42ef802360ea80fb305775fa07c45dfbf68aedce6fdc3127ceb50845c18d611e

Analysis

user interaction
yes
max time kernel
114s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
FTHRClips-Setup-2.0.0-alpha-x64(1).exe
Size 203.0MB
Sample261024-nay6ashv2w
SHA256 42ef802360ea80fb305775fa07c45dfbf68aedce6fdc3127ceb50845c18d611e
MD5 c88d62301df186d1c42fcb9b46236d55
SHA1 3a6a5b4dc400deb400d9cd98f7fe61172df580cb
SHA512 12506aaf9b2605455af4b2f1a50e5b1301021447a0f446cba6f533590b8475026f9622b9a57248626f05dfe8d93f141a95fc6471e2c891938a7114d98f896571
SSDEEP 3145728:V0Paid5cNQKNnZNGJTNn8vujX5W4nlT7YiKShE4Vs5kpu1BsT0:VKaid5BKxuPn4+M4lT7YinhEMsIu1Bso
TLSH
T1B9A8333FA2C7522DE44E167EB931D56268BF6E2425131DDAA0D88A9CD7270741C3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer persistence pyinstaller ransomware

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
3808	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
4920	vc_redist.x64.exe
912	vc_redist.x64.exe
5332	VC_redist.x64.exe
5000	VC_redist.x64.exe
4560	VC_redist.x64.exe
1088	VC_redist.x64.exe
4916	VC_redist.x64.exe

Loads dropped DLL 3 IoCs

pid	Process
912	vc_redist.x64.exe
1088	VC_redist.x64.exe
5012	VC_redist.x64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\FTHRClips\_internal\is-ERRV3482TU.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\is-Q2KK5EQZE5.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\assets\icons\is-33JOU36O8H.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\assets\icons\is-1Q1437Z0XC.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\numpy\random\is-YV83LB2PJC.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-7BCH8KTXIB.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\is-66KWQONTTP.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\assets\icons\is-4TU9PDKEGW.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\numpy-2.4.4.dist-info\licenses\numpy\random\src\splitmix64\is-GXFHB1JFP6.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\is-1CYJARAVWO.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\is-QTNJ5WLJU5.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\qml\QtQml\WorkerScript\is-RUM47B93KX.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-LWG83G9ASV.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-E8PVQGK68V.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\assets\icons\is-67ARG4ZOLK.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-TSA33NILXU.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-7TM6OW9OS8.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\is-8LOQ2HOSEN.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\engine\is-N4CIZ906C1.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\qml\QtQml\Models\is-WOZE3MTLAF.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-O8J11VNS2J.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-X6UKS9LQSP.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-V9YQJUJMX0.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\is-L8MISF0FMQ.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\is-NHBMKAMGEA.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\assets\icons\is-KOM7CO85S2.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\numpy-2.4.4.dist-info\licenses\numpy\ma\is-LRQ25IX1MH.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-OL8I1H2Q2B.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\ui\qml\is-6W4WT9K0IJ.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\assets\icons\is-L75EQGA3BN.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\licenses\is-O76NQZ2PYN.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-0DRCHQ657N.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\licenses\is-VY9H344XQX.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\numpy\random\is-BOEOF8WY4H.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\plugins\platforms\is-M9E6A6ML4F.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-ECO2GFX6EF.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-MZPM0FM5QG.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\is-G41AICMXRY.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\licenses\is-LP3EHJL62O.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\assets\icons\is-GZSQ0YAYWI.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-DXRJNKC71Z.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\licenses\optional-uploader\cryptography\is-2QHBMZ76A7.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\is-6QGASKS8UN.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\assets\icons\is-82T143CK8K.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\shiboken6\is-53Z2R7OJDK.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\licenses\is-UWFMWPIBD5.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\is-6HGBTY3E31.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\plugins\imageformats\is-HBEUWLJ4EV.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-ANNOSB5UXG.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-ZBG39J5L6V.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\licenses\is-9MFJ5RYCJK.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\is-ODY8N2Y7K1.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\assets\icons\is-L655QY3MIA.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-YIKT9Q90HR.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\licenses\optional-uploader\cffi\is-YBSZOPXECP.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\numpy-2.4.4.dist-info\licenses\numpy\fft\pocketfft\is-HY4IE35V3T.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-CL5AFRHXHI.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-S7E3AXPTXI.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\licenses\optional-uploader\pycparser\is-W3PITMB3HC.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\plugins\qmltooling\is-WLFJCRW2XH.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-8BAIT8DKR0.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\PySide6\translations\is-60JOLS5Z29.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\is-HZM8FM4U0R.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
File created	C:\Program Files\FTHRClips\_internal\assets\icons\is-PAKD37ZEOK.tmp	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF32C6D78D6037A9A4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE052.tmp	msiexec.exe
File created	C:\Windows\Installer\e5acb8f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acb8f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE5D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2B8C846D5BCFD0BF.TMP	msiexec.exe
File created	C:\Windows\Installer\e5acba1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE14F4588C6E5C4DD.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9C894C62A178488F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{43B0D101-A022-48F4-9D04-BA404CEB1D53}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFF5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE1F.tmp	msiexec.exe
File created	C:\Windows\Installer\e5acbb7.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8A91ACFAB19A9C7E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE7402E41FA214FDB.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBB2DC2D272A1C395.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCB49F9890DF313A7.TMP	msiexec.exe
File created	C:\Windows\Installer\e5acba2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acba2.msi	msiexec.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c4dc-1761.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FTHRClips-Setup-2.0.0-alpha-x64(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/876-0-0x0000000000FB0000-0x000000000108F000-memory.dmp	innosetup
behavioral2/memory/876-10-0x0000000000FB0000-0x000000000108F000-memory.dmp	innosetup
behavioral2/memory/876-2063-0x0000000000FB0000-0x000000000108F000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Version = "237799819"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}v14.44.35211\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{43B0D101-A022-48F4-9D04-BA404CEB1D53}v14.44.35211\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\9CC2BA68DB8034640B9F8FD200D627FF	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\ = "{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{43B0D101-A022-48F4-9D04-BA404CEB1D53}v14.44.35211\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Dependents	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\PackageCode = "51FBA0EFEFDB3494A815FAF727EE72D7"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Version = "14.44.35211.0"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\VC_Runtime_Additional	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{43B0D101-A022-48F4-9D04-BA404CEB1D53}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\VC_Runtime_Minimum	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3808	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
3808	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
4984	msiexec.exe
4984	msiexec.exe
4984	msiexec.exe
4984	msiexec.exe
4984	msiexec.exe
4984	msiexec.exe
4984	msiexec.exe
4984	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	1332	vssvc.exe
Token: SeRestorePrivilege	1332	vssvc.exe
Token: SeAuditPrivilege	1332	vssvc.exe
Token: SeShutdownPrivilege	5332	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	5332	VC_redist.x64.exe
Token: SeSecurityPrivilege	4984	msiexec.exe
Token: SeCreateTokenPrivilege	5332	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	5332	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	5332	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	5332	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	5332	VC_redist.x64.exe
Token: SeTcbPrivilege	5332	VC_redist.x64.exe
Token: SeSecurityPrivilege	5332	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	5332	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	5332	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	5332	VC_redist.x64.exe
Token: SeSystemtimePrivilege	5332	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	5332	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	5332	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	5332	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	5332	VC_redist.x64.exe
Token: SeBackupPrivilege	5332	VC_redist.x64.exe
Token: SeRestorePrivilege	5332	VC_redist.x64.exe
Token: SeShutdownPrivilege	5332	VC_redist.x64.exe
Token: SeDebugPrivilege	5332	VC_redist.x64.exe
Token: SeAuditPrivilege	5332	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	5332	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	5332	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	5332	VC_redist.x64.exe
Token: SeUndockPrivilege	5332	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	5332	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	5332	VC_redist.x64.exe
Token: SeManageVolumePrivilege	5332	VC_redist.x64.exe
Token: SeImpersonatePrivilege	5332	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	5332	VC_redist.x64.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe
Token: SeTakeOwnershipPrivilege	4984	msiexec.exe
Token: SeRestorePrivilege	4984	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3808	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3808	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
4984	msiexec.exe
1476	LogonUI.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 3808	876	FTHRClips-Setup-2.0.0-alpha-x64(1).exe	88
PID 3808 wrote to memory of 4920	3808	FTHRClips-Setup-2.0.0-alpha-x64(1).tmp	90
PID 4920 wrote to memory of 912	4920	vc_redist.x64.exe	91
PID 912 wrote to memory of 5332	912	vc_redist.x64.exe	92
PID 5000 wrote to memory of 4560	5000	VC_redist.x64.exe	103
PID 4560 wrote to memory of 1088	4560	VC_redist.x64.exe	104
PID 1088 wrote to memory of 4916	1088	VC_redist.x64.exe	105
PID 4916 wrote to memory of 1152	4916	VC_redist.x64.exe	107
PID 1152 wrote to memory of 5012	1152	VC_redist.x64.exe	108
PID 5012 wrote to memory of 4876	5012	VC_redist.x64.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\FTHRClips-Setup-2.0.0-alpha-x64(1).exe
"C:\Users\Admin\AppData\Local\Temp\FTHRClips-Setup-2.0.0-alpha-x64(1).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:876
- C:\Users\Admin\AppData\Local\Temp\is-YBSKILL6AI.tmp\FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-YBSKILL6AI.tmp\FTHRClips-Setup-2.0.0-alpha-x64(1).tmp" /SL5="$50042,211345682,853504,C:\Users\Admin\AppData\Local\Temp\FTHRClips-Setup-2.0.0-alpha-x64(1).exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Users\Admin\AppData\Local\Temp\is-7CHB03C0XC.tmp\vc_redist.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-7CHB03C0XC.tmp\vc_redist.x64.exe" /quiet /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\Temp\{6071B99A-33E5-49F6-9114-1C2C48F4FC4B}\.cr\vc_redist.x64.exe
      "C:\Windows\Temp\{6071B99A-33E5-49F6-9114-1C2C48F4FC4B}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-7CHB03C0XC.tmp\vc_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /quiet /norestart
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:912
    - - C:\Windows\Temp\{73561253-446F-42B2-9E0C-31B2B3BBE5C9}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{73561253-446F-42B2-9E0C-31B2B3BBE5C9}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D6ED83E9-E2AC-4AD0-A98F-6469E9703860} {65405E5D-4841-4EF0-8E9C-7715D8A5EBCE} 912
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:6136

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4984

C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000
- C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261024121513.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261024121513.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E6EDC5F9-C228-4190-87CE-F6DEA4E9C260} {743D0844-9F48-4036-B17E-89A87E05C4A1} 1088
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4916
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{3A42D5D7-2D14-44F3-B701-E9D36459B8E0} {A7F8F586-750A-4CC2-B930-6027AD97B2C5} 4916
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1152
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{3A42D5D7-2D14-44F3-B701-E9D36459B8E0} {A7F8F586-750A-4CC2-B930-6027AD97B2C5} 4916
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0E533257-1383-4B08-87A3-EB48AFD078D5} {405A254D-B1C6-413E-825E-24414A7AE47B} 5012
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4876

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a30055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5acb94.rbs

Path C:\Config.Msi\e5acb94.rbs
Size 19KB
SHA256 d05991ff0d1734b2b28e2c104bf356a57d515bfdfb52f2453044ccb26fd1cc8c
MD5 cf49f8eac4f55b6d59af53648d2f1422
SHA1 c0448aa526c8b260aab0fd405a257244c514ca3c
SHA512 99dee789cc90fc3f7263e3309cdd2b1ddc00385975578136029de460252d3436cd2333c92f0e8c835897ba87f5424ea83b598dddeba6029586757176f69fdb29
SSDEEP 192:VyRt1kRa15dXcFUADIc1f+W+y4+ogPJb7:VyRt6RaTeC81f/ceb7
TLSH
T105920C527680C9E2D87A6B30CD631B653B76DBD5A350438B50DC90308F93BCA2F9D69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5acba0.rbs

Path C:\Config.Msi\e5acba0.rbs
Size 19KB
SHA256 9d01a866485de8ce0d6bac28c6b0a47351fcaefaba5c474e0573b5b03aaf67f3
MD5 57987ae97e8aa597cc9509a8c022db0f
SHA1 6883c27328be43b97c1602ebdf1ac44bebc23b82
SHA512 5c3a6c0295d954c2a759a47ffd27017bd18553387ce18e8fe0487cde9ac0f7f75814a5408c2dcd5c91e84e1337c71262033c696bfc3eb9ccbf39624559293974
SSDEEP 384:VOOGnJXMjZ7Up+BFqiO6NLgJf0uJf0GoaOD8Lfv/8c3zMZxq+nNwzQ6R:VOOGnJXMjZ7Up+BFIrfFfx
TLSH
T1C392BA026640C5E3D8A62B70DD4B67243BB5D7CAA355A38B41DCC1708FA77CA7F8D24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5acba7.rbs

Path C:\Config.Msi\e5acba7.rbs
Size 21KB
SHA256 0b77ad0e6bd323c21be7276f136fbc99e682ef2de0c56f3dbbb16f099243e2d2
MD5 9bc5b1fc8e72b8fca70cbfcf7b638124
SHA1 5508686fa4a8891afe83bcc78df711abe881524d
SHA512 50603265ad0234ec13f362c068880bffea9bddb63dc5964e148e9aa983a34789b03d707a99bf4f591e9fed5ee49c1564ffd194d2fece1465550bd7062e6ca559
SSDEEP 384:H0RmGRrnAKxNAUhUC7xJjrMNYPzIbSfYUKFYQzQNW7lkP:HoPTAKhkmB
TLSH
T151A21D43768099E3C86227B1DD671BA93B73D7D99350434B10ECD1388F633C72E5AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5acbb6.rbs

Path C:\Config.Msi\e5acbb6.rbs
Size 21KB
SHA256 e5c7d35574eb1e70ac27c0b0ada9b66e4057337178568fa3e5853fc17a8858a5
MD5 d2888dd3036243207d0dadaae24dbe8f
SHA1 d8797222b7c007fb944d79e0659d966e2846bd2f
SHA512 2e99a7b28e0317034d86c38c25ee523c23bc5fe569ca39f678904d75a06c0ef672a9b616fbc054302616c8e1e010014cc3337560ecc4f63bfc1f0b91112587b4
SSDEEP 384:HrqvDIAZxEth/phSYjK4WbJGwazsalckU72eC6jJkE5K5JyUJysr76c+0dWg:HsDIAZxEth/phSYujbJpTElNr76/0dP
TLSH
T1EAA2FD42BA40D2D3D8A62B70CD975B2437B5D3DAA755434B00CC90348F937DA2F9AACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FTHRClips.exe

Path C:\Program Files\FTHRClips\FTHRClips.exe
Size 5.7MB
SHA256 f94d776c7370477ce779e57c91738722a6ef461334523860fc1af4097a83f320
MD5 ed4e7a04e4272eacf03d344a2fc0f31e
SHA1 0fb25cf6b2375ee04c0a8e439028a2c853f4edf9
SHA512 d562c806974d507b78123597f4b54563e2486a4636f1f0fd48be64041d6ee886400a28f10bc310ad3f136f1b75e8f6d99099af99006798cf6b33ceb583905791
SSDEEP 98304:XTW+KHs9T5mD4aSeYbnQo3sFTEtOZ5Zp+0q2rmQ/fDNkj/yADjcwrd8B9s5IR7Eb:jsHs9lmDweYrxsjxp+0qFkGj/ZHp7E72
TLSH
T1C3563354A7C505BAE8A7513D9E73C926E372BD121B31CADF068417692F372E0893AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-S7E3AXPTXI.tmp

Path C:\Program Files\FTHRClips\_internal\PySide6\translations\is-S7E3AXPTXI.tmp
Size 33B
SHA256 494ac9a2b2cb2fdeced353f4a9f898ed8dcf616e9bc667438c62681e3f7f79cf
MD5 aaea7ba475c961f941d0a23488457beb
SHA1 2bf0054002c8f7d85dd080df332553bf9b3a8e26
SHA512 5b408c36c8f93f71e73e3d3b1c0c2ad699e92a6088604b8adf8e588e8a75fc3fc92828199b7f00f5b05b224ae819220d07e56d610a76a267594870bec77172be
MD5 SHA1 SHA512

Submit Download

favicon.ico

Path C:\Program Files\FTHRClips\_internal\assets\favicon.ico
Size 14KB
SHA256 026af246059efffd9bf899b62e898f74efb6bb6b3ae80f6a168376c42f4cc936
MD5 82702b0322759aa0661243d9b2571914
SHA1 a435ba9cfcfea37e218979c69df7352b3c1b279f
SHA512 3e24e6a0e942a22412f83b30e93bfbbe4a9856590913b2217fc058bb930dfa8cd8e5e24db2c942df0c757910799b341ddc5cd4a12b0b29cdb00e845bedbd5a9a
SSDEEP 96:jWraS6U9kAPzzUEwp2zL4C9RXXAoSXH/0MBKsssssssssssssVeNqgJkqSSSSQ6:jCfY3lH/0/sssssssssssssEYg+y
TLSH
T1E3623342B665DC21D6E83DF5CF16D1F0A314AD447EC4751A2CC3B6266BBF1E3164318A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oswald-Bold.ttf

Path C:\Program Files\FTHRClips\_internal\assets\fonts\Oswald-Bold.ttf
Size 105KB
SHA256 eb7d46f856dd57f18a8c03d033c57802692bf127f01dbd95ba8984338e6b5135
MD5 f9ddaabb6c496ebd06fafead37d997aa
SHA1 2aedb49ea752c6b4d3a03e6a8a970b10e7be2b3c
SHA512 65173fb5b10cb55a809fac2f2344d5b843e6d46f79bab1324f958f3952b11485a236623bc80bbf0f16ad5ff9a83b261cb5ad0bfeac4855a99c82a54321748e30
SSDEEP 3072:6AbEdjIFa8wPdVpQHHzCjX+9cYiC4XRpFpbf/c:FEdM72jZYgXRpFpQ
TLSH
T120B34B07B705D70FEE268D7855A1E3E5B369FC603E4A43C7A6BA5E2EBC8B0850C521C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-X4NZ0T1I2Y.tmp

Path C:\Program Files\FTHRClips\_internal\assets\icons\is-X4NZ0T1I2Y.tmp
Size 521B
SHA256 1c4d1fe273ccaf209f31983a0f448f4800e95e88e6d5ffb1c3a695a1c1f607b5
MD5 9d42cf75adfb509db5f9a3709967fb7a
SHA1 d7a940e4989634611bf62545251be3b14212fee6
SHA512 973b6901c2c693a079c1777763178a96e8ecfa1b761bdae610e7c22da88a5282e63caa7e067533befcf3a291a641f44f8ba74123ff530b5a528745b096fca073
TLSH
T1A7F0592DA2494E7CF7004788A728E1F8917B98B323091A1DE944B831206885F6D370DF
MD5 SHA1 SHA512 TLSH

Submit Download

is-MFMPEBL6RY.tmp

Path C:\Program Files\FTHRClips\_internal\assets\sounds\is-MFMPEBL6RY.tmp
Size 172KB
SHA256 8e99c82a31e66f85a86d97df68c5fc05b0601dafd566b3b15e29b84770b35f1c
MD5 b541c4b0638d81ebd2dee2320b24ddbb
SHA1 30dd939d3bee60b264b406977ad114a3f7952e01
SHA512 1ef37cef6a7a31c042beafffb8080b106a67509a934a0d0c52dc21fd9c7812efce37f25d74e0107c230f5a03a232c592c4a78c8c4f49468731799eb6e149512a
SSDEEP 1536:79+vGwNIzlbb12mabM/L5zs2eWX/0iZvXtsKkCeDoq8mvnMqjgm3BgJs3HM2roy9:79PRAGL5zMmpJXtsKmzt/+mxg4roYct
TLSH
T15404A4E3F4424D51CC5B4E3A8973BF72427B2C35FF5A470A21847A156AB33D26722AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-UET2H9VTT0.tmp

Path C:\Program Files\FTHRClips\_internal\assets\sounds\is-UET2H9VTT0.tmp
Size 172KB
SHA256 80a3e9e313d6b825177eb5a82513c5907a81550d0d4d16e744f49ffb42356efb
MD5 6373ef72076917c4c28a3dadf9a74871
SHA1 75448c4000e7b3c45841ebb8023ef22cbaa0da59
SHA512 a7d4ca4e949b0cff4b20e8ddc8fecbe214676560d83b743c5987b5f81bd9b84c37793a83546380dd1841b7d3d83ff734c43ed562928ce5f379296d044e206025
SSDEEP 3072:wxEr2k0UVH8JMw/JgZNKBEUTdUH8t+mC:wER0UVaMw/JgZNKSUTdUsu
TLSH
T1CE049593F4424901CC1B4E398573AF3242776C3AFF5A970A3088BB556EB33C267666D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-35DR12AFQV.tmp

Path C:\Program Files\FTHRClips\_internal\engine\is-35DR12AFQV.tmp
Size 12.0MB
SHA256 e128459c6aa1b0165d7c6eca51b45612051c20619cd8eb6e1cfa1e497206b53b
MD5 7cfb41a059034e14ef69255bc4e1e5e5
SHA1 39263a2bca25bfd394d2b4d70259d0e58d1f7be7
SHA512 a98f18fccb47d3bb866f517173ac2bc76252a74693c866e1714a86da523b3af8ced33cc1d26993a2261e81470313c51bb801ff7770719546ffac66abbb5f35c4
SSDEEP 98304:41h5g+zxek+lKVD83xW4zWGB4ngXR4jCg/k962fwAvv48JBF2z:9MxekcKC3xWd2Rbg/kc2fvFW
TLSH
T19DC64A47E2A360ECC12BC135436B9A32F531BC5D01357EAB5690DB312F62FA0976AF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-80B7DNWQIC.tmp

Path C:\Program Files\FTHRClips\_internal\engine\is-80B7DNWQIC.tmp
Size 706KB
SHA256 b920b9173f3d25917c8fe15b4127b068b037456d24a1560df22080df434720d3
MD5 0d43fa4fc7c74206161510e20bce70e7
SHA1 cbb16d4449579224e4737d995ad8a50f5cb1c912
SHA512 7c45b417910a07be0d834bf22eb46aafe742d06f1ec1b209defac4b84e320f57b96321c769d3e64c09f60aba7ae5f9d2bfd901d5cca5ad68c458864c8afb1bda
SSDEEP 6144:Qc+9oZbk0Y+igKjJslzBF8n6ugVR+yRDPXb4MMWaSPb10igz8CLlAOEzBs6N03kj:QcsoZbJukFF8pS+SrxJjCX1EW3PyPCg
TLSH
T12EF47C86E1A365FCC63BC47052ABBA77B571745800286D7B87E1CA342E76F001F6BB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-F5UB494WO5.tmp

Path C:\Program Files\FTHRClips\_internal\engine\is-F5UB494WO5.tmp
Size 3.5MB
SHA256 353c3b75419d4da8e44fe463a0fe73fc1d19663c604619b9886183baaad2731a
MD5 a70a882fa04c8381e934fbc1e545a83c
SHA1 1d99ddc7d67dcc9a38d7b5a86febf522955027e7
SHA512 7747227ef5d32cba41c28fd6a9820425dc180ad6902e5b218f685cf02b4fcd598470dbbf0dc413bcf31eebe58e06601d6d94fed38688bd669c68011238c9c799
SSDEEP 49152:HGUN2mFRN7RunQjAp3BZoThlgGqYrKNt1PkYDvJOBJcNyXTYY:HHqbNt1ROw0XTj
TLSH
T13C065B13E2A350ECC12BC178835BAA73BA31785C41347EAB5B94DB312F61F60576EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-OU5VBYDIFH.tmp

Path C:\Program Files\FTHRClips\_internal\engine\is-OU5VBYDIFH.tmp
Size 2.8MB
SHA256 14799bb047d9db1338cadc53e7ffec56f3fbd506ae02c1286ca972fe94ce6566
MD5 a1866b5f190b0a4b665ef76969a08360
SHA1 00f3e7aef29d53393d73a1a04e0398fdedd3ff6b
SHA512 fe6a1e1bbd8bbf5f5722fd690cfacad37542fdf644bf2c20772caf481d83ae77d33b7d02707aa4dc90d4438ac1cec409ecf9992ff36d86c39317861d5e51ff70
SSDEEP 49152:BP0IG7vjPANQtOjHTv5g/SV4M0iJFmG4s9wdxy87MNkLWldlftbIOYm:mvrPRUHTNV4bs9wp7Mrdttby
TLSH
T1C7D54A13E2E354ACC16BC134869B6673BA3074594534BE7F1AA4CB352F20FA05A5FB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-U9TDPRY7Z9.tmp

Path C:\Program Files\FTHRClips\_internal\engine\is-U9TDPRY7Z9.tmp
Size 20.7MB
SHA256 4a85e712c6ecfa1dba40b1eed97cf7d7aa231270de09ad0a5ff6ad6a504e21a6
MD5 9dd875a2608d64eae0e472c34b6e7b98
SHA1 42565252dc826c2c96033dae7c762eda7bc6ecd8
SHA512 f1f19ad9d16110cbfb3c56e227729de3159dd24c6630b288d5dc960ac6d859d3889b551a7a5813a535c3d5bbc37a0bb3644a08c5938cf5e7e105728fee43d5db
SSDEEP 196608:SWoJUTKAJqVG2Nf6VslRgjJWSptg5pgun2gzTL0FGJV2tJ/t6Q:SWrGf6qlRgtWgm5pAsL0FGmTtV
TLSH
T159276B17F1A324ACD52BD17442ABAB72B631BC1801383E7B1690EB702F61F506B6FB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-VGNJP2XFJ0.tmp

Path C:\Program Files\FTHRClips\_internal\engine\is-VGNJP2XFJ0.tmp
Size 28.2MB
SHA256 e62a6cc728ed461f09cb1f4878e3fef0e497dbd524079a4dd44828479b90ab20
MD5 4675ff8acb0c5aa63d6c2f3d3d65ab6e
SHA1 ef93b93108f07985918a54184aa1f12ef5d26cd4
SHA512 0f90904a173edeae1e80286b7cda4c372665fa5acf3d401f875cb748da719e4cd8ad0d064135826c178348b700c706b81b28f4929f2240dfd807ed54e7036566
SSDEEP 786432:Smv9uOkYzIlI7V9IIawdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFhMeg:Smv9hkYzIqxKTwdcYS/aEHBt6w5Hnfls
TLSH
T192576B43E2A350ECC12BD0348267AA73B5317C5901347E7B6694DB306F72FA0A76BB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-NQPML5NJEZ.tmp

Path C:\Program Files\FTHRClips\_internal\licenses\optional-uploader\jaraco.functools\is-NQPML5NJEZ.tmp
Size 1KB
SHA256 9755a18519666e5f0f4cae3daad3d7012bcae48a600b31237d75e9fe134e6683
MD5 2e21c3f75eb8d9427c8a611a8e83e9d6
SHA1 e8b93ddf7cc897fbefb55a5fb201b86b0f350256
SHA512 c69b9a1b7bcfce721ade650953309149795ad2d321db55bce4b463d9fe3e7262607e73e644dafa961d62ecc5d6ad44c577f19aede1a90a3011d308078286e02b
TLSH
T15A11862D7260077218AB136059756CD9B22BB11F7E6B2680146DF345233A4ACC5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

is-D3C077Y3LP.tmp

Path C:\Program Files\FTHRClips\is-D3C077Y3LP.tmp
Size 32KB
SHA256 fa20afae8ae04600b02a8092abf8363d4fe4f5245ea8c56dd2de90b7d8439802
MD5 c06ccb6466dd568d2d40ebb46c9542c1
SHA1 5888e317de1e46f2bd705237ce8414f77ebb2ad0
SHA512 2873ecb216e1121b734aef7c8fca0455adb264aa6d2406fbbdb1af5c0f81cbdd041d6973f223b650d7f8a741c12032ed48e98c82001ddae65eea5ced41ebe192
SSDEEP 768:byk4o1acy3LTB2VsrHG/OfvMmnBCtLmJ9j:54hcycsrfrnouR
TLSH
T141E2635FB74413B2028206A26A9B68DEE31DD039776640A5785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-G41AICMXRY.tmp

Path C:\Program Files\FTHRClips\is-G41AICMXRY.tmp
Size 12KB
SHA256 f5162f7208591533e4b5a142753ead49f80d7fa5f4f82411d96eb5458d9bd69c
MD5 ee49dc4069c1653d46213d4b10afc3c3
SHA1 aad418f87ec0c9a48b4d821a57b9c54fcd14d97a
SHA512 dc95ad45213c600e75e85fc67fcb63bf1c20827fcd117f7b76f3cdfc9d8cb4e73ce56d30af46feb70422888c64a22d94312c6cc0db2b4da9d208c5cc402fcce5
SSDEEP 384:hvvUoyR1msk+JacOwus25pn9aUEOxG4JmhQCimNzzrMRU:tUocBJacOwus279aUJG4KBv1
TLSH
T12142D722AE77113207F483C9EE4875DFD3156645134EA29DA8D540DCA332E3E97BE076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-1OALC9TKLX.tmp

Path C:\Program Files\FTHRClips\licenses\is-1OALC9TKLX.tmp
Size 4KB
SHA256 8bfde869841a78dcd89f4d7f0733ffe8b60199b6bfbfee509a45648daf1362f9
MD5 c5a4dcfa026c83ab70a42af7959263a4
SHA1 cf10f319d1b2133d21f22cefd1d55f025b6c3322
SHA512 d83262ff0a62dd47f1c9def4dffb8bfa95b3be58d13a03639d5bc53b68ff7a7372da28ff31dd38b232e37f52c6818a62e5b09bdcfc0eb5010081a92b3d8c0697
SSDEEP 96:Yn4UibMxxUjFcyK9jfxU0LzcTiBs9zMD5usqqlQHveD:AsMPtI0LwTiHDlQHvg
TLSH
T1B191B81A3F4423B519C0D252E776F9DEE31A512D37AB65C5406AC16C23A6D2C03FE6A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-7N43QG78B9.tmp

Path C:\Program Files\FTHRClips\licenses\is-7N43QG78B9.tmp
Size 173KB
SHA256 0e8fac55c2f5bff939c1e7aae1fa2799e1cece5fd0857d8e5fafeb46562aafc9
MD5 4816c658beed4c135da7fc79751ce438
SHA1 093bc1b6c61cd1bd392832895d1a0bfbf0f210b8
SHA512 d12b0d3c077c17e5990d544ca92ad755f0bb53426ece2c4e0de3ac970309a1a3889e741b98e6594b1452cfbc81f155e5d26ba4bd2820cde48d30c310cc469314
SSDEEP 3072:c911rqjMS1xYmCnOLkvlwmfQa/lCCZ6XBmnC6lZA6Ful96JnTE+SoHe63jo6KVHm:cRnS16p5r5I+Sowj0AJRMaLUYRK
TLSH
T16804C62B7F4417B30AC2C2A16A4BA8C9F31E903E37275914345CD258276F93A93FF695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-8P16QBQKRG.tmp

Path C:\Program Files\FTHRClips\licenses\is-8P16QBQKRG.tmp
Size 1KB
SHA256 2bf14a525555d05a801c2d2c28901504fb76abee7c2d7ebfb4cfc7508d7df0f7
MD5 a1e87757f2ae00bf7498fcb2f85a1b42
SHA1 b62732feaf2b639a49b8bcfb6e14dca761f982ef
SHA512 428cc12426011cfd3de1bda7e3a14f52512d4c0a53e78c99702b3cbeae387dbebd15b5129f7f76c52bce429dbdb54418e1ddf5acf4188df097c118d4487c590b
TLSH
T15B11861E72504772189A1360597868D5F22B715A7A5F2A84146DF245232A06CC5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

is-9F12TXU6G1.tmp

Path C:\Program Files\FTHRClips\licenses\is-9F12TXU6G1.tmp
Size 1KB
SHA256 09d719058e782ac7bc71ba21c944e1136cde2bb957c0e888121f0218d6b5f02c
MD5 c4a59ea6fdfe49caa8470881ba0a6ffa
SHA1 1e2547fdf31890b2463c29b947d41eb526809231
SHA512 f8717e8b37ce7c7ef28dce3b6d34f1493b9be95b311c43bff01bebb8b1f3dee69c75341f2ca9bed95a5781073a29c2aaad33c2eb748534ed359c72f0486a75a2
TLSH
T11E11861E72550762189B1360567468D5B22B715B799F1984146DF205232A07CC5FF840
MD5 SHA1 SHA512 TLSH

Submit Download

is-9MFJ5RYCJK.tmp

Path C:\Program Files\FTHRClips\licenses\is-9MFJ5RYCJK.tmp
Size 1KB
SHA256 df8052c8bddd445d1bee064708f1a7e2cf548ae86701cda10cd3c17eabd3713e
MD5 d88277df4983989476e0679ea2578baa
SHA1 d5b39b574acc364d4cff20fb0169a9ed93465d9b
SHA512 3b9927e36a7c29d260210e7202040224c8b220c5832f011e73c66c0599aea30e1cd7f79dd247dce9c818df590f853100ceb420d3398efbb1fd9029fc036694d3
TLSH
T14631955712842BA749D21695B56ABEC4B08DD02D3B27AE05187EF3886B7B42FC8BB051
MD5 SHA1 SHA512 TLSH

Submit Download

is-AI7RRAO2Q6.tmp

Path C:\Program Files\FTHRClips\licenses\is-AI7RRAO2Q6.tmp
Size 1KB
SHA256 f99da0f82f96273ea877a569f84cd75002de01d07492a3ade0c29cf2fad06a21
MD5 750a90c600c70566c81cb22e4390dc7e
SHA1 0770481ea0ebe96a2098cfa494b823ea95c0d125
SHA512 6f3ba00362bd714dfad2d06dd0e8c510f9fe5db3fc003c33e7f340054736d45276ae838869f63f806905946424c13723dd216ac8f18542ba9209b5cf0c3da802
TLSH
T19831112E6B1ED222A78102F3A546DEF9E419224D275DC7BA10AD80886639B2C5A63495
MD5 SHA1 SHA512 TLSH

Submit Download

is-B3EGL0S9UM.tmp

Path C:\Program Files\FTHRClips\licenses\is-B3EGL0S9UM.tmp
Size 1KB
SHA256 03e7bf20b009a7d2754693c0874b58a2a917acee82d694f0b26d2f4905326b0e
MD5 d0e7bf3a98a8d613e3ee68f715da06ba
SHA1 1af2bee0dad1d866cfed65482fa51a04c01ab2cc
SHA512 43300c2427ad4e28c9cf63af35a164d549b87f6dae988072e60164d3ccc73b9a3a09a987ee0cfe50e2a830eabb838b4e4a9e9944e0e9d296d113803781c71d2b
TLSH
T1ED11821EB2610772189B13A05678A8C9B22BB25E7A5F2A84246DF245233A06CC5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

is-BJFHIDYJLE.tmp

Path C:\Program Files\FTHRClips\licenses\is-BJFHIDYJLE.tmp
Size 887B
SHA256 b7cd1be43b32c9592a4940ea8c88d2876f2e8c7e830f7f02851e61533dff377b
MD5 469c2aeef84b35a6b291465a552a8705
SHA1 eeacf0f5c0fd079244574a1b96c707c309148612
SHA512 ae88fdf5197db0e2b6e4314a7386583047963bf36ee82ddb08af9d0c1431b3a049e7d22de2cea38d49eb1b03249465e74b871132f6f75b9b014241ddca500e3f
TLSH
T19E1152639B5C26B193D203B3C76CB7EF02B596C1938215CB0875908C89333A74F9E195
MD5 SHA1 SHA512 TLSH

Submit Download

is-CD8PSS5HT0.tmp

Path C:\Program Files\FTHRClips\licenses\is-CD8PSS5HT0.tmp
Size 721B
SHA256 40ff96edcaf4cf344114a2cf71d76b07d6f61f0438818be5ce795e136c98fb8a
MD5 f85c4e24a3c703315f1ce6523866891b
SHA1 8171453a99fde264a27ca37c573861cf06137ff2
SHA512 3f3f8b022c3dd259c73d6929cd0bdee2e90a015707963658c1d85d7e534431ca63a105a05bd8eb30710593cec170aa3cde08fd92cadd901f6710d77d79f632df
TLSH
T13D01F47727DA977527C263D2E90DA0D553272BD9334926094475D0CC9D1F331939B2D3
MD5 SHA1 SHA512 TLSH

Submit Download

is-H0BAFO40DU.tmp

Path C:\Program Files\FTHRClips\licenses\is-H0BAFO40DU.tmp
Size 950B
SHA256 e45751ab3f7f982028fafb2bba675f2070123020fb8222a376608f40a46dd7ff
MD5 71ff4f8ca1ad6aaa5f0dc0019ff05562
SHA1 a34362cb9e72487e8993c6a529e8fb1bb122cd64
SHA512 1663318611301ed344026774b851fe24a721ff98d52e08a6ec7fcc49a6ad22e252b8682a7b958d264af26da3b415c10d5b5c44c3853c57252076c71ed0701ef5
TLSH
T18D1144735BEC2AF4DBC102C5C30CA455CB9112916340266D40FAE088D43F76B9B78AC3
MD5 SHA1 SHA512 TLSH

Submit Download

is-I5CA788ZP9.tmp

Path C:\Program Files\FTHRClips\licenses\is-I5CA788ZP9.tmp
Size 1KB
SHA256 1d2438cadca31cb11257f8440703766e42c995202aa27e7f629f9a79a8b5c07f
MD5 d15077e7be17c6f5fff7ba109cd21da6
SHA1 560dac1d7ffbeaf02fa55bec0937a57ca9640466
SHA512 966ce81481d5706d47ba4f0870d9a0458753be9d142d0dd6c2eea2371fdd9b5a4aec1724a1d8af8d452f1c51ef17cea4992ee1b8a5361522995f1853e09b5d83
TLSH
T1C111637975500BB2198603902A752885B7A7316FB60F6644386DF3043F3902DD2FF854
MD5 SHA1 SHA512 TLSH

Submit Download

is-IEBS6PXS4J.tmp

Path C:\Program Files\FTHRClips\licenses\is-IEBS6PXS4J.tmp
Size 1KB
SHA256 bceb22ab34f06b68cc31b6a85079710af5066a9f8828617ba92ba59238d91022
MD5 7ec8e7bab94fb7be4934e353c27ae4d8
SHA1 c1b93df0fb3876c1e947cfdfff2a45daeff26da6
SHA512 6b7c02dcb6316e3dedccd09e37a859ef8c8bd5c2f4070550616c8d49f5d180cd504d7579f987197459229d838c893baba127144a06f3cc45059111ac72b9020c
TLSH
T14021B61EB2540772285A136055799CD5F23FB15FBA9B2AC4246DF385232E36CC2FF800
MD5 SHA1 SHA512 TLSH

Submit Download

is-IW3AU6YHNA.tmp

Path C:\Program Files\FTHRClips\licenses\is-IW3AU6YHNA.tmp
Size 44KB
SHA256 dc97d59562c75c04557f1e9a68f3eae326699eb119d569cd4ed6a4eafe5f9abb
MD5 ec93f90605f6635bafd552e0901f55b3
SHA1 f431e8fd7bf4f89db4f320912fede30607466a4a
SHA512 bad47f005cd148ae40b81cc57e97e45fe36920233a60ecbdd8824fe43b0b34c9d743601af3cb88f3de40f26ceda34408270d24eea32d4b9a22944f30b648f004
SSDEEP 768:ovJDLg9RnVt68jTu9fK89qjo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7h:ovJg9jt6SQKMqjhcycsrfrnouY
TLSH
T15E23A55FB74413B201C206A26A9F68CAE32DD03937664455786DC25C27B3D3583BFBAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-KGIOLLU9PF.tmp

Path C:\Program Files\FTHRClips\licenses\is-KGIOLLU9PF.tmp
Size 7KB
SHA256 6c671e2912ec69c0832f32066c0313cee5fdc3bbcbce237822e89f3da58edd4e
MD5 d9921bcd39d6b84abf2b2749ee144239
SHA1 34c09e6d5fdec5933c7c79b254ae41625c64347f
SHA512 15c79a7c3e6abf93fd89308369d46f70b53d589be9ee90c8dd6d986ce79257ae26e75cec7120a232e604f2a609c950d3c874ab09fdc905d6a67454bd3d78f1b5
SSDEEP 192:thwssEe5kAh6FGlEMGl45Kgk4LMB1goZT0/UKM6Z:Ps15h6FiFimH7C1goG
TLSH
T1C1F1EE7BA70053B702C305526A4EA1CEA36AA03F26738D64789DC25D1767C3493B77EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-L59KRN4QGQ.tmp

Path C:\Program Files\FTHRClips\licenses\is-L59KRN4QGQ.tmp
Size 1KB
SHA256 aa154fc9070614bbe7921f89db11efd1dba7a1f3a41685958110e2230f9c0ca1
MD5 1cd5e5ac0a97c9db77e5810b60e84449
SHA1 8463f1891a8b3aa80826c20f0bc466da0144bb71
SHA512 6b1328bb6befffc7be5f820969c47fc025ed5df0169f5ebe43b884c265b2b2f6f77d8de4518236437dd6f2498a1798f1cf2a7c961c30333f615c31c5a08218bc
TLSH
T13531546F322007A22F869BB59D5EA8CEF22F602D7D5F5580946AD1096D3302C49FF690
MD5 SHA1 SHA512 TLSH

Submit Download

is-LP3EHJL62O.tmp

Path C:\Program Files\FTHRClips\licenses\is-LP3EHJL62O.tmp
Size 1KB
SHA256 b6eea21bbafbaf7a2177e492f1be6b5efc6f4e708b1980773de51cdaa52f8211
MD5 6d5b33fbb7f36a747e1ad68af179ed92
SHA1 69fe48c43fb8572f19245f1b1563f6866c3af02a
SHA512 5574651469f6bde7559c67c74a7c4df351eebf8baba703a3b3cee04864d04fc6e6061836d2a37186c1424738b9d78065bef38b195d0b058ac8a278afc230fdeb
TLSH
T19F11791E725547761C5A536055746CC4F13BB15F7A9F2684146EF345132607CD5FF840
MD5 SHA1 SHA512 TLSH

Submit Download

is-MMHV4Y61RW.tmp

Path C:\Program Files\FTHRClips\licenses\is-MMHV4Y61RW.tmp
Size 1KB
SHA256 984deb944aa702bbde5b5d982deb3b10b400df856672ee7bdc97569c7e0a4cbc
MD5 8d2c2e63a6e15b4bfb17e6d8857d8687
SHA1 9c2d8fd8f6f86e16bea3c6860ac807416afc6d0b
SHA512 bb84ea942ee7c7a122e6ce0b30717f12faba2b78fc641f7ea0a8d5024e46cd4a52f8d3f4861353e06c3c656fe3bc98306ebd8bf5b5ba44cffed6f36871db3ce1
TLSH
T1961165B3B24827790701824BAFCF51CFC291A0CA75B89708E03282886E8036A95362B5
MD5 SHA1 SHA512 TLSH

Submit Download

is-MZXN89PG3L.tmp

Path C:\Program Files\FTHRClips\licenses\is-MZXN89PG3L.tmp
Size 2KB
SHA256 8ec541fda07522a0ffeb20b791f0e9e9e955c638b399a87c7a285542323ecadd
MD5 7020a9211c263fc95d0db0bd9f2fabf8
SHA1 4c7b845b49155a7d8773e16b1959e632a03806df
SHA512 57f2a44ec760f5f9bf0dcb5bc437d0689d98a002afa36dcf8e36a109fa49c08aa896fb60edc8346e57e89923b75f071d79a34abf0aa8a6c58aa8d31e6a281681
TLSH
T1925196BDB24107A8249757D3A825BCDDF25EB035B9135E42301CF3459327B2992FF494
MD5 SHA1 SHA512 TLSH

Submit Download

is-Q6WJ9ANZOE.tmp

Path C:\Program Files\FTHRClips\licenses\is-Q6WJ9ANZOE.tmp
Size 1KB
SHA256 3831546ef0092ad73ca7b07a5262d8425ed4f73a4e50017daa3f4e75892dd73d
MD5 56700ad793c6be90091db46b58866f8c
SHA1 d9bd41d3b56ba65bf36953325389f2bb10c2e96c
SHA512 54e2b517e1f7a3136404ca0dd0fe5c59f7fb508d88fdcc15ff121159fc15194723e7e72e52b01fcc99aa8d82761ec8fdbb0e2e26ef6d187f7a664a5fb1e03196
TLSH
T1CE21235B12405BDA49D61A9175956EC4A08DD02E3A237D04187AF344677B42ED8BB451
MD5 SHA1 SHA512 TLSH

Submit Download

is-VY9H344XQX.tmp

Path C:\Program Files\FTHRClips\licenses\is-VY9H344XQX.tmp
Size 7KB
SHA256 da7eabb7bafdf7d3ae5e9f223aa5bdc1eece45ac569dc21b3b037520b4464768
MD5 e6a600fd5e1d9cbde2d983680233ad02
SHA1 f45ee1c765646813b442ca58de72e20a64a7ddba
SHA512 da6bcf3b76076d488f9a728debc7297b1bed6d94eb9cc44b15344c9b663a240c34434cc5511181f2a9b0e810b22449f5b13d793b7f225336f810367153bc8fd1
SSDEEP 192:wheJvhVL0qhYqlpIle4RrJQSqOBng4kS/cKM6L:rvjxhYWpce48engvA
TLSH
T1A2F1C07B674013F602C305526A8F61CEA36AA07A36738D6438ADC25C1767C3593B77EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-Z8XQ4IH35R.tmp

Path C:\Program Files\FTHRClips\licenses\is-Z8XQ4IH35R.tmp
Size 928B
SHA256 2f419136ff87a1bddc164b2fc007442a0829aa53ca72f6b3d9b617b4186f52c5
MD5 1e2b3dbf00f30aabd1bc6b4fdc8f9cac
SHA1 641115194bbe2fcd0ecd8ede24b319589c9f74bc
SHA512 34def60ee4781ec98dc040facab4b99323bc276f13a2f908361c73d11b568f805763d7b51d8123d6ee1c3ec2302808c8041d2c307ed2c8bb5507cd4df5b883d7
TLSH
T149115C32279F13B512671FA7140AC2D1858D20AD636D4BA4343405DD6E2EB7D04EB6F5
MD5 SHA1 SHA512 TLSH

Submit Download

is-54KEM0Q3OA.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\PyNaCl\is-54KEM0Q3OA.tmp
Size 9KB
SHA256 77af5bbded959114b6d7a5eea518b2be364e04f4f4a95f9e87d9870c27713d24
MD5 30599a72f554daf849d09f7211f8acbe
SHA1 c844fbe841ec9e8130739a5f5f382e8ba30d64e6
SHA512 527727a7dca0cd91c302441c74ced68e8802179837996b165ad93b28a3774cdff09d1f1c5e7e10c3f3c61c0df5ff8417420ed45c3ccf7cc1cbf8a2c604ee03ca
SSDEEP 192:NfTkS8V8V0tEj2R1aMFWiYFjSoJ34Ghq3DRlnDcVHJx2YlEaz1R:Nqq06jk19cX/lyzrAZ2YS8R
TLSH
T1BB12536BB70D03771AF20162AB47A4CBF31E90393B591525316CC0682F7B96193FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-7OHY175U5K.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\PyNaCl\is-7OHY175U5K.tmp
Size 841B
SHA256 93e7cac854d71cdafc9d9e4e9f8fd28d87ae541b3dda224d7c8fe23d37875704
MD5 dcf5d0758378f5e9a71631ef540a7979
SHA1 15f224b38e37089999aff566d8701501b45d5af3
SHA512 6f19ce8d17202a71c27e482c8674201ac483c74efe1367b807b53bc7b3a9cfaa3a40384e9fbba87fbd4a3703a51e4f115b17b09992ee6c3df7e7967f7d73176f
TLSH
T19A01EF8E72903B9055B19B793E62EC88E1C5B1767E03BA043475E2888F7345F906AC00
MD5 SHA1 SHA512 TLSH

Submit Download

is-ORWT2CTO4B.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\bcrypt\is-ORWT2CTO4B.tmp
Size 10KB
SHA256 8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90
MD5 8f7bb094c7232b058c7e9f2e431f389c
SHA1 5feaf15b3fa7d2d226d811e5fcd49098a1ea520c
SHA512 ca322e7f48f3e2621dc336e0d05f91b70f9af3b7de928a59d39c1b737b4e5bf16f5ad2060b67b3ab0c76b6644cd75b8c3e967b67e5e8c02cad4d8855ebed0c96
SSDEEP 192:NEASdeYFPVRQUM9o1XDFMKdFSvJZN+0G04Hrc3Pv8KIHKxF9Nmu3Dzt1XkTYst3/:KxNRrM21TiA+8VL+EKdXNt9xkTYE3/
TLSH
T16E22537F7A48037706C20162BB9764CBF31E903D3B5A6524315CC0682F6BA6553FB6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-CP5OZJG717.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\cffi\is-CP5OZJG717.tmp
Size 1KB
SHA256 5ba24ddc57067f9249add644c3afc41a5d6dc37e23433ef759d95df370b0af63
MD5 c0158ab9b75875f3bb7fea081d388818
SHA1 2c228c0055247f8ee4ee8a979ca5df1a84aac034
SHA512 946cab9ce5db47f0206a9bc2d71f3a55170711c16680ffc1e65ee3ebfa4d27a1fd3bb66ea9682874b81ab0c21b052ac80d3235b2121c2aeca247db5fe29c8038
TLSH
T1AB21467D755007B2298607902AB568D4B7AB315F761F6748386EF3042F3912DE2FF854
MD5 SHA1 SHA512 TLSH

Submit Download

is-RQI3WKIKBF.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\cffi\is-RQI3WKIKBF.tmp
Size 208B
SHA256 2a67a60bbfb33759d67d645ff131b8e6d6bc4cafc232d751fcac3eda4d314cc8
MD5 ad049e6234043170142e2793625b98ce
SHA1 7f04b335e59b27d5698a4e5620c07557656b3bbf
SHA512 086204462f3b8566d76dfa340add1a313d9e02f8b7ca87782fcdfd28ef5b7158d1ef5c375d9db1c2fa00b88abff3b704fc99c0f78f6cf5881b1662c5f6217c86
TLSH
T1F1D02224FA504B200D8393C4FE568BB1A19FC36BC2282882720E930F42D3055326B6C2
MD5 SHA1 SHA512 TLSH

Submit Download

is-23KV7H9JFW.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\cryptography\is-23KV7H9JFW.tmp
Size 11KB
SHA256 aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe
MD5 4e168cce331e5c827d4c2b68a6200e1b
SHA1 de33ead2bee64352544ce0aa9e410c0c44fdf7d9
SHA512 f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52
SSDEEP 192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
TLSH
T19432623FBA48037706C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-2QHBMZ76A7.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\cryptography\is-2QHBMZ76A7.tmp
Size 1KB
SHA256 602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb
MD5 5ae30ba4123bc4f2fa49aa0b0dce887b
SHA1 ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8
SHA512 ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41
TLSH
T14E31655B12844BE34AD2165565A7B9C0B08DC03F3A236E0A3C6EF3485F7B42EC57B051
MD5 SHA1 SHA512 TLSH

Submit Download

is-3L7K4KM6OU.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\cryptography\is-3L7K4KM6OU.tmp
Size 197B
SHA256 3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb
MD5 8c3617db4fb6fae01f1d253ab91511e4
SHA1 e442040c26cd76d1b946822caf29011a51f75d6d
SHA512 77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998
TLSH
T188D0233EB357631142D1046E171714CFAF07B40418475209F41415F134E390A4B3C5D0
MD5 SHA1 SHA512 TLSH

Submit Download

is-JIKB36UUZX.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\invoke\is-JIKB36UUZX.tmp
Size 1KB
SHA256 7922f97f896f1d161e1ebf47083e304a23638361b255c6902b5e4f34eeda0dad
MD5 a8815068973f31b78c328dc067e297ab
SHA1 eadf0675261da2116b63962716fbf09f4cb946ca
SHA512 f2f3e9cdc18812f714e2504d003514cd21ad6bdf0edbd8fa9801e388b98c0f06eda293ae357b5a024f34230f43856b2cdee2d07aa5af812a15b9525773bb5770
TLSH
T1B421565B01410FD65AD21A9125A56A84A0CDD03F3E237D04386EF3891B3F53ED8B7094
MD5 SHA1 SHA512 TLSH

Submit Download

is-RCM3SSUGNU.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\jaraco.classes\is-RCM3SSUGNU.tmp
Size 1023B
SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
MD5 141643e11c48898150daa83802dbc65f
SHA1 0445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA512 ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
TLSH
T12B11A82E735107721C5713B0557568D8B17B715F7B6B2784146EF240232A06CC1FBC40
MD5 SHA1 SHA512 TLSH

Submit Download

is-L8Q7LCHEQ6.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\keyring\is-L8Q7LCHEQ6.tmp
Size 1KB
SHA256 5a57cb4db85e2a2dd88c290628908add57e3451449e0a9a71fdfb38776fd759d
MD5 1aeae65f25a15b1e46d4381f2f094e0a
SHA1 8461b3e68caef3e970328c34ea3505b17f5e3a38
SHA512 b91b9c9e7605ca069ccb363fec50b248c632c3239abd7ad81c4faa62b122708fd57b15015ded4b27ad0d345640b839c12ec4a96a1f7d9fa04122da41fcbee5b6
TLSH
T19D11862D7260077218AA136059756CD9F22BB11F7A6B2680146DF345233A4ACC1FB840
MD5 SHA1 SHA512 TLSH

Submit Download

is-6UPJ99YUHL.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\more-itertools\is-6UPJ99YUHL.tmp
Size 1KB
SHA256 09f1c8c9e941af3e584d59641ea9b87d83c0cb0fd007eb5ef391a7e2643c1a46
MD5 3396ea30f9d21389d7857719816f83b5
SHA1 0d43a836dac65c0ea426ad49c881a1086600bf85
SHA512 d43092223392edda3bd777625f5bf54acb0cc00c25555a4f8a16db9ccdafc380d3204486cb2a5fdc9d3f9e459b1fed948ffc7000aa0e40f37b807a01f4421294
TLSH
T13211751E736407B21CAB13A055786CD5F22BB25F7AAF2684146EF345132A06CD5FB854
MD5 SHA1 SHA512 TLSH

Submit Download

is-QM88O3BM77.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\paramiko\is-QM88O3BM77.tmp
Size 25KB
SHA256 5fa25bf5f395fd26e701c2e1de4ca7d162816986dc791c22f8f4226857ad1bb2
MD5 fd0120fc2e9f841c73ac707a30389af5
SHA1 b12c713656a9b98b6980a52bb068154cfdcbdd99
SHA512 247e51f85135a48ee35f4977fa6e68e1e171130a51d36ecbd3ac404bbf799b305b8f5fbdf19b2bf59413062ffbedb1632040dd8aa170dd8cd4ee07669e91a3b8
SSDEEP 384:XU56OuAbnn0UX+X6wFDVxnFw7xqsvzt+z/k8E9HinIhFkspcM9bc7upt0MZuQP:XU5trR+DnFMz1ReScmc7GtXZuQP
TLSH
T190C2953EB70513B206C206905A0FA4DEE32BD07D32675A647499C15D23AB93543FBBEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-W3PITMB3HC.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\pycparser\is-W3PITMB3HC.tmp
Size 1KB
SHA256 0c846399369ea76ddd7b5c44fe6d16497415fcf015f5cbb508c24bf98b81c5b1
MD5 9761c3ffee7ba99c60dca0408fd3262b
SHA1 b3c1dabbd5f289a4be4a10e822857a0ae3927598
SHA512 764b2014d00222fd14ff0a4168c140ae0a11f0854e39904abb89198a417daf50bb9a3cb28192d441ff5ea98564d445a37dd755067777eeaefbadb375e6a37bbb
TLSH
T15431955702841BA719F21741B66ABEC4B04CD02E3B237E01287EF388277B52FC4BB051
MD5 SHA1 SHA512 TLSH

Submit Download

is-85GT1W8G2G.tmp

Path C:\Program Files\FTHRClips\licenses\optional-uploader\pywin32-ctypes\is-85GT1W8G2G.tmp
Size 1KB
SHA256 dfa83b3e2709adfcdb838d9ad55823ca674abb780e60563d9dd9544ccbf785e9
MD5 5c53169ac7da6abbfa63a0a6cfbeeec0
SHA1 a053e82a1779edc6d7cfc024fe54d199be3e043e
SHA512 705245fe37748f8a9cac44820dcb1f8c0e36d16fafa8b9a10ce2e6f99599089e523bc8bb8079b1b114deb31156bb2e053da1ad794f59a0822529783801ea3c35
TLSH
T11831865B12840BB746F206446356B9C0F19DC03E3F27290538B9E34C5B7B83ED5B7445
MD5 SHA1 SHA512 TLSH

Submit Download

unins000.exe

Path C:\Program Files\FTHRClips\unins000.exe
Size 4.7MB
SHA256 3f4742af0175ed260e7284214a26206cc3c01a756f05b55430cb1da328244070
MD5 a535a3ff191338c4e0f20b1b937574da
SHA1 cbc5ee56de81f8c893365f72de0b0a11d561aafe
SHA512 a81623fb48501b21ab269874d7a67300370f9ead109c2bc25c8bd4573adb7513df311bbcd02288a6c5bfd6f80193d1dce9c040e0ab67447d9f64fe8d65ef3dbd
SSDEEP 98304:VvdHRh7Vhv2Wn+FYGa7xP2gRQJhJm+333N:XHLn+eHNt0D
TLSH
T1DA368E23B384A53EE4A71E3A587FA649583F7A203A26CD476BF40D5C4F396402D3A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
Size 1000B
SHA256 9f2665b912122a28d9959c1b5033a0ad0b55663177619347adae317e87ed4ba0
MD5 674242f8cfcd74536d1b92804048d4a3
SHA1 1b704f8b750bef79dce7276cd0a21e05ccbb9895
SHA512 ae931a56bba25a981c51b1af7905a7a31d705768b1fe45e5fa6b2d5286a4b32c61e2c2dc7456399d5935973dd93dad424f77164e6ed085c0fcec528addd7ef5e
TLSH
T11C112D216FF65116F3FBAB713CF5121619BEF4214D31D52D0081628E8F32A40DD64B27
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20261024121513_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261024121513_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 b21a2ddffcdc4f0e2d9f2be5d53a6574839e600bc2d27f300b6ea9170045413a
MD5 ad6fcadea35573ded7ca19c921abd1da
SHA1 2de0af02936961e7456d9f39ada00b1e38badb4f
SHA512 f5d88cc2af4f334b703ad276fd60a0e72954368a19c69646f3ed1775f00d88250e3bfdff70170a0d36ad6282bd6c74315b472fc0f5ddd11d1996817e02d582fb
TLSH
T1874109591AD90D4AB3B79747AEF3C0619A33FCD26834DB1C2286421E0667C047C78BAE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20261024121513_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261024121513_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 37e38724cf49886eb14b8a5635b48fe0ebbcde16e52a6c8ceeca82b9f9ff0bda
MD5 5e0b59eaca241d3170bc76703365656f
SHA1 ce12c7cd87299dc19ce702487a49b357469939c1
SHA512 ecdb01dbc0e8b2c53d3db975d7dabb0b97d82b98339c0ed6611e5e3c24cfe69609bab7a2d4149c3e3d6f2eb1e212f46d6097354d7641d2829cf6afbee348a8c7
TLSH
T16E415D241BE90907F2F79A076EF3D1625A33FCC26434DB0D6385821D4667D046CB976E
MD5 SHA1 SHA512 TLSH

Submit Download

step-1-done-54.png

Path C:\Users\Admin\AppData\Local\Temp\is-7CHB03C0XC.tmp\step-1-done-54.png
Size 1KB
SHA256 57d6966f8ab4ad244eec113d7171c0e7e09703d4244df3c5e9e42bff55942c04
MD5 4d059c300f233db9299f08fe5097704a
SHA1 dd6bc52ebf0a9d76e417c0de4a02490cf676712b
SHA512 5377fd750a446110c49e7d04e87a96fcbf8a26addb882dd2fd41dc129ea08090a4cb955db50606a73fde2215dee17230dc3a69c52742e032b1cf438a5161385e
TLSH
T16E21B7FEE704F06940C17A1A266962C1E8EC44FC981E027240D2CEB5291F984D3BE61C
MD5 SHA1 SHA512 TLSH

Submit Download

step-2-done-54.png

Path C:\Users\Admin\AppData\Local\Temp\is-7CHB03C0XC.tmp\step-2-done-54.png
Size 1KB
SHA256 4abc50f7a1acf19e69c62e8eaee97581cc10c62c843db5bd50148284556198d9
MD5 69bc427ee0ffbe7f2ba9f1ff69d938fe
SHA1 05fac4a6bffb4155d806129b3eed133a43cf75cf
SHA512 dc7ea18e6fa7a632f21b91df1e08c08f29f4819ac104084ab4fb437565f6cfb02ac8b4a17390b8a5b4170c8a5769658f41eccfd3c3c2141fc072f3ec03ee68a4
TLSH
T107311A9320A2AD468C9A437223146819683193B4005D0199D377FB7D7EC68CD1EFDE0B
MD5 SHA1 SHA512 TLSH

Submit Download

step-3-active-54.png

Path C:\Users\Admin\AppData\Local\Temp\is-7CHB03C0XC.tmp\step-3-active-54.png
Size 1KB
SHA256 49ed06bd3eb4d4d141be2b934a4b67a6a669bc45b83409e0a8222ba2517abb48
MD5 8c9cc2e897d976ebf7737be2a612349b
SHA1 db8f77511d1e176505d5d19c49462c734d9db537
SHA512 ea9fd56ec76249734c3ed5e83734ee105467cc6f81fd235d4c71c8b4a11bd4a9e5618c328590ec3d7afacbd2833cf9ff7ffbd6f95551442e8a708f83402d2381
TLSH
T1FD312BF463D633E4C59305BE53D37651F37520193D0520576E81D61CE5EC695106F48F
MD5 SHA1 SHA512 TLSH

Submit Download

step-3-pending-54.png

Path C:\Users\Admin\AppData\Local\Temp\is-7CHB03C0XC.tmp\step-3-pending-54.png
Size 1KB
SHA256 a00785e95ca455beaf4ebb62dcf39309e3c48acadacaa12bc02198eda225d0f2
MD5 3b10164a81fe1b09a06906588564d0a0
SHA1 ce5b69fc2371fa89fe5467ea273d8e88ec565679
SHA512 da23bbe08b4506c32ee1f26f1a1497cb931fb2d36da556a767b0d0aeb509c0c690331fd9d7267b8fa6c44c16d7aac7028d44bd891752d264305ca738c4ac0501
TLSH
T1CE3118669430213D24609E7A12F6544AC82B0B4F3BE94141C2DB6E722CB8E12D87878F
MD5 SHA1 SHA512 TLSH

Submit Download

vc_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Temp\is-7CHB03C0XC.tmp\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FTHRClips-Setup-2.0.0-alpha-x64(1).tmp

Path C:\Users\Admin\AppData\Local\Temp\is-YBSKILL6AI.tmp\FTHRClips-Setup-2.0.0-alpha-x64(1).tmp
Size 4.7MB
SHA256 4d10d0ce3f4619d20bb09d8300e74969baaf065f2121f0872b5e20d2c2ff6783
MD5 291308bcd93676438d5982672feec448
SHA1 8ade87561e69023ac18912647fb7a14180baf329
SHA512 3b752012e01cf8f4d98735c6b8e06022d543622a02caf4ec5f9b513024eef0ac393b903246190d84c420ab60de6877a49c280d5fdd93e9582b894824bc6dbea8
SSDEEP 98304:dvdHRh7Vhv2Wn+FYGa7xP2gRQJhJm+333V:PHLn+eHNt07
TLSH
T1FD369E23B384A53EE4671E3A687FA649583F7A203A168D476BF40D5C4F396402D3B787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{6071B99A-33E5-49F6-9114-1C2C48F4FC4B}\.cr\vc_redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{73561253-446F-42B2-9E0C-31B2B3BBE5C9}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{73561253-446F-42B2-9E0C-31B2B3BBE5C9}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{73561253-446F-42B2-9E0C-31B2B3BBE5C9}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
MD5 ea81447ef1038bd5726b36063896b39a
SHA1 8f484a24bfe42276580d120c200a99bf604eea70
SHA512 31fe32db60d9a0579374ce3a51b586ef0fa7b891aebcd33613a818264bb9eeccba4f2b5ac4b95feca144d4be6146e99d9f5dfa7bfa5e11cfae46e06b41da251f
SSDEEP 98304:JnfKe/OhMAf7WUHioDNe/rdRlRFQdU8o2VDF/ZXZsHOtnF9r:hPAzWxZgU85VDbXZs+z
TLSH
T17D4633018111941B63BB250753FCF1518FF2F087A4B672BA3BD2934E4AE78CF59EA51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{73561253-446F-42B2-9E0C-31B2B3BBE5C9}\cab5046A8AB272BF37297BB7928664C9503
Size 964KB
SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
MD5 efc41c00aadf8b2050ecf9e38e9036f1
SHA1 bc4afc5cb90411f0e4e874372f1fbabab0cfd33d
SHA512 bc9cc1e83acc8dbe53501ca4554dec6d31cb0ccd3609d0e760c7fdbf73fbc4c46baf14c397667eaeced284506d0a9a0bdf7777736f05ae277e9e2f3349371136
SSDEEP 24576:+e9fUQD6DozFBvW8lRBAaKycdSCTbiVTPf1eg++4:+exUQX/e8lzAjdZTbiVTnw
TLSH
T15625338685244AC1694EEC06B346F9BF74D331FD59B5B8032A262EC8E3D33857593937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{73561253-446F-42B2-9E0C-31B2B3BBE5C9}\vcRuntimeAdditional_x64
Size 208KB
SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
MD5 f375f3d81a661e188146d701d8ed3ba9
SHA1 0851e6da56fa65981ae27d9eb7e396afe1ea0c73
SHA512 d67709e2f25ad12532ed33d26c0ae365b7a4eb0e6711b2ee7dda489480b9976b4bbfd0b902cbb847cb602922a1653a2981741718fdec4091ae25f07fe5b8bf2a
SSDEEP 3072:F9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT6qF:/laZeKFxCnBheIdlu2q
TLSH
T19E24AE12B5808033DAFE1A311178DB615F3D7E608F544A9B6364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{73561253-446F-42B2-9E0C-31B2B3BBE5C9}\vcRuntimeMinimum_x64
Size 208KB
SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
MD5 23626831f9a05572c6ebd133e5ffc4b0
SHA1 ad044cdf938a5532aa270c6bc687db95d803fe10
SHA512 1b45ea55e7278ec61f0689b70794f371d56eb2787c22106ebec38d17f1670441a853849460249d08380053bc8b2fae0285845b47ad62670029639d5de5ace10c
SSDEEP 3072:o9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTA:+laZeKFxCnBheIdlu
TLSH
T1A3249E12B5808033DAFE1A311578DB615F3D7E608F54899B6364B6AC1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{98713929-D65B-4B7F-BF6E-A8E3CA47DDB8}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{F118C3EE-EE73-450A-9934-541ABF012FD6}\.ba\BootstrapperApplicationData.xml
Size 14KB
SHA256 8c81100f594e3d0bc51e5571e0046f016086207c1c382d45708c30e1d732b648
MD5 7f35d3c6ef5189d916dce7f974f2e5b8
SHA1 37f9ed9a2ed80fdafd187ce9a38ce5b0c952f3a2
SHA512 ccaafb8ef675e2625561a244f80a4d5e05c590211055e76afe4a317b2220bab2e9baf8fe968a46b226e3ad4e2d064f1551d88e47da798d24ed365331840d4c03
SSDEEP 192:X0sveDnH5zHqQHG0Hd8Hz7HE06HA0rH3pJp+tHxLUrnDzLG0LY1ftHJr5e0II0B4:X0s6dLbmnoNwtR03J+ftcItVEp+Eo
TLSH
T1DD62D5142AFD0159F1F34F88EAB945566B76FC963E38C81D01611E0E4873E819972FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{F118C3EE-EE73-450A-9934-541ABF012FD6}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{F118C3EE-EE73-450A-9934-541ABF012FD6}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{F118C3EE-EE73-450A-9934-541ABF012FD6}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/876-0-0x0000000000FB0000-0x000000000108F000-memory.dmp

Download

memory/876-10-0x0000000000FB0000-0x000000000108F000-memory.dmp

Download

memory/876-2063-0x0000000000FB0000-0x000000000108F000-memory.dmp

Download

memory/1152-2042-0x00000000008A0000-0x0000000000917000-memory.dmp

Download

memory/3808-590-0x0000000000710000-0x0000000000BF1000-memory.dmp

Download

memory/3808-11-0x0000000000710000-0x0000000000BF1000-memory.dmp

Download

memory/3808-12-0x0000000001760000-0x0000000001761000-memory.dmp

Download

memory/3808-884-0x0000000000710000-0x0000000000BF1000-memory.dmp

Download

memory/3808-6-0x0000000001760000-0x0000000001761000-memory.dmp

Download

memory/3808-2055-0x0000000000710000-0x0000000000BF1000-memory.dmp

Download

memory/3808-2061-0x0000000000710000-0x0000000000BF1000-memory.dmp

Download

memory/3808-2062-0x0000000000710000-0x0000000000BF1000-memory.dmp

Download

memory/3808-110-0x0000000000710000-0x0000000000BF1000-memory.dmp

Download

memory/3808-1824-0x0000000000710000-0x0000000000BF1000-memory.dmp

Download

memory/4876-2039-0x00000000008A0000-0x0000000000917000-memory.dmp

Download

memory/5012-2041-0x00000000008A0000-0x0000000000917000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads