Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    210s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/09/2026, 15:00

General

  • Target
    Topaz Video AI 3.1.10 (lofix)/TopazVideoAI-3.1.10.msi
  • Size 652.9MB
  • Sample260903-sdtr7saa38
  • SHA256 eb0db8b8cb8703c79a7df53168db1adc917e342d4d32ec8532339282e829ef00
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 41 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI 3.1.10 (lofix)\TopazVideoAI-3.1.10.msi"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4436
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5440
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 98D6F22F277FAF7CD6D0AB66967C8D82 C
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:5904
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B500057A6C67DC2F466A0146FA05DC7B C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5752
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 490373E55968DCC68DC7A320A2876688
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2548
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 8C26EB2D61DFAC9485BFBC57D83CF4DF E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:2580

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5c0a49.rbs

        • Path C:\Config.Msi\e5c0a49.rbs
        • Size 196KB
        • SHA256 e961b478678798fb5ad9ad6805f8994aa35ec6ff8ed6726b8c5e86768353ccd9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        plugins.qmltypes

        • Path C:\Program Files\Topaz Labs LLC\Topaz Video AI\QtQuick\Controls\plugins.qmltypes
        • Size 215B
        • SHA256 a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
        • MD5 SHA1 SHA512 TLSH

        aaa-10.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\aaa-10.json
        • Size 17KB
        • SHA256 217ac7eb71605f232ab63679026289b3858de9d5fd61222462ffd3412c995c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aaa-9.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\aaa-9.json
        • Size 18KB
        • SHA256 35d78775657b2c65ddc48296bd98e7a8806ceaa78da018c5251ca560ce347cee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ahq-10.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ahq-10.json
        • Size 18KB
        • SHA256 22c68beafcc9bcd9d1df3ae9cb4d0fc4fd35300ff2e8188fc29a9400f90daf5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ahq-11.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ahq-11.json
        • Size 18KB
        • SHA256 7d3b82c778bd84c42ccc80bc2443860ef0e2b9a2e0d4e23d70c83029b0a92c07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ahq-12.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ahq-12.json
        • Size 17KB
        • SHA256 c93b612ddcb4ea6895f11b443fbf48c911f6ba5460d06f0ddda237b9e8fd4d28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        alq-10.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\alq-10.json
        • Size 18KB
        • SHA256 b43afd0461909eb0dc29803d9105ce8dc0bec9cce8b03af9759ef350279c6181
        • MD5 SHA1 SHA512 SSDEEP TLSH

        alq-12.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\alq-12.json
        • Size 18KB
        • SHA256 ddefef73160b648a1935d246ee0995fef56c7a10343669b534492afc2de859d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        alq-13.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\alq-13.json
        • Size 17KB
        • SHA256 928ccfee6616758b67cf60728e76d88f1697f989a08cc35ccbeae107a010532a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        alqs-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\alqs-1.json
        • Size 18KB
        • SHA256 d1a0294f51ee9fc072bafddca95257c0e30891e6196c25d09745e349aa0ce364
        • MD5 SHA1 SHA512 SSDEEP TLSH

        alqs-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\alqs-2.json
        • Size 17KB
        • SHA256 e6174978c3701b7037c32ae7e270e2eac0287d3513db4617d5e050e6790db6dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amq-10.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\amq-10.json
        • Size 18KB
        • SHA256 405ef4f95f93a8cacd178891240567c0121f3d0f01a621284dc0e6e71e3ff5d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amq-12.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\amq-12.json
        • Size 18KB
        • SHA256 027df9d5db3ab2bb01040752c386e1c564df6f16af1106ceef0a50d5402ff903
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amq-13.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\amq-13.json
        • Size 17KB
        • SHA256 6a77430eb789b0412031befded406ad690e652a4c7aa6a53a4dafafe4aab9936
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amqs-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\amqs-1.json
        • Size 18KB
        • SHA256 c1f29f483bb0df211fc9e3b2770a42d44dec930737a424ebf6682b4f6d33f978
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amqs-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\amqs-2.json
        • Size 17KB
        • SHA256 b2b088b313fc6256e78c34858daf1f079d9adbd3579eb5ef84f3042406c3c811
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apa-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apa-1.json
        • Size 6KB
        • SHA256 033ba48f6ed0c8d8692e3bdd86512279a4632df6ad7f034722d18e053524a376
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apb-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apb-1.json
        • Size 6KB
        • SHA256 d6cc24fddcab526997a7f93a3176f89d03eb8820dd850280a6dee5c7a473cfa7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apo-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apo-1.json
        • Size 4KB
        • SHA256 ec6e009a59c1e4fe39be5bd9852cf477173741b2e22585e825e328efe4774308
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apo-4.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apo-4.json
        • Size 6KB
        • SHA256 0e15d3604d44190c8afe16c1edd351ec07b1f4fca7ec76339a46e3f4fc0f9ef0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apo-5.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apo-5.json
        • Size 6KB
        • SHA256 aa8ae6c282eea74facf146e8349c5ec87b5f2065639c2184943a595ac932887c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apo-6.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apo-6.json
        • Size 6KB
        • SHA256 e34dc324cafc7f1328b52b0ca96d60160042758867f946eef387aeb1d4ba6b7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apo-7.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apo-7.json
        • Size 5KB
        • SHA256 24801fd4ee78e2e0ebd9ea48348350ec50af79d92933c92f7a27f612f51b71b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apo-8.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apo-8.json
        • Size 5KB
        • SHA256 e039b3b3b237656766b0b18859cb2e9270dae4573db5e4b0a75c271ced4a5973
        • MD5 SHA1 SHA512 SSDEEP TLSH

        benchmarks.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\benchmarks.json
        • Size 1KB
        • SHA256 c29d1c91a5d2f386913aaeba27268820d9de4c028dd0b4b9589e151f748f97f0
        • MD5 SHA1 SHA512 TLSH

        chf-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\chf-1.json
        • Size 7KB
        • SHA256 dc49b8d233a9f8e46ca4617d7e9ce73317fdf456b5005d0bc65ea4d0fe2e6993
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chf-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\chf-2.json
        • Size 7KB
        • SHA256 ab31ca414e793266c8048cf8cb9beee8ae5f0faa1a73e6ffc04299d894a18ef2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chf-3.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\chf-3.json
        • Size 7KB
        • SHA256 07fd37695cfeea92169b8baa8a9ab6c843c3042929918192707e0bb5b0a16c94
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chr-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\chr-1.json
        • Size 6KB
        • SHA256 a90aa8efd0bf4c82f22b796bad6a137ea11456caea3660bef47024a44ccaf804
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chr-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\chr-2.json
        • Size 6KB
        • SHA256 c74af8c80ab8bd47b270e38eadef8aa7f0885b3c7486dbb9ebb36e67c365fb1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cpe-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\cpe-1.json
        • Size 3KB
        • SHA256 23b742fcdb84a077ab3dfccee8dbcddff91fcc35162c30a6d6a4246e10b95349
        • MD5 SHA1 SHA512 TLSH

        cpe-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\cpe-2.json
        • Size 3KB
        • SHA256 f737be590dd5a58ca8ce02450a1ae2f9938d47f280c319a433dcc00bbc84c996
        • MD5 SHA1 SHA512 TLSH

        ddv-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ddv-1.json
        • Size 18KB
        • SHA256 0126489e7989405c3838b94595f084c1d5207bb03d8c63482777e6644514a6cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ddv-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ddv-2.json
        • Size 18KB
        • SHA256 fd3f26f97adb6e74f2d13b128b0a28c9f662daed495f01fd54580049f74a2531
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ddv-3.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ddv-3.json
        • Size 18KB
        • SHA256 c482a112d62abd86b5301a693ec9af1d146e2a8ab2d30296d3cefc6a99daaa18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtd-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtd-1.json
        • Size 18KB
        • SHA256 e2edf291b7d002cbe6bd35e9fca8f2f83c2d32333d0c4f2b19c38e5d39084cea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtd-3.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtd-3.json
        • Size 18KB
        • SHA256 c96dad3743cc0ea12cb025db64e86b1e6c398fffae50b4b3fb00e84b2a32ece9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtd-4.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtd-4.json
        • Size 17KB
        • SHA256 ca5ee29b6d237a5c6d02e7a0310ce93c65e410a2eb172e5dc872121fe822daee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtds-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtds-1.json
        • Size 18KB
        • SHA256 6a82158b51341660555ac6443cabf891160ef76e447cfcc298b46edcf9bfc964
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtds-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtds-2.json
        • Size 17KB
        • SHA256 69bd359761122f51086c6ac23704899f68db4bc9f95509ebd2e1330d4129addf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtv-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtv-1.json
        • Size 19KB
        • SHA256 0f71e80034b55dd3a1310a9cd37f2d9d01eeeff495e3fbed5d7973397d2bcc72
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtv-3.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtv-3.json
        • Size 19KB
        • SHA256 cbc47efb1fe323361482c9424d5d3ba3dbf2bcd0ac552b952f4b867c3b132d89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtv-4.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtv-4.json
        • Size 18KB
        • SHA256 1de5c302739bfcd3908d605a2deb6227705f586604e42f3df9922fd320409897
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtvs-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtvs-1.json
        • Size 18KB
        • SHA256 ed085f6b484563318b29932f96a7e6a85137879ebfe37706a61c28dfa0ae280e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtvs-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtvs-2.json
        • Size 18KB
        • SHA256 3ee09045e17b686a6b99dbe7112a8bd285e49ef83b9ca9c2e31dcac7ca4c7e74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        encoders.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\encoders.json
        • Size 8KB
        • SHA256 9433916fbe8e54eb5ac3a3f6266727dcf07a9117bc2a6c4bfaec52179476a9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gcg-5.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\gcg-5.json
        • Size 15KB
        • SHA256 e1fe363e582d8c02c00b5bd7ccbc43a8a62ff90f4692251c039db8173c299339
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ghq-5.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ghq-5.json
        • Size 15KB
        • SHA256 1ee63128773e0515cc3bb1b89038c77204120ee6308490a53fc09bf1f0320ca8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ifi-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ifi-1.json
        • Size 6KB
        • SHA256 d5740cfc5d05f1d63db526e273ff3e3eee5039196065268b3ad0609651eade83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        prap-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\prap-2.json
        • Size 1KB
        • SHA256 40fafff7d00fe52efa4e0c0e6ef30a6844fa50b5b638b9d96e7ce43b491c6b3e
        • MD5 SHA1 SHA512 TLSH

        prap-3.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\prap-3.json
        • Size 2KB
        • SHA256 af76c195e9b18ae800ce1201f6fcc98d77349681a4d4ad077ae75db54efd6cb2
        • MD5 SHA1 SHA512 TLSH

        MSI95.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\MSI95.tmp
        • Size 113KB
        • SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MSIAAE7.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\MSIAAE7.tmp
        • Size 1.0MB
        • SHA256 01950f1aa4851de5b80d440a4908a56c04023571cbf17585222f12c885a430d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MSI3C18.tmp

        • Path C:\Windows\Installer\MSI3C18.tmp
        • Size 154KB
        • SHA256 233f5e43325615710ca1aa580250530e06339def861811073912e8a16b058c69
        • MD5 SHA1 SHA512 SSDEEP TLSH