1001b1deb76eb76a59ebe030e7da529695ea90f6659c0f9c79aaf850b1ff7f77

Analysis

user interaction
yes
max time kernel
85s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VEGAS_Pro_23.0.0.356_x64_DLV_DE-EN-FR-ES_251212_18-29_6E6EC08D.exe
Size 652.3MB
Sample260818-e1pvwawcnd
SHA256 1001b1deb76eb76a59ebe030e7da529695ea90f6659c0f9c79aaf850b1ff7f77
MD5 6e6ec08d23d27e4d40b73840a6f95b14
SHA1 a0c948c970c3fcf42cd62869b10c7d6efc3d8c17
SHA512 d89a27eee94b0c35df407afc0e08687639f899b796bfcfeed55047f71d1a17c8d3e0ecdc4cf9931be89caa7c7ba416901d8e888c791e4e0f648563862a37dd8c
SSDEEP 12582912:bZ/fxN/msM1KIMStKgWLDKxcx+SgXRobqM5S5VeZDjntZIde/1SX:bZHj/msuKIMStKgWLua+SgCqMI50ZDjU
TLSH
T1D16933142F9941AEE45202F5CA66C32921284D5443FD01E7EB8EF36A53379E2EBF5723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7} = "\"C:\\ProgramData\\Package Cache\\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\P:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\U:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\V:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\I:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\W:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\K:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\L:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\Z:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\R:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\S:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\X:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\O:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\Q:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\Y:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\M:	VEGAS_Pro_23_setup.exe
File opened (read-only)	\??\N:	VEGAS_Pro_23_setup.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vcomp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp120.dll	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5b5a90.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9F25DF7842815DB7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF719A60E178C3413.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DBC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b5a90.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{53CF6934-A98D-3D84-9146-FC4EDF3D5641}	msiexec.exe

Executes dropped EXE 8 IoCs

pid	Process
3064	VEGAS_Pro_23_setup.exe
3584	vcredist_x86.exe
6656	vcredist_x86.exe
1404	vcredist_x64.exe
1092	vcredist_x64.exe
3036	vcredist_x64.exe
836	vcredist_x64.exe
6060	vcredist_x64.exe

Loads dropped DLL 2 IoCs

pid	Process
6656	vcredist_x86.exe
1092	vcredist_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VEGAS_Pro_23.0.0.356_x64_DLV_DE-EN-FR-ES_251212_18-29_6E6EC08D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VEGAS_Pro_23_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000392849c4232396370000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801392849c40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101392849c4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3392849c400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6392849c400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B88D31BC-9019-446C-9DD7-02CF59B157FD}	VEGAS_Pro_23_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\ = "{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\Version = "12.0.40664.0"	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\Dependents	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B88D31BC-9019-446C-9DD7-02CF59B157FD}\ID = "A166C9FF04EC4D90A919BF04179D0B93"	VEGAS_Pro_23_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\DisplayName = "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40664"	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\Dependents\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}	vcredist_x64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
7072	msiexec.exe
7072	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	7072	msiexec.exe
Token: SeCreateTokenPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeAssignPrimaryTokenPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeLockMemoryPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeIncreaseQuotaPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeMachineAccountPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeTcbPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeSecurityPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeTakeOwnershipPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeLoadDriverPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeSystemProfilePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeSystemtimePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeProfSingleProcessPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeIncBasePriorityPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeCreatePagefilePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeCreatePermanentPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeBackupPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeRestorePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeShutdownPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeDebugPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeAuditPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeSystemEnvironmentPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeChangeNotifyPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeRemoteShutdownPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeUndockPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeSyncAgentPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeEnableDelegationPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeManageVolumePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeImpersonatePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeCreateGlobalPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeCreateTokenPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeAssignPrimaryTokenPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeLockMemoryPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeIncreaseQuotaPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeMachineAccountPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeTcbPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeSecurityPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeTakeOwnershipPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeLoadDriverPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeSystemProfilePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeSystemtimePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeProfSingleProcessPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeIncBasePriorityPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeCreatePagefilePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeCreatePermanentPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeBackupPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeRestorePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeShutdownPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeDebugPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeAuditPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeSystemEnvironmentPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeChangeNotifyPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeRemoteShutdownPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeUndockPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeSyncAgentPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeEnableDelegationPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeManageVolumePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeImpersonatePrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeCreateGlobalPrivilege	3064	VEGAS_Pro_23_setup.exe
Token: SeBackupPrivilege	6968	vssvc.exe
Token: SeRestorePrivilege	6968	vssvc.exe
Token: SeAuditPrivilege	6968	vssvc.exe
Token: SeBackupPrivilege	7128	srtasks.exe
Token: SeRestorePrivilege	7128	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6840	VEGAS_Pro_23.0.0.356_x64_DLV_DE-EN-FR-ES_251212_18-29_6E6EC08D.exe
3064	VEGAS_Pro_23_setup.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
6840	VEGAS_Pro_23.0.0.356_x64_DLV_DE-EN-FR-ES_251212_18-29_6E6EC08D.exe
6840	VEGAS_Pro_23.0.0.356_x64_DLV_DE-EN-FR-ES_251212_18-29_6E6EC08D.exe
6840	VEGAS_Pro_23.0.0.356_x64_DLV_DE-EN-FR-ES_251212_18-29_6E6EC08D.exe
6840	VEGAS_Pro_23.0.0.356_x64_DLV_DE-EN-FR-ES_251212_18-29_6E6EC08D.exe
3064	VEGAS_Pro_23_setup.exe
3064	VEGAS_Pro_23_setup.exe
3064	VEGAS_Pro_23_setup.exe
7072	msiexec.exe
3064	VEGAS_Pro_23_setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6840 wrote to memory of 3064	6840	VEGAS_Pro_23.0.0.356_x64_DLV_DE-EN-FR-ES_251212_18-29_6E6EC08D.exe	91
PID 3064 wrote to memory of 3584	3064	VEGAS_Pro_23_setup.exe	93
PID 3584 wrote to memory of 6656	3584	vcredist_x86.exe	94
PID 3064 wrote to memory of 1404	3064	VEGAS_Pro_23_setup.exe	102
PID 1404 wrote to memory of 1092	1404	vcredist_x64.exe	103
PID 3036 wrote to memory of 836	3036	vcredist_x64.exe	107
PID 836 wrote to memory of 6060	836	vcredist_x64.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VEGAS_Pro_23.0.0.356_x64_DLV_DE-EN-FR-ES_251212_18-29_6E6EC08D.exe
"C:\Users\Admin\AppData\Local\Temp\VEGAS_Pro_23.0.0.356_x64_DLV_DE-EN-FR-ES_251212_18-29_6E6EC08D.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6840
- C:\Users\Admin\AppData\Local\Temp\mgxmlity087\product\VEGAS_Pro_23_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\mgxmlity087\product\VEGAS_Pro_23_setup.exe" -m C:\Users\Admin\AppData\Local\Temp\mgxmlity087\SetupValues.dat
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2013_12.0.40664\vcredist_x86.exe
    "C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2013_12.0.40664\vcredist_x86.exe" /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_23_20260818_002834\001#Install#vcredist2013_12_0_40664_x86.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2013_12.0.40664\vcredist_x86.exe
      "C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2013_12.0.40664\vcredist_x86.exe" /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_23_20260818_002834\001#Install#vcredist2013_12_0_40664_x86.txt" -burn.unelevated BurnPipe.{687CA932-617A-4734-A76C-42FE5E245E5C} {4B1B17B1-0FDA-41D7-AE35-6BF0DEC9C439} 3584
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6656
- - C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2013_12.0.40664\vcredist_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2013_12.0.40664\vcredist_x64.exe" /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_23_20260818_002834\002#Install#vcredist2013_12_0_40664_x64.txt"
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2013_12.0.40664\vcredist_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2013_12.0.40664\vcredist_x64.exe" /quiet /norestart /l "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_23_20260818_002834\002#Install#vcredist2013_12_0_40664_x64.txt" -burn.unelevated BurnPipe.{00862976-423D-4228-B398-FA5993067F7D} {59593C45-5410-4D9C-A7D7-9F0BBA9AB6DE} 1404
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1092

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:7072

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6968

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7128

C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_23_20260818_002834\002#Install#vcredist2013_12_0_40664_x64.txt"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_23_20260818_002834\002#Install#vcredist2013_12_0_40664_x64.txt" -burn.unelevated BurnPipe.{2988B8B3-CCA4-4919-A074-C98FC27E8573} {60E103F7-87BD-4CE7-8DE3-8E9AB29C38BB} 836
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6060
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{2135CE57-A2D1-4EB1-B624-248C3507490B} {9A84246B-26AB-4CF0-887C-0388CA182CDB} 836
    3⤵
    PID:248
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{2135CE57-A2D1-4EB1-B624-248C3507490B} {9A84246B-26AB-4CF0-887C-0388CA182CDB} 836 -burn.unelevated BurnPipe.{2CFD9E31-E8CD-4EF2-99D8-2427DA73BAE8} {9ABD9B05-01BB-4086-90AD-F3E5555B932E} 248
      4⤵
      PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b5a93.rbs

Path C:\Config.Msi\e5b5a93.rbs
Size 18KB
SHA256 d4989c1cd7bfafbf155afa659dd36c7b0d2f66ba726552857816dbec44cedde4
MD5 6bda08fdbd1c650c7660594d3750263f
SHA1 56d9316f2525172acc2d377bbed7b4ebd812fa6f
SHA512 1e038a2120d7d4b2d296c9b6e2697c974ffbe01e9bb7cca2ac17a61d24c24f156524cca63a6b9fd684d918af65d9281387b0612695a1b65b7549c870370f8649
SSDEEP 192:4yJXuj2IYcwSe88WXjMRt6S5RtQCb1m9AkIqm9AkdzFEXENNepJG:4ytuj2IYcw68WXjwFRNz6zGx
TLSH
T11D8232426610D2D3E8AB2B74DE172B283B75D6DAD351A39B04CD91304F537C92FACA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5a9c.rbs

Path C:\Config.Msi\e5b5a9c.rbs
Size 14KB
SHA256 1b10606ee0190c476f1b06421f9faf704cfc6fc3127a5cba3d41c3166968f625
MD5 56665d5be3ea890a1e2cbcb17b41cc81
SHA1 3e3b3224815186ea4d69ee5e8e8bfdc4ed022dda
SHA512 9540e174b0d331b70a9c3407cec905ef096eaf36e5d1a4fe06c5ade6996198f34117fa926c3c1fb4f3d52e420cc163da37b0f0559c3f1112455efdf6d016f6b4
SSDEEP 384:xFuRSZX27RRSmX2tR5JjZNx6Y/pSuQ7fpqPfd1/v:xM/d4X
TLSH
T1846220422B1681E2D8271730C64B1BA93F6AC7E59314834B459DDA344F977CA7FCCA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5a9d.rbf

Path C:\Config.Msi\e5b5a9d.rbf
Size 644KB
SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
MD5 edef53778eaafe476ee523be5c2ab67f
SHA1 58c416508913045f99cdf559f31e71f88626f6de
SHA512 7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8
SSDEEP 12288:EOB4p+q4N8d4l2ms4cTHN+m+gy/vEPYysExtvsIvX71A+2EKZm+GWodEEpvYG:jAtvsIvL2EKZm+GWodEEpvYG
TLSH
T158E45B13FB150AB0E192D37891D78741D7F1BC898822F30752ABE27D5F67391AA2B361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5a9e.rbf

Path C:\Config.Msi\e5b5a9e.rbf
Size 940KB
SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
MD5 aeb29ccc27e16c4fd223a00189b44524
SHA1 45a6671c64f353c79c0060bdafea0ceb5ad889be
SHA512 2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006
SSDEEP 24576:cj7dDxvo5outISmDa5HSueghIHkCvf44lmWymt:cnLLSl1tCX44h
TLSH
T1CE25BE4576A106F9D473D2B4CA679647F2B2B85A0530DB6F02E08A6D3F23B30966F317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5a9f.rbf

Path C:\Config.Msi\e5b5a9f.rbf
Size 470KB
SHA256 88a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b
MD5 f0ec8a3ddf8e0534983a05a52bce8924
SHA1 5f6d0265273f00ffe8e30cf507f0d05d330ff296
SHA512 d7b084d7f20de29ff16341df2756861bb7ac22eab0711869b3e77a84d841fb76a898d7459ca1be62eed522caa1f022c891a7d30c94bf0fff1bb4d016be8aa9bb
SSDEEP 6144:iU03ZYl14gzlZrGo2QgeapeUQdUyyO9tIUosLAV2SAD17pFHVhDnnV0tOA6Y1qkZ:i+G6gS7hAV2SGn3I1qkZ
TLSH
T1E8A43B19FA5C8C61D063923E84EBD6C6F3B234585F32DB4B6159933D2F77A90AD2C221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5aa0.rbf

Path C:\Config.Msi\e5b5aa0.rbf
Size 348KB
SHA256 1b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc
MD5 ea1e99dec990691d41f938085f68bcc7
SHA1 5fdcbcd777e10e765d593994dc66f930c1377b0e
SHA512 e90a40bd8e20bbca3c6188a78ad75578e51d88aa638e0bbfed4f6f6efdd0917e92b08ef4b0ccc2dee08774f08658b189e25234270e8ce1ca60a7e0ec8e3fbcf8
SSDEEP 6144:eg5dgFfqaKFJyHrBye4/RAHq0KzO9OAgfVgYCDlicdY:eOdc4/RAHqkeX0icm
TLSH
T18E741A127BA88CE3D43391764AA78B45E7B2B8920F71E30B2594432E5F773616C1F672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5aa1.rbf

Path C:\Config.Msi\e5b5aa1.rbf
Size 134KB
SHA256 22d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70
MD5 d7dbc7c92177837431ae2fd7fb569e2c
SHA1 c26140204a6db421842ad36599326a5369fd1b5d
SHA512 4f2b197ea912b5ea1a82ac84e1c15ca8e3787460cd79a32733ea920dcf3b1db5cf0507ad7c94f4e4ccab9dfc6773a9d05a8eeaa7bd7c61b63d780b69ed7ae0d8
SSDEEP 3072:2cjMv1qzORu8kLSiHHUswXIhEXniHJfshjcsdQoLqUi25/+MWRATg/TKEfB6:MqnTSiUswDnipy1dQoFqA8/H6
TLSH
T195D36C4B32E4007BE5A79630CD638D59D776BC5706709B4E07A402EE1F233E6AE29736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5aa2.rbf

Path C:\Config.Msi\e5b5aa2.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e5b5aa6.rbs

Path C:\Config.Msi\e5b5aa6.rbs
Size 27KB
SHA256 575bbb6f99dc6aefc2750bc359806bccc688785b86261c79583681ddbd4f6eac
MD5 03a276221c62f0ee86ab689bc6eaceac
SHA1 f64abe51ce44cbf221ae33be8ebc39eb0fff08eb
SHA512 dbebec0a25345d309b180a57663eb3890f1881f58661a63928ec64f0e608aac07aec4a03fed81541214f982f941d479e13129096117793f7e697f75a75518a7a
SSDEEP 384:TMT8MgXEtmrnb0MM0IoNfFHSeQBCgGLwK7+Y6YBVXDcpe:TMT8MgXEtmrnb0MM0IQEBjMR
TLSH
T144C23142A740D1D3C8A76B34ED5B1B657B31C6D697A4834B00DCE0784FA33D62F99A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5ab8.rbs

Path C:\Config.Msi\e5b5ab8.rbs
Size 22KB
SHA256 4f557e1379f3678461808d81c5cbece920db11d6557eaed5d55c656cad061727
MD5 486ce77a2ca8ba8f5d5e0a0bb19fc54a
SHA1 a8619af196b105650ae13014db88bb1a58a23e16
SHA512 80f23c2b7d20274565f40e39feda66acf113f24ed424137f5077eb8e82537908feaae44a03c9f15c2c5719f0fd9aba0b916f94aee865c7ee6f693c6e81c5ab1e
SSDEEP 192:TRRUYeR7YsSZBa8vSZPTgARlpUPeFOrzj/nX3XNd8eXU+XJ/7:TRRURR7NUZUPTgALpJFOrzjvXDO+Z/7
TLSH
T1D9B2CD026640C1E2CC6A2730E9931B793F32D6D59394878750EDD0B88EA77972F5DA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5ab9.rbf

Path C:\Config.Msi\e5b5ab9.rbf
Size 45KB
SHA256 cb531679be2881677a93d11067c71274ec30b30aadf1cdcf1543dddd6b1d7b61
MD5 f96a9a88487a27de7b3e15c733cf1fe1
SHA1 0a4157f064349b0370b8ee3f244f44debd04b4c0
SHA512 df5390b235157e65efa3a9385a7ffd6d5f4f2471306625f01370ed463c65b81c4274370f93b5b0d04d44175c57322d2f2fb1cdd2bcbc123997f4ae4ae9557f0b
SSDEEP 384:SzdBlsNKvsXsWMsW6YbRWktLiBrHuuPgldyevyBbXVLN1aJA0GftpBj60ERHRN7L:adzvsXyPptLkrHyTby9XVLqic0EBz7D
TLSH
T15A233A760BB8CA46D611453046D2DB83BF39E7995A11CF0BBF01F68D082A755FF09E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5aba.rbf

Path C:\Config.Msi\e5b5aba.rbf
Size 45KB
SHA256 0301c5dc6e762788891356987e9c8cd0d40b262df06e8384bf5796b1f20f083e
MD5 6a5e17d5a4b24e5c2b947a343a182949
SHA1 ddf5ed505953e073f09b17e8e2bdecf2766c6a4b
SHA512 8a383192f9f6e6c4fab24645cf7c30fa927881451f0e65175b724717151cca6fcc49ed3394cc689407f19a7b1afd6b462688bccb898912762b804eeeb7cd8d97
SSDEEP 768:ZWbfucVI4Yr7kn4TJVM3i/EhKTi37EBWfXMV:KucVI4Yr4noVM3XhKT8EBWfXMV
TLSH
T1E8233A6A07A4CB42D6514A3006D6CBA3BE34EB99AF004F57BF02F68D5C59385FF19D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5abb.rbf

Path C:\Config.Msi\e5b5abb.rbf
Size 73KB
SHA256 80e0f29ff6b7ada892f23927f17021783575ad80f9f6c8a268a6c2a7ce35e5d6
MD5 bfc853c578252e29698ff6b770794e6a
SHA1 1091dced7b18bdd7eda2be4d095ac43cfd342b7d
SHA512 306445384614b48d3182a91c8adf8d8206c36efd88abf23753800566f9650518af382164ca1a17ed000888e6a99c175478ad621d0a0d46c9bc7d5359113e05fb
SSDEEP 1536:fVPidQr0UZqnn0BDw7Pu6V4aGCWRZ+e0petNSaQhp0vcsjsr8gWt8C1dCuf9jour:fVidQr0UZqnnSw7Pu6V4aGCWRZX0bhpC
TLSH
T13273BC6143E98A19F1F2AF742EB49390BE36FDE6BE35D60E1610618D4871F40DE61B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5abc.rbf

Path C:\Config.Msi\e5b5abc.rbf
Size 63KB
SHA256 e463f38fa6b6157398ad224a462538bd8e36b75031fa711e567c5505a9092df6
MD5 19b7b852ac2dec695e6a52801e59c421
SHA1 cd72265e1a6a64c761984980895d92cb93bc61b7
SHA512 d0fd9f75820d3dbdc4001ed6262a940f062655ebb5f31f3d45d984e38b1bae2e5a958665b79b5b4aeb899e39348ba987c82148bfd85477e69249d3a59a076017
SSDEEP 768:UTijcBEhCgyPj6B1CLPLNq5f/nWHBNheOU2fd53irQxMEBKelMG9:UGzfyPj6B8PLNYf/nWHNTdBqQOEBKSMK
TLSH
T12353DA5267FC8605F5F77F702EB596516E3ABCA2AD34CA0E1640A14E0972F40EE60B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5abd.rbf

Path C:\Config.Msi\e5b5abd.rbf
Size 72KB
SHA256 db4fc3652d24224d5375d1a5696144ac8881332cc20f5992ed1488236e64c120
MD5 9ef2dc352d20b615a556be53b449b17c
SHA1 933b2a39f3d730c6b5d437558d0db68c5d2c22b7
SHA512 8031a4d0e44beb290c48292a0987108ed6d6f56950dfb17ee4671e692407fcbb8dc652d82907d8f98db2f841689f9480aee6fbce60cf2bfa1d0d6294c3f6da91
SSDEEP 768:zqj0KnBU60E6rg/PKuCOCF3OKWRElJRZRIvpLiyj3HEBFKui7el2:pwq60E68/PKuFm3OKWkRZRIVHrEBFSS2
TLSH
T11873825117F8520AF6F3BF34AAB94A945E3BBD96AD39C50E4610619E0CB1F40DE24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5abe.rbf

Path C:\Config.Msi\e5b5abe.rbf
Size 73KB
SHA256 e7cb6c2818ca27c864bda635d5b5d9f7bdb308f4b5d4bbc206ee1e135b7dbbf7
MD5 06473191b67c8b3d1a26b76474c5daeb
SHA1 94c72bb597c365cb77f621e6e2cf3920954df2d7
SHA512 237c144cd3cd78c4a4eeb5c6a22043a8e604bdbd7182b89bacb81135b1e3de08780061dfa3664508cfbdc01e918fa2610e317f9441b10c4df8def1ca444de4eb
SSDEEP 768:O26iNYajZELpjYImN8YxAaTafCp5eFQZmZUjyyyyyyyyyyyyyyyUGQFUbWo2Negk:ONuqLpjQA2SCHj0jkVEBIm
TLSH
T144735F1163F88606F6F27F3069B846555E3BBC8AED35C61E1A00A58E1CB2F54DE64B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5abf.rbf

Path C:\Config.Msi\e5b5abf.rbf
Size 71KB
SHA256 9cfc5985440df4e70b57869b32c8ee69eb6fc570a98cc94a53141a0dc7535e10
MD5 713e30e13c1998e035cf4ace66b03230
SHA1 2d244e01c2bd9f3f17dfa0b74c19ce6bc512e1b5
SHA512 8a2581aaa125eb45543e679e58be7040d151cfcfe0625f6e62dccc3fcf87872d3504b30082036d5219dc4c8493600838d31b2ddfde3ba0bc1b2b6ef97078e29a
SSDEEP 768:h3E6XaCyqbK15Md+igDGxNIlW3gyCQQQjeqS1hDsiiUWTVNviNZLEBFPrl:zass5Md+igSxNIlW37oETHUEBFPrl
TLSH
T17A63A52163FD8609F6F3BF306A7996515E3BBE96AD38C50E0650608E0872F54DE60B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5ac0.rbf

Path C:\Config.Msi\e5b5ac0.rbf
Size 52KB
SHA256 83fb72fd2142d54bff6280e7c4d4ff22d43c3a81fa4ff8881003abbe5e21ec3b
MD5 689b5f0061a67ac95f59a64744702186
SHA1 52227dd2c8a66c0528bff28475846faf7036340f
SHA512 30b4e01d20c6c3ac1b799dd4d23fda3ca988eadb59356f84aff0a0760572b5c4119ef21467494e47a7d74dd6b136633a6ae40f45ec051d5cacbe44b5d6255d42
SSDEEP 768:y8anVn/ZBtJxtr10/euKRHIWHvifhEBafXA:y7np/ZT/uMhSEBafXA
TLSH
T11C33D7DD3AB88A0BE0E2C5300190F2D57A39FA449AA18E132F48F54F54556CAEF15F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5ac1.rbf

Path C:\Config.Msi\e5b5ac1.rbf
Size 52KB
SHA256 b2c7fc2c95b13bac36316d298c94d842dd2574f78e9c22e4d4e4af1c3fcc0fd9
MD5 7d03ffc6a8fb686abd660efdc3aaf223
SHA1 3d04c53971a525cc3255ff1eab05ff0cbad75bb7
SHA512 b5d41294630e342f2242a91c9dcf9085cddbd2389860e14c741147cb695425971cf79339b523d28fd3189589e5f948115359b89f59a03186e3c6a103f854f4e1
SSDEEP 768:fCzO54LQTNyDraHniJNB2I7CvqliwfiEBA1AQ:f951TNyiniJv2I7Cvql2EBAyQ
TLSH
T1F933296716B8D903E8608575A7A2C797B7399780AB234E07EB00F2AD146A7D4FF10F5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5ac2.rbf

Path C:\Config.Msi\e5b5ac2.rbf
Size 69KB
SHA256 3238676035d9c1595248ef65ef5b044384b473ab9bdfe8d1077e10e4fe7bc983
MD5 a99ad214ccd1e7bc1f609b972467b0ca
SHA1 9ee79954fdb2338026c3c81da00ab6e7e6c2e1ff
SHA512 da1f8a4dd82559635ea53dfeac1817a9ced1d247a170a8153a54c05c371fc80aa2fa958bc5c515c026815c505f70fb374178f8ccf94836b66c4a7e23dab1c083
SSDEEP 768:gq/gFXOvijuqN9TMIVhtZ3FckD+SsMipzEB88L5:/6XOvilhTVcMaEBfF
TLSH
T118634E5FEA7CD611E864C2701F9289D7207AB700672986CBDA8FBD6D602C33577285CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5ac3.rbf

Path C:\Config.Msi\e5b5ac3.rbf
Size 5.4MB
SHA256 75497de4aec4b5f0f258164672db2eb55eef5138c028317860e05f11030f7b7c
MD5 ee4af4ceb4b7fded7cdda37faef69704
SHA1 5ab8f2ace2f4a1892ea4a2a26df5ee7e9cd497b2
SHA512 4f807157e6bd57ac37bd1d8a52ffdc38e330e517101a1ea603096d8728b04c9c2ae96e510b961c87536e957587ce169fdece6bc3ed5e5025aa87c0f276da0ece
SSDEEP 98304:afQjxbHkzO6QhbMi0cFLOAkGkzdnEVomFHKnPK:afAbHkz0hbFLOyomFHKnPK
TLSH
T17F468C5A2AFC8059D0A7E135C55B8F4BD7F3FD902935D76F042222AEAF77721190A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5ac4.rbf

Path C:\Config.Msi\e5b5ac4.rbf
Size 5.3MB
SHA256 950ff7746d747de51cc09c1aaaf88fbc2fc97c59865f574cc3fb10243ae7b906
MD5 a6d08e8e290c80822842015cd877d405
SHA1 2ee9d28e20a73facff20be87092e482b562dad41
SHA512 b6dfc3d0ef4f57c116d44b201fae187c9427d4fe7cad969f50f9408af40071d811e88698134491f479923b259a47d0b528e7ea23790248314e902ee24d0b93a2
SSDEEP 98304:TbsL/TwbVuBQwMvYFLOAkGkzdnEVomFHKnP4:TbsAbVuBQPYFLOyomFHKnP4
TLSH
T107469D5A6BBC4098D096D135C5678F5BE3B3FD512A32F35F0821269EAF733711A4A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5ac5.rbf

Path C:\Config.Msi\e5b5ac5.rbf
Size 89KB
SHA256 a78e7988c9f99bcbe02d29441b0dcbdebafa616d2a4652aad867b81f554a0476
MD5 43aae7bfb0c911e7e98003e2b45667e6
SHA1 0c6c7d96cd0eca734e425b1ddef178c3ab6c31ce
SHA512 33d1293a7905ee9ec58b9a7744981006d6dadafb75ef64769723de02ba273f344a20e20d206d64d2453746549fe471328a035e2b5cc8e485e7cfd2c2fbc7c6a9
SSDEEP 1536:wHTxEJCfkrRasN/cfvSpauyd/nbzLVicuGJOZwKXXEPFNFOAAucNqh+EBDgn2:MTx1YTcXMapRVicuGJOZ2tOAAucNqh+D
TLSH
T147937C0A6A76C6EFF49A59725A13CE42223BD3936B61C7871130A79D0C973C0BF16B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b5ac6.rbf

Path C:\Config.Msi\e5b5ac6.rbf
Size 89KB
SHA256 864958960b8dd2890d47f2774ba836954f2c4f5ad6e4d529b13138caefcce73e
MD5 0d5451a0050f7acc970ca02459c63d9a
SHA1 2de9febca0b1d48014081907e835237c832c65b0
SHA512 4d0b3d3d494c1774ae4575eb945f3c0742b723d6583d98dd36cc51a1d099b8f1a090d4b18c54897d1d58a67381b800604724cb609447860105bc2e0e8d5094a8
SSDEEP 1536:lHTxHw36oFacndsFjFoTc+sgqv4G4DG/88W8uzOZwKbrEzeBB7OAv9wxpEBgq:hTx2JdAD588W8uzOZqiFOAv9wxpEyq
TLSH
T1C1937D4A6A75C6FFF58B49710A53CF42223AD3936B61D7471234B79C1C873D0AB05B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\state.rsm
Size 788B
SHA256 859a62fcdbf45e92b44d1c5dc4ea29460c0145e73d07920d1a180b5587fce91c
MD5 c5ed0ccf162e5ef37abb28290665637f
SHA1 d8fa993cd5b62a8b41baabbd51d88742f257d074
SHA512 6191f0027540265dcfef4fd138061af964721e1623d3b21d1ea89ed04833febd67686e758af47f8b615aef5dbecf446322f067c1fa247aaab41894bf72f6baeb
TLSH
T18301E2244FFA500AF3B7AB31A9F50215287AB4022D31D15E4182324F8F32B90ED60B16
MD5 SHA1 SHA512 TLSH

Submit Download

002#Install#vcredist2013_12_0_40664_x64_000_vcRuntimeMinimum_x64.txt

Path C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_23_20260818_002834\002#Install#vcredist2013_12_0_40664_x64_000_vcRuntimeMinimum_x64.txt
Size 2KB
SHA256 f0fb2094db3daa6e9c2102c42e46cc2532bba6140f6688e3ad188a7dc3a5864b
MD5 bdfe3d172beffb89c74f45f4051da92a
SHA1 12ad359ee48ec0397346e17cb798cfe4541763fd
SHA512 0ae948117a54f18d9651de13159bb98441c6793d68693879c787bac15cf33680ec13d1f3822a6d5922edd2920a58d3ac338d18e9902ced19c44832a47b807169
TLSH
T104412E6A1EE90846F2B7974799F7C0631E73FCD2A874DB0C13C483194667D00AEA47A7
MD5 SHA1 SHA512 TLSH

Submit Download

002#Install#vcredist2013_12_0_40664_x64_001_vcRuntimeAdditional_x64.txt

Path C:\Users\Admin\AppData\Local\Temp\MxMsiLogs\VEGAS_Pro_23_20260818_002834\002#Install#vcredist2013_12_0_40664_x64_001_vcRuntimeAdditional_x64.txt
Size 2KB
SHA256 04d8160f206c54e46ff41b3f0e4f832a3053eaf76a701110592507bbca68840d
MD5 021babcd3c03c54977c7a1e2b2f0c3f9
SHA1 9798adb8d2dff283510e74cb1308bc76a68e5faf
SHA512 717e7eba1185c887a6d45d5e978d9acf72f322b8bb1f3cba4aaa9fc74024195e670e1ea053d86938b6bed9b217e7814e1b48a4e484df1e6f9ea3532ba13b8d85
TLSH
T10E412B691AD50946F1B79747AEF3C0235E73FCE66838D70C23C5531E0A67D00ADA47AA
MD5 SHA1 SHA512 TLSH

Submit Download

VEGAS_Capture_en-US.mst

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\VEGAS_Capture\VEGAS_Capture_en-US.mst
Size 60KB
SHA256 16ea74a96420a49dba80a726b3f9d644bf735706788e4d60e4778801afe9cc4c
MD5 ebd4a963f8bfb5e248286cb03fd2d039
SHA1 99b3b10c4a8016ff75d6e1e9ad2a2f6b75fedb80
SHA512 668705c633c03848b521c2a3bcf13842e4d676b6e75a639fb4326bf411005c073033ec9f72368e9c1774b5ffb16f32b62384a40c5c245bb771affb22cd5ad18c
SSDEEP 768:BgWROZN6/Q4Ct1PEXyaa2O7L/W/MYibR5ALI:OWQ4Q4Ct1PEXEvzuM7
TLSH
T11D532C4BFA90417BCED2433569895B6B1B759C3C8BD201A560CEB28C3FB229863F71D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VEGAS_Capture_es-ES.mst

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\VEGAS_Capture\VEGAS_Capture_es-ES.mst
Size 60KB
SHA256 e3a0d69567400890064dbc440886536aa968458edac5793e58ef53804c57aa41
MD5 29dbeabd49f4072d4b9f727da0d8f421
SHA1 3a9506d5b8626a893febad5bafcdf8f6ae92c9b9
SHA512 942000d048fd04028cdc41534413a3ffde34547f39489040e52c82d5aef8feb61f0dad393c0efa1bd3f2bb639956786e7575ee72d905647afdb713075415aee9
SSDEEP 384:zewpIxT6fbLCBhe6xA4P3jBB7tT5wUE9N2xXFinYgtbH0HVNmqXXaiG3IYirNELr:zzil6f134VTdptu0HbxXVYi2LJ5AL
TLSH
T10E53FB6AB6C84A53E682433DA587CB2791D49CD07808C1D292EEF35A1BB1FCC97772D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VEGAS_Capture_fr-FR.mst

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\VEGAS_Capture\VEGAS_Capture_fr-FR.mst
Size 64KB
SHA256 7710c3e4a253e0fde0ba5645b22baa2d3700c5ba5c2d3c2bbe8f77478d569d8d
MD5 728d0f61c7514da11843405bee982497
SHA1 467139fcbce5f863018c930fdab7737227790f33
SHA512 4ac3ac1d7ad6e8c623bfdbcc7db77660093280af88dc3d9be7f7b3a5d44f4641cd1ad779158c30c3ff301d30af7419dca30e2c085ac30c94347d4921d2c382b2
SSDEEP 768:FwwGS+RY7q1UmFske6PSLYcqSu7Mw/yCcmBUvYn+BXxBYYiGl5ALq:US+C7q6gsh6PSQ7MCBUvY+BXg7GX
TLSH
T1AB531A8AF8F0A145D9830337F9019753EAB4DD94705AE109DEDAB28E17729BC639B1F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VEGAS_Capture_setup_x64.ms_

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\VEGAS_Capture\VEGAS_Capture_setup_x64.ms_
Size 2.4MB
SHA256 0b75622d287816854e41e1085f9be33eedd98bcea585e89aaa7e0164a8e5f45e
MD5 2808c34167eb5f33923e123822046653
SHA1 ca7cb79720e79e6f6b9b71194644689ec25acabb
SHA512 1c0c249eb22fe1d640aeda8523fe1ee6bd8c1ccbf2790c3efffef03175c311cd2b9e909612e65b596b5ac635950cbb144a95edc365788027ba7f450c141d3d58
SSDEEP 49152:2qBG0JzpVbeaOh6DGCpeet7jpbgJoO0sno+:9zqr6SCpeeFjpb+
TLSH
T141B55A126F58C139E9AE02F1592C9B294469BDB017FC45D3B288FB5D59338C2DAF2B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_aze2vqq.cab

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\VEGAS_Capture\_aze2vqq.cab
Size 36B
SHA256 a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
MD5 8708699d2c73bed30a0a08d80f96d6d7
SHA1 684cb9d317146553e8c5269c8afb1539565f4f78
SHA512 38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264
MD5 SHA1 SHA512

Submit Download

vcredist_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2013_12.0.40664\vcredist_x64.exe
Size 6.9MB
SHA256 a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
MD5 49b1164f8e95ec6409ea83cdb352d8da
SHA1 1194e6bf4153fa88f20b2a70ac15bc359ada4ee2
SHA512 29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60
SSDEEP 196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC
TLSH
T1EC76333296645127D1F20973F810E2207E3CB12D7F1044A3A794EEAD2EA95E667FB347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2013_12.0.40664\vcredist_x86.exe
Size 6.2MB
SHA256 53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd
MD5 38a1b890ce847167d16567cf7b7a5642
SHA1 0f5d66bcaf120f2d3f340e448a268fe4bbf7709d
SHA512 907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd
SSDEEP 196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv
TLSH
T195663331E2649033D2F209B2F92497307E7DF2186710C4BAD658AE1D7A694D3A7FB253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2022-2015_14.40.33810\VC_redist.x64.exe
Size 24.2MB
SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
MD5 1d545507009cc4ec7409c1bc6e93b17b
SHA1 84c61fadf8cd38016fb7632969b3ace9e54b763a
SHA512 5935b69f5138ac3fbc33813c74da853269ba079f910936aefa95e230c6092b92f6225bffb594e5dd35ff29bf260e4b35f91adede90fdf5f062030d8666fd0104
SSDEEP 786432:tSp+Ty2SfUfnbDDko5dFMYqlQbgAVLSElbmucMuZZxs6Sf:4p+Ty2SfWnHDk8FjVbfzPTq4
TLSH
T19F4733339648042AEBE34573AD99F5241D38A52C63024DF6EAECDD5E177829237FB702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\addon\vcredist2022-2015_14.40.33810\VC_redist.x86.exe
Size 13.2MB
SHA256 a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600
MD5 8457542fd4be74cb2c3a92b3386ae8e9
SHA1 198722b4f5fc62721910569d9d926dce22730c22
SHA512 91a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182
SSDEEP 393216:x3RwlptVYmfr7yBG/4uOzH01/Nc1eJ/RXZMPDyiX:xGpttD7yBG/jx1/N/tZUDJ
TLSH
T145D63332E158413BDBB704736998FA242E3CE12823148DBBE3D8ED5D2B7519227FB651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VEGAS_Pro_23_SetupInfo.ini

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\product\VEGAS_Pro_23_SetupInfo.ini
Size 2KB
SHA256 1fd39f1b28dd312867210fbb33dea43799ec52e6ca4d37df0ce9977b541598c2
MD5 77e3ef62f0f11c5f91da8390b8704d90
SHA1 92000fb6668f7b25fd930813e0808f299472b581
SHA512 9f437a605bd0e36b6c497bfe5ea27c0e3a32286a9db969496a753bfe8074612d57417fc906c387e502674edf8fd4528e779634991a19545d14d5f01c11439a14
TLSH
T17541A41A97F40118B2F74748EF74A8F6173378A26B3DD95E40E2128D08F5E41E912BBB
MD5 SHA1 SHA512 TLSH

Submit Download

VEGAS_Pro_23_SetupRes.mxres

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\product\VEGAS_Pro_23_SetupRes.mxres
Size 3.0MB
SHA256 08757b2beb625b8faacfa026953b499e0637bd7b79d1d4d0ffb5e727d42399ac
MD5 a9ae24212346ce2fc075054b3c51e8fa
SHA1 96229a767ba3b3d3d3ef0e3ee1bfbb181d4ff922
SHA512 c00efa21aa9eb580f7b98f337387bbdfdc32aa6312bf85c4b91c95f3b1ac96ce942272c52b51eee85b99afadc35409d2292419be53a5042cb495b39a72b309bd
SSDEEP 49152:ncdwoEJywvbQF8puppuNjcRbPHf64Jg+E:ewoQywYC4JE
TLSH
T11AE56BC97F4F02AE31C20226DD92D19E6AAC85E8533941FCF74FA1175B898549337BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VEGAS_Pro_23_en-US.mst

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\product\VEGAS_Pro_23_en-US.mst
Size 60KB
SHA256 8f33bea35f8af3fe9529e472f2c8c77a7d42bce6d8c9819cfaf8018bb4adca9a
MD5 23609aae4d2d9615436fe3782d2f5309
SHA1 94d61cba99cad07a36e5f6ccdf7a1fa562322ac8
SHA512 502b4ad56bcf08c1c6e860cec559bf936bbb4c75aedcb711ba4cdc8b7f978c1a60b51e87529aa6ff26ce4c4705f71ef1b3fb1e6285e6b433dee204434d391300
SSDEEP 768:kUWaOaN6/Q4Ct1PEXyaa2O7L/fQJENYi+5AL:hWHnQ4Ct1PEXEvzY+7
TLSH
T17E533D4BFA90417BCED2433569896B6B5B755C3C8BE201A560CEB28C3FB229463F71D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VEGAS_Pro_23_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\product\VEGAS_Pro_23_setup.exe
Size 4.7MB
SHA256 2da937727a4eaaaeb7f43bedb86d7950755c1899da41bfaa4717e2b53be9cd3d
MD5 8faeb7b0f28f2539d9b2f1db93112068
SHA1 ffc909141de78d360906c90be35f226dff4b751e
SHA512 3bd50ea70960c549d7a9d196c92114d033f3ac1412408e13082dc8917bee4bca33c067a1ffe2cfe63f55fa0ede1b2893c929688ad8f8d5186dbe6e2bda1aac9b
SSDEEP 49152:MrXaWF/LeJt7MXM561ImgwtX44uWXbNDkaM8zq9AfODGAgEMXa+m5gxBlTT+zWLA:MzIJz561Zg844uWXbNDkF3yEMXa7zW9G
TLSH
T146365B507E55C135D59201F1A928AB2A40ACBE714BFD54C7A388FF1E1A739C2E6F2F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VEGAS_Pro_23_setup.xml

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\product\VEGAS_Pro_23_setup.xml
Size 4KB
SHA256 57090f9351d785475c8f5c7e4761151f1b72cd56833f922c9c9926c8ff936ce2
MD5 0dced2460d2a2654b766fed931e51683
SHA1 11bf567248fbca4724b1c74f1b3ba257b20aef51
SHA512 892bfbe2c0d52fc4c02bf3bb5c703e84762621ee145e2d81d2dcb0fdc79ee4aa5a4c5da6d63851b170554bb8d66d5d06520e5e530d280396d3895982396e8c22
SSDEEP 96:3GxctGGlc4oDNj/6WeMj/qNcmxgmyz4Mg+NozEB9bupsgXkb2NPAgmg4lGqCmN+K:3gYXjKda/TjrYHIY
TLSH
T1D6A1202CB618FDE92CA032D9A8526C713BB64B507221C074A4E698CA179FDC5D4FF1B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VEGAS_Pro_23_setup_x64.ms_

Path C:\Users\Admin\AppData\Local\Temp\mgxmlity087\product\VEGAS_Pro_23_setup_x64.ms_
Size 2.7MB
SHA256 51c2e9dd020fbd5cd313e7c0a5b4f572156a2e7c72a229ae29ae4d4cb9b3f178
MD5 fa05a6ada903f794838adeb84884d689
SHA1 2d2bf5f66255d5d0e65c56bbf6f6177e37b44600
SHA512 5cceb6144ae82e8559fd2816a3ed3289f9f9c7e872ad3bf9fd9aaeb0364fce8e247da541e4c140cf6c5fd989aeb4ee6862bb02087336ac2e531aa9b6191b7998
SSDEEP 49152:oPtd2SZr00zpVbeaOh6DGCpeet7jpbgJol0sno+:o28vzqr6SCpeeFjpb+
TLSH
T138D56B127F488136E9AE02F099299B19186EADB047FD45C3F298FB4D5D335C2D6F2B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba2\license.rtf
Size 6KB
SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
MD5 1e47ee7b71b22488068343df4ce30534
SHA1 deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
SHA512 c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
SSDEEP 192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
TLSH
T194E1C6FD2243DAE0069F1399194194C6FB0F0F79DDBF7E50B5B69110126291C727EAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba2\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba2\thm.xml
Size 5KB
SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
MD5 0056f10a42638ea8b4befc614741ddd6
SHA1 61d488cfbea063e028a947cb1610ee372d873c9f
SHA512 5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
SSDEEP 96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
TLSH
T193C179B546DDB801C133EB1166F231D27F126972C0C86E99F94C3AFA4FE1150A87B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.be\vcredist_x64.exe
Size 455KB
SHA256 102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6
MD5 3284088a2d414d65e865004fdb641936
SHA1 7f3e9180d9025fc14c8a7868b763b0c3e7a900b4
SHA512 6786fb431addf05df256d0e1383501f96356aa78f66482db9772c58334aead59838abb7db0ea793d4a17627a357598266681c28328485489a21bc2985e751b62
SSDEEP 6144:9qIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi/6xLdowQguVC+:9qIOkU8AMXE9B7PElZlP41v6ro4n+
TLSH
T13BA45D31A6A04037D6F106B3F914D6307E7DA2187B1184ABD394AE2D7AB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.3MB
SHA256 1f2f8f5d60dadbc6e4d3d36c88cc54f22af0a615b609609e748782dc26231174
MD5 f5879f5f3ffa839a280ab853338de872
SHA1 3b4366abb2da245416531925ebd8c76adc3e90ef
SHA512 96a88601cedf859c9fcd388d9e8d2fd6139f6e69ab6b05b0e044d1a598cd1a066d27a0f7a7c71bd77576dcdd083dec7a55f2cd9de52ff95aac23171c9f9670de
SSDEEP 98304:y1lJQ3eMBA/uI4ms8UDSSBEnOEEEHlDyrAaKxk6MGII5wFGRB2CfhXkyq:yyuuI4mJKCLEEFeoxkcMsfhC
TLSH
T1164633356D2A270BE8B732015872E69A380CF4BEEE832CE13F65E7E5785735591BC112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab5046A8AB272BF37297BB7928664C9503
Size 1010KB
SHA256 e95d29cbb06bb323d9d43fc2ce61d4565b0866622a83d93df76430a0c252b433
MD5 361903c5ff86511786d7b450301dd640
SHA1 c9fc04a718a388294658590f1240d8c7e9ee4f82
SHA512 78ceaaaa7f3e1a40ac2528e2f169416d6ebfaba54301754035f2a62f845421c8cddaed84770182e51794c9fb32720aec998d453de2bef621de7a7e2b3b35af20
SSDEEP 24576:OaZAjJ7/iOnOtfHFVdbtaezjCsajNZV3Yk6dStkeQL4QfeQXsI8:nA16OnOtGezjC9ZBXLKeis5h
TLSH
T1BF2533E689685D43B808EC35D359EDDBFE3126F220794025D97CB93D0AB0693564CAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeAdditional_x64
Size 140KB
SHA256 8909e5c1d917064983595a4e4717f758c2a8df8f59d7b31a5b79b2f95bd8f7cc
MD5 4f782799f84cd006f7f1c750afb04d8c
SHA1 0cd219d326fd40665d2f1b22569e2517792edfd9
SHA512 cfddad551aa5a35b032b7006b167fd322aff46ec8a2934632c087882b24404ee48083ee38b9110add9846880b1ae0bed136bb21ae751e1d3cde9dc27eaed5915
SSDEEP 3072:rJyjFGJvLIcXcSqviQICInggvUwMNme8:0SIcXgvi3un8
TLSH
T1E4E38E13B7909137C0924331647A97A22F38AC344FE1419E6B9972AD3FB16C0A77B3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeMinimum_x64
Size 140KB
SHA256 e88d0915814e622cd1deca849efa23a0d58d5d756be44ebbb4d460d3dac9e816
MD5 87b74c694f295830ffe516ba20de0b93
SHA1 e6996d47bb76ad25954b793f73211524490f55a9
SHA512 d0fd7f8c8964a99ce7a9d187640acdbff4ca3d16f02e44696706d6107b58890e763a18857bec2b94f92ca559510fea0ae5515ce3de20aa4371aebb38006c05eb
SSDEEP 1536:v/JyjziSGJvuiGPceicSqaQdFofZc9PMWkK1ICInuoAg6euHT2GDUQel5Tmt1PF:XJyjFGJvLIcXcSqviQICInggBGHNmCQ
TLSH
T1B4E37D17B7909136D0920331587AD3626F39BC344BE1429E6B9972AC3FB16C0A77B3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-547-0x0000000000A40000-0x0000000000AA5000-memory.dmp

Download

memory/2728-546-0x0000000000A40000-0x0000000000AA5000-memory.dmp

Download