Analysis

  • max time kernel
    148s
  • max time network
    196s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/09/2026, 22:52

General

  • Target
    Topaz Video AI 3.3.3 (x64)/TopazVideoAI-3.3.3.msi
  • Size 653.5MB
  • Sample260919-2th53svs2r
  • SHA256 1824d4f6475b28cdbf057c21c48041d0f43a475fff90b8e6ebf8c638f92e764a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 41 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Topaz Video AI 3.3.3 (x64)\TopazVideoAI-3.3.3.msi"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4200
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:236
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 6BDF30894939246ACB2608F1BA23D897 C
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2176
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2192D136B50C42135E655DDD64030591 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1568
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 3FC7A4903EE965919500B0B63E3E0871
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:5492
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 71B41B011420E4BD83129DBD6ED2FB58 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:4884

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5a6851.rbs

        • Path C:\Config.Msi\e5a6851.rbs
        • Size 196KB
        • SHA256 67a74e05052d8aa1837972f400c26575704b974dc6a24c04a5a0015a4f8e43a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        plugins.qmltypes

        • Path C:\Program Files\Topaz Labs LLC\Topaz Video AI\QtQuick\Controls\plugins.qmltypes
        • Size 215B
        • SHA256 a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
        • MD5 SHA1 SHA512 TLSH

        aaa-10.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\aaa-10.json
        • Size 17KB
        • SHA256 6d5db3e30fcbeae6b665a05958e91a69a0b9945631035744a05c9d86df97ddfa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aaa-9.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\aaa-9.json
        • Size 18KB
        • SHA256 3fb8016c69cb6b39062f3a5860d3f17b602b33dc34d9d128983b31af14f2c3b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ahq-10.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ahq-10.json
        • Size 18KB
        • SHA256 2936d9c36d1fc284b6f2f61dbbf86a42a151e933aa1b28cac6946484dec4ec8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ahq-11.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ahq-11.json
        • Size 18KB
        • SHA256 c72dd0a319391b6d84f8c80b6de70d0b315c66a099796d3740fae1fc7682235d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ahq-12.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ahq-12.json
        • Size 17KB
        • SHA256 dc05527aaea0c401b7133a8c5c21314e7d884e38f84ecdd80689d577898a7f44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        alq-10.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\alq-10.json
        • Size 18KB
        • SHA256 8daddc54f817e260d7a284157081a4c12f960615555e7a9467a21383d45263ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        alq-12.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\alq-12.json
        • Size 18KB
        • SHA256 bbe672bac66c401820de53f985a89d30348622f2f7b6feb6285092dccb60b127
        • MD5 SHA1 SHA512 SSDEEP TLSH

        alq-13.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\alq-13.json
        • Size 17KB
        • SHA256 d02570742ea002209cf87432ec92b8b7f897e2f44f5cbd5e843265a846682ded
        • MD5 SHA1 SHA512 SSDEEP TLSH

        alqs-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\alqs-1.json
        • Size 18KB
        • SHA256 ab679e0382ea87629889d5b91d7a6a6d0562bd8f07cbc27916f013fb005d6e9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        alqs-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\alqs-2.json
        • Size 17KB
        • SHA256 ab0694e95ccf376da7705684c80a448cef88e4d199a1c89e8b491670f41e765e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amq-10.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\amq-10.json
        • Size 18KB
        • SHA256 7c699ec7c0ad2e67bad885053297cfc81e2efb1753006f8952245e8bf1ca3cba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amq-12.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\amq-12.json
        • Size 18KB
        • SHA256 0e3a5f03ee53cc5e01f675d7d95e440ae773e6584eee65efdd2adf4f326550db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amq-13.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\amq-13.json
        • Size 17KB
        • SHA256 7a5531f445b6a1ec1397b85717bd9db5e5bf4763505c62642d6c3c3b8e2edcb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amqs-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\amqs-1.json
        • Size 18KB
        • SHA256 5f10dcacce097fb67f16e72ba9965e1b0e8b2475ef6e077044c05ad02d20fa19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amqs-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\amqs-2.json
        • Size 17KB
        • SHA256 98a9b9fee92b47f4376549a99598d367d00054df4f6725a6d22a2b6eae959acc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apa-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apa-1.json
        • Size 6KB
        • SHA256 a040e307ab636d973aade7b30c6a5fbcc332f442affb3ed943ba07f5aa3840c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apb-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apb-1.json
        • Size 6KB
        • SHA256 c670428e036a2f8e17705d32755ccc7f299d70f4992161b86ffcacaf33720486
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apf-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apf-1.json
        • Size 7KB
        • SHA256 522935b3171ecbf004e74af6aa9ff60a448e7260a531f2e20f17df05fa699448
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apf-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apf-2.json
        • Size 7KB
        • SHA256 30c8b9187badcd4d36972d476e8956832b3c378098c81fb9cacd874deefc1ef3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apo-5.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apo-5.json
        • Size 7KB
        • SHA256 ce2962b800b002de90f6cc722bb232fa4bbfcebd39af7e7fe6fa2d2504021a15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apo-6.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apo-6.json
        • Size 7KB
        • SHA256 2ecf6b5a793289f583aaaec2e99b6d8798fe5853d16eb4c0687d10c498408f37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apo-7.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apo-7.json
        • Size 7KB
        • SHA256 2610f77bacafd6c3936ed35eb7ce8060a26f9662eee2bdc88c676bf0a3997c07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apo-8.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\apo-8.json
        • Size 7KB
        • SHA256 454427127eaaa63e11e0e9e40d22acf671dabf217b1fe7fe192fb9da28535296
        • MD5 SHA1 SHA512 SSDEEP TLSH

        audio-codecs.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\audio-codecs.json
        • Size 764B
        • SHA256 2620ecd7094bd0f0b6f179fd1eaf95ae807edb446e7d091874f9c2152bd34dbe
        • MD5 SHA1 SHA512 TLSH

        benchmarks.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\benchmarks.json
        • Size 1KB
        • SHA256 dd50f814af61a23f6a7227fac7a139cfdce833c604da1de8c0b20ce0c7619163
        • MD5 SHA1 SHA512 TLSH

        chf-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\chf-1.json
        • Size 6KB
        • SHA256 198c91a0217515db394c711f45abbfe3929d3d893ff11f95ac677c4f8045a8c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chf-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\chf-2.json
        • Size 6KB
        • SHA256 76c78914bfeca36114cb17e3a576eafc10980e5c1773d6e3b6425ddab59ddcca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chf-3.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\chf-3.json
        • Size 6KB
        • SHA256 04037999ea17c64d1e271cb4a502636ebd192bc801ba666f41e54fbc58c506e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chr-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\chr-1.json
        • Size 6KB
        • SHA256 693cb80fe7e43531287c22d2b99f6fde96a5f25b550db7128854b170873330d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chr-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\chr-2.json
        • Size 6KB
        • SHA256 49e59c035e04aa183dbf393efe60ff2db854dcc23a8378cf3cdfc1f674d41e06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cpe-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\cpe-1.json
        • Size 3KB
        • SHA256 19b04c5d606f25f096d2a135a5159fa1d843f39de6bce5c891fd04e2bf502914
        • MD5 SHA1 SHA512 TLSH

        cpe-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\cpe-2.json
        • Size 3KB
        • SHA256 4967c184c8571e3719ec5a3def52eade53e72424cec986f21efee17a0c671bc4
        • MD5 SHA1 SHA512 TLSH

        ddv-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ddv-1.json
        • Size 19KB
        • SHA256 642af1f675264753874462326ade9e8b3ea5624ff9e3548145a043b2c9748d5e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ddv-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ddv-2.json
        • Size 19KB
        • SHA256 8d92c0f08d345d211f6cba914070fba8f60903c452ec31c4a49d4d7a21b6845b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ddv-3.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ddv-3.json
        • Size 18KB
        • SHA256 815ea4880f0dc3118c81ee82fd81b269e00cb6c84e26e1b8ce8b1f2a2c9ef98c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtd-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtd-1.json
        • Size 18KB
        • SHA256 f4aafcab3b0ce5e46652434d359cbfd719caca80fdfc0d3ae83b77bc0f1ee0ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtd-3.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtd-3.json
        • Size 18KB
        • SHA256 131c0899e07ea7f8912dfb3f07db6fb433744726a09f19ebbe6c55bace3d3afd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtd-4.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtd-4.json
        • Size 17KB
        • SHA256 f6189db3fb413746e59bd40533bf52ccdcb66985b7bee4b5d46d0b699c24b094
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtds-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtds-1.json
        • Size 18KB
        • SHA256 d4b543828c821c43059ec4e5d009a5fca1f4dbce24a159089deed16f37fd5a5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtds-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtds-2.json
        • Size 17KB
        • SHA256 dec5c2601f2925a9eabca527db415b574f4eb31f0ce43506815ac6561f175a53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtv-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtv-1.json
        • Size 19KB
        • SHA256 9e620839faaf2e27f69a3b3e0aa4f8184062af7fbc02a9aaf9a08507ff9e702a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtv-3.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtv-3.json
        • Size 19KB
        • SHA256 ee13ca9a51bb58c3dfc8414eab3a8f523e9b80f30a175e965e6d23e03a1a64b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtv-4.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtv-4.json
        • Size 18KB
        • SHA256 47d70b17497f0f02ced30cb1651026717345cff6a02447dc07ac9c844619d237
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtvs-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtvs-1.json
        • Size 18KB
        • SHA256 e2d72d3a5e57f4c70aa7274fa6d314c709ce86cddfd329da80fdbc32d6d5be58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dtvs-2.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\dtvs-2.json
        • Size 18KB
        • SHA256 ea6dfe6d6b16e1cdb8584edb259d3c7f6e1e7084024b60ddf0f03f3fc1442c67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        encoders.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\encoders.json
        • Size 115B
        • SHA256 c5e4c595f825f8d487b4b4095c4bbd08e8aeb300a5bb2cbc63675ed5ebf9a0f2
        • MD5 SHA1 SHA512 TLSH

        gcg-5.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\gcg-5.json
        • Size 15KB
        • SHA256 23bc394b51bb0b915fb675227855a93027bf6673a8847f319f9d6fab67546c59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ghq-5.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ghq-5.json
        • Size 15KB
        • SHA256 2a393eb10120e19c7daa3207a940946fb7cf2b952c005d693729ec2981129c59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ifi-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\ifi-1.json
        • Size 6KB
        • SHA256 d5740cfc5d05f1d63db526e273ff3e3eee5039196065268b3ad0609651eade83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iris-1.json

        • Path C:\ProgramData\Topaz Labs LLC\Topaz Video AI\models\iris-1.json
        • Size 13KB
        • SHA256 31213e99acf805b8fb86cf948e8b2068fee0dbbe6764638557e4b8bcf6abd0c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MSI3347.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\MSI3347.tmp
        • Size 113KB
        • SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MSIFD42.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\MSIFD42.tmp
        • Size 1.0MB
        • SHA256 ba34c85faddf75b2822c8001436e4238227b4370011ecac6ff65a9a99349cc0a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MSI9703.tmp

        • Path C:\Windows\Installer\MSI9703.tmp
        • Size 154KB
        • SHA256 233f5e43325615710ca1aa580250530e06339def861811073912e8a16b058c69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/236-18-0x00000207291A0000-0x0000020729B44000-memory.dmp