Resubmissions

02/11/2026, 16:47

261102-vap1ysbw2v

02/11/2026, 15:48

261102-s87ybafe696

Analysis

  • user interaction
    yes
  • max time kernel
    51s
  • max time network
    70s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 15:48

General

  • Target
    Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.exe
  • Size 546.8MB
  • Sample261102-s87ybafe69
  • SHA256 e000be0eb67a5903d7c2975b17c79bba8c093fd442a6276c76f6be278c049e66
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 21 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.exe
    "C:\Users\Admin\AppData\Local\Temp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5656
    • C:\Users\Admin\AppData\Local\Temp\is-66S0RW1WX0.tmp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-66S0RW1WX0.tmp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp" /SL5="$6026C,571761725,892416,C:\Users\Admin\AppData\Local\Temp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3508
      • C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\vcredist_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\vcredist_x64.exe" /q /norestart
        3⤵
        • Adds Run key to start application
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1372
        • C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\vcredist_x64.exe
          "C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\vcredist_x64.exe" /q /norestart -burn.unelevated BurnPipe.{92DED4EF-B635-4DDC-AA49-DB5D6041E083} {86042384-1C5F-464C-B459-DA285558C6C2} 1372
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4344
        • C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{BB8E3963-155F-4E77-A609-295200B0DFE8} {BF4838E8-D413-4E21-A302-70196CD5949A} 1372
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4936
          • C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{BB8E3963-155F-4E77-A609-295200B0DFE8} {BF4838E8-D413-4E21-A302-70196CD5949A} 1372 -burn.unelevated BurnPipe.{B7978577-6451-4DDE-B41B-DEF23579FEE0} {B497438B-C803-4E6A-8448-EA5AC1A7B43B} 4936
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1928
      • C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x64.exe" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Windows\Temp\{9E2BC9EA-4D60-4524-8D0C-3EFFB208CD71}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{9E2BC9EA-4D60-4524-8D0C-3EFFB208CD71}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692 /q /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3848
          • C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{AA705A34-AEFB-45F2-9528-09A212C0A7BA} {16216262-30CE-411C-B1A9-08BF1814FF57} 3848
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:5840
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1036 -burn.embedded BurnPipe.{8FC9DE53-A1B2-48D0-92F2-72689AC7DDE0} {3AC3CF24-35D4-4AB4-B50B-30A646267CE4} 5840
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3272
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1036 -burn.embedded BurnPipe.{8FC9DE53-A1B2-48D0-92F2-72689AC7DDE0} {3AC3CF24-35D4-4AB4-B50B-30A646267CE4} 5840
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2784
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{45AC9565-E58E-4428-9AEF-8CCB5998BFDA} {0B74231A-EE1B-43A4-9164-569B6AA07D4F} 2784
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4912
      • C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x86.exe
        "C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x86.exe" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4484
        • C:\Windows\Temp\{D8D7D094-4AF9-4998-A844-311C14AB16A8}\.cr\VC_redist.x86.exe
          "C:\Windows\Temp\{D8D7D094-4AF9-4998-A844-311C14AB16A8}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692 /q /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4972
          • C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{3D33C7F8-29F0-4929-9781-EE5B19CA686F} {91FAED75-6731-4F7C-B553-554AAA216D84} 4972
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:6080
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e4ccf1b-d073-4cfe-8a24-e86185719b56} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{FA9B616C-2B3E-4EC9-AE20-AC7BB833D3FD} {C5865AE9-0BFA-4BD4-9665-DB2B3E4EC806} 6080
              6⤵
                PID:2272
                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e4ccf1b-d073-4cfe-8a24-e86185719b56} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{FA9B616C-2B3E-4EC9-AE20-AC7BB833D3FD} {C5865AE9-0BFA-4BD4-9665-DB2B3E4EC806} 6080
                  7⤵
                    PID:4924
                    • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{31BF0139-935A-450D-BFE7-AA551071E772} {11A8EBDA-458C-4429-B7EE-42530F9DD2ED} 4924
                      8⤵
                        PID:2384
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:5500
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          1⤵
            PID:4084
          • C:\Windows\system32\msiexec.exe
            C:\Windows\system32\msiexec.exe /V
            1⤵
            • Enumerates connected drives
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4544
          • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1820
            • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155411.log"
              2⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2436
              • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155411.log" -burn.unelevated BurnPipe.{44178780-2882-498B-9EAD-16004F58339E} {A4CB8011-5636-4E4F-8372-45C8A44B7511} 2436
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:5652
          • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4076
            • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155433.log"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2084
              • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155433.log"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1988
                • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5E3039D4-8829-4D40-B15E-0755B9EF755C} {F09253E2-74BA-46F6-A148-952174D55F88} 1988
                  4⤵
                  • Adds Run key to start application
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4044
          • C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe
            "C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5756
            • C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102155443.log"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5416
              • C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102155443.log"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5296
                • C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{611FA2DC-CFC7-4C5E-B910-1BB995A2D223} {BB439A8E-3B64-4042-8D16-F354374429EB} 5296
                  4⤵
                    PID:3780

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  e59e1af.rbs

                  • Path C:\Config.Msi\e59e1af.rbs
                  • Size 18KB
                  • SHA256 54cd64bdf798a6a6be40bba9890d3b3601d0a49d3d7aa6194cd007a4e0f09a43
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  e59e1b8.rbs

                  • Path C:\Config.Msi\e59e1b8.rbs
                  • Size 14KB
                  • SHA256 0c865887885e40da3b8cbb43f8995d5cf9c4f9261f7fca4cead3ac0ed1997a54
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  e59e1be.rbf

                  • Path C:\Config.Msi\e59e1be.rbf
                  • Size 3B
                  • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                  • MD5 SHA1 SHA512

                  e59e1c2.rbs

                  • Path C:\Config.Msi\e59e1c2.rbs
                  • Size 27KB
                  • SHA256 89233bf8c04cb4e38e4f3cd46e8155087b9eaf8467805dee958743e471bbe863
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  e59e1d4.rbs

                  • Path C:\Config.Msi\e59e1d4.rbs
                  • Size 22KB
                  • SHA256 44691c70dbc5ca66619d90efafaa5ba8a11e939470ad1178a6c8317307888ac4
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  e59e1e9.rbs

                  • Path C:\Config.Msi\e59e1e9.rbs
                  • Size 19KB
                  • SHA256 a246bd56416c4f7e3e4b5a9a73fe2e8d144f8968648fea8779e9ca83c0f1bc05
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  e59e1f5.rbs

                  • Path C:\Config.Msi\e59e1f5.rbs
                  • Size 19KB
                  • SHA256 ea4f28eb82de50913836db11eb7e1ade3bce36f9d64d73843368b336bbe46bb5
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  e59e1fc.rbs

                  • Path C:\Config.Msi\e59e1fc.rbs
                  • Size 21KB
                  • SHA256 675c9c141a7fd2cd5c404c2efb7ebc2d96bd53d0707f92d3b2b539acde935df9
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  e59e20b.rbs

                  • Path C:\Config.Msi\e59e20b.rbs
                  • Size 21KB
                  • SHA256 229e31a7bd784609f14c9feef59e21a4c720eccc6ceb668dbe6ce9d092156d31
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  e59e212.rbs

                  • Path C:\Config.Msi\e59e212.rbs
                  • Size 16KB
                  • SHA256 9e933a785f43825f180a28dc16abc2ef71de9902eb6c0e80f2c069d30605a34d
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  e59e217.rbs

                  • Path C:\Config.Msi\e59e217.rbs
                  • Size 18KB
                  • SHA256 98a0025245e4c66295a5d965921bf943f09b80ebe3a9f758ef912c6fb57a5c08
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  e59e224.rbs

                  • Path C:\Config.Msi\e59e224.rbs
                  • Size 20KB
                  • SHA256 4ac80d7648254cba8a2c62666cfc1a82679bf7058621025d8b2fed555a75723b
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  e59e233.rbs

                  • Path C:\Config.Msi\e59e233.rbs
                  • Size 19KB
                  • SHA256 088e4c3733cb8e1ec6985db7397a9fbce5140de3879cd8c4f6806a14074cb66c
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  AAFCOAPI.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\AAFCOAPI.dll
                  • Size 3.3MB
                  • SHA256 1365ef3769c838f7f13e12f16051172b02f74529497e2abd3402cfbb9e62eef5
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  AjaVideoProperties.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\AjaVideoProperties.dll
                  • Size 35KB
                  • SHA256 95b30a3b6182e272e6496f9d1bb47b81b68b3babeb0e22c42c6488f58eb5df4f
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  Boris FX Vegas Pro 2026 -- ShuttlePro v2.pref

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\Boris FX Vegas Pro 2026 -- ShuttlePro v2.pref
                  • Size 11KB
                  • SHA256 0e2be754c0c9d890dbda0fd3c8ce5a051da12aee103df11dc912364932288e47
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  Boris FX Vegas Pro 2026 -- ShuttleXPress.pref

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\Boris FX Vegas Pro 2026 -- ShuttleXPress.pref
                  • Size 11KB
                  • SHA256 13658f29df766e4eff758bc827524cce547780c6d4c63d1dca86a1f3a270149f
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ColorGradingPanel.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\ColorGradingPanel.dll
                  • Size 456KB
                  • SHA256 dc1f22a6fdf2a9bfda1833a53a42033da5c0d334f8a77c19f44a56d4cf97be48
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ControlLibrary.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\ControlLibrary.dll
                  • Size 38KB
                  • SHA256 6c94a9a546561f9b7862f8afbb3b45bbaacc8bb1084aa37771364e3248ca3db7
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  CoreGraphics.Native.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\CoreGraphics.Native.dll
                  • Size 135KB
                  • SHA256 a531e254f8160c634049b6d9e1c55b1f7b4c9a156d4d31b5fa353e0771a537a2
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  CorePrimitives.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\CorePrimitives.dll
                  • Size 44KB
                  • SHA256 894173ea030a229cf31e5fd0d7e4ca22638a833e32998d7c119cda72f9256f9e
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  CoreUI.XmlSerializers.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\CoreUI.XmlSerializers.dll
                  • Size 309KB
                  • SHA256 86c140a6c47ede0bd023a5fa6dde886a8c098b11ff10c6ab70dea1b5e9058096
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  CoreUI.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\CoreUI.dll
                  • Size 119KB
                  • SHA256 16c671392d1934be7927489c417b87bdc469196e617e875752ef4611ade23b2b
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  DecklinkVideoProperties.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\DecklinkVideoProperties.dll
                  • Size 31KB
                  • SHA256 9d99d038f723f23e81b37d39024ea3bde50a5845413bfc6085d90668a5d2f484
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  DetailedRenderLibrary.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\DetailedRenderLibrary.dll
                  • Size 54KB
                  • SHA256 eaf4143c889dad0a3acbaef0d9eb1e5e0ded44ce43b5831e326ad9e348e79c42
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  DirectML.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\DirectML.dll
                  • Size 17.7MB
                  • SHA256 9c9e6d822561c6c41b90e6994b3e8857cf1d66dbfb1e0c4c799c7c89b4e92da1
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  EULA

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\EULA
                  • Size 23KB
                  • SHA256 d77e7c0aaeedc52ba95d200189395be99bda5a256027bfaeee8ba928a9e746d4
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ErrorReport.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\ErrorReport.dll
                  • Size 61KB
                  • SHA256 2216e747823d1b8d5e3aaf7a8e88a0a9b9e80ee7a6d58f89b56b922676538a2e
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ErrorReportClient.exe

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\ErrorReportClient.exe
                  • Size 1.3MB
                  • SHA256 a436f6dd6697913cdc6962d5d377c4f0edf9b5ddc9a9cbcd08d4881c5dc86bbc
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  ErrorReportConfig.xml

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\ErrorReportConfig.xml
                  • Size 1KB
                  • SHA256 ce6a598f3ef0514eccc17b054aa057bae7952c8c572cbece34dca4cf8815a0b1
                  • MD5 SHA1 SHA512 TLSH

                  FileIOProxyStubx64.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\FileIOProxyStubx64.dll
                  • Size 52KB
                  • SHA256 9f9d6bb5d179a001cbb613ed5864b67e7ba49f76a6dc5c60bfbd4a5fc55410f2
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  GPCHolder.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\GPCHolder.dll
                  • Size 16KB
                  • SHA256 d9c22501ff62a9624bbce86b9a01e4d9de0623e847ea2a1a882f7195c1600a42
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  GPCLibrary.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\GPCLibrary.dll
                  • Size 64KB
                  • SHA256 abf0f752edbe24a1f7f69955714959df5765a47e460ba946319275d25f79db84
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  Google.Protobuf.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\Google.Protobuf.dll
                  • Size 424KB
                  • SHA256 5e12cb98aaabeb5bad0944bbdef9882632fac720601e4db41f4c4e5c84f85cef
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  Grpc.Core.Api.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\Grpc.Core.Api.dll
                  • Size 58KB
                  • SHA256 d13ba6360fa73140cda545afab6f21d6576475f9644cd153c182dde6aede8f80
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  Grpc.Core.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\Grpc.Core.dll
                  • Size 474KB
                  • SHA256 aa99e6ad71c01997c154be1f0f6e5402266f787422cf67d66c5d59f63d26131f
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  HardwareDetection.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\HardwareDetection.dll
                  • Size 29KB
                  • SHA256 30eb2e83c9cf3a46a596154fda6bbd5f5f46350d8875f24bfe05d1270e2e2768
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  Interop.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\Interop.dll
                  • Size 29KB
                  • SHA256 e55079e907bc80db8a6345df9539119b38f5a4c0b8aae148c2d9a0d285a4aa56
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  activate.cmd

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\activate.cmd
                  • Size 245B
                  • SHA256 60b256135c51b54e931bfcfdaabe694825d9904e62e87bb48d96c13aac233f30
                  • MD5 SHA1 SHA512 TLSH

                  atlantic.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\atlantic.dll
                  • Size 240KB
                  • SHA256 d1918c117a149d5e7858a8285155209114062c0e5a261a121b733a217a6fe626
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  audio_plugin_scan_server_vst2.exe

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_scan_server_vst2.exe
                  • Size 1.7MB
                  • SHA256 67d138ed05ec88bf432158e1b0dbf267da83fb700f90e775dffdfe6934a6c1f7
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  audio_plugin_scan_server_vst2_x64.exe

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_scan_server_vst2_x64.exe
                  • Size 1.9MB
                  • SHA256 b1b43d3becac0fca17543cd05ab0eec45e9be8f7120ffb18612eee8310a0688f
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  audio_plugin_scan_server_vst3.exe

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_scan_server_vst3.exe
                  • Size 1.7MB
                  • SHA256 c204fb4dcc7c9f6788ae6e639363493271236088aef51f7424b7a744d2481532
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  audio_plugin_scan_server_vst3_x64.exe

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_scan_server_vst3_x64.exe
                  • Size 1.9MB
                  • SHA256 4b5b810768dcebbdf34d8029462a841f602d25cb1254da2e061f856a6d4bff2c
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  audio_plugin_server.exe

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_server.exe
                  • Size 1.9MB
                  • SHA256 5f6bd53041ba58e19a45baa8ccd6485b4c10c375c88605abcfc2cbeee7c9cc68
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  audio_plugin_server_x64.exe

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_server_x64.exe
                  • Size 2.2MB
                  • SHA256 2a97715394efa3968f824942554063beb70cef0f95ed1ebbc6c7d1484d4af1ef
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  crashpad_handler.exe

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\crashpad_handler.exe
                  • Size 668KB
                  • SHA256 2cb00ff129cb4a77b80211836c2ce1f618694c03ea41843d25138f2d4bbe83e2
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  crashpad_wer.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\crashpad_wer.dll
                  • Size 23KB
                  • SHA256 8ce09a8d96d1309c805ba8c6b163dfbdc31d3226942c86e7f1a80790c1f2051a
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  deactivate.cmd

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\deactivate.cmd
                  • Size 172B
                  • SHA256 8a12c36a999078412a276cb58078dbd9c73ebb7642c4e3fe02c2458555bddab6
                  • MD5 SHA1 SHA512 TLSH

                  discdrv.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\discdrv.dll
                  • Size 227KB
                  • SHA256 9ba02f24fa1458c5b4a865f0278b457c54fafe4cdec5d28a773107f4af23a49b
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  gahelper_rel_u_dynMFC_x64_vc16.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\gahelper_rel_u_dynMFC_x64_vc16.dll
                  • Size 264KB
                  • SHA256 984faa18f9dd57995b7bb53de1f6f693a4e6baf7d7c2b0ae10576c09378b5838
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  grpc_csharp_ext.x64.dll

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\grpc_csharp_ext.x64.dll
                  • Size 8.1MB
                  • SHA256 0634411fb4e04ab89e90f2b1418d4baa0c78736ce12793d184a8a3bce045f133
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  install.cfg

                  • Path C:\Program Files\BorisFX\Vegas Pro 2026\install.cfg
                  • Size 204B
                  • SHA256 bf45a35670e1275273af17bbe2e9a7abe3630299dd763e7a02d8d643f0e4e553
                  • MD5 SHA1 SHA512 TLSH

                  state.rsm

                  • Path C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\state.rsm
                  • Size 740B
                  • SHA256 666d8042fd0e167eec349b05f4c3329c821d681276ced33a307fd01a83f2072a
                  • MD5 SHA1 SHA512 TLSH

                  vcredist_x64.exe

                  • Path C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
                  • Size 455KB
                  • SHA256 102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  state.rsm

                  • Path C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\state.rsm
                  • Size 976B
                  • SHA256 ffa1605004abe7e765aa3c0c555e95117536cd98b56af3cb26147801acc93048
                  • MD5 SHA1 SHA512 TLSH

                  state.rsm

                  • Path C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\state.rsm
                  • Size 980B
                  • SHA256 4676d549d0ee3f19ace0016a7dced7030888d33e49d3836fe60209280a8a47be
                  • MD5 SHA1 SHA512 TLSH

                  dd_vcredist_amd64_20261102155411_000_vcRuntimeMinimum_x64.log

                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155411_000_vcRuntimeMinimum_x64.log
                  • Size 2KB
                  • SHA256 d3abed4e2fde8ea8320ed643a8344fb6931d1254f610ea54e088b3cfc8f8c861
                  • MD5 SHA1 SHA512 TLSH

                  dd_vcredist_amd64_20261102155411_001_vcRuntimeAdditional_x64.log

                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155411_001_vcRuntimeAdditional_x64.log
                  • Size 2KB
                  • SHA256 0717cba08c12931f1e50924778b4aa140235885b3ba3a3c3de6beee2982099d0
                  • MD5 SHA1 SHA512 TLSH

                  dd_vcredist_amd64_20261102155433.log

                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155433.log
                  • Size 12KB
                  • SHA256 7be1eb70dab529b40655f423e68ff9415f1509bb190e5592146220a987098529
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  dd_vcredist_amd64_20261102155433_000_vcRuntimeMinimum_x64.log

                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155433_000_vcRuntimeMinimum_x64.log
                  • Size 2KB
                  • SHA256 f11cda652c148c948d9402548aa256bf50a9214f682a25c5ffdce1a6fc3f0d96
                  • MD5 SHA1 SHA512 TLSH

                  dd_vcredist_amd64_20261102155433_001_vcRuntimeAdditional_x64.log

                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155433_001_vcRuntimeAdditional_x64.log
                  • Size 2KB
                  • SHA256 737cdc2385ec9df95f2aaab1c4274dcef7b6310ac9165b2a0a486ecfae9d3432
                  • MD5 SHA1 SHA512 TLSH

                  dd_vcredist_x86_20261102155443.log

                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102155443.log
                  • Size 11KB
                  • SHA256 d8ae4e286af79c044e8ca59e1cf2e77a298e142937324f5aa1c604c27094483f
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  dd_vcredist_x86_20261102155443_000_vcRuntimeMinimum_x86.log

                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102155443_000_vcRuntimeMinimum_x86.log
                  • Size 3KB
                  • SHA256 de2f2dcf014c847427ab0a73dfab0837d7855329ba20d3f0633b324dacc73c77
                  • MD5 SHA1 SHA512 TLSH

                  dd_vcredist_x86_20261102155443_001_vcRuntimeAdditional_x86.log

                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102155443_001_vcRuntimeAdditional_x86.log
                  • Size 2KB
                  • SHA256 346c4d79f630baa261217460b205fd348d028ca478b267f664b53055b7dfdee7
                  • MD5 SHA1 SHA512 TLSH

                  VC_redist.x64.exe

                  • Path C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x64.exe
                  • Size 17.7MB
                  • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  VC_redist.x86.exe

                  • Path C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x86.exe
                  • Size 6.6MB
                  • SHA256 e7267c1bdf9237c0b4a28cf027c382b97aa909934f84f1c92d3fb9f04173b33e
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  vcredist_x64.exe

                  • Path C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\vcredist_x64.exe
                  • Size 6.9MB
                  • SHA256 a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\is-66S0RW1WX0.tmp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp
                  • Size 4.2MB
                  • SHA256 439b028c7bc40edd8aa4052f46f1590e5e749aecad3928cecc5b675ee48c11e4
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  logo.png

                  • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png
                  • Size 1KB
                  • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                  • MD5 SHA1 SHA512 TLSH

                  wixstdba.dll

                  • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll
                  • Size 117KB
                  • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  BootstrapperApplicationData.xml

                  • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba2\BootstrapperApplicationData.xml
                  • Size 5KB
                  • SHA256 3ae340bec4fb68b477f34dbeadaf8cf3ea95550e427a3bb84994b5806485b5b3
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  cab2C04DDC374BD96EB5C8EB8208F2C7C92

                  • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                  • Size 5.3MB
                  • SHA256 1f2f8f5d60dadbc6e4d3d36c88cc54f22af0a615b609609e748782dc26231174
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  cab5046A8AB272BF37297BB7928664C9503

                  • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab5046A8AB272BF37297BB7928664C9503
                  • Size 1010KB
                  • SHA256 e95d29cbb06bb323d9d43fc2ce61d4565b0866622a83d93df76430a0c252b433
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  vcRuntimeAdditional_x64

                  • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeAdditional_x64
                  • Size 140KB
                  • SHA256 8909e5c1d917064983595a4e4717f758c2a8df8f59d7b31a5b79b2f95bd8f7cc
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  vcRuntimeMinimum_x64

                  • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeMinimum_x64
                  • Size 140KB
                  • SHA256 e88d0915814e622cd1deca849efa23a0d58d5d756be44ebbb4d460d3dac9e816
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  license.rtf

                  • Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\license.rtf
                  • Size 6KB
                  • SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  thm.wxl

                  • Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\thm.wxl
                  • Size 2KB
                  • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                  • MD5 SHA1 SHA512 TLSH

                  thm.xml

                  • Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\thm.xml
                  • Size 5KB
                  • SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120_x64
                  • Size 5.3MB
                  • SHA256 950ff7746d747de51cc09c1aaaf88fbc2fc97c59865f574cc3fb10243ae7b906
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120chs_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120chs_x64
                  • Size 45KB
                  • SHA256 cb531679be2881677a93d11067c71274ec30b30aadf1cdcf1543dddd6b1d7b61
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120cht_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120cht_x64
                  • Size 45KB
                  • SHA256 0301c5dc6e762788891356987e9c8cd0d40b262df06e8384bf5796b1f20f083e
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120deu_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120deu_x64
                  • Size 73KB
                  • SHA256 80e0f29ff6b7ada892f23927f17021783575ad80f9f6c8a268a6c2a7ce35e5d6
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120enu_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120enu_x64
                  • Size 63KB
                  • SHA256 e463f38fa6b6157398ad224a462538bd8e36b75031fa711e567c5505a9092df6
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120esn_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120esn_x64
                  • Size 72KB
                  • SHA256 db4fc3652d24224d5375d1a5696144ac8881332cc20f5992ed1488236e64c120
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120fra_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120fra_x64
                  • Size 73KB
                  • SHA256 e7cb6c2818ca27c864bda635d5b5d9f7bdb308f4b5d4bbc206ee1e135b7dbbf7
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120ita_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120ita_x64
                  • Size 71KB
                  • SHA256 9cfc5985440df4e70b57869b32c8ee69eb6fc570a98cc94a53141a0dc7535e10
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120jpn_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120jpn_x64
                  • Size 52KB
                  • SHA256 83fb72fd2142d54bff6280e7c4d4ff22d43c3a81fa4ff8881003abbe5e21ec3b
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120kor_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120kor_x64
                  • Size 52KB
                  • SHA256 b2c7fc2c95b13bac36316d298c94d842dd2574f78e9c22e4d4e4af1c3fcc0fd9
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120rus_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120rus_x64
                  • Size 69KB
                  • SHA256 3238676035d9c1595248ef65ef5b044384b473ab9bdfe8d1077e10e4fe7bc983
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfc120u_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120u_x64
                  • Size 5.4MB
                  • SHA256 75497de4aec4b5f0f258164672db2eb55eef5138c028317860e05f11030f7b7c
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfcm120_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120_x64
                  • Size 89KB
                  • SHA256 864958960b8dd2890d47f2774ba836954f2c4f5ad6e4d529b13138caefcce73e
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_mfcm120u_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120u_x64
                  • Size 89KB
                  • SHA256 a78e7988c9f99bcbe02d29441b0dcbdebafa616d2a4652aad867b81f554a0476
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_msvcp120_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcp120_x64
                  • Size 644KB
                  • SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_msvcr120_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcr120_x64
                  • Size 940KB
                  • SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_vcamp120_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcamp120_x64
                  • Size 470KB
                  • SHA256 88a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_vccorlib120_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vccorlib120_x64
                  • Size 348KB
                  • SHA256 1b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  F_CENTRAL_vcomp120_x64

                  • Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcomp120_x64
                  • Size 134KB
                  • SHA256 22d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  license.rtf

                  • Path C:\Windows\Temp\{2043F21B-D42C-4038-BBD9-A095649CDE7B}\.ba\license.rtf
                  • Size 9KB
                  • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  thm.xml

                  • Path C:\Windows\Temp\{2043F21B-D42C-4038-BBD9-A095649CDE7B}\.ba\thm.xml
                  • Size 8KB
                  • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1028\thm.wxl
                  • Size 3KB
                  • SHA256 c1fe572ca3dd4387e473272bc9f2a2da5dbee58fa8ad6010eb308e119c903da0
                  • MD5 SHA1 SHA512 TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1029\thm.wxl
                  • Size 3KB
                  • SHA256 1aa579e8e2cb828c9bbbd598e837d6923262fc4c8fbc1ee30b166cfcb10a849c
                  • MD5 SHA1 SHA512 TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1031\thm.wxl
                  • Size 3KB
                  • SHA256 4f3601c2c80999ca9a2ab7c42c1170220f1ff4d958d210d12e50168631c303ab
                  • MD5 SHA1 SHA512 TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1036\thm.wxl
                  • Size 3KB
                  • SHA256 4127145ea3ccc42f9364fefa3eaf7f50e3229eb6ab2ebcdca33a0609003a69a5
                  • MD5 SHA1 SHA512 TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1040\thm.wxl
                  • Size 3KB
                  • SHA256 5d3c97e5ac0b8bac06f6a0c6e3edd92ab5c2c8978543c770b826139edf624c24
                  • MD5 SHA1 SHA512 TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1041\thm.wxl
                  • Size 4KB
                  • SHA256 04ce070c6f65c85958cd1d5518327bcd615469910f02254dcbbd5f95eebb2212
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1042\thm.wxl
                  • Size 3KB
                  • SHA256 cd825881d63ea021d6002eb8375d51a508fcb784fb90753e6323776a3e651aaa
                  • MD5 SHA1 SHA512 TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1045\thm.wxl
                  • Size 3KB
                  • SHA256 49323aaa73e4dfa7dff2dfce004d89cc1d2d4f7d7d530f4cae0b67cf9f91c789
                  • MD5 SHA1 SHA512 TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1046\thm.wxl
                  • Size 3KB
                  • SHA256 cc146b6e1788bff1d0363ca894229b13632b8546a76a55ea1a4cc2dbb4470aba
                  • MD5 SHA1 SHA512 TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1049\thm.wxl
                  • Size 4KB
                  • SHA256 8fa0e3b51a00c5559d1120b1c66b2a00c7693147257b2911fe038a7bf7b8fd94
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1055\thm.wxl
                  • Size 3KB
                  • SHA256 90085069fdf4dcd699579209dbfd62a6719fe1a6e07168b938b92913da3287a3
                  • MD5 SHA1 SHA512 TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\2052\thm.wxl
                  • Size 3KB
                  • SHA256 62bdb8fa52dcf8b5298da5fc7a745aa9481eadb3f32862f2996d070c29f21d2c
                  • MD5 SHA1 SHA512 TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\3082\thm.wxl
                  • Size 3KB
                  • SHA256 2c6f29f040da15f2b6a63cfbf47e07f569afdb778f178feec9e0079199644aca
                  • MD5 SHA1 SHA512 TLSH

                  BootstrapperApplicationData.xml

                  • Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\BootstrapperApplicationData.xml
                  • Size 5KB
                  • SHA256 6eb6c71de94b32df79fd63ca06ab2d27bdd221fe937fd2988edfbe16dca89473
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  BootstrapperApplicationData.xml

                  • Path C:\Windows\Temp\{974A6CF8-18F8-4291-BD45-ACD5C5A8F894}\.ba\BootstrapperApplicationData.xml
                  • Size 7KB
                  • SHA256 1ce95b466c776490014e99096c7f96785147d99f5488fa8e297ad9bf60730493
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  VC_redist.x64.exe

                  • Path C:\Windows\Temp\{9E2BC9EA-4D60-4524-8D0C-3EFFB208CD71}\.cr\VC_redist.x64.exe
                  • Size 615KB
                  • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  wixstdba.dll

                  • Path C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\.ba\wixstdba.dll
                  • Size 215KB
                  • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  cab2C04DDC374BD96EB5C8EB8208F2C7C92

                  • Path C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                  • Size 5.4MB
                  • SHA256 62a859b0db8bca416c7b6ad2ad5d2c84a4890a39e5d45cbec75f90a2fd328749
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  cab5046A8AB272BF37297BB7928664C9503

                  • Path C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\cab5046A8AB272BF37297BB7928664C9503
                  • Size 967KB
                  • SHA256 c346d91193246b18301cce532f2ae784fb377cb068d77bd22edec238e5746aa7
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  vcRuntimeAdditional_x64

                  • Path C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\vcRuntimeAdditional_x64
                  • Size 208KB
                  • SHA256 275d770dc4332bf6f3eae9ebc544ed07e3b169de791ba3d20ad50f04d9d222df
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  vcRuntimeMinimum_x64

                  • Path C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\vcRuntimeMinimum_x64
                  • Size 208KB
                  • SHA256 57d65221ca418dabfcc6320215b2c05eec907690aa4f93384f2007eb9e1394b0
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  wixstdba.dll

                  • Path C:\Windows\Temp\{C3188CEE-DB53-4491-BBB7-FE8354E39387}\.ba\wixstdba.dll
                  • Size 191KB
                  • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  VC_redist.x86.exe

                  • Path C:\Windows\Temp\{D8D7D094-4AF9-4998-A844-311C14AB16A8}\.cr\VC_redist.x86.exe
                  • Size 614KB
                  • SHA256 3d37aa9541cbdab5361c4776304ded5a497a45b486277db14bbfd26cd436f997
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  thm.wxl

                  • Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\.ba\thm.wxl
                  • Size 3KB
                  • SHA256 21a76eb702fe727ca06de6632be2294ed1caa9e1d3798d01ed1428e0f40e19ea
                  • MD5 SHA1 SHA512 TLSH

                  thm.xml

                  • Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\.ba\thm.xml
                  • Size 8KB
                  • SHA256 8d67851408a62b0f04dbaaddc588cd98499cf3630ec5df9f7c0699f0d367f79c
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  cab54A5CABBE7274D8A22EB58060AAB7623

                  • Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\cab54A5CABBE7274D8A22EB58060AAB7623
                  • Size 840KB
                  • SHA256 8b177ce7ea07fcf055dee844c567d3feeee40abc15cc5aa21acbf9e97a9dbfae
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  cabB3E1576D1FEFBB979E13B1A5379E0B16

                  • Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\cabB3E1576D1FEFBB979E13B1A5379E0B16
                  • Size 4.9MB
                  • SHA256 951657e869eb42149ccaa66d4c3f4465ebd29c490285f24c51c8492993861c25
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  vcRuntimeAdditional_x86

                  • Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\vcRuntimeAdditional_x86
                  • Size 200KB
                  • SHA256 21e993652e0cab41bbbc8c8a6df9baa1a25e9147a50700cf956e24e6b15f63d6
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  vcRuntimeMinimum_x86

                  • Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\vcRuntimeMinimum_x86
                  • Size 200KB
                  • SHA256 15aa329341a7df570ca75769e44bb820a301e58ff566a00e1db29db7fe8dcedd
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  memory/1928-413-0x00000000001F0000-0x0000000000255000-memory.dmp

                  memory/2272-904-0x00000000003C0000-0x0000000000437000-memory.dmp

                  memory/2384-901-0x00000000003C0000-0x0000000000437000-memory.dmp

                  memory/2784-653-0x0000000000BA0000-0x0000000000C17000-memory.dmp

                  memory/3272-654-0x0000000000BA0000-0x0000000000C17000-memory.dmp

                  memory/3508-551-0x00000000004C0000-0x0000000000903000-memory.dmp

                  memory/3508-807-0x00000000004C0000-0x0000000000903000-memory.dmp

                  memory/3508-34-0x00000000004C0000-0x0000000000903000-memory.dmp

                  memory/3508-8-0x00000000004C0000-0x0000000000903000-memory.dmp

                  memory/3508-9-0x0000000001440000-0x0000000001441000-memory.dmp

                  memory/3508-5-0x0000000001440000-0x0000000001441000-memory.dmp

                  memory/4912-651-0x0000000000BA0000-0x0000000000C17000-memory.dmp

                  memory/4924-903-0x00000000003C0000-0x0000000000437000-memory.dmp

                  memory/4936-414-0x00000000001F0000-0x0000000000255000-memory.dmp

                  memory/5656-0-0x0000000000F50000-0x0000000001038000-memory.dmp

                  memory/5656-7-0x0000000000F50000-0x0000000001038000-memory.dmp