Overview

overview

7

Static

static

1

Boris FX H...in.exe

windows10-2004-x64

3

Boris FX H...in.exe

windows11-21h2-x64

Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • max time kernel
    49s
  • max time network
    60s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    20/04/2026, 22:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    Boris FX Hub Launcher_Vegas Pro-win.exe
  • Size 34.8MB
  • Sample260420-2pexvsey2p
  • SHA256 34f9d12d87b1e12cd6aecfe425d3a42dc26e49885e5e46703d575510b5cc2589
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutioninstallerpersistenceransomware

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Drops file in System32 directory 23 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 18 IoCs
  • Executes dropped EXE 13 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 48 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Boris FX Hub Launcher_Vegas Pro-win.exe
    "C:\Users\Admin\AppData\Local\Temp\Boris FX Hub Launcher_Vegas Pro-win.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\7zSCA721468\bfxhublauncher.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSCA721468\bfxhublauncher.exe" vc_redist.x64.exe /quiet /norestart & "Boris FX Hub Launcher_Vegas Pro-win.exe" -log
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Users\Admin\AppData\Local\Temp\7zSCA721468\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSCA721468\vc_redist.x64.exe" /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Windows\Temp\{5558D4DF-CCB8-4FE5-B1A1-4C1CC5477786}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{5558D4DF-CCB8-4FE5-B1A1-4C1CC5477786}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\7zSCA721468\vc_redist.x64.exe" -burn.filehandle.attached=780 -burn.filehandle.self=784 /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2380
          • C:\Windows\Temp\{BC1B4B51-80B1-4A1C-BED4-F906A2A43047}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{BC1B4B51-80B1-4A1C-BED4-F906A2A43047}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{CFD1F994-EFF6-4FE5-BD04-379C47D341C5} {3DCBAE99-50DB-45B5-9F6F-4F417826F29D} 2380
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2872
      • C:\Users\Admin\AppData\Local\Temp\7zSCA721468\Boris FX Hub Launcher_Vegas Pro-win.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSCA721468\Boris FX Hub Launcher_Vegas Pro-win.exe" -log
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3856
        • C:\Users\Admin\AppData\Local\BorisFX\Boris FX Hub Launcher\Hub\BorisFXHub-1.1.61-win\BorisFXHub-1.1.61-win.exe
          "C:\Users\Admin\AppData\Local\BorisFX\Boris FX Hub Launcher\Hub\BorisFXHub-1.1.61-win\BorisFXHub-1.1.61-win.exe" /VERYSILENT /SP- /CLOSEAPPLICATIONS
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4400
          • C:\Users\Admin\AppData\Local\Temp\is-4FTI25LJSL.tmp\BorisFXHub-1.1.61-win.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-4FTI25LJSL.tmp\BorisFXHub-1.1.61-win.tmp" /SL5="$A01FE,107376243,903680,C:\Users\Admin\AppData\Local\BorisFX\Boris FX Hub Launcher\Hub\BorisFXHub-1.1.61-win\BorisFXHub-1.1.61-win.exe" /VERYSILENT /SP- /CLOSEAPPLICATIONS
            5⤵
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4764
            • C:\Windows\system32\sc.exe
              "C:\Windows\system32\sc.exe" stop bfxhelper
              6⤵
              • Launches sc.exe
              PID:3264
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\SelfDelete.bat""
              6⤵
                PID:4748
              • C:\Program Files\BorisFX\Boris FX Hub\vc_redist.x64.exe
                "C:\Program Files\BorisFX\Boris FX Hub\vc_redist.x64.exe" /silent
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:956
                • C:\Windows\Temp\{6C369551-8FBA-48A1-9CF5-1FE1F97A1028}\.cr\vc_redist.x64.exe
                  "C:\Windows\Temp\{6C369551-8FBA-48A1-9CF5-1FE1F97A1028}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\BorisFX\Boris FX Hub\vc_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /silent
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3220
                  • C:\Windows\Temp\{5884FDED-FBF5-45BB-B08E-B533CE76A8ED}\.be\VC_redist.x64.exe
                    "C:\Windows\Temp\{5884FDED-FBF5-45BB-B08E-B533CE76A8ED}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6673BCE9-880F-447F-9717-DD65CD534F25} {3736AE27-DA06-4785-A806-53146312DCEC} 3220
                    8⤵
                    • Adds Run key to start application
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1864
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1432
                    8⤵
                    • Program crash
                    PID:488
              • C:\Program Files\BorisFX\Boris FX Hub\bfx-license-tool\vcredist_x64.exe
                "C:\Program Files\BorisFX\Boris FX Hub\bfx-license-tool\vcredist_x64.exe" /silent
                6⤵
                  PID:2900
                  • C:\Windows\Temp\{BF3832D1-EEF9-44FD-87CC-61CBB551717E}\.cr\vcredist_x64.exe
                    "C:\Windows\Temp\{BF3832D1-EEF9-44FD-87CC-61CBB551717E}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Program Files\BorisFX\Boris FX Hub\bfx-license-tool\vcredist_x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /silent
                    7⤵
                      PID:1504
                  • C:\Windows\system32\sc.exe
                    "C:\Windows\system32\sc.exe" create bfxhelper start= auto binPath= "C:\Program Files\BorisFX\Boris FX Hub\borisfxhelper.exe"
                    6⤵
                    • Launches sc.exe
                    PID:3176
                  • C:\Windows\system32\sc.exe
                    "C:\Windows\system32\sc.exe" description bfxhelper "Boris FX Hub Helper Service"
                    6⤵
                    • Launches sc.exe
                    PID:416
                  • C:\Windows\system32\sc.exe
                    "C:\Windows\system32\sc.exe" config bfxhelper DisplayName= "Boris FX Hub Helper"
                    6⤵
                    • Launches sc.exe
                    PID:1940
                  • C:\Windows\system32\sc.exe
                    "C:\Windows\system32\sc.exe" start bfxhelper
                    6⤵
                    • Launches sc.exe
                    PID:2156
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Boris FX Hub" dir=in protocol=UDP profile=private action=allow program="C:\Program Files\BorisFX\Boris FX Hub\Boris FX Hub.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:1884
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Boris FX Hub" dir=in protocol=TCP profile=private action=allow program="C:\Program Files\BorisFX\Boris FX Hub\Boris FX Hub.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:864
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Boris FX Hub" dir=in protocol=UDP profile=public action=allow program="C:\Program Files\BorisFX\Boris FX Hub\Boris FX Hub.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:3980
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Boris FX Hub" dir=in protocol=TCP profile=public action=allow program="C:\Program Files\BorisFX\Boris FX Hub\Boris FX Hub.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:572
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\SelfDelete.bat""
                    6⤵
                      PID:1060
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\SelfDelete.bat""
                      6⤵
                        PID:4852
                  • C:\Program Files\BorisFX\Boris FX Hub\Boris FX Hub.exe
                    "C:\Program Files\BorisFX\Boris FX Hub\Boris FX Hub.exe" -trial "Vegas Pro"
                    4⤵
                      PID:1608
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:4512
              • C:\Windows\system32\srtasks.exe
                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3416
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Enumerates connected drives
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1604
              • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
                1⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:432
                • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420184624.log"
                  2⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1636
                  • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420184624.log"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3904
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3220 -ip 3220
                1⤵
                  PID:4856
                • C:\Program Files\BorisFX\Boris FX Hub\borisfxhelper.exe
                  "C:\Program Files\BorisFX\Boris FX Hub\borisfxhelper.exe"
                  1⤵
                    PID:4016
                  • C:\Windows\system32\LogonUI.exe
                    "LogonUI.exe" /flags:0x4 /state0:0xa39f2855 /state1:0x41c64e6d
                    1⤵
                      PID:4180

                    Network

                          MITRE ATT&CK Enterprise v16

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          System Services

                          2
                          T1569

                          Service Execution

                          2
                          T1569.002

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          3
                          T1543

                          Windows Service

                          3
                          T1543.003

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          3
                          T1543

                          Windows Service

                          3
                          T1543.003

                          Defense Evasion

                          Impair Defenses

                          2
                          T1562

                          Disable or Modify System Firewall

                          1
                          T1562.004

                          Modify Registry

                          1
                          T1112

                          Credential Access

                          Discovery

                          Peripheral Device Discovery

                          2
                          T1120

                          Query Registry

                          3
                          T1012

                          System Information Discovery

                          3
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Service Stop

                          1
                          T1489

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          e58f84b.rbs
                          • Path C:\Config.Msi\e58f84b.rbs
                          • Size 19KB
                          • SHA256 0465538d96b2a6c9ac26f6584bf5ab6e64ab233a719f2187ce85f0150dda3a54
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          e58f857.rbs
                          • Path C:\Config.Msi\e58f857.rbs
                          • Size 19KB
                          • SHA256 ca1391fca949901bb957ffab88b68d7636477d8bac383c335880335bcfdd80e2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          e58f85e.rbs
                          • Path C:\Config.Msi\e58f85e.rbs
                          • Size 21KB
                          • SHA256 a932ed1eec6f680846fd69047ac55397e96d6b8c3b85c7e0647b36f9130aa3d2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          e58f86d.rbs
                          • Path C:\Config.Msi\e58f86d.rbs
                          • Size 21KB
                          • SHA256 4177e2c071fef3591e5552036b6e707256d78c483e730892335489e2d79833ac
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Boris FX Hub.exe
                          • Path C:\Program Files\BorisFX\Boris FX Hub\Boris FX Hub.exe
                          • Size 27.7MB
                          • SHA256 b3ae088cf60976db68e5f0ad44373286738975c1c56b173da86a38ff39fa841a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vcredist_x64.exe
                          • Path C:\Program Files\BorisFX\Boris FX Hub\bfx-license-tool\vcredist_x64.exe
                          • Size 14.6MB
                          • SHA256 b9ee625d3080f99b1e304b8404192e82ab13126854610f33d7bbba258c307b08
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          borisfxhelper.exe
                          • Path C:\Program Files\BorisFX\Boris FX Hub\borisfxhelper.exe
                          • Size 1.1MB
                          • SHA256 d4c50a346914640d245f407879cbd898fc312cab927c2943ac5af9a7adf51a34
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          is-SVLKWMMYV1.tmp
                          • Path C:\Program Files\BorisFX\Boris FX Hub\qml\QtQuick\Controls\Universal\is-SVLKWMMYV1.tmp
                          • Size 1KB
                          • SHA256 78b5fc58e6d881d16351e92d32b8cadea6b14fbf8c20c1bc7e56d02946467ae8
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          is-PEAP93N1O8.tmp
                          • Path C:\Program Files\BorisFX\Boris FX Hub\qml\QtQuick\Controls\Windows\is-PEAP93N1O8.tmp
                          • Size 215B
                          • SHA256 a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          helper.log
                          • Path C:\ProgramData\BorisFX\Boris FX Hub\helper.log
                          • Size 185B
                          • SHA256 aedc0a44d0edf02aebcd5739c739ec90f4c7f03b3caa1c241deae7490d3576dd
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          install_log.txt
                          • Path C:\Users\Admin\AppData\Local\BorisFX\Logs\Boris FX Hub Installer\install_log.txt
                          • Size 554B
                          • SHA256 0e500d35a2e2a35a025b00d42f33e6ac8dc8bc272abec39fc7dddf13631e12a7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Boris FX Hub Launcher_Vegas Pro-win.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\Boris FX Hub Launcher_Vegas Pro-win.exe
                          • Size 983KB
                          • SHA256 91d302787fd7e69256763d8e482d3825728c11082cc04117c2206e3c0ad32221
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Qt6Core.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\Qt6Core.dll
                          • Size 5.5MB
                          • SHA256 d432c183b37f8d6918e74b7989341a03835f404cf8416eb09eb5bd454c685118
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Qt6Gui.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\Qt6Gui.dll
                          • Size 7.4MB
                          • SHA256 f2fab457a82c132268fb00db9a62b3910055445de3baec5df6ebce43e7451c62
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Qt6Network.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\Qt6Network.dll
                          • Size 1.3MB
                          • SHA256 7b81a00d8b235e3fd8157d163e169f5366ddc668cb6d11e81c20b95d6223e3c1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Qt6Widgets.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\Qt6Widgets.dll
                          • Size 5.8MB
                          • SHA256 972df3c7b9123105f7cb66b9d1a1541cb5b787efd487008374c5a31c73fcd056
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          bfxhublauncher.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\bfxhublauncher.exe
                          • Size 190KB
                          • SHA256 0bd65e610cf70e43c5754df83e2bba7d19716ef91e6ccfa9c7b0c12fdc9beec9
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          qgif.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\imageformats\qgif.dll
                          • Size 56KB
                          • SHA256 fd5d11fdce1684a7f1962d3821cae94c5b727c4b0930722e8bc4220b6737fcd6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          qico.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\imageformats\qico.dll
                          • Size 54KB
                          • SHA256 1f158f467db1ece67770cba738bc57a7e5bf99df1b2ef3040a03d334f3ff6c45
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          qjpeg.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\imageformats\qjpeg.dll
                          • Size 454KB
                          • SHA256 321d8f671bd263106fff75f31b4cd06ce6efd9bcbe334fe551ae6c609725c10e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          qwindows.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\platforms\qwindows.dll
                          • Size 829KB
                          • SHA256 063c2585693384303e413d4c7ee5a47a84e387ee3831b11a4bce488a4e34c27f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          qwindowsvistastyle.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\styles\qwindowsvistastyle.dll
                          • Size 147KB
                          • SHA256 522ba7a8a62ddc3060901bf14aecf5b2a06616e807426fc599e3290bea6ccaad
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          qcertonlybackend.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\tls\qcertonlybackend.dll
                          • Size 105KB
                          • SHA256 a1a9ecae5bdd3ba22d18486941df78cfed00bdfc9992ed289e2626b06bef5b77
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          qopensslbackend.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\tls\qopensslbackend.dll
                          • Size 307KB
                          • SHA256 1029674424dd0a57a1254df4c874c9a4ae722677767e95592dcdbb75c70eb8c4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          qschannelbackend.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\tls\qschannelbackend.dll
                          • Size 221KB
                          • SHA256 27bd5f092cffe35983482508abaee2dedf79cedf36c38bf98d4c1db8c77cc580
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vc_redist.x64.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\7zSCA721468\vc_redist.x64.exe
                          • Size 24.4MB
                          • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SelfDelete.bat
                          • Path C:\Users\Admin\AppData\Local\Temp\SelfDelete.bat
                          • Size 276B
                          • SHA256 507ea541617f8858c181eb7c4b6d27b6303fe659f34b750b3aa3ef5d92c6aab6
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dd_vcredist_amd64_20260420184624.log
                          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420184624.log
                          • Size 15KB
                          • SHA256 e0b129c6de75f28210f2d66277a12837f6ee03f7c6ecf957fa4bc1648a9564a2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dd_vcredist_amd64_20260420184624_000_vcRuntimeMinimum_x64.log
                          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420184624_000_vcRuntimeMinimum_x64.log
                          • Size 2KB
                          • SHA256 27431cfb7a582873b4a7133496f855f2f7d53a8f027ea7998a5ca525f11329c0
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dd_vcredist_amd64_20260420184624_001_vcRuntimeAdditional_x64.log
                          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420184624_001_vcRuntimeAdditional_x64.log
                          • Size 2KB
                          • SHA256 4b0bf657546bad6ba73b7f73f634272f67f347b4e311bfd93df61e2f4cd85d52
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          BorisFXHub-1.1.61-win.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\is-4FTI25LJSL.tmp\BorisFXHub-1.1.61-win.tmp
                          • Size 4.2MB
                          • SHA256 1fb73e9e7ffa625fd3f8e784a10d09415e71c47379910c64367ce7e981c171b7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vc_redist.x64.exe
                          • Path C:\Windows\Temp\{5558D4DF-CCB8-4FE5-B1A1-4C1CC5477786}\.cr\vc_redist.x64.exe
                          • Size 670KB
                          • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cab2C04DDC374BD96EB5C8EB8208F2C7C92
                          • Path C:\Windows\Temp\{5884FDED-FBF5-45BB-B08E-B533CE76A8ED}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                          • Size 5.4MB
                          • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cab5046A8AB272BF37297BB7928664C9503
                          • Path C:\Windows\Temp\{5884FDED-FBF5-45BB-B08E-B533CE76A8ED}\cab5046A8AB272BF37297BB7928664C9503
                          • Size 964KB
                          • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vcRuntimeAdditional_x64
                          • Path C:\Windows\Temp\{5884FDED-FBF5-45BB-B08E-B533CE76A8ED}\vcRuntimeAdditional_x64
                          • Size 208KB
                          • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vcRuntimeMinimum_x64
                          • Path C:\Windows\Temp\{5884FDED-FBF5-45BB-B08E-B533CE76A8ED}\vcRuntimeMinimum_x64
                          • Size 208KB
                          • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          BootstrapperApplicationData.xml
                          • Path C:\Windows\Temp\{91D5BD3C-9B6B-41C6-8B6E-80E5BD808606}\.ba\BootstrapperApplicationData.xml
                          • Size 14KB
                          • SHA256 8c81100f594e3d0bc51e5571e0046f016086207c1c382d45708c30e1d732b648
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          license.rtf
                          • Path C:\Windows\Temp\{91D5BD3C-9B6B-41C6-8B6E-80E5BD808606}\.ba\license.rtf
                          • Size 9KB
                          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          thm.wxl
                          • Path C:\Windows\Temp\{91D5BD3C-9B6B-41C6-8B6E-80E5BD808606}\.ba\thm.wxl
                          • Size 2KB
                          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          thm.xml
                          • Path C:\Windows\Temp\{91D5BD3C-9B6B-41C6-8B6E-80E5BD808606}\.ba\thm.xml
                          • Size 8KB
                          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          logo.png
                          • Path C:\Windows\Temp\{BC1B4B51-80B1-4A1C-BED4-F906A2A43047}\.ba\logo.png
                          • Size 1KB
                          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          wixstdba.dll
                          • Path C:\Windows\Temp\{BC1B4B51-80B1-4A1C-BED4-F906A2A43047}\.ba\wixstdba.dll
                          • Size 215KB
                          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vcredist_x64.exe
                          • Path C:\Windows\Temp\{BF3832D1-EEF9-44FD-87CC-61CBB551717E}\.cr\vcredist_x64.exe
                          • Size 917KB
                          • SHA256 8c13a649c567be84e4e3a262689f6b59dcde3e9f8b0037869710fc693b2bc0ff
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          license.rtf
                          • Path C:\Windows\Temp\{CA238E88-9602-4F84-A600-043B0D27E9C6}\.ba\1055\license.rtf
                          • Size 177KB
                          • SHA256 f79108a254f876e0f6bbcb05a9effbe25dc252e7ea256bfe3fd28ceb79737f25
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          memory/432-2008-0x0000000003560000-0x00000000035AA000-memory.dmp
                          Download

                          memory/956-2078-0x00000000031F0000-0x000000000323A000-memory.dmp
                          Download

                          memory/1504-2134-0x00000000029E0000-0x0000000002A2A000-memory.dmp
                          Download

                          memory/1604-2208-0x0000025E3A7A0000-0x0000025E3A7AC000-memory.dmp
                          Download

                          memory/1604-2207-0x0000025E3A620000-0x0000025E3A6CF000-memory.dmp
                          Download

                          memory/1608-2195-0x00007FFC97960000-0x00007FFC97E55000-memory.dmp
                          Download

                          memory/1608-2196-0x00007FFC96DC0000-0x00007FFC97385000-memory.dmp
                          Download

                          memory/1636-2199-0x0000000002820000-0x000000000286A000-memory.dmp
                          Download

                          memory/1864-2182-0x0000000002A00000-0x0000000002A4A000-memory.dmp
                          Download

                          memory/1964-69-0x0000000000730000-0x000000000077A000-memory.dmp
                          Download

                          memory/2380-111-0x0000000000FA0000-0x0000000000FEA000-memory.dmp
                          Download

                          memory/2872-109-0x0000000000A70000-0x0000000000ABA000-memory.dmp
                          Download

                          memory/2900-2135-0x00000000027E0000-0x000000000282A000-memory.dmp
                          Download

                          memory/3220-2077-0x0000000003290000-0x00000000032DA000-memory.dmp
                          Download

                          memory/3416-193-0x0000016C26EE0000-0x0000016C26F8F000-memory.dmp
                          Download

                          memory/3856-194-0x000001996F660000-0x000001996F70F000-memory.dmp
                          Download

                          memory/3856-2148-0x00007FFCA9B30000-0x00007FFCA9B5F000-memory.dmp
                          Download

                          memory/3856-2144-0x00007FFCAA850000-0x00007FFCAA86B000-memory.dmp
                          Download

                          memory/3856-2141-0x00007FFC9ED40000-0x00007FFC9EDCE000-memory.dmp
                          Download

                          memory/3856-124-0x00007FFC99FD0000-0x00007FFC9A595000-memory.dmp
                          Download

                          memory/3856-2146-0x00007FFCAA990000-0x00007FFCAA99C000-memory.dmp
                          Download

                          memory/3856-2147-0x00007FFCAA960000-0x00007FFCAA969000-memory.dmp
                          Download

                          memory/3904-2198-0x0000000002B10000-0x0000000002B5A000-memory.dmp
                          Download

                          memory/4400-2192-0x0000000000420000-0x000000000050B000-memory.dmp
                          Download

                          memory/4400-208-0x0000000000420000-0x000000000050B000-memory.dmp
                          Download

                          memory/4400-1976-0x0000000000420000-0x000000000050B000-memory.dmp
                          Download

                          memory/4512-159-0x0000020963620000-0x00000209636CF000-memory.dmp
                          Download

                          memory/4512-2209-0x0000020963620000-0x00000209636CF000-memory.dmp
                          Download

                          memory/4764-2191-0x00000000006B0000-0x0000000000AF5000-memory.dmp
                          Download

                          memory/4764-1977-0x00000000006B0000-0x0000000000AF5000-memory.dmp
                          Download

                          memory/5100-112-0x0000000001280000-0x00000000012CA000-memory.dmp
                          Download