Analysis

  • user interaction
    yes
  • max time kernel
    137s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/09/2026, 22:22

General

  • Target
    Shutter Encoder 20.3 Windows 64bits.exe
  • Size 158.1MB
  • Sample260923-2aezbaef36
  • SHA256 56062dbbf28558648ebadf67321eda31cb573977a471d47033d848287822a1e6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 40 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shutter Encoder 20.3 Windows 64bits.exe
    "C:\Users\Admin\AppData\Local\Temp\Shutter Encoder 20.3 Windows 64bits.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Users\Admin\AppData\Local\Temp\is-NFRL6.tmp\Shutter Encoder 20.3 Windows 64bits.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NFRL6.tmp\Shutter Encoder 20.3 Windows 64bits.tmp" /SL5="$30182,164569696,963072,C:\Users\Admin\AppData\Local\Temp\Shutter Encoder 20.3 Windows 64bits.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4336
      • C:\Program Files\Shutter Encoder\Shutter Encoder.exe
        "C:\Program Files\Shutter Encoder\Shutter Encoder.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3280
        • C:\Program Files\Shutter Encoder\Shutter Encoder.exe
          "C:\Program Files\Shutter Encoder\Shutter Encoder.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2568
          • C:\Windows\System32\Wbem\wmic.exe
            wmic cpu get Name
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1276
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4088
          • C:\Program Files\Shutter Encoder\app\Library\ffmpeg.exe
            "C:\Program Files\Shutter Encoder\app\Library\ffmpeg.exe" -strict experimental -hide_banner -hwaccels"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4544
          • C:\Program Files\Shutter Encoder\app\Library\exiftool.exe
            "C:\Program Files\Shutter Encoder\app\Library\exiftool.exe" ""
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4420
            • C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\exiftool.exe
              C:\Program Files\Shutter Encoder\app\Library\exiftool.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3576

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Shutter Encoder.exe

        • Path C:\Program Files\Shutter Encoder\Shutter Encoder.exe
        • Size 616KB
        • SHA256 bec912dd45e1d428482396dd3f0f013356cba9b333885890a5a7d8382a49580d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en.properties

        • Path C:\Program Files\Shutter Encoder\app\Languages\en.properties
        • Size 18KB
        • SHA256 ce858ff2e974ead48711d305c35eca7c8a021a0350a49579f6546b30d37de1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avdevice-63.dll

        • Path C:\Program Files\Shutter Encoder\app\Library\avdevice-63.dll
        • Size 788KB
        • SHA256 9e430ee2060abcbf4a8b11eaabdc72f157c6a00bebf005ace543d5f1f7904cfc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avfilter-12.dll

        • Path C:\Program Files\Shutter Encoder\app\Library\avfilter-12.dll
        • Size 27.1MB
        • SHA256 a42436b94ee40eed505b302470e8faeb7a8429da5eed46dd17bbed8d8097c33f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avformat-63.dll

        • Path C:\Program Files\Shutter Encoder\app\Library\avformat-63.dll
        • Size 3.9MB
        • SHA256 3788b978760f3184e94756360206588cd8d91d6af1c5ac19f82fe47f6d348560
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avutil-61.dll

        • Path C:\Program Files\Shutter Encoder\app\Library\avutil-61.dll
        • Size 2.6MB
        • SHA256 2c429084915b77370186b8c1c0cf559ad49c5f7bebb8782753dadef6b37c13ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.exe

        • Path C:\Program Files\Shutter Encoder\app\Library\ffmpeg.exe
        • Size 534KB
        • SHA256 164451f724c4f2f90895db1dda42f2c3a975774654f3d56a1a8b9872e567dadc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        swresample-7.dll

        • Path C:\Program Files\Shutter Encoder\app\Library\swresample-7.dll
        • Size 176KB
        • SHA256 3c3f02b27aa8912c8ef4da9dd9396e82d6b4e6db8635e61f064faa3fab4d8468
        • MD5 SHA1 SHA512 SSDEEP TLSH

        swscale-10.dll

        • Path C:\Program Files\Shutter Encoder\app\Library\swscale-10.dll
        • Size 2.2MB
        • SHA256 267694453499a1a1888c5f02dfba3ab751a234c5b83b9ed2617d398687efaebe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Shutter Encoder.cfg

        • Path C:\Program Files\Shutter Encoder\app\Shutter Encoder.cfg
        • Size 261B
        • SHA256 c6e1fe09495e8e74276cbd631df305dd641248dc206cbf7e74af6d3eeb5f7df4
        • MD5 SHA1 SHA512 TLSH

        Shutter Encoder.jar

        • Path C:\Program Files\Shutter Encoder\app\Shutter Encoder.jar
        • Size 7.5MB
        • SHA256 41fc37a9a4ec5fbb42328fd184f06a55774fe37e36811f90acea1d7e60eb90e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        awt.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\awt.dll
        • Size 1.4MB
        • SHA256 8007bb1e0eeccdbbac74a9b7f11fa9374ce90494619f05a88c27cd649c1c2582
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fontmanager.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\fontmanager.dll
        • Size 939KB
        • SHA256 94f3a4cd2776a48dd9cfab2d48058bdac9d475276f13ddd0bf677304797ff2ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        freetype.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\freetype.dll
        • Size 535KB
        • SHA256 1c18ddb5a0f99dbd91214a04a7edc23282a6e6dc29a9e9dc7e7716a0f50203f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\java.dll
        • Size 116KB
        • SHA256 396af136f9f9295259fb5f5fedf9993972a5dd45d9b2ad118dfeff15e2e4bd9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Shutter Encoder\runtime\bin\java.exe
        • Size 49KB
        • SHA256 63267782812f84001922687feeaa93c3218c7a1f03409f0650dcdbef2e7bc8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jimage.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\jimage.dll
        • Size 33KB
        • SHA256 929531ae936031d3054beda7d21044a1fd4874c3adce558f993879c04e43240b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jli.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\jli.dll
        • Size 82KB
        • SHA256 7611e414ac53d08aaf7f3b81d2b66c7801b40fd0ef1242c3b2d32af6cad5f663
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\msvcp140.dll
        • Size 562KB
        • SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        net.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\net.dll
        • Size 60KB
        • SHA256 8004a2ed43787005d1293612f55458c5bd0861235731d50bbdca9b750ac07992
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nio.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\nio.dll
        • Size 80KB
        • SHA256 23c83b83b31c62b93976e91f59ab4df3dcac096b63f666f8cf14b8c2fad18eb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jvm.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\server\jvm.dll
        • Size 13.9MB
        • SHA256 b490375d4040ffa39becd1a2a38c63c39c0ac704e5f807aacd8408c984f6b949
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140_1.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\vcruntime140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zip.dll

        • Path C:\Program Files\Shutter Encoder\runtime\bin\zip.dll
        • Size 82KB
        • SHA256 07c5f1bd14e592e591d6f495ab6c1bfc32af40553e21450f608b9d3816ca81d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logging.properties

        • Path C:\Program Files\Shutter Encoder\runtime\conf\logging.properties
        • Size 2KB
        • SHA256 8590633e1e8a7d88ffe74cc04189c5c61b1ed4703180cbc851dcd5575efcce74
        • MD5 SHA1 SHA512 TLSH

        java.security

        • Path C:\Program Files\Shutter Encoder\runtime\conf\security\java.security
        • Size 69KB
        • SHA256 fde0e205efed66f3578b68798f5cbd47aa337f354edbf7ee65e8ee78b531e7ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-QSKD1.tmp

        • Path C:\Program Files\Shutter Encoder\runtime\legal\java.logging\is-QSKD1.tmp
        • Size 44B
        • SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
        • MD5 SHA1 SHA512

        is-S0VA2.tmp

        • Path C:\Program Files\Shutter Encoder\runtime\legal\java.logging\is-S0VA2.tmp
        • Size 33B
        • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
        • MD5 SHA1 SHA512

        is-V89A9.tmp

        • Path C:\Program Files\Shutter Encoder\runtime\legal\java.logging\is-V89A9.tmp
        • Size 49B
        • SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
        • MD5 SHA1 SHA512

        fontconfig.bfc

        • Path C:\Program Files\Shutter Encoder\runtime\lib\fontconfig.bfc
        • Size 4KB
        • SHA256 c7e2e76b908cb6330823e698889943c162e9861a4575501cbb59c9b830158ab0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FreeSans.ttf

        • Path C:\Program Files\Shutter Encoder\runtime\lib\fonts\FreeSans.ttf
        • Size 697KB
        • SHA256 70bf37038a48f18d21c161f14acd249467949f73bc85a25d3a6321fe6a461d65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Magneto.ttf

        • Path C:\Program Files\Shutter Encoder\runtime\lib\fonts\Magneto.ttf
        • Size 63KB
        • SHA256 455964b4a07af53205ed705e0f40778ff203f2c9e7c72a8bf2c4d7a3a834e895
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Montserrat.ttf

        • Path C:\Program Files\Shutter Encoder\runtime\lib\fonts\Montserrat.ttf
        • Size 28KB
        • SHA256 32f9bdc73ecf308a19c0e918b407e12da12b6cd9a667decdc2ddcb74f457839a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansSC.otf

        • Path C:\Program Files\Shutter Encoder\runtime\lib\fonts\NotoSansSC.otf
        • Size 8.1MB
        • SHA256 58b862f9d6d088002112ecad8f8b66859fa924740c05c86761235fc82bc1bb51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jvm.cfg

        • Path C:\Program Files\Shutter Encoder\runtime\lib\jvm.cfg
        • Size 29B
        • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
        • MD5 SHA1 SHA512

        modules

        • Path C:\Program Files\Shutter Encoder\runtime\lib\modules
        • Size 49.3MB
        • SHA256 c8eff98bcc490b8fec454e2b07a490608acfde0531dc9d14296d0725841fed9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        release

        • Path C:\Program Files\Shutter Encoder\runtime\release
        • Size 141B
        • SHA256 e442d53c825bdff49d7b05d7e7877a5bf5284824ddf02f76df8e46710b8a33cf
        • MD5 SHA1 SHA512 TLSH

        flatlaf-windows-x86_64-6792963985200.dll

        • Path C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-6792963985200.dll
        • Size 33KB
        • SHA256 71cb3c7815d8538b21ed14d057da428b0deb61934d5a4b57645312e8c03f850a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Shutter Encoder 20.3 Windows 64bits.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-NFRL6.tmp\Shutter Encoder 20.3 Windows 64bits.tmp
        • Size 3.5MB
        • SHA256 7e2b2cd8c2b23070fe174fa6e86f214b0b1a8ae077c131df8f59227818002b0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        25bbf886.dll

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\25bbf886.dll
        • Size 26KB
        • SHA256 7c6018daef31e150232cfb178f622213dcee8482a581254bbb5846e3d7e6d82b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        30e95417.dll

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\30e95417.dll
        • Size 73KB
        • SHA256 8e4f9505caa50db78056393c2e2b7655aff2cf22fc1de68d59796d23e6ac87ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        exiftool.exe

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\exiftool.exe
        • Size 56KB
        • SHA256 190fa21bca88e2c4ac0ebea467be79f2fda63ccd45915d72a2582ca30a3c7c67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RandomAccess.pm

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\File\RandomAccess.pm
        • Size 12KB
        • SHA256 46fd6382cfa0371d006f05b901095d373e61780cfd5b4ca2dd22d1e1af388345
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExifTool.pm

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Image\ExifTool.pm
        • Size 341KB
        • SHA256 6ca00b3d1dfb73e20aef9653cc7fcd9dafe75c9cf1ddcf2c8e442929c483e07a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Root

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Image\ExifTool\Charset\CVS\Root
        • Size 49B
        • SHA256 3641791fe2f62c505b05da9ce982ebb341139c18b2c92c19a02a99babb2f39d3
        • MD5 SHA1 SHA512

        Exif.pm

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Image\ExifTool\Exif.pm
        • Size 224KB
        • SHA256 d310229018719280067ceb1dc5b7e8cd47e3e2c304a418de9fdb710bf6e6247a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MakerNotes.pm

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Image\ExifTool\MakerNotes.pm
        • Size 67KB
        • SHA256 63a664a440008dd7931dec36b4f4b7fe306318754d904349cba1d27c3da61511
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QuickTimeStream.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\QuickTimeStream.pl
        • Size 45KB
        • SHA256 050ee0f160b2ac7685467250fd42ee0d47b9ff8d66d18d1b0eb284ab1ed23845
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Shift.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Shift.pl
        • Size 22KB
        • SHA256 d1aa363bac4a2f84ae1d8ed8c929b0715b5c9641678541d81ee9969558209873
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Handle.pm

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Tie\Handle.pm
        • Size 1KB
        • SHA256 0d788cb546e5d79bd28b7425a426f40ba902ee44637d99a38afdff7a8ffcad1a
        • MD5 SHA1 SHA512 TLSH

        StdHandle.pm

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Tie\StdHandle.pm
        • Size 831B
        • SHA256 6e156297c3a26478a74b9766fcf8f036de55bc4a4de17512d67fb62c39281a9f
        • MD5 SHA1 SHA512 TLSH

        File.pm

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Win32API\File.pm
        • Size 21KB
        • SHA256 eee869f0e51c0c250272c17600032a89a7c75e86e7e8281e871a786b1c8bc6b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        API.pm

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Win32\API.pm
        • Size 21KB
        • SHA256 76cd253a8e72594e80b0b3693deb5dd6358676589512afb3987d5a21b5e3b97c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Struct.pm

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Win32\API\Struct.pm
        • Size 17KB
        • SHA256 44c8fd47133ff0b2123b8c82d510be5a9638280946a9b2488674c47c247d4754
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Type.pm

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Win32\API\Type.pm
        • Size 12KB
        • SHA256 2cabd8cc72c49360bde11e0a96cb39692657e05767554b3a289345c11e533b91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WriteCanonRaw.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\WriteCanonRaw.pl
        • Size 24KB
        • SHA256 c44f45b6af3fd63ea036350294d9b5d7580a85cc63ca749c2d4d848bad85c311
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WriteExif.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\WriteExif.pl
        • Size 129KB
        • SHA256 16dcf90d1690544bb0f2ced4f0553fd721b71b5274e43d5b898a242375455d4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WriteIPTC.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\WriteIPTC.pl
        • Size 29KB
        • SHA256 08761dbb7a066868aa95f5c0629cc3845c8cb31a3d1ef16b74115135a9a39ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WritePDF.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\WritePDF.pl
        • Size 28KB
        • SHA256 a19e64844c8790e6de9021115546f6d4bc41c84ee2b9ac0e29e6f40161ca56ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WritePNG.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\WritePNG.pl
        • Size 15KB
        • SHA256 c66fdeb5fd55d383b42bf5c66bb0cb10512235858d394d8f83e49e285bc86d10
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WritePhotoshop.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\WritePhotoshop.pl
        • Size 10KB
        • SHA256 bb0ff666046fcc8fce9c17dd5678199973e31c437cf08e0665b0e94dd17e1254
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WritePostScript.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\WritePostScript.pl
        • Size 29KB
        • SHA256 005a6349e564eedc65d3da5c0df4265c14a3f477c36fa91e9c96d31a33166030
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WriteQuickTime.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\WriteQuickTime.pl
        • Size 15KB
        • SHA256 b895bedc6d3d97b96bf46ee6e5713170905071c49f7cd7e521e816233d7cf4d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WriteXMP.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\WriteXMP.pl
        • Size 63KB
        • SHA256 965d4ed8a786ca1def4659c95e2d54d793ed4244360150b3b19a829b43a7d02c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Writer.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\Writer.pl
        • Size 284KB
        • SHA256 2923670b2ebe4eabbc1a07abc895e1d98a472f9c3d2c8c54b8aee432556b65c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        XMP2.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\XMP2.pl
        • Size 66KB
        • SHA256 9f155e6934e8a88b8116c208592a5e1b051b7b1ccef7be3b5be185fe7f93340b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        XMPStruct.pl

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\XMPStruct.pl
        • Size 35KB
        • SHA256 ad0cd30bffc4f1654625fe7514a56b5f58e51eea178597862bb66b954021ad97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Zlib.dll

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\auto\Compress\Raw\Zlib\Zlib.dll
        • Size 105KB
        • SHA256 a8346e9c165d21a9a99313d32c3704dcaab01f142c3be0fbc0dedd39756e3bd5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Cwd.dll

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\auto\Cwd\Cwd.dll
        • Size 19KB
        • SHA256 fa2960fe31c5dc687d11a93c22ddf03be20714e7ee038bceb54ec035cac086a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Encode.dll

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\auto\Encode\Encode.dll
        • Size 36KB
        • SHA256 5cc5ab3445e73175471edaa84984b3c94dd638877e585dff084829ac27d78dc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Fcntl.dll

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\auto\Fcntl\Fcntl.dll
        • Size 17KB
        • SHA256 ad40e880026b5e3c4c66fd1542d1786c79c3f8523e9d3a65ca22a4d74fab0643
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Glob.dll

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\auto\File\Glob\Glob.dll
        • Size 25KB
        • SHA256 ac8fa59812bff98bbdc147e5f5c92a5a58dc51d1192be55b9b5c20735c1601d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IO.dll

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\auto\IO\IO.dll
        • Size 21KB
        • SHA256 16e220de234afad379bd5ae434542df2ada7100ae47e14a97797f3491ca903ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Util.dll

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\auto\List\Util\Util.dll
        • Size 46KB
        • SHA256 3b7654eac8a06f4d172bfa90a06c35336e3085ae4afd8065dd523f7865b59cbd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Win32.dll

        • Path C:\Users\Admin\AppData\Local\Temp\par-41646d696e\cache-33c7e7d92c53e03d4bb8e3389caaca25c451a4dd\inc\lib\auto\Win32\Win32.dll
        • Size 47KB
        • SHA256 9c0fa5a8bf5a0dcf7777c32a4de912dc1844296995f7468c1152cacc2a8e2ac3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2424-8-0x00000000004A0000-0x000000000059A000-memory.dmp

        memory/2424-604-0x00000000004A0000-0x000000000059A000-memory.dmp

        memory/2424-1-0x00000000004A0000-0x000000000059A000-memory.dmp

        memory/3576-3391-0x0000000064FC0000-0x0000000064FCC000-memory.dmp

        memory/3576-3381-0x0000000000400000-0x0000000000416000-memory.dmp

        memory/3576-3383-0x00000000674C0000-0x00000000674CD000-memory.dmp

        memory/3576-3384-0x0000000066E00000-0x0000000066E0B000-memory.dmp

        memory/3576-3385-0x0000000062580000-0x000000006258C000-memory.dmp

        memory/3576-3386-0x0000000066A00000-0x0000000066A21000-memory.dmp

        memory/3576-3387-0x0000000062D80000-0x0000000062D92000-memory.dmp

        memory/3576-3389-0x000000006A540000-0x000000006A54F000-memory.dmp

        memory/3576-3390-0x00000000707C0000-0x00000000707CE000-memory.dmp

        memory/3576-3388-0x0000000070840000-0x0000000070853000-memory.dmp

        memory/3576-3394-0x0000000062100000-0x000000006210D000-memory.dmp

        memory/3576-3395-0x0000000065600000-0x0000000065619000-memory.dmp

        memory/3576-3382-0x000000006DAC0000-0x000000006DC9F000-memory.dmp

        memory/3576-3392-0x0000000062AC0000-0x0000000062ACB000-memory.dmp

        memory/3576-3393-0x0000000068600000-0x000000006860C000-memory.dmp

        memory/4088-644-0x00000207A2F90000-0x00000207A2FAE000-memory.dmp

        memory/4088-641-0x00000207A2B60000-0x00000207A2B82000-memory.dmp

        memory/4088-646-0x00000207A2D80000-0x00000207A2D8A000-memory.dmp

        memory/4088-648-0x00000207A32F0000-0x00000207A3314000-memory.dmp

        memory/4088-645-0x00000207A2FB0000-0x00000207A3062000-memory.dmp

        memory/4088-647-0x00000207A32F0000-0x00000207A331A000-memory.dmp

        memory/4336-603-0x00000000001D0000-0x000000000056D000-memory.dmp

        memory/4336-10-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

        memory/4336-18-0x00000000001D0000-0x000000000056D000-memory.dmp

        memory/4336-163-0x00000000001D0000-0x000000000056D000-memory.dmp

        memory/4336-14-0x00000000001D0000-0x000000000056D000-memory.dmp

        memory/4336-16-0x00000000001D0000-0x000000000056D000-memory.dmp

        memory/4336-12-0x00000000001D0000-0x000000000056D000-memory.dmp

        memory/4336-9-0x00000000001D0000-0x000000000056D000-memory.dmp

        memory/4336-6-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

        memory/4420-3396-0x0000000000400000-0x00000000005FD000-memory.dmp

        memory/4544-681-0x00007FFF3DC50000-0x00007FFF3F7CD000-memory.dmp

        memory/4544-676-0x00007FFF48080000-0x00007FFF4814C000-memory.dmp

        memory/4544-677-0x00007FFF3FE10000-0x00007FFF40201000-memory.dmp

        memory/4544-678-0x00007FFF3FA50000-0x00007FFF3FE08000-memory.dmp

        memory/4544-680-0x00007FFF3F7D0000-0x00007FFF3FA4E000-memory.dmp

        memory/4544-679-0x00007FFF4D360000-0x00007FFF4D392000-memory.dmp

        memory/4544-675-0x00007FF71D0A0000-0x00007FF71D12E000-memory.dmp

        memory/4544-682-0x00007FFF30D90000-0x00007FFF36947000-memory.dmp