Analysis
- user interaction
yes - max time kernel
1217s - max time network
1262s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/07/2026, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
Topaz.Photo.Pro.1.6.1.x64.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral2
Sample
Topaz.Photo.Pro.1.6.1.x64.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
600 seconds
General
- Target Topaz.Photo.Pro.1.6.1.x64.rar
- Size 963.1MB
- Sample260726-2cp73asvas
- SHA256 b90a52f46b4c9cceda28cfe70ca42c855a5581726ed1aadc7815f627bb797457
- MD5 dca506c93bbda9eeebb0abbc974c7ca8
- SHA1 1d9b1a391c5037248288ffce354a43cd8cc9624d
- SHA512 a5f8777e795b0de5dbab07871b38587abd92183f63f7a9fd0aa34682258a195a82bcaa95a21d1d39120d61f3c61da5c74530d238fd7a5b4a6088999c6d476f08
- SSDEEP 25165824:75WtQXjCj5RtMNB0zxpN6cCR6xHn8I9pXcrawKQ:nCjZLxjnrLwvKQ
- TLSH T116A9335E02F228F0DB2DEB7299AA517FC2B45FC44C15376EFAE68754B8240E65F244E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 2 IoCs
pid Process 5928 Topaz Photo.exe 4456 crashpad_handler.exe - Loads dropped DLL 64 IoCs
pid Process 1588 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 4380 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 2484 MsiExec.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 23 4380 MsiExec.exe 24 4380 MsiExec.exe 25 4380 MsiExec.exe 26 4380 MsiExec.exe 26 4380 MsiExec.exe 23 4380 MsiExec.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini explorer.exe File opened for modification C:\Users\Public\desktop.ini explorer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini explorer.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in System32 directory 34 IoCs
description ioc Process File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\vcruntime140_threads.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2AFD0F2A990690F73D679630FBA93C68 MsiExec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2AFD0F2A990690F73D679630FBA93C68 MsiExec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 MsiExec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 MsiExec.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 MsiExec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Basic\PageIndicator.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\Qt6LabsPlatform.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Windows\impl\CheckIndicator.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Windows\Frame.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\networkinformation\qnetworklistmanager.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\combobox-background-hovered.png msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Fusion\impl\RadioIndicator.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Imagine\SwipeDelegate.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\editablecombobox-popup-background-hovered-open.png msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Fusion\ToolTip.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\checkbox-indicator-checked.png msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\DelayButton.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Basic\ProgressBar.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\translations\qt_lv.qm msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Dialogs\quickimpl\qml\+Material\FolderDialog.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Material\ToolBar.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Basic\Dialog.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Basic\CalendarModel.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Fusion\ScrollBar.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Window\quickwindow.qmltypes msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\translations\qt_hu.qm msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Fusion\SpinBox.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Fusion\Pane.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\pageindicatordelegate-indicator.png msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\translations\qt_ko.qm msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\Basic\SelectionRectangle.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQml\WorkerScript\workerscriptplugin.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\lensfun\db\slr-tokina.xml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\TNetwork\networkplugin.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\checkbox-indicator.png msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Dialogs\quickimpl\qml\+Imagine\FolderBreadcrumbBar.qml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\checkbox-indicator-hovered.png msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\NativeStyle\qtquickcontrols2nativestyleplugin.dll msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\lensfun\db\slr-samyang.xml msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe File created C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected] msiexec.exe - Drops file in Windows directory 35 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI11C6.tmp msiexec.exe File created C:\Windows\Fonts\Inter-SemiBold.ttf msiexec.exe File opened for modification C:\Windows\Installer\MSIF11.tmp msiexec.exe File opened for modification \??\c:\windows\installer\{b5d90c77-78c0-4fff-b81e-797f404ec750}\topaz_photo.exe explorer.exe File created C:\Windows\SystemTemp\~DF421646EA08C31B69.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF2786CA9D9166A9C0.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{B5D90C77-78C0-4FFF-B81E-797F404EC750} msiexec.exe File opened for modification C:\Windows\Installer\MSIF29B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF56C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI10DA.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Fonts\Inter-Regular.ttf msiexec.exe File created C:\Windows\Installer\{B5D90C77-78C0-4FFF-B81E-797F404EC750}\Topaz_Photo.exe msiexec.exe File created C:\Windows\Installer\e5ba976.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI436E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1205.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5ba96b.msi msiexec.exe File created C:\Windows\SystemTemp\~DF1E87FDC14CACC25A.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIFBF4.tmp msiexec.exe File created C:\Windows\Installer\DerandomizedSymbolicLinksForSourceLists\TopazPhoto-1.6.1.msi MsiExec.exe File opened for modification C:\Windows\Installer\MSI106B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1138.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI143A.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE1D1.tmp msiexec.exe File created C:\Windows\Fonts\Inter-Medium.ttf msiexec.exe File opened for modification C:\Windows\Installer\MSI44D7.tmp msiexec.exe File created C:\Windows\Installer\e5ba96b.msi msiexec.exe File opened for modification C:\Windows\Installer\{B5D90C77-78C0-4FFF-B81E-797F404EC750}\Topaz_Photo.exe msiexec.exe File created C:\Windows\SystemTemp\~DFB9173C344DCF1C39.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF4CE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF70.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI13CC.tmp msiexec.exe File opened for modification C:\Windows\Installer\{B5D90C77-78C0-4FFF-B81E-797F404EC750}\Topaz_Photo.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000508ea0cb0cbd3e300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801508ea0cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101508ea0cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3508ea0cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6508ea0cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main explorer.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe - Modifies data under HKEY_USERS 12 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\topaz-photo\shell\open\command\ = "\"C:\\Program Files\\Topaz Labs LLC\\Topaz Photo\\Topaz Photo.exe\" \"%1\"" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77C09D5B0C87FFF48BE197F704E47C05\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Desktop\\Topaz.Photo.Pro.1.6.1.x64\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77C09D5B0C87FFF48BE197F704E47C05\SourceList\LastUsedSource = "n;2;C:\\Users\\Admin\\Desktop\\Topaz.Photo.Pro.1.6.1.x64\\" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\77C09D5B0C87FFF48BE197F704E47C05\Complete msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77C09D5B0C87FFF48BE197F704E47C05\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{0F95D339-5E98-4615-B33E-CA156694A845} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).right = "1121" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\1\0\0\NodeSlot = "10" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ NOTEPAD.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77C09D5B0C87FFF48BE197F704E47C05\InstanceType = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77C09D5B0C87FFF48BE197F704E47C05\PackageCode = "E12E2D1E5CE342849A3F60A6DA0B3CDC" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\77C09D5B0C87FFF48BE197F704E47C05 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77C09D5B0C87FFF48BE197F704E47C05\SourceList\PackageName = "TopazPhoto-1.6.1.msi" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3944 NOTEPAD.EXE - Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 3440 explorer.exe 3440 explorer.exe 5928 Topaz Photo.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2964 msiexec.exe 2964 msiexec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 2484 MsiExec.exe 3440 explorer.exe 3440 explorer.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe 5928 Topaz Photo.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3468 7zFM.exe 3440 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3468 7zFM.exe Token: 35 3468 7zFM.exe Token: SeSecurityPrivilege 3468 7zFM.exe Token: SeShutdownPrivilege 4672 msiexec.exe Token: SeIncreaseQuotaPrivilege 4672 msiexec.exe Token: SeSecurityPrivilege 2964 msiexec.exe Token: SeCreateTokenPrivilege 4672 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4672 msiexec.exe Token: SeLockMemoryPrivilege 4672 msiexec.exe Token: SeIncreaseQuotaPrivilege 4672 msiexec.exe Token: SeMachineAccountPrivilege 4672 msiexec.exe Token: SeTcbPrivilege 4672 msiexec.exe Token: SeSecurityPrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeLoadDriverPrivilege 4672 msiexec.exe Token: SeSystemProfilePrivilege 4672 msiexec.exe Token: SeSystemtimePrivilege 4672 msiexec.exe Token: SeProfSingleProcessPrivilege 4672 msiexec.exe Token: SeIncBasePriorityPrivilege 4672 msiexec.exe Token: SeCreatePagefilePrivilege 4672 msiexec.exe Token: SeCreatePermanentPrivilege 4672 msiexec.exe Token: SeBackupPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeShutdownPrivilege 4672 msiexec.exe Token: SeDebugPrivilege 4672 msiexec.exe Token: SeAuditPrivilege 4672 msiexec.exe Token: SeSystemEnvironmentPrivilege 4672 msiexec.exe Token: SeChangeNotifyPrivilege 4672 msiexec.exe Token: SeRemoteShutdownPrivilege 4672 msiexec.exe Token: SeUndockPrivilege 4672 msiexec.exe Token: SeSyncAgentPrivilege 4672 msiexec.exe Token: SeEnableDelegationPrivilege 4672 msiexec.exe Token: SeManageVolumePrivilege 4672 msiexec.exe Token: SeImpersonatePrivilege 4672 msiexec.exe Token: SeCreateGlobalPrivilege 4672 msiexec.exe Token: SeCreateTokenPrivilege 4672 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4672 msiexec.exe Token: SeLockMemoryPrivilege 4672 msiexec.exe Token: SeIncreaseQuotaPrivilege 4672 msiexec.exe Token: SeMachineAccountPrivilege 4672 msiexec.exe Token: SeTcbPrivilege 4672 msiexec.exe Token: SeSecurityPrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeLoadDriverPrivilege 4672 msiexec.exe Token: SeSystemProfilePrivilege 4672 msiexec.exe Token: SeSystemtimePrivilege 4672 msiexec.exe Token: SeProfSingleProcessPrivilege 4672 msiexec.exe Token: SeIncBasePriorityPrivilege 4672 msiexec.exe Token: SeCreatePagefilePrivilege 4672 msiexec.exe Token: SeCreatePermanentPrivilege 4672 msiexec.exe Token: SeBackupPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeShutdownPrivilege 4672 msiexec.exe Token: SeDebugPrivilege 4672 msiexec.exe Token: SeAuditPrivilege 4672 msiexec.exe Token: SeSystemEnvironmentPrivilege 4672 msiexec.exe Token: SeChangeNotifyPrivilege 4672 msiexec.exe Token: SeRemoteShutdownPrivilege 4672 msiexec.exe Token: SeUndockPrivilege 4672 msiexec.exe Token: SeSyncAgentPrivilege 4672 msiexec.exe Token: SeEnableDelegationPrivilege 4672 msiexec.exe Token: SeManageVolumePrivilege 4672 msiexec.exe Token: SeImpersonatePrivilege 4672 msiexec.exe Token: SeCreateGlobalPrivilege 4672 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3468 7zFM.exe 3468 7zFM.exe 4672 msiexec.exe 6120 sihost.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 4672 msiexec.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4672 msiexec.exe 2964 msiexec.exe 1588 MsiExec.exe 2764 MsiExec.exe 3052 MsiExec.exe 2484 MsiExec.exe 4380 MsiExec.exe 4896 StartMenuExperienceHost.exe 2992 SearchHost.exe 3440 explorer.exe 3440 explorer.exe 3944 NOTEPAD.EXE 5928 Topaz Photo.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2964 wrote to memory of 1588 2964 msiexec.exe 95 PID 2964 wrote to memory of 2764 2964 msiexec.exe 96 PID 2964 wrote to memory of 2596 2964 msiexec.exe 101 PID 2964 wrote to memory of 3052 2964 msiexec.exe 103 PID 2964 wrote to memory of 2484 2964 msiexec.exe 104 PID 2964 wrote to memory of 4380 2964 msiexec.exe 106 PID 6120 wrote to memory of 3440 6120 sihost.exe 120 PID 3440 wrote to memory of 5928 3440 explorer.exe 136 PID 5928 wrote to memory of 4456 5928 Topaz Photo.exe 137 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Topaz.Photo.Pro.1.6.1.x64.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3468
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3496
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Topaz.Photo.Pro.1.6.1.x64\ReadMe (How to Install).txt1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:3944
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\Topaz.Photo.Pro.1.6.1.x64\TopazPhoto-1.6.1.msi"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4672
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1BDE746E691056C64B3A613244331AD5 C2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1588
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FB271DB81B74E3A6DA4C8BB040A30F80 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2764
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2596
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding A580473A2592C540177AA6E373223D062⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3052
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EC7D764F4DE1CEB5FAADDE02B6A549DA2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2484
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4916CEBD4424FD8932E1C4B4CD65B2A9 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4380
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4832
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Program Files\Topaz Labs LLC\Topaz Photo\Topaz Photo.exe"C:\Program Files\Topaz Labs LLC\Topaz Photo\Topaz Photo.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Program Files\Topaz Labs LLC\Topaz Photo\Crashpad\crashpad_handler.exe"C:/Program Files/Topaz Labs LLC/Topaz Photo/Crashpad/crashpad_handler.exe" --no-rate-limit "--database=C:/ProgramData/Topaz Labs LLC/Topaz Photo/Logs/../crashpad" "--metrics-dir=C:/ProgramData/Topaz Labs LLC/Topaz Photo/Logs/../crashpad" --url=https://submit.backtrace.io/topazlabs/bf3d092c4d7b781d02ac0761e0ba8f4b82b67daa9c2c21a66edff83eba6e7aca/minidump "--annotation=appName=Topaz Photo" --annotation=appVersion=1.6.1 --annotation=format=minidump --annotation=sessionId=e0fdfa38-5154-41a7-8a84-925ae47c15fe --annotation=token=bf3d092c4d7b781d02ac0761e0ba8f4b82b67daa9c2c21a66edff83eba6e7aca "--attachment=C:/ProgramData/Topaz Labs LLC/Topaz Photo/Logs/2026-07-26-23-50-42.tzlog" --initial-client-data=0x3b8,0x3bc,0x3c0,0x394,0x3c4,0x7ff61c059f90,0x7ff61c059fa8,0x7ff61c059fc04⤵
- Executes dropped EXE
PID:4456
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:3708
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4896
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2992
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:2876
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1120
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5ba96c.rbs
- Size 11.4MB
- SHA256 0c94fb9ee87faf3e6577e00edf3c91cd56a87362c479703b2ff56c13314f5dbb
- MD5 31d9ac2dcc16a18f1a3ae9c144913ae9
- SHA1 e0aaae8916c2d84ae09d670251468b4079d8fccb
- SHA512 681f2f905b2a684515e36e4d66ef7361b039f4d49a69ce95fcfcf5a64a7723a994fe89ef263729d9fcc6245366697bd992003ed1342f617a0e1a2e418d46edde
- SSDEEP 98304:UAFlKIFSnk2tcAFlKIFSnk2tFAFlKIFSnk2t/AFlKIFSnk2tp:UAzKIFTAzKIFwAzKIFaAzKIFS
- TLSH T107C68E3A66E81194E17BC1FDCA874F0AC7A1740943219BDF11A586AE1F67FE50B3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 167B
- SHA256 6d584df93b6785277a090e3c2d46ebba057d262253dfcebbb81585a9f48658c1
- MD5 5829742e78fdd6cb8f893903fc814778
- SHA1 e2e3a2ebaea56c3664004e7c5758967a04862d36
- SHA512 7e4ccedbf24842f9f00123415c16e4858ef70b76783358601e5024d22faabe128ac78b314f9846af8c79818363c2f64ab77902e6ee67e2ea802ff76bfc1e9b72
- TLSH T151C08CCA62B15C698EC8456B938620A49CC40C5D28218A638286767C5DB232AA983783
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\combobox-indicator-hovered.png
- Size 120B
- SHA256 dda8d0d5444670f0a82f7b7aabf1f771d94d0c418f15be75b120137758932c7a
- MD5 a9d763e92351af2d6d6fb16b17e36490
- SHA1 c45d83865e7c09c8ad6f790fdcb9640eca207a5e
- SHA512 563f33bafd2fa7263eba83b6285b84d47255d9e23fd3c41ec9684b64bf820723631ac8f162765ba36e6f393c00aaeb73f3c38406693a19d7ae13630c42cd53ad
- TLSH T193B02B92E0912824C7084133120CD550A8115448448900302700D431221E10C0050F33
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 177B
- SHA256 340dfb8f5d90ee5d986eb4b3570a2b3481ca50048a1a5eb38144e13a598d9bc9
- MD5 7a6d8bc2b7b89f67d0071fd478f03c56
- SHA1 debb609ccbf690c74690b13c424530b5fb6e1293
- SHA512 08939949b87639243e0dff61be03fedb314b76429c93248face3d8d159c3ba925b39405bfb88a70edec038312d0773cf8b770f9aab410df7b169be8ed8d52378
- TLSH T176C08CA763A09E32DE45A8F7C34A184584395D10ABA2029F8068B46F1A34192DA8AA63
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 171B
- SHA256 840b43337d232f04aed0b3209a43a0b25bb5f4bb53920620c7e0bcc155743daa
- MD5 c5bf70b32da28a72b9907db3192fdc55
- SHA1 6fd954665a546c517567fc708645c02a33fd3f46
- SHA512 5d7c0924eee3f2b0be4f1cb71a118905131362f5871c2973bde24ba305739db51f541f491421f88beae78f586a3a1b4fee9fbd25c5e2527f6c159fc1b7c5ee35
- TLSH T176C08CE2A220AEE5C1CE003E4289210289EA8D1C3E274102F645D435AAE110E46C679F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\editablecombobox-indicator-open.png
- Size 125B
- SHA256 0941ec5da06f1cafe91004c1b035997609ab1eef1f39a9ac5f0bb558dd8f93eb
- MD5 a189060065cfef46d1bc5a7150b390e5
- SHA1 73f7375aa440ceec13bb16ee7416f1033e6e4400
- SHA512 393cf37bbb82c5b3b5e91f989ef84bab4ca65c907d5bf4b242f0e75a056677fb5cdd55695881f70730d950adac90712e9b6074ba3824f9a42d0aca0a00840c0e
- TLSH T1F4B02BD22230287DCF4D0333490B80008D73323D454101018D05886F251DB0500DCD32
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\rangeslider-first-handle-disabled.png
- Size 442B
- SHA256 e04fbcc696a2ea2a326a1b7bc57f25a0e1b33091e588889da5a9d7015c595022
- MD5 34b81abeeef2a5fcceb972f1e3cf2997
- SHA1 e262ba643aace4b66c93842989135209a7b8df85
- SHA512 e575c06e29890e63c6898b31754b419eeb73ff87d7d71d0787a8fcc3d2a30c82cdd83eb94139d9f0f25d9001da9e030d7c06ba1ea2392c191d6cd9e2112fe4f7
- TLSH T1E3F0ABDA6B9F28AA8409581A10A891228C2C1C00BC20FFCB6789B46C1570E9682C410B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 875B
- SHA256 6001207502a85ce95a405c9100e575994dab92e04fd28c1c66eefc69c52dc3ad
- MD5 775918baa819c1f84b2d51392985de66
- SHA1 1dc21dc416d21177ccd58bdbf93596cb5ecc997a
- SHA512 98d4cabd4361dc4e2226e0a2911c918a52e51cd8ce67348d0996dac0607922776b0fc72d6a527e6d46f8c12e71c606d6fa4634db9bbd18cfcc3a4a26d317f42f
- TLSH T1B5114652DA5F1477A9B0300895DD01D0DA611E4035693AF7858A7EE94036ED71C9C3A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 698B
- SHA256 caf54e636473e19db45d86b01fb79142bf28e916030ec3b60272a14643313460
- MD5 bac5eff99d83f1b5c73fde4cd05c9db9
- SHA1 4824a9748cce1bf329558dc887bac4a509d197b5
- SHA512 8c46a4bd86b8f5e8cc4634b6af3d4f81a5dfe7f9462fcaf6aabc818fb085cb3724508d926c84a0243c69af585c1bf9ad95e02c2ed25df38ba2107815467a18d6
- TLSH T1D90123D7505614D907412E6E436C54204DB80E1C7179B2176288F3FC497591C3CEC0AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 935B
- SHA256 60f757e557455aef99ad54ae55c3e8d18347fdef0bdc5af176055e154e7b8f38
- MD5 2f2fb4bb6e72e89435b356a6cf44c81e
- SHA1 11f3ee2d3f0cd0dd9002b33399a714d0721abf56
- SHA512 ac4bffda40907144446200808994e35c1a8512d95f3c71fc7bf6ccb41853e7dd44f63424ae1fb592a54677fb6bb3e778335541fdc6f0720b0f990cf72af93128
- TLSH T1B91163DB3918BCD685990A2F156A3211917A5E1D2025DB23A15CB8BB0F70F88A08E88A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\slider-handle-hovered.png
- Size 493B
- SHA256 4d5d16a9ef3db072309d531e11057076bfa7b03f4f47f6bd8a7d89d1fe0bd39b
- MD5 9848e43810261e6570a4cf83c3752b4c
- SHA1 6c228608e331b9fa2cf9a44e74c7507c19af7d63
- SHA512 4fa4df1cb5e08f14d1e990280e834fface6270ed637ce1cdb1799f1e568e78be9aa7f440af1d2002c5f50e2f22a96199e1fea6d957d996d09cd05e0b2911801f
- TLSH T1BFF0A357321FEC47C904D6E888A84196EA2A7D97354A73B72A267CDC093EFD8C5C9143
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 1KB
- SHA256 f38227a12d179e016f9b2696d3dc8ec4c6c96c275cfccbe839dd5ba0c51d9b26
- MD5 5eb1ce92eb912af9509c4277272943b5
- SHA1 77d4586a33e99ab715a628af2ba6adac2aa7e39d
- SHA512 b1865a0eb9fa04138ec132cefc0008f70f5f181c39e4125b694079f23feaee70c92bdc58f9f5d243cba9298785a3bd2eed35638ae4c322b2e1e0303b36b47b7d
- TLSH T1B9210AC634AE983370B15B9EA0CEC196FE862CF3092405A483DD78EA577BF8604681C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 683B
- SHA256 349cb567bded99187024758d0cb9cda60b55227a4d7fe1763f7f41753f692d7c
- MD5 d0e50dd9b89b841d6ef1cd78d2e3d1f6
- SHA1 9018ef9ff9e0f1946be96597b5f344715efaa773
- SHA512 8d09c2d0f369a673c8d9b7092b46b0ad68320a217fd4936133727331e6125ae0129c4986c3503cccca8246058ff7b07e70cb30456f480c6950490fcaa87f4d0d
- TLSH T1B50162FB16C32956B604D0E19850B80C05397F26BE520DAF5538FD2E8472D0FE782A07
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-background-up-hovered.png
- Size 317B
- SHA256 237ff3516492b63b2ed41562ea6e3b983f277a2375f12d427a0a7769cec15043
- MD5 d0b3581b97087f79fa2e265737f44eb1
- SHA1 34add1ba94fc3b95c7335ebd9a821487bfd6ca00
- SHA512 68125745776591cc7c9869f938c42c2b19021027aa0c1c08069e4b9cb9c4425389e88134b39558832051ad64762966642c9c07c8d71ff0979b3b5e34f2e8cf64
- TLSH T104E02BF68AD0192FC6CE8FF706680716D9212CEAB813B0145111F4191C30B0EE0DAA05
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 1KB
- SHA256 4c9186092eabc6788e704b074423e009cd3b80a8d5de0bb1ada6f7599f91bb9c
- MD5 16464a005372e7a0092f1721f96a3fb0
- SHA1 900e4a0b3744bd390f89592e236bc7e2358b16d1
- SHA512 1f854ecd6dc27978a54b4ab507c662eea0c2ad4209306b0c568b4ee8a4b2c2d37d5304eb91f180eff43db9d1ba9e1310c72a76c41312fd15de0dd3fede20b67a
- TLSH T1E0218683B5705D2B5971FE17D4284544AED18EAC3F6400EAD1B6312E3679941C35B33D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-down-background-atlimit.png
- Size 83B
- SHA256 8285acc7fe450d3a72eed1432566f7aa90af7ee33a154aa7402dc707018979b7
- MD5 abd4a5f439d8f789c9f460945c09fefd
- SHA1 dad89434297a1fcb7baa221f8c924fe1e0df9cfc
- SHA512 d73432e7014978d01ee440de8144ec6d9d62cbc3c8e040de94dc2b7c2aac4c62d5582ac3dea1c1619d7e4bb9582af8a96cdf836aa292149ae3b1bef74f5dfdf0
- TLSH T1D9A012E28F4068A8D09502778526D070C876010100B30008901A8230B540A0010C4302
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 164B
- SHA256 e2ee0ed4ccf6d0e468b02b83598f0487cc3167d508c6e08e6490b925d8305474
- MD5 84b1c5af5460f1468c4cd17bfb7d7ffc
- SHA1 a9c6259103be4cde24e9a85e5ebd7f663ba3db97
- SHA512 a7394e01336bee9993ee2603bd7abcd56d86e815e502fab58d52311e998ffa512d3dba9a99bfb9dc7cf935d67b779059ab1b1baf53a6c9ec63c4b05cbdd5ac82
- TLSH T16AC080E01EB7597BF3040177655AD130ADB6471459195614C1DD9D3D984910EC055513
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 211B
- SHA256 d712f165711bf5e0f265607705a4e83452c8fcbc59e106238663664f791f28e5
- MD5 26568e7446e134efd965b6b5aa29c8d9
- SHA1 12eb2e9d03ea621dec674ba3c6bfbfc80656dbeb
- SHA512 29d11aa4bdf62dd609b7753a91503d50d589ca6c12761ad4d033f55d746a0f27b582a0737c319f0f5cfc1e2a213084195f81776ca4e1c91546f1b73dfe1741e5
- TLSH T1B3D012F293403C1E89D906B5529C4545C86A4E1D9E3252626418B42C7A3698481F8762
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-down-icon-up-pressed.png
- Size 118B
- SHA256 33f189b55282b1a6d904fd2424cdc051fbd3af17b942899942fc6daf46280146
- MD5 ed93c06f00fc6df9f9a60e049ee927df
- SHA1 35443a7419b91d784a93e7e89b686a4d6577dffd
- SHA512 d2b1cd6c0f6f416dd96ee9719357d088355bd9cfdb328ebc1b96d6273cfe4652ccc37e8f66d3b654f3be4b168e881b7b2f6fd8260ca2a115fb15090af2bd8723
- TLSH T16AB09BC5D15159FCCD41317B94491220D9356D2539594FD9551A553714D5045F14130D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 92B
- SHA256 4a812392a115a37694707507b84dc3c789fb3880c298cce2a7d31f1d837f601f
- MD5 c710613ae2b8f9e620c1663ebb8a8de5
- SHA1 fce48edc3b6183fedf5fc3ff29c68c7afcaea290
- SHA512 c35dc15a92d3df91ba6b0a2c1458b5841f4df5dcf8706566ebd7e72e609b96e7f09c8141cd099a805234318d127e147c21cb58601781b151f6bbdf61a44ab67a
- TLSH T108B012EB56400E28C0A2013B673A8040C4B072078A310104090584305C125440544352
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 150B
- SHA256 50e45c5bc1f41a265ccdb7106571d751b4a875577d19c5409009fcdd0e82cfc1
- MD5 48ca0e19d6ae84a966cf0a8dd4c1ff47
- SHA1 97cfdbdd03481d1b6ae8283a7bdbbdd70d2347f6
- SHA512 b60068add983d8a3e259feb0734a0d3060bace984d5693da01d3340c64949b7662956605cee90841cb0438e22bbadb9ee9aa5539d76314946e036fff22eb95c0
- TLSH T1A7C08CE26A8BB4A4A88A022660F64320D066842482D18089A954F1F841877495847A03
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
- Size 210B
- SHA256 f85b2a74823a54b1d904d44b638204ae78301a91eabacfc1dc7f07508c384057
- MD5 a53be3f2aac6ceb758f6d7669f5d3c1f
- SHA1 86f8e6e4553dbebcc5048f5ec922da300ecb76a8
- SHA512 4b58e4c8465df0dec6e022a1f91ea481ec50ae97e9ab88deaef59fd1e42e6e0030bf80b597b2c86f2a6d53b7b7b27547a778fb9e53cc225dc3f54f5c97c0fd12
- TLSH T198D012B5B209ADBF869B0753426C8209CC014D280A461156A406722D963140E9096A86
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-up-icon-up-hovered.png
- Size 118B
- SHA256 7109a067ad00c3cdd31365c76ea8e24264910fe9b1350a292fc00dd7d2b97e5b
- MD5 199bb6520ab013968e74e85504c8544c
- SHA1 b1ebd8627cd955e44261b6f457f0229e17ab4579
- SHA512 543501c68c73ffb92379cf0eaf29e3c9cc9c950bf158a23afd49546df25ba55aa0a85abc4b6b822923bf69558badeb2ac822541530c40829faf7064f29e4eb3d
- TLSH T1F0B09BC16165793DCB16517E9605201485755B6821851768510BF4751417055D094745
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 184B
- SHA256 b74cf0894a7b42aae0630586e321e3cea282724a16e1ed40322cb39014c0041f
- MD5 908266ce67b93472e143907653199c82
- SHA1 bba4cf1937a44620899437018fd8b5d6409efd05
- SHA512 7e33945d29a4f6e717e22c5eb32ab8ff9ad7900842bb08112f5ae2212fe8f01be38964cf60e1d5fa643bf998c46d478038f88e1c62c62b64c1f8bfdbd994bd34
- TLSH T170C080C7F7208DF4D598D53DA51C710949161914D936026F15E5D81D4513270855D545
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 780B
- SHA256 7afea33b4b6109fccad617fc05ba2ffc422bc60b02e805303e129ca9954953a1
- MD5 f0522340c01a7fe94c2774d6664674ad
- SHA1 95fc0e863573a37749d5c8c32461386d2f0e2b6b
- SHA512 d9bd3fe11d905090ea0088517b80f84cb78c608aff7366606dac0a7820d2a0945de1a219d2e94c1b959ea6131539e26096883e5f41579027dd033cd07cca7631
- TLSH T16E01E911C165A4B9CC7C007A5BD43C9075B33048D83BC129931A037431D32D28F411B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 1KB
- SHA256 caf1dc9e14b96d649fbc00a5210fbd0e209fee56c724ba746ea7a22edf73d5ac
- MD5 c47a860f4d6d50af02b754ecb49956ba
- SHA1 091ff88d16d313ccdec4546372153ce9e4533cae
- SHA512 a69618d04414314b026d81b6d957991df794a1e1257ab54e5fae5ab872933df77163ae148e70baf15abc847d8dd91fe3803d1242b8ba7391d93d9fd13ea616d4
- TLSH T18711252F853B3DB5C1E2057B598E56449C3746ACFA610E51054FE96A9D353A110C3A94
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 1KB
- SHA256 34a47dc79f253f27a7757d747f3402559294fe080d1409890ffaeaad1a3d7b1e
- MD5 e9d1a856239067967890d74edd779f93
- SHA1 de390dcf922397ffdb8c1a0afb7ee915266fd404
- SHA512 f2ba5e6558516c3dcde9ae20c954b2ef46cc118934ddb07153924b9f0bf2fbb71aa2508ef300653806d35eb2a6a4a9179de8ca52808558466238f8fe1ca35a6d
- TLSH T1AE31C99982C89C62CC7D4DF30AE814EA1F73154ABD742D65499218D2093B2B95B94A44
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\rangeslider-second-handle-handle-pressed.png
- Size 343B
- SHA256 d0f2f23ce73f6559fa3a61f4e7c068875e321dc6aca3a0eb6a423ae94054b92a
- MD5 c193c11c9827a76d682c215d8fc81a2e
- SHA1 9f0b8a87122e7ff62cc3f62a713df9de12778cc5
- SHA512 ec4562cef1a338ed11a6cb9a214698515ff4c02d3ff7b0d7381c7480c63e52ddb50b21059b81fcf982134e210f4ce156306180506594648c5a7dc96726cd90fd
- TLSH T16CE07DB392463C1AC660AD7680185A60D329035A4CA5240F0231A99639F226B90D4D67
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 590B
- SHA256 5d2c7b18155db2f3583896fde0addccc481a816a9b36531b201bc5e31bbb35ab
- MD5 698ffb59b04034eb202468c06c4f0f2b
- SHA1 c4869724b5182e9df7da9712731d0cf83d2655fc
- SHA512 056e014b701556c9af02e53fb268b53a5a2867bbb27d02072ebdfc1424d3bda4df28432d35e9137245d79037788fbfd63eca76ccfa5723adf41fe2a07b12bfb7
- TLSH T144F0C0368B61EA28CE0904B15F148DA18E10945DDA09C23D0DA6EBC99906EBEC58217A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\slider-handle.png
- Size 513B
- SHA256 3bd1cba7b0517257de59ea097e188ebaa706b7bbfca338a29ddbec2d944c5567
- MD5 320ec974cd5352b0e0ece1548d6f658e
- SHA1 b19afe19067e1f976c34848ed9d760f68e16afbb
- SHA512 40dece1f2ec1640307a315eb6b761f2b01cd2b208c0c1a87c096778bf8d142e826d51f2cbe4351a0048603c875e364332254ef100cbe5b7b106db5a643f0b6ad
- TLSH T102F0758442C4ECB4CF87C5DD508C6924D83E5BDC8D8021A4CE504C126BC72F153E8CB3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 992B
- SHA256 9b1916e06dd0605a1cb61052de50cda49723e08f280dfce484b8b06d54cb1a17
- MD5 1d1c5a016cfd3ea6e3a2057599da0380
- SHA1 80023655baecfc69242efd3dc53c680b681f14a9
- SHA512 7d7165b0ab589e51fac7828300a9731688d0b50e69fe9aa366f364a5e98c14d89e62418cb8a4e9be63271f95debcb09ff4b7e2781c7c8dc5bc7d90eb54f13957
- TLSH T11D1165BF74F974AFDDA49771109818711B66D609255E4C0B930908BCC0F10885554C6B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 1KB
- SHA256 ac3911723fbc5dbd7831c4049036f4f9d5b290a52164143d9e4846fc3fa5ceb0
- MD5 9b74f84a472f3c247473daa320dc7e1a
- SHA1 e9a327d1850b175610700f50bcdba9eaf59d13e8
- SHA512 81b33dadb7213e8a3fb75e69b20e44b36432567aa6915cc4066b12b2ef4e9b094b50f994c48131534b1d416e1a04c9d040c23fac9f4aaab2a5692d98da920484
- TLSH T16731F6EA40215EEAE05F35F960DD08F8A851C03C93517012871FB8786D9A26C299315C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-background.png
- Size 438B
- SHA256 b690ff71125077a35907ee9df97bb986fbebb2ee82b1f443d86e25fd15738204
- MD5 59b236bbfcf80799730a41eb5db6e0d9
- SHA1 db0c6bac65a9cc0f8717447e06e16c92ca0408c6
- SHA512 14b8f4d94c53a23850d5f8414617e9cc6cab23a03f82d0d3f1f17c6e99c5f3a826cc3a4a4f3e448d7cc92a148dbde4eb659efe63d8121049f7d2f16b01938068
- TLSH T115F0FADCC450ACBCF15C743148D444782D760A9FC97941196107AC3C5C3530E0EDBD42
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 215B
- SHA256 bfdd4f412de35ced17a26b6090b41befbf11e97578a244798a475c35f1b81685
- MD5 f5c20c701ba0afaef155867a3259978f
- SHA1 bd78c42b1fbf4f7ca6ec8415e20358b09b5913d1
- SHA512 a7f553839456af8dcb8dd17ee63011548c0c015756c186c6feba293588ebe7523b8a60a043ae08feb17547b84dd69e5d014c67b79de2b9afcd1a2336eb9fb183
- TLSH T150D080DBFFD47D28D50301F7C15841EDCCE2473D29076A52D1106C395D15A0E8BC2781
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-down-icon-hovered.png
- Size 138B
- SHA256 6291f9c78c77f1fb89dd0b43c51daa98c2ab6c98ca737c2ef1f61f1f201b4514
- MD5 432942b96cec036996b48617c5b38d4a
- SHA1 c783d444d450193cbba5de874ae323fc7395a29f
- SHA512 76d935f697e31f4521c0bfd281931bd9da0b7b1aae75806a3a5fb7c8f920bb80381fdfc988aebe2564c6cfbf07fb25a055ba69975003f79a0e72fe2999cfb9ff
- TLSH T118C02BC033D85DB48E02C37B535FB6815C2C71CC10AC204492087F726D71410E4C43C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 180B
- SHA256 6fd283b8c8f1c96a7b0084a475dc0915cc7db16c938858b6c2fc42a2c286107a
- MD5 4cb9524e2fd47071b240da4bd839dbf0
- SHA1 6a2e10e02b4d5544159ad40a714c6b66508b7ffc
- SHA512 c093ed39741b06489928c7a3b60c812325403d6d5daf6aeba5dbb739e52d02607679293b41c8911bebb56c8949572373fb5862c8ce36a01b933af23d5d93467c
- TLSH T1D8C0C0F893C3F8F8C9C84531754B900CFF2E1150E300301560C4903C3ED1709214D382
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 101B
- SHA256 02530ad19a6a050f2813c5d801a9fe75c9b0fbf4508491c6abb1bbdb72b28734
- MD5 27d3ae547e7e8ff9c88e8ca58a201f25
- SHA1 17a828d4ec352b0ae8b6f9aa7623baaa4a920c74
- SHA512 3f55067d9369c367a0da811f61369ab11e05026258fd80a546365b7cac776869e0bf222b79b75fcc7b0deb881e340271e084bd675efb51dd1473a510cf288dff
- TLSH T139B012D793754C3CC33481228B1C8113CB56073CE019415306499C650AB1216C3D8786
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-up-icon-hovered.png
- Size 131B
- SHA256 95bc4afbc55494f30ec3553ae051c73b535e9aad45426eb373cb788f25f88caa
- MD5 3340595b829e7ceebc4997ce038e90e9
- SHA1 921e0225ba2ed03be7257fa2b0ae0f958a4a1d5e
- SHA512 ef0b38ebe3b48a3e2808477c5947d44aceed6bfd238dc3cd72814c9ad664113e0b78bce8163bfa517eaaab631696b3c2844abadbb075af4aa1dad259a9e83d21
- TLSH T18DC02B83002CAC38CF4850B74342024CE6701AF011A8412F0013D0310B115ED8048709
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 206B
- SHA256 9bef876bbd6193e05e5e0ad50706ee454d1ea71da782a6f9e9bf8e5e71bb920d
- MD5 10dafc29a0983b6524f168083824daf8
- SHA1 2f5197f1e9f10ba3c9a1b4c7a1c0aec5e905bb96
- SHA512 5142031c3627f6fb4e99ec899f66e918e55b714dbeb0e4ba46be4926b0161541ce1b29153b26e98cc170875b34cb238d461b82158d50586b14e8d4eac2ca5097
- TLSH T1CED0C0C21314EF91D151443BB07E010A82203C18D44BCE0424A0A40F48F9D80EDC4692
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
- Size 164B
- SHA256 d5a68925a3626dabc5a773663cd0134ae03c908c0c8adb4381578078c3fc056e
- MD5 42fd9607554573669c87044ee3472156
- SHA1 ef6a403c0581dbc7ce08eda9f1f69152242433cc
- SHA512 4f974de0e694ed5761e318fe52f2b3112cc33b86562dd374c607047e47f31b9cccd1ed1cc743492c3042289cdb948ea0865c027cd8c77056f6232942931288df
- TLSH T176C02BEE329C7C34C314153311C59110C531A6DC6082C70B044980321DE204FC1C23D2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Topaz Labs LLC\Topaz Photo\qml\QtQuick\Controls\plugins.qmltypes
- Size 215B
- SHA256 a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
- MD5 2006d4b7d0da455aa4c7414653c0018a
- SHA1 6685b8360b97799aa4d6b18789bf84a343e9e891
- SHA512 703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84
- TLSH T18ED02352CEECF6A313451C16C44C47E72E53D1544731AD10F05401ED714771C36ABBC5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\logs\Installer-2026-07-26_23-36-39.log
- Size 1KB
- SHA256 095b95ca8c9a27f06c4f78d2630ae86d90c3987320c72bbcfe908f22fb577f23
- MD5 f135c58661452d7fabefdf3ee75aac7a
- SHA1 1dfadf6e372f69e5a97e78375e6ab087e7271a27
- SHA512 8cd1983bf552124d510a558fbe74837e7f7ba36a2b8a71bcb58bde1362e1066cea347cb354b559b08688c4f2bc132b8c3f705ff04c2040558afd5f244e8954bd
- TLSH T13531E9780CF60361363DA0E8C7984D45F3C1F9EBA6AB882AB2F5045F1751D1A59BE3A0
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\logs\Installer-2026-07-26_23-36-39.log
- Size 4KB
- SHA256 74d219e6c0280d40c5db7852056d6930adfebcb8897cd9c282d327e6d8fb6d8f
- MD5 17468432c605d641de88d7841440aff2
- SHA1 a0347a04a25d3d61719fabc79740fea2c25eb6a4
- SHA512 36a90a248b02768c189858a8154a05ca10a9629ded57bef83e7b394786445bd4bcde7e083427bc736604aabc58cb74bdd1709c68874d0bddb730fb98517c2574
- SSDEEP 96:10KtHAHYHdH1KHBXHQHwHLHGH0HyHcHpHNHpHTHWPHaHpHhHiH7HsHIHqHdHVHgH:19g49QdwQrmUS8JtJzM6JBCbMoK91AOc
- TLSH T1A5A1967908F60351723DA0E8D75C4989F3C0FDEBA6AB582AB2F5046F2751D1B54FE2A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\ap_all.json
- Size 1KB
- SHA256 6f9d7d2d3ef7dc17130743bfee84b1c027c07c965b81a703047891694f79941b
- MD5 40c2fdf6e43e93ca837db8d9f4d4708c
- SHA1 dce83570191f5d886a69ea9d5aee1710c47ace87
- SHA512 8096172c4fc11db388789bff0d54b86ceac9c9c470ce68bb5f4ec0079c9e88ea9d5a68807766e7958b65ece4731944ad3c78e7126a3deb447268a09191c8cfe3
- TLSH T17331BF3EC2261CA741FAB3B1B4FC0587F526432B15884C0376BDAABC4F761623246F5A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\claa.json
- Size 1KB
- SHA256 889c1169e28568e2ba4a4861a8040a9c3ed9a33185cf552bb79845a100fc13bc
- MD5 2f981665210939ca0146ac2c04c5b171
- SHA1 6bd8202453e86840a577469b5fba07c6ac484660
- SHA512 7b9051f97ea37f2bf3bf2682fc1c867140362c9256a6826ea0a487cf6de8bcc38311e7426ddafb9829a10b9ae170d515451b955525400a898a75fad97ec0a57e
- TLSH T11F21AE2AC5295DAB01F9B3B0A4B94507F5A50B6B01540C8BBB7D589C4F731370542F0A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\claae.json
- Size 1KB
- SHA256 e860d8dd4f74b07de815ccf618745e04a6e71b94524ad72fd9ef516761c8a44d
- MD5 98a0de6e549fff29c17e572476ef57b8
- SHA1 0fa2879fea81444a09ce20d90ec2bc05bbe98f07
- SHA512 b1da83977d03bed89f5bdb19b8a8f1efadadcda6f30f0ce059e7a20ba3a7a525aef3b831ff41fb6253305e5eeebc43005e22d6fa6a3fd9ac86e45166c7ae9c58
- TLSH T10421CD3AC5355DAB01B9B3B0A4B94607F6B54B6B01940C8BBBBD589C4F332770642F0E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\cloud_config.json
- Size 1KB
- SHA256 c94f705e3c7db5e4da9c5ea9eec63539b33f7a21d04a5fb6a283b800feb116f4
- MD5 fb7ef958adad54bde49dd05f39ee460d
- SHA1 3ab98b436103a1bf3dc0a73e3327388ac2354fa9
- SHA512 ff305119ee6344efa358c1ae88bf1c26129274a01a0cc9d6056a9fdb6e2cc63406796680e40815a73f1f5183cf6393bb7e646ba0f077a4212e98ea14b31a3065
- TLSH T19631FC1EC6358C9B08FEB3B1B4A50797F525432B4201090B3E7D226C4F7BD260BA5E9D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\daclip.json
- Size 2KB
- SHA256 905409a6d212298ceede3dd1a45fcd6c4a2b72caaaadc0cf2c853baac84e735f
- MD5 37e9a6e7ebaf30acb79739a072aa87f0
- SHA1 b4810b05d28c51dc76ce7ab8e0bdfaac4a815123
- SHA512 671df8ad98611bd398596cb82478cbe8772159e3705c1ec5f9a6ad95b1ae0a4e436ec568733b3f0f89ef3fb8bd8b8d6a85f7f3eb8b7ab68e12d6a24499b636f0
- TLSH T11351E12AD1348D9711FAB376A8EE4B13FA6A476B14500D4B37BD920C4F321764663E2E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\denoise-max.json
- Size 381B
- SHA256 ed81cbbe68f4a6e57ab90d416b313092c37c2471801f085eeccaa8bf2996ba48
- MD5 fdb869c2b49aa979e8930e2b617528aa
- SHA1 fee39b07ffa27c705578a647253a9f98d664aefe
- SHA512 dcde85867c67101cf4d458e89b4c4d07eb2fc3a250c8a78a2b2807636539f0180a3049192d6e167cb69279c4579e64bd9c7eec87e26583b0392309bf0a6c4c50
- TLSH T117E0DF23801846BB05BC53B050F80183FB210F2F21300C4F3ABB38998BD79390940B14
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\dnt_beta.json
- Size 2KB
- SHA256 4559a82a25fb875e13be98354f48a8987f7a6812b9114839c1d98522b05dbd48
- MD5 b080d8bb328378bea617511be15dfce1
- SHA1 7bc104ec058871009e5ebcd9fbc0cd2a140db035
- SHA512 e98de7c9d5589ec4d43584677d51a5a37b0565bb475fee9f4093603a68b5d8d06f2e1930d51269d3c7a8637b5230fe5460575048a2202af39483db259c9fbeaa
- TLSH T13051B12AC5655DA712FAB370B0A80A27F464076B45D80C4BB7BD985C8F3B2A60641F1B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\draw_linear.json
- Size 2KB
- SHA256 ddeba98b84cada301c4eacf3e6cf0521ece8c7bd7eb98f251ff682236dfd5a6a
- MD5 d9b4d82f413066dbc4d08f646c02f267
- SHA1 0a31b5cd540db0716340bf55349401db9aed181f
- SHA512 68cc38f1caa8cc162611f2d06eb79defbe2df94ce8f6f5cbd092d3fd863768eaf6c4bd9a7d608dc1054b42b5e6f14aff1bdbab69c0e295cd364ac329089c6744
- TLSH T16541D22AC0754D9B02FAF371B1B90A67F97803AB15900C8BBBBC249C4F7A5760251F1E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\drw_native.json
- Size 1KB
- SHA256 71375e29896da09d553ed87e0fae1667b231355fc11f0dd8b58b08c2afd7abbf
- MD5 fd48a01d674b4ac5877da216fe3e4d97
- SHA1 07bd7ebffed5da93077a64b320ba91ea54d3c781
- SHA512 bdbab98cd0f02ad4d80d5ce22e93edaf0f3a3ff86c0c1608ff2a520f3f26efac434cc0b5876e3165a6b20b9bccb601038b9da28e4cf881b793b737d60a8a6684
- TLSH T1A031F52AC5358EA702F9B370A0B90A27F9700B6B10940C8BBBBC5C8C0F7B5760255F5B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\drw_native_mac.json
- Size 1021B
- SHA256 18c210e4bbcc38acdcf5b96d21c2efb23d9aba4d66a4fc82592d1c944f03eaaf
- MD5 4b510ec2b055a82fe47d404d6d6e6a5b
- SHA1 f1b9114bdc77d26aef5b45fa3e6f0d32bed624a5
- SHA512 c2c1aabbae85ea613293a02f89427f9abce2819b3efdb235f1c069eed75793316ceb553265a98ec9216f38ba9b1260af6ebd83ad4e4b01aa7bd102aad04296fa
- TLSH T11B11062AC6318DA701F5B3B0A0B90617F9700F3BA0600C9BB6BE5D8C0F3A5750245F5B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\drw_standard.json
- Size 1KB
- SHA256 be7a26208fbc4cdaa918b9503e7b3c13c577e1814aa649d61b633efa94b72576
- MD5 8432f8b5463e99360b8eda320e48f7a4
- SHA1 bc0b30f4dc73ad0ed0af3270d7acae9252bbd6b6
- SHA512 0c97308a6c4ee340001b44c6011cccb26c8f4ce4a695551df3b23ddaec1b51318bb1478041a8ab85540ad00b8f86fcc19337ac02a43d36339ac00e4b8f2a638a
- TLSH T17031D52AC5358EA702F9B371A0B90A27F9700B6B10940C8BBBBD5D8C0F7B5760555F5B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\drw_standard_mac.json
- Size 1KB
- SHA256 6c35ae3d187228bb2797d004d119dfad4331544b195321ee7fc6551748bd32c4
- MD5 9ca19343895c8a0d792c4634d862d255
- SHA1 151566b9f7e3b84582738c112803c2f64b30fdfb
- SHA512 0062f5fc261b55fb2ecfbc68ac084802baf375f5901880b98e53195f6fe52481552a1083f9a7e749e65f5f1bdd0f5736d5f0655fe236116741ca94ae9ed28d10
- TLSH T10111E32AC5318DAB01F5B3B0A0B80617F5700F2B61A00C4B767E9D8C0F765760145F4A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\dswn_dec.json
- Size 1KB
- SHA256 f7d906e4c229cd3ef77d9f933380cd96e1b544a9b474e24c825c0c66a8145b9b
- MD5 fa74f3410fd21c4637c172dbd76ddb5a
- SHA1 035495a9567e419e88b661f34792146187af609a
- SHA512 4f40f3b5003b6f25140683cdf989efb76a5716c15c5afc7508edf840e3edf867013bfcd0a73ad5cede6db9a4863b287c24da22c2d91d064cb1b2f49703b8c01d
- TLSH T106318926C0344DA752F9B3B0A5B80A27F5B40B6B41A40C5B7BBCA45C8F736B61246F4F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\dswn_dit.json
- Size 2KB
- SHA256 362ecd76694e2f08974a418af8ed90a693c04bfdfce14162f77436584289c1cd
- MD5 6ddb8b3c4e06da77d08178df797b176a
- SHA1 d3683c0dc32e4e312e5c84b8976e11a9b4483743
- SHA512 6d2586721d0cd9793ac9a746ae0c0935221c7d9b6a57add78b396f528a212d7931f13247cfd71af2482ef182f856a02cc8c7eb58cdbf0b1ae75ee0aa99d86fdd
- TLSH T14641262AC5394D9752FAB3B0A4B80A57F5B4036B01950C5B3BFC956C8F726B21146F4F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\dswn_enc.json
- Size 1KB
- SHA256 2f2dc22feff67702ac8db6389b9b2e8890d1661f684750331c180b8bd74fb5f5
- MD5 12f89cd8266229ff5919a06b9f407447
- SHA1 2358cc7335629364209919a28f8541ce9caedd4f
- SHA512 ef54f6c8210f1a84dd4146bde763e3b2bc4d14ac7ae23ae01bd4fe3e596b97bb095b2ec2a597cdde346cfd4599369fe7eda7585d63f4d08ad075c4cfbddc7077
- TLSH T18E312426C1354EAB51F9B374A4BD052BF6B0076B01540C5FBBBC855C8F726B60652F2B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\expog.json
- Size 2KB
- SHA256 78fbaf9b32113bada6cf46b075a8c8463c79e5b931ab8ce8fdc4a78b2d44866b
- MD5 ce361de9238903728517818a5b2729d0
- SHA1 392b1b9f2cf66aa3b0185cb94e4de512bb6a09a1
- SHA512 7556986eaa7a8ab5bcbbcdada16b83169afc6d3335d5a6f44cbc60f3a1d07dc4d4bf3e77a11a4e4eb8e502f61cf1619f14688c38d3d0dd57b0426bcaf822bf11
- TLSH T1DD41C02AC4358DAB02FAB37174780A27F5B4076B05940C8B7BBC589C4F776760152F1B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\expoi.json
- Size 1KB
- SHA256 6e079f8d8584a7d61b8dbf686d6cc4c8c453d5bf155263a111693b5ebb396447
- MD5 7afff2da9eba7001be5e5b637490925a
- SHA1 cb7e109e8640b97b5181cd4747a4ef6ede01fe25
- SHA512 19b0192affd67395a63dea646a9a24276f4a7bd83221d34c46f0e7724dd162254f2cfb124cf439df45e04d74cb3aee58cd4919765b2c5eb2836e757ace1b05fd
- TLSH T19C31C42AC4344DA712F9B370B4B80A27F9B4076B05950C8B77BC585C4F7B1B64156F1A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\gfclc.json
- Size 885B
- SHA256 5a266313f2d9ce473985e016cc894721062507efd935572e3e99f3f044ec1c49
- MD5 030fc7e714329228c2f0fa852610002a
- SHA1 2e6bf11ba5ab477ca516b5c2e86a9dc8c11ec48a
- SHA512 2f519324853ba9b96b4ba8fdc03bdfdbc61c33b73f264c8274d3ba5cb94eb4ad0f4107d505f8992d06dc78f3e085cf0570292f39cc666840abd9b9b60d5e12a4
- TLSH T1B811282AC5258DB701F9B3B0A0B90617F5B10F6B01A40C8FBA7E1C9C4F7A6760245F5E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\gffm.json
- Size 1KB
- SHA256 7d67ecafdf6a578e3f0a838b1cff755c56c2f98057271aeb01a492b83c56e8ec
- MD5 00525b8da538561c995d47182d28d994
- SHA1 691338a39b642d318ad79ce9dde1111e3d7df8d9
- SHA512 643c64a07f457d3b60ffd1768377557db055a6ce53f1374bcc0577145ed52669b20ed2be74d8559c06b2c4fdbfa1883eb609fb89d1ddb0f264ec82c5c0b6a05f
- TLSH T1EF41C62AC5748D9711FEB371B4B90A67F564076B01C40C8BBBBC589C4FBB5760152F1A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\gfg.json
- Size 1KB
- SHA256 65b70e7ec5cc74d570764343323e50911f62ceddbd1b9856db52c09941626fcb
- MD5 1b32ea032a043daf98fc9888601737ab
- SHA1 ced3fa5ee77728538ca16345eaf18d340b72bf18
- SHA512 505570cf7403a415c186c88fe82a191b8557964cdc7e58f33336f2bd9361f1bd1229b23d6d39ee474980f0890506b35f8e0cff9b9e8f83ecefe590e96492e170
- TLSH T1B631E42AC5758EAB11F9B371A0780A27F5B4076B01940C8BBBBC589C4F7B5760251F1B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\gfp-l.json
- Size 1KB
- SHA256 8aaa262b8a7a073ce1f49bc22712aa8d32f58a9a41ed7583f773cacc4e9a99b0
- MD5 b1c395a22d46ed1278dbf29b4c889212
- SHA1 3d7663d5dc3041d4bc8d72ab32dc0971dec508d9
- SHA512 7506159669c93b7b8f7f59d5193ed7ad4f148489504f0336e275bd559a215b2dcca3eed2a24ef0c0149dd9911db5a96f5fe69905a250079264e1f764761808ce
- TLSH T10331CA29C0798D9722FDB770B9B90627F6B4076B01900C8F7BBD586C4FB61760266F1A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\gfp-s.json
- Size 1KB
- SHA256 b6e1d6733773cefbf2575326b759bf7b00d19837451f34503c0aa1f92e8dbbd8
- MD5 fa8b9f93b409985f82aabad723af83b8
- SHA1 457114ee388c3f586744637a59c2b4de589accb9
- SHA512 19b3282e6f372a0a05f44e064c4fd5a0884dadbd2f6c3679bf4ee0d332707d5cb45e7696012a7ff144ac4b1108b296e9b9f021be96821099d690fb81bc0a8415
- TLSH T19131E82AC0798D5742F9B770B5B80A27F5B4076B01A00C8BBBBC5C5C8F765760261F2B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\gfpf.json
- Size 1KB
- SHA256 d0ecaf64c4647b372fd90333ade90c62d66ec7070f5bdead07b7ddda60cef72b
- MD5 6e59a07e059554c8b267aeb874b2833a
- SHA1 c73ad78269178a04f820738d2163c3bc8ea5dfa6
- SHA512 0216610a9ecc42a27d2cd00c3371dac5ab8378caa54590ea5084e46d650e40a0fa56902e6f1777838d8f472262c72bf5e202cb7b09c6fb475bc2f9f2cd574aad
- TLSH T18D31D42EC0798E5752FEB370B4B90A27F5A4076B01940C9B7BBC585C4FB71760262F1A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\gfrf.json
- Size 1KB
- SHA256 a462b74936c6b52d27f06471e8ce412faf8d941c61f498b339f280b47eed7c4d
- MD5 a90165135cb6c3cfa751abf2388ca1d9
- SHA1 41e9581ff313710c88d5364d8770411c8e127054
- SHA512 3404b115408aa4b8e3fcdf436b7cc9fe5ce3abd04884c8e1a857eb65e0dbd9dfcb25b78eb841dfcd8449bd9d50fe6b9b12ad3105ee8a24d99237e303b62c96f8
- TLSH T1F831C71AC4798D5742F9B370A0B84A67F560076701D40C8B7BBD9D5C4F765720292F2B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\gfrfn.json
- Size 1KB
- SHA256 6af8085342051c0433b37196f192fa2ce5203559fe7e88726c1b3012da2e78e2
- MD5 ee9eb04c6ededaf5ce8fc85ce479359e
- SHA1 d77053486a4357efc7eb16a5a5ae98437a8719b9
- SHA512 a98ac76e610a0c10fe56391f3914e91e45c1749ab2b88deb44f10ee829d5de2707cfe0b6ee4029702b96ef74f02c1590b9bf23bc2072aa32f6bc014a4e3eb217
- TLSH T15311C429C0358D9751FAB370A0F9051BF9B10B6701A00C4BBB7D595C4FB61760145F2A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\gfrg.json
- Size 1KB
- SHA256 1e22dc4d01dd0cd8ede1a3eaf297f0b4e353931500e67f267616b3a3da73ae9a
- MD5 5931f793ac178a5fb944782af3bb6516
- SHA1 4920667d241103555750856cc1c9a0d9edd986d7
- SHA512 6355bc0a311617fd21297ab9a8f1cf045e0fd81426a15bd1e3bff9e9a63dad3b79999629124b63837f8081efee71bc9daa7420977c4771ed615317f22daa1f59
- TLSH T1CC31C52AC5348DA711FEB371A0B90A17F5B50B6701940C8BBBBD589C4FB71760241F1A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\ggi.json
- Size 5KB
- SHA256 54f689a545b1f49ab2a1f64a0b6e2b3a347e8656bf7d3fb8476697f6eed479eb
- MD5 df284a133cd5d8b9b3c6e9bcdc602bca
- SHA1 e0f039b3596198b86f826a474cbbcf3192b9cbe0
- SHA512 8c58aa39161b481007738d7d2bc43dc6b6ed6867c06ca5b497877f0e683f9fa95978b86843333d6474a38eac67e358d21c433689b729cf019ed41191e8e9b0df
- SSDEEP 48:9390vALeMbZo9RSdv0JcdvuJNORoLv0JeLvuJ6RCrvirvFRgrvArvCR+rv1rvPR6:NeMbZKP1s7J6nsSeppTVJ
- TLSH T163C1ADBFD6355D5751F9B374A46D4E12F8A5076B1D88088AB2BC88AC8F331971602E4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\ggn.json
- Size 4KB
- SHA256 dca872d7fe5090162f429dad9554ebb7a94c2fb8fde2e10a4bd9788defa1aace
- MD5 9b4e33e3674cfc42f9078b3345849cbe
- SHA1 128d61275c141575e9d180520639209fc1b59b64
- SHA512 e0ad097cad2a8c4039259755407d81a1980a4233395a84c0f6bbb3463468d7d7db83210f3a0317ca23c2767d56acbc9d11218c6b4b7c524833695383da322e86
- SSDEEP 48:93D0ozALJdo9RoLvFLvKRwrvgrvKRcrvCrvaR/rvVrvnRwEnEpRf8IvNIv+vLXZ:kLKhsaL/Epv
- TLSH T132A1BDABC9396C5751F9B3B0B46D8E17F864076B1D98084B73BC889C8F331A72502E4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\ggn_noee.json
- Size 2KB
- SHA256 e83563e60e85cb9d707307d9bf60d119f44711e191bcf6f735e818d4e8590d69
- MD5 f0455f1a3123c51ea18c86279a0a4718
- SHA1 ebddb53a4826a70c4ab049fbdc143232b18f45eb
- SHA512 c92b5b1f35b6bab485dd9e13069e9109bdf0e3d9e95aeccfdbe9bcb8c176d431e1108848800c0bd7f3d9cb2dc916c870f0f881b5659e484177edea417051d106
- TLSH T11241C07BC9359C6701F9B3B0A4A94A07F464076F6AA40C4B727C9D9C8F371B22641F5A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\ggnv2.json
- Size 4KB
- SHA256 9ccfd57af7469a40f62c4250f67f973de0dfd91d3e07e2e6a8941aba4dca543e
- MD5 655d48df03abb67321914015502de724
- SHA1 13182ca00ac0a6fdc6840178484e7118eba158bb
- SHA512 1f9d119752c13b5528f90c022452b2eda27820cf1ecbec2cda9d47b269a766dd9b140df849ad582aa71c75a8267b83b5cce14a1e6e1d342ff400c64eefcb257b
- SSDEEP 48:93Djz3ALJlo9RILv/LvKRGrvgrvKRcrvCrvaRErv2rvnRwEnEpR8IvrIv+vLHS:YLKRqa//Epu
- TLSH T162A1AD6BC9396C5751F9F3B0B46D8A17F8A4076B1D98084B73BC989C8F331A72502E4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Topaz Labs LLC\Topaz Photo\models\ghq.json
- Size 4KB
- SHA256 f40a18b5a194dce78ddb59afc3dedf11193cff0f56c32e6bba2828d4dbcd930e
- MD5 486f233caccc1a9f97883c0a20edbf33
- SHA1 8118b24cb7488dbcfca5e87ad3849182909b5251
- SHA512 92a56614df52282e09c3f216155717372359deb2da127dec2c4efaeb2c36ad756f218da9e630951a8f38aed1e6decb07da16490c0bb95b760f46f742e76fdd1e
- SSDEEP 48:9390lALJdo9RoLvXLvoRwrvGrv8RcrvcrvgR/rv/rvhRwCnCpRf8Iv7IvsvCaZ:dLK1UOnNCpc2
- TLSH T16CA1AD6BD9356C5721F9B7B4B4AD4E12F864076B5D88084B73BC899C4F331A72602E4F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\c02fa5929d338637\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
- Size 64KB
- SHA256 e5487a658884a7b8d59d0d64c217a9ed8bac02a28ffebe25bb258512783e8ea6
- MD5 b112a427fb7bdbd2e370eb7f79777664
- SHA1 94ae6457ea732aa6d09636f09d90b934154a3b14
- SHA512 4c86d22209495e5f60b53b4b81b9cceab790809ec98a22503a77f7e351770e1c682ec39c42bd1536c2aaba1b08cdbb6ce101e78cd45034f36a63c4b40ae00350
- SSDEEP 3:RqOlHllGlll/l/lXp9ZjrPBY06llqlHes7XllZP:R19l0dPBY0OcpV
- TLSH T16E5312C52283071BC442033045CA0740397412044343041152106130C45870002B118A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\c02fa5929d338637\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
- Size 4B
- SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
- MD5 f49655f856acb8884cc0ace29216f511
- SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
- SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\D3DSCache\c02fa5929d338637\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
- Size 960B
- SHA256 77a05eb5dafefbe902ed7f355fc4c5e7fb07043c9c528bf41761ea1a6bc2fc11
- MD5 6ec8f6dab8ae751c4e0b69b9f57467c0
- SHA1 c693e565232e6b797562056904adc419a4b6cd16
- SHA512 41e6b36c2a798ff77417ebe3e9960835c69cfc1e401a7ed98e501d982460d0d7457c49f808f6fd7dde9a238860aed53c17ce41100d9430a81689fe2ed6fcfee5
- TLSH T136118C843BC72CB0D36578350039D2101203B10208E3D34889C485634A22409D431FA4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI1450.tmp
- Size 2.7MB
- SHA256 3d2cbccdc2beba7b0a55e638bdcf7f6b0cf111094add80e702a837dd3e1d3f0c
- MD5 258caf3b5fdb1dbf07e5ccff7f6010b5
- SHA1 034a223afa725a7b45257acdf43ee194eacaa24e
- SHA512 477b96e35ed8c057ec53a3a2263895f42f036af929b6cc4f437cc9142567b71693b96ead1f0e888297dc94f1a3063790ed2ac2acb5a7617b75eb6c3efffc4fd8
- SSDEEP 24576:8a8kLfgPhL8BU/XIQnu2/6xJ0QGIEynk2SpXsOEB6Ic:Z8kLfgP98q/XfyxaFI3nk2usOQ6
- TLSH T194D58F2A66D81198D1BFC1BDCA874F1BD6B1740903619BCF05A086AD1F67FE90B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2112.tmp
- Size 234KB
- SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
- MD5 8edc1557e9fc7f25f89ad384d01bcec4
- SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
- SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
- SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
- TLSH T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4F67.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIaee0b.LOG
- Size 132KB
- SHA256 9c90e912e072ad2dc552d35d01d6ea934e7b15ad5541f2c93cba6603447a1d00
- MD5 e1be9bc1b996fb5f1b4d7fce6e4783fd
- SHA1 1d7825cfdf0535545b2f395d0eb33ebfee7a523d
- SHA512 623498520825c0fa3764dcbd216bf10100c35ce1ba5e81a7ba3d5455b41b7d212e2e21603504af8c7e426b3ae9f9f6fb4d35308170d6a7b6aa8882a15a645f3d
- SSDEEP 1536:MEFqmKdhwZ2H1qaDPoruB1eS3lFveQaMqli4ScSwScS0KeQaMqli4ScSwScSUqeJ:lcCsqcF9Hlu
- TLSH T193D318292BF41186B3B3DB875FF3486A4737F5266A35DD0D60C2920D0471E08AA5E7EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
- Size 9KB
- SHA256 7f64376e7be9e5ffc9bd08414af71cf6ee4582d0441abf12f97e56cc389ca590
- MD5 b11c3496ac413ec5424eefe4a2ec9497
- SHA1 293f61e8e44c5c3268c76196eb626c712cace177
- SHA512 2c3085d1b11c655d9f1c9ca13d16be416f45e025763fb4b57932342ac26036cb28eb3f74636e0eb6a1f53ff752de72da58202032eb17059cf9b2beed03763cfa
- SSDEEP 192:+/h8aQ8aT+mKQKD+cqvWQW0dnVRQR6UbQcQcEqnB4Q4rs4Wul8aQ8agsWQWgcdx+:Qh8aQ8a6mKQKDuvWQWaVRQR3QcQcHB42
- TLSH T12E122002F25A9637D02092B54E2E83779774BE03EE1A8A1BBA81331F6F354515C19B39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\Topaz.Photo.Pro.1.6.1.x64\ReadMe (How to Install).txt
- Size 1KB
- SHA256 ddc0e3ef700297dd4dc65f0fee7eeb651a6072bc99789bdc5d8c36b7e4c4af39
- MD5 08e857a118de4178023446d204041fe5
- SHA1 1d9600632b8e67ba67c9951f1eac3658fa37fa5e
- SHA512 c6e853e907ac5bec449afd0c23df823e5f8908c0b7db079a485a2b3f7453dcf0c45a778560c928297519735a7ebe679ee480723ad9c30353574d90fbe8240f45
- TLSH T17B31C83784A1AA20A2949D9836342DD253687BCAFBD8101130F83BCD7FBED50CD184B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\VCRUNTIME140.dll
- Size 117KB
- SHA256 642ae52687a7a6bfb03d0b20dc7e07f4b11ceca634f7eb7ba184d6711ab51a51
- MD5 c22ab531881b21277ba168e6f311d225
- SHA1 948c3acd2702737949b2b3a030e1d2a2181fb4af
- SHA512 8d3d39a7a469a5a5be1650f25293b9318277ea1ba828883bc6605e28ed66b4b1e2dd4796836fa9fd3517aa4deb9ca0fb51d699fa0a1ed1c9b43ae070c63b930e
- SSDEEP 1536:PI2v39UXigCBs29DdxfggO6vMMKZsY24fkUxoecbdhGRdVzVZgz2B:PiwskD8B6vMMEs54uecbdkRXEc
- TLSH T1B2C38C4572A002FBD16AC274C1A35E17FB75B84487A0A7CF03B58A690F53BE1AE3D385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 0e560532e721b6938dafe4055eedd0251ba5eb5994cd96937cebbcf16a7ddae5
- MD5 7e986e7469d9ab3b1138353418da1793
- SHA1 77903692aae688f6d5b04511d5006c66ce4daf8b
- SHA512 6c8951ae9a0e329cf32eed8bf32bd83294e7a1cf7f16dd716cedbed4caf39e56e62c5f639091f9711922443ada7dbc61dffcace093211d70a85821f19883cbea
- SSDEEP 768:uzzO6ujT3MbR3vXCz6Sz2q83yvjdsrU9zcgElebe9zVFZ:rq/XU63Cjd9zcZebazDZ
- TLSH T176235C9067788486D49F95B0C1D6EF537D78FAD24B40968F0BA0D1982F637C1EB3D21A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vcruntime140.dll
- Size 94KB
- SHA256 d8faf8ebf360ed0b3b1a43877a04863f7e044b3d19b641d88737e0829d683b36
- MD5 6e34fc4a713c3fbd88e47ac188d2540d
- SHA1 1877a17da406d147566168c56aac1eb576782b37
- SHA512 848a1d9602210d7da0f6e4d7817af08dc02baac7eccf1cfaadaf3a24b55e1316e77c40672a6a1195797e525f448817e534ae200e99cdf548ee64a7996fbcec4f
- SSDEEP 1536:NT11/9nhu8HQRC/lYLFy1E0CWtVn3GwDa/becbfQqFt3:N5NF/eLUCnWtVn2wDObecbftFt
- TLSH T1FA936C4A76A442B7D06AD178C2E35E16F770B844877053CF03B686AA8F67BE05E3D346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vcruntime140_1.dll
- Size 36KB
- SHA256 0d8217dbb0d52a3f8cd233b089131ca19aa6e0fc0c0fb10081f3c50761f5d15e
- MD5 d76532f224b6648179b77525326e8754
- SHA1 cb0a90adf84b9c19e750b166789452693f031053
- SHA512 721b4f0f55fbeefa394d3471c66d32e2f0f452f9977987450b1662b8e2e9a88d1b9c014b5f2a4b378d99f6fe4de6b5810f8b00157ae25b0de2a3bf3e211ea2fc
- SSDEEP 384:isFi8rE+2UUtAAd928q4qXnU5fBLn8umItRWqoVJtYftmz/U3ZlvJWriKW/014gx:s8g+2UUt/yXgBLn85aRZoZStvZRcbB0Y
- TLSH T1BDF23A9563784092E46B95B0C4D3AF27FB38F8A15750978F0BA0825D2E237D0F63E71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 934a005dffa3ed6d461323b46d198dc089c9d66bdbe8c363c24f693613c4e9d0
- MD5 c6a574295b5407cebae94c11a1d2afb4
- SHA1 bb8147fd47e81ae580122550697fbc24539cdef8
- SHA512 034a93497bed089bfb3fba356db552249d3d771faae1a824b91404f9fe277b181fd03a506507c3ebebb9133f74ce1ac833c307d01798f174a3138da83b8b99c1
- SSDEEP 24576:kFo3DMPjdoO/vvTL/yQqKC1gP7egB7tZUHMo93Uy8PE6JdrasIBm6jgb+Ok:qHo
- TLSH T18B57A31437F92140E7B79E3CA8F06A234D397D5BAC19DE8D45411B4E0922FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cba08e50-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{bc1e7b4e-71b6-4095-b01c-1f12b616bef2}_OnDiskSnapshotProp
- Size 6KB
- SHA256 26f485484934918e56c6a76d863d8a01dc81c1502bc04a327ecfc35448df7152
- MD5 f4f0cb058359f8e70cf4f0f0f0d3ae6a
- SHA1 34564df41f52a1249f305735bbf30442378c204f
- SHA512 6cb5b224ac479a9ac3c4813b4e5a101b4ea3d3ef967ab3421a50b667fab5f0fcd38bf18a5100d451057f87035d9c8e04821d2110d7e68e7194bd46739b0d781d
- SSDEEP 96:FybxSpnavc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Klb++uVm
- TLSH T177D188185AF54711E2B3AB3229F18557A877B811FF33CB8E0198238E6631910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH