea8f448af7b8f3c6f9cf89dd7641cf4b072f85c6ae5a03ea11d3a
SHA512b97f08883930f4904c72fcc2e83d7dfc0fcde43f6280a9ba0bb61fb9c1d8500ee7766dd892093f5827410add657e6fd2a3d9de34465f09b41439288634695e62
-
Filesize
15KB
MD5cb5aff330f5d6cd7e2b03da4c24ffbbb
SHA12166c2bcfe096217c6b96dcd6bb70a3674f3b7db
SHA2561881b9c9eddb157b802dd36c8edc65ad05cdccd2ba681bf1443ab61accc7c184
SHA5128bb05d9e6255deeb611cbd55ed04ca8cfa3e9e75df7becba944931717e91a067f866e77bd2bf5bb717af421b0062d6b9f8c1c89d2cb811a14547893b947ded33
-
Filesize
16KB
MD50a5c32e14442df5039f9a52c1a4e1bb9
SHA1b56bbdc02d2cf55417086c222d697620925b2aee
SHA25673884f0d47655a631e3ab1d6182416810968c196b165a499ff12a519759075b5
SHA512535d6be3e177b1437800ddcc71d26cd2aa75b268aed183e5881fe418699d68e6af768a524b9417260a31abddc0418bae87dfa6501fca6921484509a952eebce4
-
Filesize
16KB
MD5730f7220aa524f1bb4dc27c3dde436cf
SHA1a9ea35b837b7fa7501b673344b427c7da2eec17d
SHA256bdcf1ca9ed576ce36887070bc917bf114d7bc25adeac1bd9675945ca339ccfb6
SHA512749c47be319cee025274f3a13cdc2be90f39dccb2cba365e0a447453322ccf5ea40e5b3ddb7ca2b539d6cbe93ea038543a9d49ea11c664756a0bcc0bce5cfdec
-
Filesize
15KB
MD5a980b9d7f559a391c142165d1df9f8a6
SHA1a0d792e770163c70dbe3ea98f86c6f2dd829833f
SHA256b2130bd95b7ba455e042ccc3265397052cf81c5acbbf0782eefd948c274e7252
SHA512caba558ec1831fd3b5ead05f77df692bd26ac378f2a7e702580e424bfeaef00b7402a648b7e296ce98d232b28acd26c36668da3ff44434ad88c2fce39c7a8df9
-
Filesize
16KB
MD5a4c4b31c497be8b9bdb41550c3d69330
SHA1c9b65d79f79d0bc9076e39501b7610d67c0a85b1
SHA256fc2d3c287aa078a195bf6192600a689a686750df5ce80ec73d50b1a30bcd68fb
SHA512bbee351854445e51af1acdfc4f6271f77914799c679266c3ccd1757bad3278419febb5453d21537ed6cbb00fbdd71a9dc9152cd35d879c1048b9f781ae7c9ab8
-
Filesize
15KB
MD52676ca678c429d7b6ec492bfcee70d37
SHA1c589df32510dabf072201dd5d184dde0efdb1812
SHA2566daad44517f48d52ef9745f1dcedddc4445bc01fc0094ebfe3152ff82ca125e2
SHA5127b12a6043c873b2e442d75f599d44bd18b830e0793497c1611a082ebbee4831436c1ca77a5f90c55d75da84eff2a9ae29a260bee1722c33af53a0aca2360d398
-
Filesize
7KB
MD52a1f74958c7f0e99eb33c9abb420b362
SHA1217ba5788c0f0e1ab6f184308fb094c569400895
SHA25691edf7ba0031535455b5086fe63f752ad729bfb4a7db21fd476b9bb699c52361
SHA512ad5f440b4e5a36a1c1b9305c924bda4851ee98b0078dcb5dd826fbe03905096713add4d094af596a689935653249f440b584f2f7f4500d3271d2dd313f4c92b1
-
Filesize
5KB
MD5aa984cd18d40fdaf3edd271c666be0b8
SHA1094d91b52f32b98f944fd712126a64f17b7c300c
SHA2560e8ba99ccb1bf568e1df2ce96996e2955134824c412d680239f70af906686fcf
SHA512119bd6710c33d5ebb8b45350d4d742cc052002fa45b1cb16f5039a2a601310f7674d2547738df14cfd3bdd2ee17a39994680a9ad726c53d663085f84d2f7b6d0
-
Filesize
6KB
MD5f8bebf7bdfd5b785b130d9a9d55efc1d
SHA18e58ac923790310fe14027add261f30c87da8cf8
SHA2567af23e45c8dc4513f59b3d3106d4cf744c66a3fc51d89c79cb9b75c8f3d92619
SHA512590258c29b07739129a04fc0cddfd30ef30d973bf6295ae590bc9248f0b8d2b0be2597161ebcebacf31c2b5870c6ebf761aa112697cea067e723aa8b374d7403
-
Filesize
6KB
MD5138e7de0526469f6fe30be3a7a916da1
SHA1f57986d034af2cad48f18c0731dc7e1bb41ecdaf
SHA2569d792af085369c9aac64f8f058054b4f1a1191884bf649d26bd6702d94569948
SHA512a61b7d1b00bc94026d0b3a3869c40791c950820efe704694afeba9b7506585fbb4c10ead520afeae42293b2b7be82fb179e1c29339c0efcd498b03a55dfa2b3f
-
Filesize
6KB
MD53f2fafd095c8089f10d0d9fb26fa6c9e
SHA153ab664ecf33b88d5ff002cafd4c28c37a19a543
SHA256288de57ed3791709f6871cccdb0e033f97fb4f1d8d8459786385e2c7216134be
SHA5121784b98d41450da47014c5e956efdc81cf64439d0151dcba6ee4c46c65d1aba87a588ec7d3790301a876a47f4a23a647ebaa9e3e77a6e6d496f73b8b79aec574
-
Filesize
7KB
MD524fffa520cd11fa736dc05d5efa5c79c
SHA1d4018712e585e36154cb45902b7698534aca50a5
SHA25697f0ebc357553c7de9a1c365fb359c3d5899e789d20b259f1737c51d04885f6e
SHA51275bda7e7c0d32666e6fa87e4897235039a1f1da07fb18d9d3f985f242f91f20e0c14926c9ec111670c7304b971685044acabf3d014f18185730683d8aa8e5410
-
Filesize
785B
MD57c7b86dc885096030fe894c2b85239bd
SHA153c7b53122adeb80b6d54567d15f9d24054ec17f
SHA2564a6034be779a311d4eeb60010c4719b026dca670a435d156587cafbf5e655643
SHA512e0095c0acd2b3918adeb1b72aed929474f5de5ca79c8814f18d0a706ce5ba4ceaa01778b550c57645ef348e449c4bed40ad1b1d4ae88231fed9e8b292510c942
-
Filesize
2KB
MD517b9192d01aa3faa43c6211e91ec44f6
SHA12e0ca5e45c2feb5902bd780b4397d17072b27afe
SHA256e5eb84914d7a7a62c0b4800ea6e55145969c80d15c580c552465ecb1e8c3d2a9
SHA5125f8081f0928a94e695a1564224a77b59239bbcb8e423591f6af83a96b78411ffb7728603c70df37cb7761880abcd93e0fb32b90752880444c02817cce46558c3
-
Filesize
5KB
MD595edb9da265c288aace6d503375f3a2b
SHA14c794eb7cfab95236431914cf3a00de8c4e20f21
SHA256d073b682ca710a2e218bc44fad0bcec7717a0adc953728782f8858dc9e03c0f2
SHA51296a5891c8305db859e66a8575020f42d2cf0c92c7d0ca62036e4feca75ad90f62dbe5f67121857195b7430d6c9f4a0b6758390ade9f46bd1f4b3dc0cd5d9749c
-
Filesize
5KB
MD5cb0dbb84a98e34a7d216b80c6410086d
SHA1fa61f351ed77a2b61de9021f446b44027847eccf
SHA25665c2000fd5b39fff34430de6015a160b99f25f794e758acb93723496e91738b1
SHA5126b60a18fd78dc2ab1f52c86d9688f14b64a3048984f206ec84cd86ad9a1c04be25d9555a71e07fd07a5a659de3753d67dc227ef169819b1c7cd137d5a02dfca5
-
Filesize
6KB
MD56a5a5b5957b87c67bb19196994b8f00f
SHA1665be7c5667e66a9eed9e1892309a931d8fbaccd
SHA256f75a5ea5576c4077ec55e7eed0a3dbf23c1d0b8abd2585ef1b9b0d5aa5925096
SHA5125d6548ac03216cf14acfa1e76cd29d59e0743c8564c276437861fe396d4b13b62e368e52736d328b99583df0019066a74306fc19229ae3f1047b9a35f534a5c1
-
Filesize
5KB
MD577fa409e8e15fa6922e6060a0573ddbe
SHA1ebab63cc45a4767d9d27811fe11185b7a8730bae
SHA25636d351db704395ad1f085f1aac653c3b75b4cbbc44e676701bf20dc8b196f751
SHA512d5a47390c6321a7ff6ef85f83856d3932d6ebf502c043443bbcefd7617f453560e04d3059ecb06da9b2c7375452b0b960fb11d03dc921c33ec3337bae7a6d810
-
Filesize
6KB
MD5608c21974b1f7d71f02c6f1ca9a3e0b3
SHA1305bf15112d338c5250703734988714d5fd9a354
SHA256f7b3141bbe3d0fafcecd3bc85c56fce4bb209c5517d94de401c8a1843b73a64c
SHA5127d855d8581604b8bce4fa3095fc26f0d8e61833e9bf295bde62a6183783005d2ae0c82a3409dd6a0c6f6760e211b7c97025a69d78fb765fdc06c37bc43f3e2ac
-
Filesize
3KB
MD54fc5b03cc4a91ef843a62433ef66f861
SHA1f612b833ae923b14b03cfe5bc5f7faf5a580abb6
SHA25606434f4426a38fb50fa35940650fda60de0aeed5bd2a613e9e11a80b35a898d0
SHA51232359b087d866339a22863222ae4ca57428affcceae13aeec2539ca4014baee895f5cf14575096e8124ab15010e0130eafecc939ddbd400b4da8528ebc5026d2
-
Filesize
3KB
MD5ba85ed32ddd8751cde31da2c0eace2d7
SHA1996f21a603f0db04bd62be874d99fa63a10e1e2c
SHA25611461468fb3caede43be491734095e0789dc1ab4634929216b2d0bbf272f1efb
SHA5120d0dcecac6fb746a445703600f0f358cbd641c3cddfe5899fb5e2570b0825e399f65c67cac5bb29501149a7bbbed4bea15943f2f098f071b13db56fa5c3c6939
-
Filesize
17KB
MD5a4d4bf4774a28073b2956b02d463067a
SHA18a75246c634ed6d7921bb40ec0c956fc5448b6fe
SHA256db132914558bcf4c0652d224128e206f7a3dec9df3dc3e31e247af02edc4a75c
SHA512482dae8659fbf08dd0a3e010893a00b313afb287138b706406566d99ffc20403e3c324d246b8f89fd45fa858505a271c880009b0955e273d4a31e72e7143315b
-
Filesize
17KB
MD5d2b47f9be57e1bfb348176f28f56028d
SHA1d4c68c391a9c361c68a341db1e33f512dc58f34a
SHA25638200a80ff930569f924c1660e6d307f1ce9a16229d631c2d0c20cb906c9f397
SHA512b17e7153a3e78b1658f333041dd86ef37d9c04162feab62a4c8c5fb75e8a7ea58582ae8c146834c7d0e6ea3f448bfa8e8151e46a298038eac892c5938e601678
-
Filesize
16KB
MD50c1d841439f3221cb8766945db7f766b
SHA15b4202c91b0547097a595cade88ed47c57212fe3
SHA2563fb29f95615b11ecfafccc1c76aa645b1fe41322312154ae8f106dd64d46857c
SHA512ba4883c460f08f5d7081df4fe40d87accd8c7c7cb304eb0c5124fd863bd3a3de026863331796307ed27f684b460fc0113d9c573bf825cc86abf6c0c4d1ba6be9
-
Filesize
16KB
MD5ade0e41e00bcb4269d3dc71c65bb31de
SHA1cf82dcbc77dc339068201645628ccdde53f72b51
SHA2560ee835f0707ca361c81cee518c81c22c7471da04bbbe0c218b1d32a7bfbe0516
SHA512bc1169b3418758ab6581b8634ee6c3f002556a80839088c144ddc4720f5aa04685077b1b75df64658f2ae191facda3a21b262908540fd86b702243e9a764fc05
-
Filesize
16KB
MD52b513fbb105388c6c91d3ccabaa421ce
SHA1195f3fdd275a073f6ebbdacdbb58b435e8c58084
SHA256fe117ae1335d02297a36a12906e8daac4d174a7313511bbb78580110fa2c353f
SHA5128322fd42401679a6c0c562d765e26670143e38a445aa19684d683ab8dc078804d3f562b1ae8e02d51453a78baf4ead4e4e791fa078ae1671d7fc91c71034a20d
-
Filesize
15KB
MD597d9a9b2c606eeb19d87d2a253735bda
SHA1a50827c0f4833063519d55310f4ef18d79d123da
SHA2564a90a35e6a8a73e98cff4637c87e000201f54ec1fa7b0ad7f2ae1f1356951d61
SHA5126e2af393e9022518e58aaf00721af076846e397596d9842c8691135e4b07fc37aed6e62deeb06ddc82d81ddd39b9b08f1a0e6c64269ae36cfd0aa89f58cc0f0d
-
Filesize
16KB
MD5bd38533dcf457c3d648d6356c4b2ea8a
SHA133c625074c3811c1cd6a0ea7624ef3d32e413385
SHA25679b47da55c14b09a60e76e531e57bac869893c3d03fdbfc1da825101408759b7
SHA512572f28c0a3b3153c2d63a30ebb4b95faedae274b8c951a672d2b86d00c8932bdd255eb9cf6c365ca0e1048c1ffa74e68ab8b74bebf3237225997224502159e75
-
Filesize
15KB
MD583c8d2c967860bc6b06250984c600dbe
SHA1a01e08b69f71dc120e56ee8a00c4e014ed8fd415
SHA256d0a163e73cdb1a5ff42b3e04d1913d91834197d0f26b7e7428794a7bfb4e5c97
SHA51279321d6f9fd4a0d8e482364bcdf2729a486ab9b9ebf0619013b113f0baddb4aeda2afb3a35a58bbde6965264ea161618bb9005a22071e80ea8986bd2e886c08d
-
Filesize
17KB
MD5fa3689344434b6b4e63ea48d3bb5aca7
SHA1ae707a29b92ced7e881ce371b8743988dbc78ed6
SHA2563937e7dbaf13fb42f0818967b013cfeaaca179fab36b31e9d7c9db01711abb5d
SHA5124422ba3d6afc3c1855c0b2d803018d770420ef3504cf4b4d98ecea70b2682766f2fbc4d8805d40f06f8287c718d4090399cc222c78a6b7ada46a72613321d0a4
-
Filesize
17KB
MD5ea1aded31ea35c48a4ff2356f6a94e75
SHA1d336593869cb55d6872b03389cb01b00acf78a06
SHA256836c7507eb6ef8d0e5e86c97e9635c011805fe487323a15100ad4ed745f1b25f
SHA512868c9218883dab37722b66c2205dd96359d09965762e90e4c61747f15468d73c874bfe8e793c234c69cac739396484031eb42bee525c4d2ce70b75e00991a085
-
Filesize
16KB
MD5145a5494ff51f8c4a8c209f31a98a5e4
SHA1493ed36e8bf2727c8de4c45890b33310dad17144
SHA256615b2cc830a891777175a9321eb9c6b9bedc777343ef1e4f0164309c094d79bf
SHA5122e5bdbe040ebb8038c6a3dd901f2dcfe720a95e15715a2756e7a157b876e8a118be593a3b344e464657cc6f87a949ad2c4e79302b35f2e3a33a187e5b89a7191
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD565e2192e4dc04fc206f436f9a86e1023
SHA16435da8290f576c8604ddcddbb40bacd19458c8e
SHA2568df5fb73b8f3f863f2829e3911cd5446c5426437ec869bb87309c639ede8aec8
SHA512215b8f9c268587b4ba022e2d5374cfaa0d680a7f5277db9207367a4d9387d91ddefb4686c4449a6e80e473be6d67ddb7d80247586401c4dce9656a5e17290a31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_622FF18A3B1CFCB8CC579FBC66AAEA0E
Filesize727B
MD590d9d9e5322c7f6d53b5b5171ef7c804
SHA1c4c59c702635a5c4d80592383b602abd47ed588f
SHA256447a7dacd9b46ce5a60facfdc71c064f10eabf381cb805713172d9b1315e2e3c
SHA5127f2bc6f4f92ac0e02785b2f10ccb2abb385c2c4e9078e6b94cdbaa38ca6c22e0a8ab8ab900547617b56691f226c55f96a09965f191f4625591040edc45b6938d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD572db13da5fff7268cc2462be217daac9
SHA13eab5c472f6a341d752a3c38a9447db3eaeede10
SHA25608441bff263e0edff40c3d7b80737a4bfc3a0c93832daf1166bb512045282735
SHA5127d88cd7fc9371eae08d40e19f4d9f2204fa83716056d8ba5ba332eef278861907bc967b3e8f74c8a12e1be15f481ea7216c3ff669917943d462df3bc0c25de89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD52ced0a14a4ae20290dcd8c955ad9c041
SHA1445cbffcfc4baf978ef8adf3bbf3de76dc575c48
SHA2568a4a2a41611d2393ee8d24bce9880e4d943465506eb49558f8e500c9486e5d94
SHA512071229a4498fa435a642fa9e8b0fcfd7915f1e0570626d94f20f3554d535a2e7b7ca0164dde1bc5a484ad6e7c1d9f482152f0ecad761d534d484f7030e2a470d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_622FF18A3B1CFCB8CC579FBC66AAEA0E
Filesize404B
MD503d042dedc90f4d0bfe8428afa594a67
SHA186e3eea1336ae9e25a89001e70247c5bfb5f1c79
SHA256ece0dbfb70599357ff2192c3ce3bb7beae76173c1dd269868d2c27f0b12c1cc2
SHA512a191c667ef98c44457aa5eb57b0a8f45c52517864efda1962dd62a5e78a634a2b73d1d8c014ef6ae1b424fe7be1f8bec2fd9df1bfc41f3598d3ce893ade01f53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD5498c4eae92d5205632653646845ea193
SHA1251204c80bd6739629d8990dcc3018a4a91d8613
SHA256538b9e324176d638e9b5e8cd983b589bf29075b83e0d707b1d9cdb3551913d11
SHA51265c581e09f8ba1ffb115cd5b3e31a4d451249e370df76d8a239f2d4f9819b95ba4a71742208a9cbff4599b494e21e63c0e09e2cd5cf729a8d59b79bc90bc2277
-
Filesize
1.0MB
MD57b269dc43386d749c69d6c7032b5d69e
SHA133fe67ce3629bf6d350150b4ce03c066fb068f5f
SHA2563e97760c51ee6263498b03e6fa353856155541105600946dea4a0cd0b9b1f792
SHA512136149782dd19297028db427ff941542362890d126fbb720135c50c39f952dcbbbad1f493dc01d12f62e596a3a5b282fb34f5c14440cecec1b2c990297e9345a
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
C:\Users\Admin\AppData\Local\Temp\Topaz Labs LLC\Topaz Video AI\Crashes\db\reports\a69a1755-537b-4698-9679-9b60e90ba8fd.dmp
Filesize8.6MB
MD50d4ae74369f8925ad158f4a828f800ba
SHA18f56ad9834dfa8aaa5bd0546b2e9e62f95b49dbb
SHA256978ba81996e5b2b7aeb3ee2f2ac1bf2cefaea566e7137b82a80ba59e85a697d9
SHA512484c84933a5253e8137adc364ee978b582a1def13fafdf11c19bccb6e391b5684fcc24015b67552e182a5f2e8d6e73a412254788fc2709bef812522500d39d4d
-
Filesize
154KB
MD5b2e2c24ebce4f188cf28b9e1470227f5
SHA19de61721326d8e88636f9633aa37fcb885a4babe
SHA256233f5e43325615710ca1aa580250530e06339def861811073912e8a16b058c69
SHA512343ea590c7f6b682b3b3e27fd4ab10ffeded788c08000c6dd1e796203f07bf9f8c65d64e9d4b17ce0da8eb17aaf1bd09c002359a89a7e5ab09cf2cb2960e7354