c55e0db91810cc83a32037a31115c8c5df85e8aa83f077a9483ca484b8a671cb

Analysis

user interaction
yes
max time kernel
899s
max time network
640s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:55

Target
Topaz Video AI 3.1.10 (lofix).zip
Size 649.8MB
Sample260720-ccapyacs2k
SHA256 c55e0db91810cc83a32037a31115c8c5df85e8aa83f077a9483ca484b8a671cb
MD5 89734e217294cded2e7fea5df35787af
SHA1 2699c222885d17648dd3cf78407d039573189701
SHA512 3e48b1b2e3b5cbbf969024a3c4ebe7f0a94f02abd4f38a6900a7d435933aff971b08cc6a0dd0fad4fb3de36ff596953287f4adab20629959551b39a4de9678dc
SSDEEP 12582912:SsQzkuDBw7RooufGccewq5ERwAeeHnpgKLwi3Z/8jBHilhK2YEQESCyJ+rQDS+G/:SsQzHN4fe9mlpdLwi3ZkjBilhFhSCyJO
TLSH
T1BE6933926812DE3C718C4FE44E3A48DA78336CFE7C2C2BA5E4015735B85949A2F947B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
5656	NOTEPAD.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Topaz Video AI 3.1.10 (lofix).zip"
1⤵
PID:3232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4116

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4008