Analysis
- user interaction
yes - max time kernel
51s - max time network
70s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 15:48
Behavioral task
behavioral1
Sample
Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.exe
Resource
win10v2004-20260911-en
19 signatures
60 seconds
General
- Target Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.exe
- Size 546.8MB
- Sample261102-s87ybafe69
- SHA256 e000be0eb67a5903d7c2975b17c79bba8c093fd442a6276c76f6be278c049e66
- MD5 18bdbe130356b4fcc5083668fe5dd116
- SHA1 843a16cd93df1e20d0897048d0642d3435efb6fc
- SHA512 2b4eff7222eb090a7530e6c661485829fc81be0c70365a27ea1a403f1dc265ecdcde96d3dd04fd118fff21f1e79a143831886717d9df9e95c1148f360608a4e5
- SSDEEP 12582912:IBI3KqbDcznaYWU9QI4NjFqMWeEmlQLQJV+ADJUAaHvyqTRPuRU6P6:IpzmUaeMD/lQcstTP1RPuRFP6
- TLSH T1ED593333381EA97DCC257C3524B66268067ED66142C8D9AC88FCD45CAB6AC75BB3F503
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0e4ccf1b-d073-4cfe-8a24-e86185719b56} = "\"C:\\ProgramData\\Package Cache\\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\\VC_redist.x86.exe\" /burn.runonce" VC_redist.x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} = "\"C:\\ProgramData\\Package Cache\\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7} = "\"C:\\ProgramData\\Package Cache\\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\\vcredist_x64.exe\" /burn.runonce" vcredist_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7} = "\"C:\\ProgramData\\Package Cache\\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\\vcredist_x64.exe\" /burn.runonce" vcredist_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} = "\"C:\\ProgramData\\Package Cache\\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation VC_redist.x64.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation VC_redist.x86.exe Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation VC_redist.x64.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\vcamp120.dll msiexec.exe File created C:\Windows\system32\mfc120jpn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120kor.dll msiexec.exe File created C:\Windows\system32\mfc120rus.dll msiexec.exe File created C:\Windows\system32\mfcm120.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\vcruntime140_threads.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vcomp140.dll msiexec.exe File created C:\Windows\system32\mfc120chs.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120chs.dll msiexec.exe File created C:\Windows\system32\mfcm120u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_2.dll msiexec.exe File created C:\Windows\SysWOW64\vcruntime140_threads.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib120.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\mfc120deu.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120ita.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120jpn.dll msiexec.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\vcamp120.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120rus.dll msiexec.exe File created C:\Windows\system32\mfc120cht.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140chs.dll msiexec.exe File created C:\Windows\system32\vccorlib120.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120cht.dll msiexec.exe File created C:\Windows\system32\mfc120.dll msiexec.exe File created C:\Windows\system32\mfc120fra.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\SysWOW64\msvcp140_2.dll msiexec.exe File created C:\Windows\SysWOW64\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140deu.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp120.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120esn.dll msiexec.exe File created C:\Windows\system32\mfc120esn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm120u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120fra.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File created C:\Windows\system32\mfc140cht.dll msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\Video Plug-Ins\SfPagePeel.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\compoundplug\mc_dec_avc.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\fr\AjaVideoProperties.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\fr\ScriptPortal.Capture.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\compoundplug\compoundplug_plk.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\sflgaplg\sflgaplg_deu.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\bfx-license-tool\pylib\Lib\site-packages\PyQt6\Qt6\plugins\platforms\qwindows.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\bin\boost_filesystem.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\mxcompoundplug\mxcompoundplug_fra.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\bmrawplug\DecoderCUDA.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\sflgaplg\sflgaplg_jpn.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\bin\opencv_imgcodecs455.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\qml\QtQuick\Particles\particlesplugin.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\de\ScriptPortal.Vegas.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\openvino.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\openvino_intel_gpu_plugin.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\mp3plug2\mp3plug2_esp.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\de\ScriptPortal.MediaSoftware.TextGen.OFXInterop.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\bmrawplug\InstructionSetServicesAVX2.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\mvcplug\mvcplug.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\bin\Qt6Xml.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\RenderDialog.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\bfx-license-tool\pylib\Lib\site-packages\PyQt6\Qt6\plugins\imageformats\qico.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\zh-CN\ScriptPortal.Vegas.Slideshow.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\opencv_videoio4110.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\ScriptPortal.Capture.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\ScriptPortal.Monitor3D.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\wmfplug4\wmfplug4_jpn.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\ja-JP\ScriptPortal.Capture.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\es\ScriptPortal.MediaSoftware.TextGen.CoreGraphics.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\gifplug\gifplug.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\pt-BR\PRSConfig.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\NetEnumHelper.exe Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\bin\Qt6Widgets.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\VegasStyle.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\mxcompoundplug\mxcompoundplug_plk.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\so4compoundplug\So4Reader.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\sfpaplug\sfpaplug.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\so4compoundplug\so4compoundplug_deu.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\bin\boost_date_time.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\opencv_calib3d4110.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\sflgaplg\sflgaplg_plk.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\qml\QtQuick\Shapes\qmlshapesplugin.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\mcplug2\mc_dec_mp2v.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\bin\boost_log.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\bin\zlib.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\Microsoft.Bcl.AsyncInterfaces.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\mcplug2\mcplug2_deu.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\mxcompoundplug\mxcompoundplug_esp.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\bin\isildur.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\qml\QtQuick\VirtualKeyboard\Plugins\qtvkbpluginsplugin.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\pl-PL\ColorGradingPanel.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\pl-PL\WidgetLibrary.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\pt-BR\ScriptPortal.Vegas.Slideshow.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\qml\QtQuick\Controls\Basic\impl\qtquickcontrols2basicstyleimplplugin.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\mcplug2\mc_mux_mp2.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\aviplug\aviplug.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\aviplug\aviplug_chs.chm Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\FileIO Plug-Ins\mxfplug3\mxfplug3.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\bin\opencl.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\OFX Video Plug-Ins\mochaVegas2026.ofx.bundle\Contents\Win64\mochaui\bin\sentry.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\zh-CN\AjaVideoProperties.resources.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\System.Threading.Channels.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp File opened for modification C:\Program Files\BorisFX\Vegas Pro 2026\Microsoft.DotNet.PlatformAbstractions.dll Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120esn_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120u_x64 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{53CF6934-A98D-3D84-9146-FC4EDF3D5641} msiexec.exe File opened for modification C:\Windows\Installer\MSIE3A0.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcamp120_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120chs_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\CacheSize.txt msiexec.exe File created C:\Windows\Installer\SourceHash{010792BA-551A-3AC0-A7EF-0FAB4156C382} msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120u_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\CacheSize.txt msiexec.exe File opened for modification C:\Windows\Installer\MSI18ED.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1F66.tmp msiexec.exe File created C:\Windows\Installer\e59e21f.msi msiexec.exe File created C:\Windows\Installer\e59e20c.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcr120_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vccorlib120_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcomp120_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120ita_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120rus_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120u_x64 msiexec.exe File opened for modification C:\Windows\Installer\MSIF287.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{5A0DFA55-3851-45BC-8B20-95EA4BF5812D} msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\CacheSize.txt msiexec.exe File opened for modification C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120chs_x64 msiexec.exe File created C:\Windows\Installer\e59e1e4.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcr120_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120fra_x64 msiexec.exe File opened for modification C:\Windows\Installer\e59e1f7.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3E7B.tmp msiexec.exe File created C:\Windows\Installer\e59e1f7.msi msiexec.exe File created C:\Windows\Installer\e59e21e.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120cht_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120deu_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120enu_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\CacheSize.txt msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120esn_x64 msiexec.exe File opened for modification C:\Windows\Installer\MSIE789.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIED85.tmp msiexec.exe File opened for modification C:\Windows\Installer\e59e21f.msi msiexec.exe File created C:\Windows\Installer\SourceHash{61B44572-8722-4DAF-8ACF-8E742D30BCC5} msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120u_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120_x64 msiexec.exe File opened for modification C:\Windows\Installer\MSI3BF9.tmp msiexec.exe File created C:\Windows\Installer\e59e1bf.msi msiexec.exe File created C:\Windows\Installer\e59e1ac.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcp120_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcomp120_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120cht_x64 msiexec.exe File created C:\Windows\Installer\SourceHash{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF} msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120kor_x64 msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcp120_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120jpn_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120kor_x64 msiexec.exe File created C:\Windows\Installer\e59e20d.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vccorlib120_x64 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120_x64 msiexec.exe - Executes dropped EXE 19 IoCs
pid Process 3508 Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp 1372 vcredist_x64.exe 4344 vcredist_x64.exe 1820 vcredist_x64.exe 2436 vcredist_x64.exe 5652 vcredist_x64.exe 2884 VC_redist.x64.exe 3848 VC_redist.x64.exe 5840 VC_redist.x64.exe 4076 VC_redist.x64.exe 2084 VC_redist.x64.exe 1988 VC_redist.x64.exe 4484 VC_redist.x86.exe 4972 VC_redist.x86.exe 6080 VC_redist.x86.exe 4044 VC_redist.x64.exe 5756 VC_redist.x86.exe 5416 VC_redist.x86.exe 5296 VC_redist.x86.exe - Loads dropped DLL 7 IoCs
pid Process 4344 vcredist_x64.exe 1928 vcredist_x64.exe 5652 vcredist_x64.exe 3848 VC_redist.x64.exe 2784 VC_redist.x64.exe 4972 VC_redist.x86.exe 1988 VC_redist.x64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/5656-0-0x0000000000F50000-0x0000000001038000-memory.dmp innosetup behavioral1/memory/5656-7-0x0000000000F50000-0x0000000001038000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000069bf6088149b83f10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000069bf60880000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090069bf6088000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a69bf6088000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d69bf6088000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 21 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.50,bundle\ = "{0e4ccf1b-d073-4cfe-8a24-e86185719b56}" VC_redist.x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.50,bundle\Version = "14.50.35719.0" VC_redist.x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{5A0DFA55-3851-45BC-8B20-95EA4BF5812D}" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FC00402C7EDE723A94E0F3FD809588F msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{010792BA-551A-3AC0-A7EF-0FAB4156C382}v12.0.40664\\packages\\vcRuntimeAdditional_amd64\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0DE4DCEAB3A89E14291DB6EE3047CCFA\VC_Runtime_Additional msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\ = "{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}" vcredist_x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12 vcredist_x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D}v14.50.35719\\packages\\vcRuntimeMinimum_x86\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4396FC35D89A48D31964CFE4FDD36514 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4396FC35D89A48D31964CFE4FDD36514\VC_Runtime_Minimum msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList\Media\1 = ";" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}v14.50.35719\\packages\\vcRuntimeAdditional_amd64\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27544B162278FAD4A8FCE847D203CB5C\VC_Runtime_Minimum msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.50.35719" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.50,bundle\Dependents VC_redist.x86.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\AuthorizedLUAApp = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27544B162278FAD4A8FCE847D203CB5C msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12 vcredist_x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\Version = "238193543" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55AFD0A51583CB54B80259AEB45F18D2\VC_Runtime_Minimum msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\ProductName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.50.35719" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.50,bundle\Dependents VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\27544B162278FAD4A8FCE847D203CB5C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\PackageCode = "3E495A2D16316AD4F9919561BAD80BFC" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 VC_redist.x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1\55AFD0A51583CB54B80259AEB45F18D2 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.50,bundle\ = "{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}" VC_redist.x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{61B44572-8722-4DAF-8ACF-8E742D30BCC5}v14.50.35719\\packages\\vcRuntimeMinimum_amd64\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55AFD0A51583CB54B80259AEB45F18D2\Provider msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14 VC_redist.x86.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3508 Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp 3508 Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe 4544 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 5500 vssvc.exe Token: SeRestorePrivilege 5500 vssvc.exe Token: SeAuditPrivilege 5500 vssvc.exe Token: SeShutdownPrivilege 1372 vcredist_x64.exe Token: SeIncreaseQuotaPrivilege 1372 vcredist_x64.exe Token: SeSecurityPrivilege 4544 msiexec.exe Token: SeCreateTokenPrivilege 1372 vcredist_x64.exe Token: SeAssignPrimaryTokenPrivilege 1372 vcredist_x64.exe Token: SeLockMemoryPrivilege 1372 vcredist_x64.exe Token: SeIncreaseQuotaPrivilege 1372 vcredist_x64.exe Token: SeMachineAccountPrivilege 1372 vcredist_x64.exe Token: SeTcbPrivilege 1372 vcredist_x64.exe Token: SeSecurityPrivilege 1372 vcredist_x64.exe Token: SeTakeOwnershipPrivilege 1372 vcredist_x64.exe Token: SeLoadDriverPrivilege 1372 vcredist_x64.exe Token: SeSystemProfilePrivilege 1372 vcredist_x64.exe Token: SeSystemtimePrivilege 1372 vcredist_x64.exe Token: SeProfSingleProcessPrivilege 1372 vcredist_x64.exe Token: SeIncBasePriorityPrivilege 1372 vcredist_x64.exe Token: SeCreatePagefilePrivilege 1372 vcredist_x64.exe Token: SeCreatePermanentPrivilege 1372 vcredist_x64.exe Token: SeBackupPrivilege 1372 vcredist_x64.exe Token: SeRestorePrivilege 1372 vcredist_x64.exe Token: SeShutdownPrivilege 1372 vcredist_x64.exe Token: SeDebugPrivilege 1372 vcredist_x64.exe Token: SeAuditPrivilege 1372 vcredist_x64.exe Token: SeSystemEnvironmentPrivilege 1372 vcredist_x64.exe Token: SeChangeNotifyPrivilege 1372 vcredist_x64.exe Token: SeRemoteShutdownPrivilege 1372 vcredist_x64.exe Token: SeUndockPrivilege 1372 vcredist_x64.exe Token: SeSyncAgentPrivilege 1372 vcredist_x64.exe Token: SeEnableDelegationPrivilege 1372 vcredist_x64.exe Token: SeManageVolumePrivilege 1372 vcredist_x64.exe Token: SeImpersonatePrivilege 1372 vcredist_x64.exe Token: SeCreateGlobalPrivilege 1372 vcredist_x64.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe Token: SeTakeOwnershipPrivilege 4544 msiexec.exe Token: SeRestorePrivilege 4544 msiexec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5656 wrote to memory of 3508 5656 Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.exe 88 PID 3508 wrote to memory of 1372 3508 Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp 98 PID 1372 wrote to memory of 4344 1372 vcredist_x64.exe 99 PID 1820 wrote to memory of 2436 1820 vcredist_x64.exe 110 PID 2436 wrote to memory of 5652 2436 vcredist_x64.exe 111 PID 1372 wrote to memory of 4936 1372 vcredist_x64.exe 116 PID 4936 wrote to memory of 1928 4936 vcredist_x64.exe 117 PID 3508 wrote to memory of 2884 3508 Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp 119 PID 2884 wrote to memory of 3848 2884 VC_redist.x64.exe 120 PID 3848 wrote to memory of 5840 3848 VC_redist.x64.exe 121 PID 4076 wrote to memory of 2084 4076 VC_redist.x64.exe 125 PID 2084 wrote to memory of 1988 2084 VC_redist.x64.exe 126 PID 5840 wrote to memory of 3272 5840 VC_redist.x64.exe 127 PID 3272 wrote to memory of 2784 3272 VC_redist.x64.exe 128 PID 2784 wrote to memory of 4912 2784 VC_redist.x64.exe 129 PID 3508 wrote to memory of 4484 3508 Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp 130 PID 4484 wrote to memory of 4972 4484 VC_redist.x86.exe 131 PID 4972 wrote to memory of 6080 4972 VC_redist.x86.exe 132 PID 1988 wrote to memory of 4044 1988 VC_redist.x64.exe 135 PID 5756 wrote to memory of 5416 5756 VC_redist.x86.exe 137 PID 5416 wrote to memory of 5296 5416 VC_redist.x86.exe 138 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.exe"C:\Users\Admin\AppData\Local\Temp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\is-66S0RW1WX0.tmp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp"C:\Users\Admin\AppData\Local\Temp\is-66S0RW1WX0.tmp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp" /SL5="$6026C,571761725,892416,C:\Users\Admin\AppData\Local\Temp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\vcredist_x64.exe" /q /norestart3⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\vcredist_x64.exe" /q /norestart -burn.unelevated BurnPipe.{92DED4EF-B635-4DDC-AA49-DB5D6041E083} {86042384-1C5F-464C-B459-DA285558C6C2} 13724⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4344
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{BB8E3963-155F-4E77-A609-295200B0DFE8} {BF4838E8-D413-4E21-A302-70196CD5949A} 13724⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{BB8E3963-155F-4E77-A609-295200B0DFE8} {BF4838E8-D413-4E21-A302-70196CD5949A} 1372 -burn.unelevated BurnPipe.{B7978577-6451-4DDE-B41B-DEF23579FEE0} {B497438B-C803-4E6A-8448-EA5AC1A7B43B} 49365⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1928
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x64.exe" /q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\Temp\{9E2BC9EA-4D60-4524-8D0C-3EFFB208CD71}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{9E2BC9EA-4D60-4524-8D0C-3EFFB208CD71}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\.be\VC_redist.x64.exe"C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{AA705A34-AEFB-45F2-9528-09A212C0A7BA} {16216262-30CE-411C-B1A9-08BF1814FF57} 38485⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1036 -burn.embedded BurnPipe.{8FC9DE53-A1B2-48D0-92F2-72689AC7DDE0} {3AC3CF24-35D4-4AB4-B50B-30A646267CE4} 58406⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1036 -burn.embedded BurnPipe.{8FC9DE53-A1B2-48D0-92F2-72689AC7DDE0} {3AC3CF24-35D4-4AB4-B50B-30A646267CE4} 58407⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{45AC9565-E58E-4428-9AEF-8CCB5998BFDA} {0B74231A-EE1B-43A4-9164-569B6AA07D4F} 27848⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4912
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x86.exe" /q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\Temp\{D8D7D094-4AF9-4998-A844-311C14AB16A8}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{D8D7D094-4AF9-4998-A844-311C14AB16A8}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\.be\VC_redist.x86.exe"C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{3D33C7F8-29F0-4929-9781-EE5B19CA686F} {91FAED75-6731-4F7C-B553-554AAA216D84} 49725⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6080 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e4ccf1b-d073-4cfe-8a24-e86185719b56} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{FA9B616C-2B3E-4EC9-AE20-AC7BB833D3FD} {C5865AE9-0BFA-4BD4-9665-DB2B3E4EC806} 60806⤵PID:2272
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e4ccf1b-d073-4cfe-8a24-e86185719b56} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{FA9B616C-2B3E-4EC9-AE20-AC7BB833D3FD} {C5865AE9-0BFA-4BD4-9665-DB2B3E4EC806} 60807⤵PID:4924
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{31BF0139-935A-450D-BFE7-AA551071E772} {11A8EBDA-458C-4429-B7EE-42530F9DD2ED} 49248⤵PID:2384
-
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5500
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:4084
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe"C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe"C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155411.log"2⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe"C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155411.log" -burn.unelevated BurnPipe.{44178780-2882-498B-9EAD-16004F58339E} {A4CB8011-5636-4E4F-8372-45C8A44B7511} 24363⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5652
-
-
-
C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155433.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155433.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5E3039D4-8829-4D40-B15E-0755B9EF755C} {F09253E2-74BA-46F6-A148-952174D55F88} 19884⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4044
-
-
-
-
C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102155443.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102155443.log"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5296 -
C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{611FA2DC-CFC7-4C5E-B910-1BB995A2D223} {BB439A8E-3B64-4042-8D16-F354374429EB} 52964⤵PID:3780
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59e1af.rbs
- Size 18KB
- SHA256 54cd64bdf798a6a6be40bba9890d3b3601d0a49d3d7aa6194cd007a4e0f09a43
- MD5 e2c69b572cafff830debc2cc32cdcf3e
- SHA1 b01da42011241c7f2eaf25561ac3c151c199ae23
- SHA512 43ee4558f28b3836e3fddef3a99138c4df58b58b4db5661dab8d2db0006bbfc531ff088555ed72557d2585c4a7dd854374cbf5e3907087a392081a2a7a24da74
- SSDEEP 192:Q7JXuj2IYcwce84/OVPz2Rt6S5Rthew1x9AkIqx9AkdpFEXENNepJG:Q7tuj2IYcwo4iPzyFRn060ex
- TLSH T1EC8231426A00D2D3E8AB2B74DE172B283B75D6CAD351A39B05CD91304F537C92FAD64E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59e1b8.rbs
- Size 14KB
- SHA256 0c865887885e40da3b8cbb43f8995d5cf9c4f9261f7fca4cead3ac0ed1997a54
- MD5 b4f5fad5f241c07737e9ffe7da6e7b73
- SHA1 56ddfd0bf4ae0141c163047cac7f2646d9e4e0e7
- SHA512 6fb36ca19f5f838be566d49042c254d9d6ee72cc814a58976c0bd60968418cb3af682f45c80701661941f109a2034a7300706a90023127ba1018a4c7ad9103a1
- SSDEEP 384:TFJRFbX27RRFmX2tR5JjZNx6Y/pSuQ7fpqPfdf/v:TVMK45
- TLSH T1336221422B1681E2D8671731CA0B1BA93F66C7D59314834B059DDA344F577CABFCCA8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59e1be.rbf
- Size 3B
- SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
- MD5 21438ef4b9ad4fc266b6129a2f60de29
- SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
- SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
- MD5 SHA1 SHA512
- Path C:\Config.Msi\e59e1c2.rbs
- Size 27KB
- SHA256 89233bf8c04cb4e38e4f3cd46e8155087b9eaf8467805dee958743e471bbe863
- MD5 2a58e365e1de2572e9bec1b879fd6c5e
- SHA1 541998f88a168111167861b64dc4fb5d8de3ea8e
- SHA512 f80bb0b0d79fa56e32f8b390a18a7d39e85a2d0e6344eb8ca9a615cde153f6c541d55434ec67a17c396364badecf666822416e9c248e622e4bdacba2008a3eb7
- SSDEEP 384:TtT8MgXEtmrnb0MM0Iur1d3eu67wuGJwc71363B1XDcpe:TtT8MgXEtmrnb0MM0Iy2aqvR
- TLSH T121C23243A740D1D3C8A76B34ED5B1B657B31C6D657A4834B00DCE0784FA33D62F9AA8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59e1d4.rbs
- Size 22KB
- SHA256 44691c70dbc5ca66619d90efafaa5ba8a11e939470ad1178a6c8317307888ac4
- MD5 4a6cbec865ccdaa05a14b368441e6d71
- SHA1 a913eed5871b643fec7b40e786f529fc262fc7b0
- SHA512 190af4f211db9fd06e5693a45ef18dc7f39f212dae919925c342214ee0bcf5415f91f5743412cebb992d6a9714638dcd9ae0fe6263e3429e4798881cd687ce61
- SSDEEP 192:CwRtYeRMYsSZBa8vSZPTgARlpUPeFOrzj/5X3XNd8eXD+cXT/7:CwRtRRMNUZUPTgALpJFOrzjxXDEcj/7
- TLSH T1C6B2CD026A40C1E3CC6B2730E9571B793F32D6D58394878740EDD0B88EA77972F59A8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59e1e9.rbs
- Size 19KB
- SHA256 a246bd56416c4f7e3e4b5a9a73fe2e8d144f8968648fea8779e9ca83c0f1bc05
- MD5 ce834b50c457a261658fad3a177699c8
- SHA1 f9c5157d6be547a5f5e36cb66b0ea83a47dd0689
- SHA512 de56ee67465b9a765b66a619d5a478f6ba6f19f227bc9ccb06f55f03f05e5bffe5b0294beb6b31636679c137f029e30a4611a292fcd7dda38399c6c5427025dc
- SSDEEP 192:OhRH1kRa15dXcFUADIc1L+W+y4+agPuen7:OhRH6RaTeC81L/cKn7
- TLSH T19B920C426A80C9D2D8766B30CD671BA53B76DBD5A350438B50DC94308F93BCA2F9D68D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59e1f5.rbs
- Size 19KB
- SHA256 ea4f28eb82de50913836db11eb7e1ade3bce36f9d64d73843368b336bbe46bb5
- MD5 e2eddd792120e09142f68c967778d441
- SHA1 437f91df766f9279c30998802ad4364eea98a4fa
- SHA512 511156ab3c48851b75a23dd934e7702e7da32c70d980078039723608f3931875ece7b400d06350df8e9d224d8dc212cc79c136d212608b53fc5329ee145a3201
- SSDEEP 192:R2DAoBHRq+M3NinQv7SlstgC3ez2+dUI/+dUgg3ETLNfHOpM:RIAoBHRqF3NinQv7GQ+d/+dP5
- TLSH T1B992EC416A40C2A3DDA63B70DD5B1B193BB6D3D9D792434B42CC80748E837CA6FDE58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59e1fc.rbs
- Size 21KB
- SHA256 675c9c141a7fd2cd5c404c2efb7ebc2d96bd53d0707f92d3b2b539acde935df9
- MD5 40d050705a50216d7d859faf757c4917
- SHA1 06638e40e7a5f1a862a3b75d25d3674a91b72fec
- SHA512 f7104734dd91dd1390869caaf1b13af1b4fc8e676d5cccad521fa290b9864f23e2d1d337e46a94365dbff663933e50033276c8cac67464ce1db2b7477815268d
- SSDEEP 384:4PRIGRrnAKxNAUhUC7xJjrMNYPVIbS/GscX6m1ubwV9kP:4pRTAKhCsN
- TLSH T10CA21D03768099E3D86227B0DD671BA93B73D7D99350434B10ACD1388F673C72E5AA9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59e20b.rbs
- Size 21KB
- SHA256 229e31a7bd784609f14c9feef59e21a4c720eccc6ceb668dbe6ce9d092156d31
- MD5 31f4af27dc46b4dcf86b59c665a1c90e
- SHA1 7a065ea64d529dc69ec0bcdc7ad173be732653f8
- SHA512 27d29a137abfbedff954a9b5f61fac161ee14879e430e17b3f4cd161b22fd886ca0e1cd087391d786aaa464f5f1ea4c1f22dab8b6fdff30eb9e9497b8404bf7a
- SSDEEP 384:4S6tFYQxkA+pAv9jH4ryItsalckU72eC6AZj6UaU+Kw2sLV:4S6tFYQxkA+pAv9jayIhZeD9KwXLV
- TLSH T11EA2ED017A00D292E4AB2730CD971B247776C3D99361D78B80DDE1748F837D66FAD68A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59e212.rbs
- Size 16KB
- SHA256 9e933a785f43825f180a28dc16abc2ef71de9902eb6c0e80f2c069d30605a34d
- MD5 122da0b8e8812ccc09f5f14dfe956378
- SHA1 3e38c1e4e25ed39314b363b110d2da5deba7623b
- SHA512 c9098fa226fdce62fa0d389c6d90d0b9a90307ee13f840e20573978334fcdee97ff1203a81a7fbe276017bd5e74bafd908959d7301cde9b6980560bb255cf4c5
- SSDEEP 96:KeRp55RpSNPWT8RXeDd11xQo8RdeDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3Tjo:K/R61GRA1Hn4Xyin5f7U+nh18vTJty
- TLSH T11372FF42A54096C3E8A62B70DD57177037B7D7E5A344839B40DC92349F8B7D22F9E28E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59e217.rbs
- Size 18KB
- SHA256 98a0025245e4c66295a5d965921bf943f09b80ebe3a9f758ef912c6fb57a5c08
- MD5 e2ea7b7f1a6122f1dd2077973f625399
- SHA1 51ed6fb6f52e69df93ce8d9cab97d7c6387488e4
- SHA512 3dba03f0bcb152ce34bd2f391fb19fa54572650eee9ef81624bd45876da290612e7a168bda80284a9e02baeb9db2b98f1ec80e4986dae1f8034cc29a966d5f69
- SSDEEP 96:F9PRp0LWRpdJJNBdwNNNNNNNNNNpFobH4tnPV5zTRpP8Nkg9pRE4a+eeRptemANM:XbmDH1ce02GUIaGUSArjnyEmqUxOpO
- TLSH T18D92EA436A10C5E3E8EB6B71CA9B0B163B72D3E6C354634B44DCD1304F937C92E9965A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59e224.rbs
- Size 20KB
- SHA256 4ac80d7648254cba8a2c62666cfc1a82679bf7058621025d8b2fed555a75723b
- MD5 c45b3ba83f19ce9469df9200938afd47
- SHA1 b14f5d5f9dec48182afb3e875871862e2f11bb09
- SHA512 41bc3c8810d474d48e8b7c00df2dad9ae578a3e2789de174ab6223b41dce2e5f94d9e1a07662f14b9958e127fadca68c29b01288a2d5c8ff64a0d51ee6b1371f
- SSDEEP 384:E9RFglRBgFfXMawmn28I1S9HXVZFb3QsesOPWQJSCv2dYnhft:EzFgBifXMawmn28IA9HXVZFbgseseWQL
- TLSH T11BA2FF03B64495D3D8BA2B70DD671BA47B32CBE59361434B40DC94394F973C23E9A68E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59e233.rbs
- Size 19KB
- SHA256 088e4c3733cb8e1ec6985db7397a9fbce5140de3879cd8c4f6806a14074cb66c
- MD5 74502b62b0fe30da3d77a68f07c4d707
- SHA1 86f0dcb36ee03bf2e88cbc0f138676922a8c1e84
- SHA512 2d846e2842dc1af37efef0b36ebc2496ede1137ac9ed82dc7eec4619234d24c09621a159951a2efe003ac332c10b656cc224239686b1f41c046a235a1d2d7584
- SSDEEP 192:E8mBtwWk0Ve2SD4QsUh+/RrMWet29UI/9U5uD1jW5LsUErLrS7aOpsv:E8SVk0Ve2SD4QsUh+px9/9hRyQfS7O
- TLSH T18392CA427A00DA92D8A62B70DD971B253372D3DAD750538B02DCD1744F933C6AF9EA8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\AAFCOAPI.dll
- Size 3.3MB
- SHA256 1365ef3769c838f7f13e12f16051172b02f74529497e2abd3402cfbb9e62eef5
- MD5 440f316a8a679120c63e4cbd356f65a9
- SHA1 86e881b07273c99fb2b1db0e2d0cdecbf80e5a91
- SHA512 2b4bf8a0b398f553229d4c57c637088f4f8e1960b5357a98ba69bf694913fee03483b55fd7656bb73abcebe3d32a6bd942f3d3a2bda06714a540f7848cf3de2b
- SSDEEP 49152:QT0BnOG8mYCQ1eaxoUygZ4bLgwty1HwfbZ09IrSAUNC:UIl4Z4AwDfbfrx
- TLSH T1CBF53A0B7BB884E1D16A903CC9678B8DE6B234A24B7257CF1465433E9F2B7E54D39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\AjaVideoProperties.dll
- Size 35KB
- SHA256 95b30a3b6182e272e6496f9d1bb47b81b68b3babeb0e22c42c6488f58eb5df4f
- MD5 9836999fe319ed9b7583ebbc395da0bc
- SHA1 612d932309abeacb464a917661b8a972670d9b10
- SHA512 c2467c54a02ac0b5e8f0ee3124e3a6f818da0f535811bd7d6c0b18289ec84a93cd027e6df94832d0a5936525306ab006da81572849c91667e77f3484c65e6645
- SSDEEP 768:eK9QBaZOMqAIY/xMvoCpzv5GwwnMc+02y1Yibda5ALwu:AcOMavoPaty17R9
- TLSH T1A6F27D7EA7D41737F9AE8AB1BCF00013673631926B62D7CB5C8593858D42F861E4262F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\Boris FX Vegas Pro 2026 -- ShuttlePro v2.pref
- Size 11KB
- SHA256 0e2be754c0c9d890dbda0fd3c8ce5a051da12aee103df11dc912364932288e47
- MD5 d5d60dfe40096a6b1d44aa8e69da7d8e
- SHA1 942c1fc9213e12642402307a145b7806b1218bd8
- SHA512 f0573be92c54cc405a7ce8672fa325a7a3db9c4af481f5644f277bc67b60f0c068efc9a26a797e97012854d5033819d89a1e34f9d531f322263e969c80eb7c17
- SSDEEP 24:P666NvT6BoP2QMlssulEX+35uzg6fQiQuTAg4AVbYzOx:PA8lssulEOJuzjYluTz4ANS
- TLSH T14842849133E0005EF2BB59311DB257B85F22FD897A31F36D11915A07ACBDA4087A9392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\Boris FX Vegas Pro 2026 -- ShuttleXPress.pref
- Size 11KB
- SHA256 13658f29df766e4eff758bc827524cce547780c6d4c63d1dca86a1f3a270149f
- MD5 5a90724462bd9c5aa6b672821ca1c2e2
- SHA1 13f33badc369fb9eda41be444afa6d16079aef9d
- SHA512 cb1995171726650d8e7e150f8494fbf43c2d21f7cfb209802a23082ef2cc18d9b405768dceabda9850c19bfaf1bb2646c79cca841a733c2e7d2718718a9aa472
- SSDEEP 24:P66cZ4NvT6BoP2QMls1laklEJed2edLNuzg6fQiQuTHk4AL7CcuP:Ph8ls1laklEQRjuzjYluTE4AXTu
- TLSH T18342929137E1001EF1B71A311C7257B85F22FDDA7A72F36C1151190B6CB9E408B693A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\ColorGradingPanel.dll
- Size 456KB
- SHA256 dc1f22a6fdf2a9bfda1833a53a42033da5c0d334f8a77c19f44a56d4cf97be48
- MD5 c62ae571f1ed8571869abd3dde7b865d
- SHA1 1a527372444ff1a7d0adef385d8789a2d1aa9eb2
- SHA512 9f3b75d9a32b9074f344bfc4fe80034e9a2cc2489454d1a31b7883451ce486d6f24c75ed547d7a8f896a08bc0853283432f787c7852920b7afd882222cb2b3e5
- SSDEEP 6144:ujkHEiCH60vahLxOR3CsW9mMfozSKZxwsZGSsCK5mCK5h5RZc0s0u:ujkKzX3e8y
- TLSH T1B5A44C15A7BC4B99CEBF07BD505150808BB6618BD7CEDB9E5C942CFD7680381CA432AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\ControlLibrary.dll
- Size 38KB
- SHA256 6c94a9a546561f9b7862f8afbb3b45bbaacc8bb1084aa37771364e3248ca3db7
- MD5 02e3e6db83f93ce000920db99eb47e56
- SHA1 b54a403b67257f9b34dddc75cc4d9c02984fcfbc
- SHA512 041d268c13dba2d8e767096dced48f29205344492d64c456004eb37a3efcfc4fea45fcb0b49a544b75f6f5dd279c1036d1d940856bc5ddbad1ae23bf35f1e188
- SSDEEP 768:d1yHdEuHYsroyVvIPBtQeJavX5Si2f/pqKhcGiYib7+5ALj:AGuHYUowVGi7nV
- TLSH T11D037C2692A8E613D93E4DB4B850191147B0E2856A50EBE63DCC61CF8FF3B453B173A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\CoreGraphics.Native.dll
- Size 135KB
- SHA256 a531e254f8160c634049b6d9e1c55b1f7b4c9a156d4d31b5fa353e0771a537a2
- MD5 f8584af5422a08c36cc66ab2ab316edd
- SHA1 454bb0af469adcdb792d100b1f79592f400b3d3b
- SHA512 e9e5432da1fbf8d4e1a39d50071462a066d8815bdcb9094d413e610121ef5b8ad781cd8df53a885c6d8038d5af64c181e9485fa629f2039374f46601a3ccc5a4
- SSDEEP 3072:aFEc7NfU0UeV6/lOtVW5e6UA64Is4xhGcvXw:4EcRfUteKOTWND64IbXfY
- TLSH T152D36B62B2A1E5DED435947CA1ABB207BB7134180F2047EB8B9486146F97BD06FFB311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\CorePrimitives.dll
- Size 44KB
- SHA256 894173ea030a229cf31e5fd0d7e4ca22638a833e32998d7c119cda72f9256f9e
- MD5 92a28051df2d180e3b29cfac02ab529a
- SHA1 ebaaa4dd390ddbf83eec6bd06d2e54f9c8690e94
- SHA512 371cb23afc5900e7fd4ea3b7a54e9e65330be689e233d2421084e9267986802d545c64054fd4fd6848ae4a903d07e768cd16e2f870ccc70f5a12057ce7f3151e
- SSDEEP 768:woFwsxtrK726PQ0L6H5RF8X3zZd2Dk7xWyB9TILvqH0xtDE9TZ7Yiblz5ALN:NXwPQ0LeL8X3FldWyB9TI77xta77Ze
- TLSH T145239F0667E88F13C9EF5BB9B8F011155370E229AA13E3CB2D48A0F419A37C46B61777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\CoreUI.XmlSerializers.dll
- Size 309KB
- SHA256 86c140a6c47ede0bd023a5fa6dde886a8c098b11ff10c6ab70dea1b5e9058096
- MD5 b04774348c6c452ee3eff09c91970978
- SHA1 736765510cfe4122b5c5f1fa39bfb690dfcc5e5e
- SHA512 4be46fe9e657a9980eaa6785dbf922b5b1eec45662f6e01a1bd51c10a59bc502d818e353d6f4c7330a4fb4302236fd607ce2fbdd74a39eeb890ff4a19ff6efcf
- SSDEEP 3072:DcZn4FnoA5d/tAonhEYXTe6SRUuHcnA6BuXdCihv5utXdCihC7LdXdCih+dBXdCL:64ftGSf4XTPiZgqGDI9LdKBGWv5
- TLSH T13764FD00B2F63E19D17F1B725B7022E086B65C179056FAAC0F9805ADE6E4349E583BDF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\CoreUI.dll
- Size 119KB
- SHA256 16c671392d1934be7927489c417b87bdc469196e617e875752ef4611ade23b2b
- MD5 c24fc6b9dc002684e994fa7af6be79e8
- SHA1 d98c90f468965bdc281b8426432ad7464db54bf1
- SHA512 f0cd87069691213ea1210a6b94aff53fdecd1e399cd12d81419a8654ad41e216daeb409c61e2971eb49a0ea1f4da9e355ed06365edc9586dd394b05c2555420e
- SSDEEP 3072:b1OK4Z1qtOgsef1MWV/CSVWx2kO83SFIaK1E:boK4ngsICMWx223eIaT
- TLSH T18FC34C25B7DC8E5BCA6E8139F07045018374E252B243DB8B3D8C65B69B933926A137E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\DecklinkVideoProperties.dll
- Size 31KB
- SHA256 9d99d038f723f23e81b37d39024ea3bde50a5845413bfc6085d90668a5d2f484
- MD5 c71edc23aa4a0496563886064136c427
- SHA1 ec07854d9220bd17b3752405b2fa9abb664f5d14
- SHA512 8d1e9f39a5edbf4dae3d6fe224119ff1fdd8c199e60c3f169e532e277d9bb2088c1f83c02a93383ae94f34de90f3bbaa15d59d67653d48cc0c1ad646783d5bcd
- SSDEEP 768:91ARO2kwdDtvd8HTwwT2fevcJ0wnYibk5ALb:HFiv69sYcvn73
- TLSH T14DE27DBE97E8661BFEAB8AF1BDF010336A3471C2A952D5CA5C4093494E507422F6127F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\DetailedRenderLibrary.dll
- Size 54KB
- SHA256 eaf4143c889dad0a3acbaef0d9eb1e5e0ded44ce43b5831e326ad9e348e79c42
- MD5 95ee184da29573553a9e0509afc0a117
- SHA1 234fb298814b14c27aea61fba46f9b87394a9b0d
- SHA512 ff6b3b50c96fac372ae5f2c44dcd5846fd0dd7dcf3ac6ee490fa60cec7f04a01b17a2c68976a1d8ea367dff30177dbd0e73472960d257d09762148d0b7f17077
- SSDEEP 768:6LdU39CgVe9iqc1340av2xxZho0obPbO72iV/dr+q2qsuH6QYibDe5ALgy:6hUlbZZ+tPbO72w/drDbaQ7Ky
- TLSH T18E438E14A3ED5A13C9FF0BB6647595284B716122BF91EBD958D050CE3FDB381820ABB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\DirectML.dll
- Size 17.7MB
- SHA256 9c9e6d822561c6c41b90e6994b3e8857cf1d66dbfb1e0c4c799c7c89b4e92da1
- MD5 abc458767c27ab4691e8910714d47ed6
- SHA1 a9cdf72540b949520045ef11d7b44879e2181c79
- SHA512 97af8aef5fbd25e87012351d93129e8a0a64a96569c4f8f458d5389f1ffc49239f6a14d9bc99f8b0a41e915ef12ee1fd781e391fae67f9774c08311b49005131
- SSDEEP 196608:/AZfeTLx3Ohq0Ytzn7OBdzIkRnyrQAH5+sM3TKC:K80hMtz7oZIkByrQo5QTH
- TLSH T18A17D01A6F6415A6C17BD23D9A534A43E3B6748A43706AE706F80D311F97BE05B3F382
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\EULA
- Size 23KB
- SHA256 d77e7c0aaeedc52ba95d200189395be99bda5a256027bfaeee8ba928a9e746d4
- MD5 374bf9b9a12ec63665897196cf02cd4c
- SHA1 e5b94b74f271082bcbbdce36403da921f3974572
- SHA512 f0d62e33cd2e3e76463af972abc9d5c81f958029f32d243f0188f88df5df98a408b5f12b2af9ac757e42a57c72b062c57c32d0f8645649f6a4c806b6923007b4
- SSDEEP 384:OGFsGQaT8pKvGSa76CmboE79JKqvfkROOYHRx5ESnOcHrwvJMmgEzsulyky8L3IJ:OHQ8MGSSmboEjfkOOYxx5ESnOcLwvJMJ
- TLSH T15DB2F86736D41396039F033167426ED7C33E80A9756EEF50D0AAD1462361CBCA2B6AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\ErrorReport.dll
- Size 61KB
- SHA256 2216e747823d1b8d5e3aaf7a8e88a0a9b9e80ee7a6d58f89b56b922676538a2e
- MD5 07a77d6a51a4854ed9b1186165aee256
- SHA1 ce9189aad89df6349735db53fba94d11e802cfbf
- SHA512 1e44fb32cf30a518eb6c1da1910a03dec7d2ae35ff373b7305154b5e205d3d0d27d2b0be61d8a30c92c81dfc327f83a3edba92cbf36ddf03c751810507d24920
- SSDEEP 768:PLTPGnllIImIUcGLrAgLuloOwWUDZhLkZy+TfT09NZx9h3nYibf5AL1:PLDGlGImIwL3u/IDZhLk/TfT09dn3n7I
- TLSH T13C536D57ABA400ACE46AC7BAC9E69D12F77234490B6197CF035082161F737D0AD7A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\ErrorReportClient.exe
- Size 1.3MB
- SHA256 a436f6dd6697913cdc6962d5d377c4f0edf9b5ddc9a9cbcd08d4881c5dc86bbc
- MD5 4f6d3c0716109370c8f46cd2331bd6c3
- SHA1 f3630d17ed3b0dfc4281df103c13c54598ec0873
- SHA512 9d460f0f095692c4bd2400180e5bbcbcd08d236d9fe2122e3a1a1883861b5cfd90ad13757586911f712bfc8954abdff127e44a403e228fe4db89b7a7f2737df4
- SSDEEP 24576:HKde87CU7kiGugXAVkkqwQJLlUvFUnzfVkSIRQzd9mzAgWuJcPGdltlj:HKdJ7L73GugXAVkkqwQJLlUvFUnztIRb
- TLSH T1BC55590677F842D4F1B7923898B28216A672BC519B31D7DF16905B5E2F33AC18E39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\ErrorReportConfig.xml
- Size 1KB
- SHA256 ce6a598f3ef0514eccc17b054aa057bae7952c8c572cbece34dca4cf8815a0b1
- MD5 2bb3f8201b2536c337b947fb83aceac3
- SHA1 a29610fe0be07e393f30eda26d18b508e518c5d3
- SHA512 ea83bd9df05a04807946a900c6db3d7764ad8542caf9cb05e2e799f44cb53cac0a8479a3e9420c7238af00d84a99ae87369cc94362f52120089bf2ea04433b6e
- TLSH T1CB315C2046EC5553423303FAE970A418EF2BDA6341D60C29B28D57CF3FB655686DBA51
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\FileIOProxyStubx64.dll
- Size 52KB
- SHA256 9f9d6bb5d179a001cbb613ed5864b67e7ba49f76a6dc5c60bfbd4a5fc55410f2
- MD5 6689ceab1ba6a82b752e845ada16aabd
- SHA1 6d378fdca44b3dbd391f9dd8b6d7c2042d9e0bb4
- SHA512 a8a2c6316e65adea44f93171b646bf6e7a53a071c427e4ed3678a649b93c3274f695e2ef52dde1a87d8ea43450c3daa94f8ce30cd5c7658e5681ec913de88ce5
- SSDEEP 384:lZSB99hTSWXUaVii0L783pC3b/xAXQvvlO1yNc78PJM7VXOAcAsnxJQsLA/dslY8:l09qWEuImHJZ8T2OX2oOJbXYibZ5ALm8
- TLSH T19F33C548B95448B7C8EAA43154933E209679ED50AFD243CF2198722D8EB3385EF767DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\GPCHolder.dll
- Size 16KB
- SHA256 d9c22501ff62a9624bbce86b9a01e4d9de0623e847ea2a1a882f7195c1600a42
- MD5 acef164e4ea9acfc80fab7cd4df4d690
- SHA1 140295f2e61f80b94b58984bd18cf44f1df8402b
- SHA512 762fada878287e38c1ca49a05e5537b689eb44f7ae743b528b23f5fa1cfca70d7f02c0f5f38700289f583d72c01cc6b3c3f9dcda35bbf4a1965f4847f789005a
- SSDEEP 384:2lqEPWaO9wsNIYibo0/y8RbmL4nNyvm/t:bOsaYibR5ALst
- TLSH T1B6726D6386E05913DC6F5E30B8D0A532BFB1BB918DC1C7D73198C1459B123855FEA3AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\GPCLibrary.dll
- Size 64KB
- SHA256 abf0f752edbe24a1f7f69955714959df5765a47e460ba946319275d25f79db84
- MD5 e4fe60685da74c7c3ea57ecec62b3565
- SHA1 9f532387a5f693c9c5ef23ca352b24eedfb7c667
- SHA512 84c9bf8a7a86245851b0e552e123b24008972708da0024c0fa4bb776e055559857475c32f328d96b38f6fc8d980ccbf147f8ad9d9f7a13de93f3237662404572
- SSDEEP 1536:KmAqHHqakdt39nVxizkxCDN9rQGlGyRn9nBHZBA3j8vlrsD7dZ:KmAEHe9nyz7/NOhZ
- TLSH T17D536C0432A80B27C9BB4BB965F5C005DB306B237791DB9C2DCE68CD5D82B414A53BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\Google.Protobuf.dll
- Size 424KB
- SHA256 5e12cb98aaabeb5bad0944bbdef9882632fac720601e4db41f4c4e5c84f85cef
- MD5 3afffd8ea0846c25d637eff3023ad79d
- SHA1 69f9ec780788f5e8b30c7c60c12c1ee529e74a1c
- SHA512 b4c481eaaec65f86d54bb8d39cb327b8dc26371c9da38063c2bbbb856d9eb59035fb9de903c305890b6a15f24f85d845858343a3a01fa4288c54b5418c5f8598
- SSDEEP 6144:is4mDEbeeBQDF77FlqswTu/ToiGsdypmbGUdsBmedbfCLXinm7zBufgqbB/s0SD:NzleBQp77FGpmMmmOL++Vb
- TLSH T15F9449106AFC5A24E6BF7732F8F0586446F6E413719DEB6E6940B7FA8C43741A880277
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\Grpc.Core.Api.dll
- Size 58KB
- SHA256 d13ba6360fa73140cda545afab6f21d6576475f9644cd153c182dde6aede8f80
- MD5 2fce7cf52f2cef8d660a4dda509f2eed
- SHA1 9585cbf4e077087a878111eedf9621707d252c54
- SHA512 c58788087b5514b4b13fe89fdf6a6dfd5f909ca1ca8067620b10b63e3be420f369f97bcfb3672439b3a5339dd4587b1143d7d507de38a1680fb47cb503c329b3
- SSDEEP 1536:5iI8m/ZUzZeXt+0O/QLHEhq6S+WqVs5w8yDYGtZQN7uPxic:5WICM7OdFVs5zyDYGtyN+xic
- TLSH T15F434B25C3DC4A3BDFAF46F8F89421651771F7147883E3AB154CA0E91993B94CBA432A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\Grpc.Core.dll
- Size 474KB
- SHA256 aa99e6ad71c01997c154be1f0f6e5402266f787422cf67d66c5d59f63d26131f
- MD5 6155b91228d88a0cfff0e8f32942e772
- SHA1 b855c00124ff8048dd278f3ada5a3392576aa5d6
- SHA512 4e6a0c07c09845072ebe16aa7087b572358800e6ff1691b2a2e6f56c60ebddb29eb9cdd4412dc78a8b9738e2d14b76b6c72373dbc7cd444b972e6320a818a728
- SSDEEP 6144:VrJLcdXl5xFcQyCmnMENW1H/M8f9Z5mNplX4XmRrcMFADwYCuMsligT/Q5MSg:VrJLcd15XafWN/vZ4NLqmRrctb65MB
- TLSH T168A4AFC40B990D41E46FA2BAD5231302CEF4E157E5F7F3DA0ADB50DDE1137029AA879A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\HardwareDetection.dll
- Size 29KB
- SHA256 30eb2e83c9cf3a46a596154fda6bbd5f5f46350d8875f24bfe05d1270e2e2768
- MD5 fd97b958a01d2093950b0e64b1faa3a0
- SHA1 e3d4a29845a61aec2853b9a9f2f5b7273d18912b
- SHA512 441f7fe65cbcdfe62e7cc7edb524fbec95cb99fcfe70d230a4fa9c39d5d89a74844ee4d98e8c5f308cd0cc97369996dbaf0895b742d572f37cbea80b5f545e66
- SSDEEP 384:6YD4fpULl4W9ywae5TOvapuHixrf5ReXeixrf5ReQCjW2V8IYibz171y8RbmL4ne:IfpULPqvac0eO0eQCjJVtYibzP5ALH5
- TLSH T1E4D25C124BBC442ADC6F0F3975B660250A327AC6BD91C7DEA294918E5F733860E437E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\Interop.dll
- Size 29KB
- SHA256 e55079e907bc80db8a6345df9539119b38f5a4c0b8aae148c2d9a0d285a4aa56
- MD5 bb6741ae188444d6850f3001ea6f777d
- SHA1 44bf3f5896b0b50878b25fe22cb8af0fc1f2b931
- SHA512 6e00fbb69e7b61cfaa9fc79ad0bcbb20c7d63553b358f7b4b3a82b6a675c6a9d9daba7880880d4060edeedbcbd5c8c0b989089e01101408cc7c8ba00489b6343
- SSDEEP 768:3vJjNLGPzGeBo7R0HQ7jTb+jnH8aaYibR5ALfl:/JjNLGgR7baH8aa7+
- TLSH T14DD27C1BAF90D907CC6F69B0BCE407645B71D3569643D7C72E9C90DA4AC33901F493AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\activate.cmd
- Size 245B
- SHA256 60b256135c51b54e931bfcfdaabe694825d9904e62e87bb48d96c13aac233f30
- MD5 cca7a40b7a039ceba0b11a41abcf03b9
- SHA1 80ebe4d0f2e5f55256d7a84110daf5c7c3fc8b57
- SHA512 e90670167bc97a083ffa6614075973f48b2a31e975b527fdbcc4befaec3630e1685eb9bdb510d5806d848b862588b38d9e8a35ab5dc44826193d6ec687fef006
- TLSH T12AD0950CF57BC6DB1A8500F23985204F753370C3501958DEA0658074167F10413E40C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\atlantic.dll
- Size 240KB
- SHA256 d1918c117a149d5e7858a8285155209114062c0e5a261a121b733a217a6fe626
- MD5 492a5dc6c48ee32bec7d9136fe9d6694
- SHA1 9ecf609b9c8c566c22ed14f4799286a52400534e
- SHA512 d655bf96364c526158f7036c913ef6fea78091fae93061a7ff4a64cc37e49f2bfbee29d2e3ec79c5f79b6abe336f4dc9510a801997bbb80210cde618b75d6400
- SSDEEP 6144:H97qbEhHY86RAKvk9BiKQg11Vkp+OlyHkg/OcKQMo/ER:hqbEh486GKvk9BiKQg11SHlOkl
- TLSH T19534D53972811961DCAAA27885E35D56A9F338101735B6CBD312021ECF3F7CCABBE594
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_scan_server_vst2.exe
- Size 1.7MB
- SHA256 67d138ed05ec88bf432158e1b0dbf267da83fb700f90e775dffdfe6934a6c1f7
- MD5 1ebaedba104e2b2aa9678b942ae97c76
- SHA1 a4704b463c098740dbcd9ccf6df3d681c759fd99
- SHA512 32b6e75bd12a7c28f189918cfc631432e8a4ad5ad587c7921da56c515955cae8d57d26e8034eb0bee777cca828dfab996e82cd5ec15a49b14954ff25dcf55b7a
- SSDEEP 49152:NEThqv0ubUEiFnzDpBrmTrBBBUWBiBBXkHtY:IhQidfpOBBBUWBiBBn
- TLSH T15D858C31750AC17AC5C002B1992DBBEF95B8DF290B7A00C793D02E6E9D785C32F7A55A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_scan_server_vst2_x64.exe
- Size 1.9MB
- SHA256 b1b43d3becac0fca17543cd05ab0eec45e9be8f7120ffb18612eee8310a0688f
- MD5 4ebf019004e485a313ca6b43b6d7b1c8
- SHA1 7ed835bbf63a63ff85af668bea58ea46e65681f7
- SHA512 811f56d1c603e7fe62f762a778eb4a2b59dcd023e16a6bce00318d5f22d9897f7a116bcc6020166b7ef452648657c62ab434014e78f77044635a360f568b8b25
- SSDEEP 24576:h2g9f8fdaiszAP9v8YL0BUAT4PhADujCYGTpFBBBU2B+BBfMnbbZkBJ:hFMdRsU1vs14ZyHTjBBBU2B+BBFv
- TLSH T111959D4772B850E8D17AC03D8642D51FE6B1780507A0DBDB1AE187AA2F27FE14F7A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_scan_server_vst3.exe
- Size 1.7MB
- SHA256 c204fb4dcc7c9f6788ae6e639363493271236088aef51f7424b7a744d2481532
- MD5 1182b428e821a4da7a0abf748703241b
- SHA1 d2b9eab08d13f16c685521a227bd884c6eecda45
- SHA512 8a8e22fc0d0eefa5f8126772455edaa25d1cb74cbe41a60857119edf81f35157a4fb44bca1c88ee89e025dcfc9e5db3a96d518c15fa4ed3beebfd8d92fb0785b
- SSDEEP 49152:3EThqv0ubUEiFnzDpBrmTrBBBUWBiBBXkHtM:ChQidfpOBBBUWBiBBX
- TLSH T1F4858C31750AC17AC5C002B1992DBBEF95B8DF290B7A00C793D02E6E9D785C32F7A55A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_scan_server_vst3_x64.exe
- Size 1.9MB
- SHA256 4b5b810768dcebbdf34d8029462a841f602d25cb1254da2e061f856a6d4bff2c
- MD5 1922c92ec1f80f1baa533e661c273194
- SHA1 b25f45d980cece4fc0c821f12639d4b24c2f27c5
- SHA512 1760247234d7dd56f7a096aa2e5616c20310505b7a6bc9d2f556bb9adec438d6f3db82f5e37701261784bfb5836efce0defcba7494477637af871b5a47b8921a
- SSDEEP 24576:S2g9f8fdaiszAP9v8YL0BUAT4PhADujCYGTpFBBBU2B+BBfMnbbZkBO:SFMdRsU1vs14ZyHTjBBBU2B+BBFY
- TLSH T1F3959D4772B850E8D17AC03D8642D51FE6B1780507A0DBDB1AE187AA2F27FE14F7A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_server.exe
- Size 1.9MB
- SHA256 5f6bd53041ba58e19a45baa8ccd6485b4c10c375c88605abcfc2cbeee7c9cc68
- MD5 1b91af627f5ef1c7bf354a1fd55d7c13
- SHA1 4773c897daecfa49daa16c915c3b7ba3cf5e7313
- SHA512 38f85af22302ceb647327e5c64636690da8fa439b6db72bf03e3a8fed620bb8afd54dd401c99cc42939620b029f6f6e77ceb63e3ceacfd24c4a998c27b12e466
- SSDEEP 49152:1S4GYfyMOztXqW6QmLyTvFTtBBBBBBBB2h2lg6nDSEj:1S4LfM6dLyTvPBBBBBBBB2h2lg6Tj
- TLSH T1E5959E30B706C275D98002B2E52D7EBF51289F290B2556CB93D46E7E5D78CC32B3B64A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\audio_plugin_server_x64.exe
- Size 2.2MB
- SHA256 2a97715394efa3968f824942554063beb70cef0f95ed1ebbc6c7d1484d4af1ef
- MD5 f4e822226ea5855a6fd0aac253b2a33b
- SHA1 42d6127c266e4b992aa2899ad85c15ff73e318e9
- SHA512 653e744b48273fdf90ef5e7ed2107cf4348028abcefb02e93f6ebe352a0518e689f38ecf01c7d3b9cbbafb00f7baf2cd9225ab03c892030278dd081309a6ce4a
- SSDEEP 49152:4dV+yrNB06SE6DC2wZkJBMTMBBBBBBBByh2l4PdkBcfd06OqV:x6Z6nBBBBBBBByh2l4KBcfd0M
- TLSH T1A6B59D4BB2B901D4D1AAC07C8642951BE67278050768DBDF16908B9E6F73AE24FFF350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\crashpad_handler.exe
- Size 668KB
- SHA256 2cb00ff129cb4a77b80211836c2ce1f618694c03ea41843d25138f2d4bbe83e2
- MD5 cbb46e45dfffa49f9465462bd846ffb3
- SHA1 d08f4a1f4f7b961363e29aff4f62fc61c26d0aac
- SHA512 0656384ed3bbf50fdb7b05e5c16992ba10d2c88e0e33d281afa12925fb1212e6bb0a1b3797eb3dd3cea641c97c3da2d7e94d5fbdf245f96438e5657d9ede5477
- SSDEEP 12288:9o7DY/MMlN/E0gDXL2B77YTnO1L2xwBhjuJd8jha+TRj3I:9AY/MMlN/E0gbL2B77YTnO1L2xwBhjul
- TLSH T145E43A2A736810BDD1B7C1BADB82C943F7B2340B43B15AEB169587521F17AD84F39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\crashpad_wer.dll
- Size 23KB
- SHA256 8ce09a8d96d1309c805ba8c6b163dfbdc31d3226942c86e7f1a80790c1f2051a
- MD5 984b8901366413e98aae5e57821bde81
- SHA1 fcfb5f69f6c7f2c864488c869d407d82f10a238f
- SHA512 df262627b1db6b378e044976833eff873a74fe4e115cce6cefde6300d756e72b8b26687b13eaa81cf04e3b2b6205a02f5277be5c75a75ce3ef0c6a1ab282a883
- SSDEEP 384:vWuejiJrDrMtbIGYBc74yKW6FIYib3ZJHy8RbmL4nNyLZOE:vtemPQtbIbBS4yNPYib3j5AL6E
- TLSH T191B28E83D4A00C95E85BC970E4A38A26DDB6B6111BA1D7CF2324C1091F623C177BF6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\deactivate.cmd
- Size 172B
- SHA256 8a12c36a999078412a276cb58078dbd9c73ebb7642c4e3fe02c2458555bddab6
- MD5 65844def639c60f1dd93460d13aafe85
- SHA1 dd43ddb3067e150db8c683317ad843b822b77fee
- SHA512 7ec07adb704ef9eb7e0b6115f1fed0faa8951b84d3215399232a1f203f4ca0f2d524963a29097004f7a619f56f3cf7b89d534cb0b5552e6f7a1bccd8e081c6a4
- TLSH T185C0800DF57785E11F4E04F3744B204F690372C6C11699456446C43051FF54413F5053
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\discdrv.dll
- Size 227KB
- SHA256 9ba02f24fa1458c5b4a865f0278b457c54fafe4cdec5d28a773107f4af23a49b
- MD5 f1b3141e116d6ada35fb41a80c81c88f
- SHA1 e2d8d26af9fc96038dd84e82fb7da3bcedf10275
- SHA512 2b976129efd81aaeb20bf2cc5e392ea16ad3bfd27b764acee599e2a086ed0493a74616cac93e9bf52e306716a76203c59cf3ed066670254d46a6e8a45d4e2296
- SSDEEP 3072:D63us2pBfXlwwGTaB4S1fjthAYVkOb5OkuZV4DEwUBvdEHpfw0N6XVPwslt8Shyj:wd2oukmOkuZuDEwU7DVPwM8S4F
- TLSH T195342B1263FC5609F6F3BB395BB516858A3ABC51AB39C68F0255055E0E31FA08E71B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\gahelper_rel_u_dynMFC_x64_vc16.dll
- Size 264KB
- SHA256 984faa18f9dd57995b7bb53de1f6f693a4e6baf7d7c2b0ae10576c09378b5838
- MD5 db1cc0578e79e945c9a9bb6a85d162e7
- SHA1 222d04c1d3b161effcad500b284b8b242a6e744f
- SHA512 61a2a99bafeaf02e37b2276e987f7542336b930d2f227f3820982325b1131f78488ac1c7202944853b32a0ab4855f3f32a8988ffba8654f1e3cecf3cde5d1419
- SSDEEP 6144:1F7zPgPy1x5jzuTQdOmvjDtXSJJZuJGP0nuiI1v0AccBlo/:1F7UUpuTQdTvjDtAJZX0u30si/
- TLSH T1BF44296B62580EB4F5A7C2BD86C7CD01D6737C455321DAEF13A18A2A0F37AE1BE35610
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\grpc_csharp_ext.x64.dll
- Size 8.1MB
- SHA256 0634411fb4e04ab89e90f2b1418d4baa0c78736ce12793d184a8a3bce045f133
- MD5 829658d46a3a480756e8f9a6ce85d16c
- SHA1 7135799092e9109201d26bde4e9b7a294fd287c0
- SHA512 c64e226dc405d923bad567a2fa18d094624577c45d21eaa3697864b034021c92a40de9147ea40c837ca8343b488ec048ba94cb71e0310a6cb09a13b0b4b3b821
- SSDEEP 49152:Mir5riCvroZBNvr0lqrOmw0Xcww1V8WYf+6MS3aY8wd8uBV4iNSGnl64uRR1b8/P:T90rvru1gfhuxb58gzjuq8/bx7z
- TLSH T170863B6E56A80485E1BAD16DC7CBD91BE6F2340907326ACF48A6435E1F63EFD44BD230
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\BorisFX\Vegas Pro 2026\install.cfg
- Size 204B
- SHA256 bf45a35670e1275273af17bbe2e9a7abe3630299dd763e7a02d8d643f0e4e553
- MD5 fffd7102400431a788f0aca5acd07f9a
- SHA1 8402bf8a6ba16d10760cb3fce6a9a4b22909d25c
- SHA512 2da26f78b33ebe6c1d099e619dbd6cf46e953feecddbb2f0a5da1b8e688aac12b3155a98d5cb62f907548a8f9ef2ca3e149a514adff0155e621f36fdd4295db2
- TLSH T134D0221A16A0A3BD67323107CD6A00421003986B8509D8102181BCCDA6E2881756A97B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\state.rsm
- Size 740B
- SHA256 666d8042fd0e167eec349b05f4c3329c821d681276ced33a307fd01a83f2072a
- MD5 35e37541cf303ec899d942b64def8c81
- SHA1 6bd66f2af6e4f0a7c4f65045cabe170b74eebcf8
- SHA512 f1bd5317f73ed1286c35b066347aa7da66da916193317e9ed7346863a4f75eca2d3c78035d68dd8993951361cc878a78d77bfeab983900f26012daa40a0b1108
- TLSH T18B01A0615FEA9009E3BBAB7169F5065429AAB4126D31D11E4142328BCF32A80DD64B16
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
- Size 455KB
- SHA256 102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6
- MD5 3284088a2d414d65e865004fdb641936
- SHA1 7f3e9180d9025fc14c8a7868b763b0c3e7a900b4
- SHA512 6786fb431addf05df256d0e1383501f96356aa78f66482db9772c58334aead59838abb7db0ea793d4a17627a357598266681c28328485489a21bc2985e751b62
- SSDEEP 6144:9qIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi/6xLdowQguVC+:9qIOkU8AMXE9B7PElZlP41v6ro4n+
- TLSH T13BA45D31A6A04037D6F106B3F914D6307E7DA2187B1184ABD394AE2D7AB8597A7F7303
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\state.rsm
- Size 976B
- SHA256 ffa1605004abe7e765aa3c0c555e95117536cd98b56af3cb26147801acc93048
- MD5 0c36cea2336c9879e38b00c9cdde2d2f
- SHA1 4f65e1dae04472f68db097d4a27efe6426d255d8
- SHA512 b67867f9b46e4d7fb0ea869b1c3b8b4d1fc71629c7672b931448f7591c7a66c1308b66b93a5d435979c6be6dc01b97a9523f2ef2b60114386b7223244db6f4fb
- TLSH T18F11F420AFFA5119F3F76B707EF6065429BEB4216D22D01D0001618ACF32B80CD74B26
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\state.rsm
- Size 980B
- SHA256 4676d549d0ee3f19ace0016a7dced7030888d33e49d3836fe60209280a8a47be
- MD5 f1177255edbe62d7cdf085fdc5a8fdcd
- SHA1 e59506adc7df473a4b2c5e188243e60d0a4acc63
- SHA512 bdc477e8016ab2bfc20fd51fc31f61df119d9b148b252be4b91db289e8f9e51a73d8648d785dd3df1d980d1c9090a937da41e5696ec2dbc787d323547dced4f8
- TLSH T19E11F420AFFA9119F3FB6B703DF5065419BEB4216D22D11D0041618ACF32B80CD64B26
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155411_000_vcRuntimeMinimum_x64.log
- Size 2KB
- SHA256 d3abed4e2fde8ea8320ed643a8344fb6931d1254f610ea54e088b3cfc8f8c861
- MD5 abf5bb0b267585aa8e07f1bc512980e4
- SHA1 ed8af5f8b10211496f1b87b6483777fb43b9b77c
- SHA512 eddba9dcff035b1d5f9bc003a1099fccb6cf75b4414b7536494946319d16e5d9e3287bc3b6a0761d9784d34a387752c39297b67be23ec36374ba8c8351370031
- TLSH T16D4129561AF84D06F2F6A787EEF3C0519E73FCE56834878C2286821A4566C046C7C7AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155411_001_vcRuntimeAdditional_x64.log
- Size 2KB
- SHA256 0717cba08c12931f1e50924778b4aa140235885b3ba3a3c3de6beee2982099d0
- MD5 d5185187ab1d9445b806fda3b277da62
- SHA1 64f64506446956aed12cea58477c2dc6f2373dd8
- SHA512 8add3049ee40670a8db669e83c29b9709a319a56b6d85a913fd9fdd9e9a876972e457bd1b30c6f103eee8d51eaddbd0d5c49249e446e66c198fbb799dc3f5ba0
- TLSH T11641F5661AE54E05F2F7A647DEF3C1128E37FDD1A8348B4C239682194967D006C6C7AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155433.log
- Size 12KB
- SHA256 7be1eb70dab529b40655f423e68ff9415f1509bb190e5592146220a987098529
- MD5 2daf497d00fbda6aac644d00a2d22a6a
- SHA1 43478220d0960d5c2f28e06424757473999f5e99
- SHA512 24a516550ab07bd89ef199efe9d105cb8580440bf6cad6e4abf0fbc23e13eba4f39d779d49c23e76f9634c7bf10e55ded82d043a6af02045670b41fa8e40bd48
- SSDEEP 192:AZjotbF1tUrHO5ODpOZzjNjgIaObQeaO+NOlOPwOPXA/bWTUKOcOes:AZjotbF14esGzhsrw0VN6LyA/byUKf1s
- TLSH T19E4241C527C69AF53D94F39AB8745BA89A6128542B4020EC7BDDC74F0202CBAD3F96C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155433_000_vcRuntimeMinimum_x64.log
- Size 2KB
- SHA256 f11cda652c148c948d9402548aa256bf50a9214f682a25c5ffdce1a6fc3f0d96
- MD5 1b0f0cdbabcc6087d8bb02a7daf0e444
- SHA1 ba8ffc3ae8fb7052fe61cabc3c2c7faa52654605
- SHA512 5af337c23463bc2a95d70b9c010b77babddef426ee09f57aee423e93a3bd8cafae720f45ae40e7870ddd1c73895bde011f7b79961af797144d23b4d6de509dc7
- TLSH T1D24118151ED80C4AF3B756479EF3C0529A73FCD26935DF8C2395421A06ABD046C6CB6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102155433_001_vcRuntimeAdditional_x64.log
- Size 2KB
- SHA256 737cdc2385ec9df95f2aaab1c4274dcef7b6310ac9165b2a0a486ecfae9d3432
- MD5 41fc8e65039b139fc3861d4b362bc035
- SHA1 9e69454ee04cf19771046f2fda868beb107e3dd6
- SHA512 d67a657dc528a33cfeafcf035a26241f00ff5a818499c1a21c7163e9f2a2c485172fe7e1cde08c724ce4d2077dd7226dd8fa8ccfaeb1a332238b0df0659936f4
- TLSH T19B41E7601AF8484AF2B757479FF3C1528A73FDC668348B4D2285821A166BD045CACB7E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102155443.log
- Size 11KB
- SHA256 d8ae4e286af79c044e8ca59e1cf2e77a298e142937324f5aa1c604c27094483f
- MD5 91a0f619b09bdb579b144b035731e73d
- SHA1 16990cfd2d10a713a13534bc1018647ee4ba72a2
- SHA512 d1858e8e7d697e73d2f39d1da46463a24868876448893bee63da0f639775fce5ca12a601f90d8e7304dbfd878a14eb00714623e94d9c11b51ba09c4ddb7b0fde
- SSDEEP 96:0Mj1ZbeWDD2KLYt3qLDLHbkbab9bh5vKmjcu9/oJgRXIlI7Y76AeQZQYQZ9NCMCG:bhn8axh5feW2Ize9d0UnITcitd
- TLSH T1F63247817FCEA9B12DD4E1EAA87418B8DB6468541A4C79FCA7E9C75C0205CACEB8D340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102155443_000_vcRuntimeMinimum_x86.log
- Size 3KB
- SHA256 de2f2dcf014c847427ab0a73dfab0837d7855329ba20d3f0633b324dacc73c77
- MD5 11a97b4fe269049895d44baa160d1f03
- SHA1 45afe8bfe1037017f32ae64d0f98794c4432f4e9
- SHA512 f8b995f8b3605a735da7346bbf0342f26f19f9652f74f80e85fa3d2111e6a3990c199c4b49013a6a50cce1980676a53c2ab0d8df728566d9ada73b9c0522a04d
- TLSH T13871E6111AD90C86F2B75647DEF3C412DA33FDD299718B4C6387821A42ABC069D7CB6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102155443_001_vcRuntimeAdditional_x86.log
- Size 2KB
- SHA256 346c4d79f630baa261217460b205fd348d028ca478b267f664b53055b7dfdee7
- MD5 6b5ced24e5e9022b11461b16f5a6a53d
- SHA1 5ca66bf43f6dee1e60418e4b99f8dca60f0caa60
- SHA512 f6854946046dcb1664c88a8ca7a20319ff4ae00f0a7bb1b6c5c0f5acf1a115473d11ab38588e182f16258ea05483d806713a7999aa54c4c3f2cc709a6607fa80
- TLSH T1004114601AF90945F2B3174B9FF3C0579A33FDD269318B4C224A431907ABD04A8BDB6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x64.exe
- Size 17.7MB
- SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
- MD5 23985a8a66ae306aedf0a9feb1a3d14b
- SHA1 7ee9442ceaeef605ea66849f042b8410433c988d
- SHA512 b618f601a1989a696c8efa0208efd977a3bfe9a8df8ace8fae9eef20262240e7eefcb67ce466fe166bdc606d80d594d2de80b3b4e530749aab8e99f5cecd86d4
- SSDEEP 393216:Sr3bJsxx3E2DiCLwmQQp5MTFarWznCY1LHRqLJ:S3mx3D585AI+WDCYZHRw
- TLSH T1D717333160A0413BFBF51077B928A2202E7CE73C2B5598BAD7D8AD1D7D6A84147FB163
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\VC_redist.x86.exe
- Size 6.6MB
- SHA256 e7267c1bdf9237c0b4a28cf027c382b97aa909934f84f1c92d3fb9f04173b33e
- MD5 84855eb74e9d7fd646f42137c7b93069
- SHA1 ed3708cabffb4c52314eff81f452b7ae70e99d3a
- SHA512 a6687ef328597c90093a4278a12a0059496711801d84a40dc730511badde3d94199368d57fdc0926d8a3e19d2d2aeec8fe58337b91cc69aeb4dfa251833ca5a6
- SSDEEP 196608:ILZfOXtuDj+lkIbrhibcDrlC0OqatbB5bMebjA:MMgKeBbcBeFLnjA
- TLSH T1AD66233294644133FBF61173B938D0307D3CB72827549CAEE7D8BD5939A9886A3B7216
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-5CI4D6GDJJ.tmp\vcredist_x64.exe
- Size 6.9MB
- SHA256 a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
- MD5 49b1164f8e95ec6409ea83cdb352d8da
- SHA1 1194e6bf4153fa88f20b2a70ac15bc359ada4ee2
- SHA512 29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60
- SSDEEP 196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC
- TLSH T1EC76333296645127D1F20973F810E2207E3CB12D7F1044A3A794EEAD2EA95E667FB347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-66S0RW1WX0.tmp\Vegas_Pro_2026.0.3.189_x64_RELEASE_260819_133724.tmp
- Size 4.2MB
- SHA256 439b028c7bc40edd8aa4052f46f1590e5e749aecad3928cecc5b675ee48c11e4
- MD5 50e970ee49cabde11a5874f37deb17da
- SHA1 1d99b8667c8de443dc4f0862cc0ec264c285ada3
- SHA512 b35d78e061a4bc8763ed539ec6d55c42fdec44e4f728707ace07be136e86344e345939ab7287824c2253950c51365698837247e15f9250d4b28b38e14d66a1d8
- SSDEEP 98304:VlUAbauOajmH8wRY/kFmEU6jmhO+Jrn333V:JOunjmc2FrSR
- TLSH T1BE168F03B388B53EE4571A3A583FA294983F7A213A15CD4BA7F40D5C8F3A6417D2A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll
- Size 117KB
- SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
- MD5 a52e5220efb60813b31a82d101a97dcb
- SHA1 56e16e4df0944cb07e73a01301886644f062d79b
- SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
- SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
- TLSH T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba2\BootstrapperApplicationData.xml
- Size 5KB
- SHA256 3ae340bec4fb68b477f34dbeadaf8cf3ea95550e427a3bb84994b5806485b5b3
- MD5 d1439b6cfe105425bcce1a81954b3417
- SHA1 288e59bd999dcfed5c4c746c1992cfc9bb5f2380
- SHA512 868a9c1706b967f532039f9413bbde8ba0fca5cf76915334c1a1be7d0513d3815f506a766183d85d3595af2b4928cf5f3ad16703d20b2a5caa9c9c47b4880086
- SSDEEP 96:X0eVJbgV2VBLHeBvn6yeZqCE0wLycujEn6qLUemcmqpq0wMLrycNLchtrtvRtrti:X001Ks1Up2lpJwxLURf6zLG0LcFlBL5+
- TLSH T1FAC1E5652BFD0109F1F34F88EAF555629A7BFC922935C81D01652D0E4872E818DA2F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
- Size 5.3MB
- SHA256 1f2f8f5d60dadbc6e4d3d36c88cc54f22af0a615b609609e748782dc26231174
- MD5 f5879f5f3ffa839a280ab853338de872
- SHA1 3b4366abb2da245416531925ebd8c76adc3e90ef
- SHA512 96a88601cedf859c9fcd388d9e8d2fd6139f6e69ab6b05b0e044d1a598cd1a066d27a0f7a7c71bd77576dcdd083dec7a55f2cd9de52ff95aac23171c9f9670de
- SSDEEP 98304:y1lJQ3eMBA/uI4ms8UDSSBEnOEEEHlDyrAaKxk6MGII5wFGRB2CfhXkyq:yyuuI4mJKCLEEFeoxkcMsfhC
- TLSH T1164633356D2A270BE8B732015872E69A380CF4BEEE832CE13F65E7E5785735591BC112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab5046A8AB272BF37297BB7928664C9503
- Size 1010KB
- SHA256 e95d29cbb06bb323d9d43fc2ce61d4565b0866622a83d93df76430a0c252b433
- MD5 361903c5ff86511786d7b450301dd640
- SHA1 c9fc04a718a388294658590f1240d8c7e9ee4f82
- SHA512 78ceaaaa7f3e1a40ac2528e2f169416d6ebfaba54301754035f2a62f845421c8cddaed84770182e51794c9fb32720aec998d453de2bef621de7a7e2b3b35af20
- SSDEEP 24576:OaZAjJ7/iOnOtfHFVdbtaezjCsajNZV3Yk6dStkeQL4QfeQXsI8:nA16OnOtGezjC9ZBXLKeis5h
- TLSH T1BF2533E689685D43B808EC35D359EDDBFE3126F220794025D97CB93D0AB0693564CAFC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeAdditional_x64
- Size 140KB
- SHA256 8909e5c1d917064983595a4e4717f758c2a8df8f59d7b31a5b79b2f95bd8f7cc
- MD5 4f782799f84cd006f7f1c750afb04d8c
- SHA1 0cd219d326fd40665d2f1b22569e2517792edfd9
- SHA512 cfddad551aa5a35b032b7006b167fd322aff46ec8a2934632c087882b24404ee48083ee38b9110add9846880b1ae0bed136bb21ae751e1d3cde9dc27eaed5915
- SSDEEP 3072:rJyjFGJvLIcXcSqviQICInggvUwMNme8:0SIcXgvi3un8
- TLSH T1E4E38E13B7909137C0924331647A97A22F38AC344FE1419E6B9972AD3FB16C0A77B3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeMinimum_x64
- Size 140KB
- SHA256 e88d0915814e622cd1deca849efa23a0d58d5d756be44ebbb4d460d3dac9e816
- MD5 87b74c694f295830ffe516ba20de0b93
- SHA1 e6996d47bb76ad25954b793f73211524490f55a9
- SHA512 d0fd7f8c8964a99ce7a9d187640acdbff4ca3d16f02e44696706d6107b58890e763a18857bec2b94f92ca559510fea0ae5515ce3de20aa4371aebb38006c05eb
- SSDEEP 1536:v/JyjziSGJvuiGPceicSqaQdFofZc9PMWkK1ICInuoAg6euHT2GDUQel5Tmt1PF:XJyjFGJvLIcXcSqviQICInggBGHNmCQ
- TLSH T1B4E37D17B7909136D0920331587AD3626F39BC344BE1429E6B9972AC3FB16C0A77B3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\license.rtf
- Size 6KB
- SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
- MD5 1e47ee7b71b22488068343df4ce30534
- SHA1 deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
- SHA512 c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
- SSDEEP 192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
- TLSH T194E1C6FD2243DAE0069F1399194194C6FB0F0F79DDBF7E50B5B69110126291C727EAD8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\thm.wxl
- Size 2KB
- SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
- MD5 fbfcbc4dacc566a3c426f43ce10907b6
- SHA1 63c45f9a771161740e100faf710f30eed017d723
- SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
- TLSH T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\thm.xml
- Size 5KB
- SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
- MD5 0056f10a42638ea8b4befc614741ddd6
- SHA1 61d488cfbea063e028a947cb1610ee372d873c9f
- SHA512 5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
- SSDEEP 96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
- TLSH T193C179B546DDB801C133EB1166F231D27F126972C0C86E99F94C3AFA4FE1150A87B2AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120_x64
- Size 5.3MB
- SHA256 950ff7746d747de51cc09c1aaaf88fbc2fc97c59865f574cc3fb10243ae7b906
- MD5 a6d08e8e290c80822842015cd877d405
- SHA1 2ee9d28e20a73facff20be87092e482b562dad41
- SHA512 b6dfc3d0ef4f57c116d44b201fae187c9427d4fe7cad969f50f9408af40071d811e88698134491f479923b259a47d0b528e7ea23790248314e902ee24d0b93a2
- SSDEEP 98304:TbsL/TwbVuBQwMvYFLOAkGkzdnEVomFHKnP4:TbsAbVuBQPYFLOyomFHKnP4
- TLSH T107469D5A6BBC4098D096D135C5678F5BE3B3FD512A32F35F0821269EAF733711A4A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120chs_x64
- Size 45KB
- SHA256 cb531679be2881677a93d11067c71274ec30b30aadf1cdcf1543dddd6b1d7b61
- MD5 f96a9a88487a27de7b3e15c733cf1fe1
- SHA1 0a4157f064349b0370b8ee3f244f44debd04b4c0
- SHA512 df5390b235157e65efa3a9385a7ffd6d5f4f2471306625f01370ed463c65b81c4274370f93b5b0d04d44175c57322d2f2fb1cdd2bcbc123997f4ae4ae9557f0b
- SSDEEP 384:SzdBlsNKvsXsWMsW6YbRWktLiBrHuuPgldyevyBbXVLN1aJA0GftpBj60ERHRN7L:adzvsXyPptLkrHyTby9XVLqic0EBz7D
- TLSH T15A233A760BB8CA46D611453046D2DB83BF39E7995A11CF0BBF01F68D082A755FF09E29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120cht_x64
- Size 45KB
- SHA256 0301c5dc6e762788891356987e9c8cd0d40b262df06e8384bf5796b1f20f083e
- MD5 6a5e17d5a4b24e5c2b947a343a182949
- SHA1 ddf5ed505953e073f09b17e8e2bdecf2766c6a4b
- SHA512 8a383192f9f6e6c4fab24645cf7c30fa927881451f0e65175b724717151cca6fcc49ed3394cc689407f19a7b1afd6b462688bccb898912762b804eeeb7cd8d97
- SSDEEP 768:ZWbfucVI4Yr7kn4TJVM3i/EhKTi37EBWfXMV:KucVI4Yr4noVM3XhKT8EBWfXMV
- TLSH T1E8233A6A07A4CB42D6514A3006D6CBA3BE34EB99AF004F57BF02F68D5C59385FF19D28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120deu_x64
- Size 73KB
- SHA256 80e0f29ff6b7ada892f23927f17021783575ad80f9f6c8a268a6c2a7ce35e5d6
- MD5 bfc853c578252e29698ff6b770794e6a
- SHA1 1091dced7b18bdd7eda2be4d095ac43cfd342b7d
- SHA512 306445384614b48d3182a91c8adf8d8206c36efd88abf23753800566f9650518af382164ca1a17ed000888e6a99c175478ad621d0a0d46c9bc7d5359113e05fb
- SSDEEP 1536:fVPidQr0UZqnn0BDw7Pu6V4aGCWRZ+e0petNSaQhp0vcsjsr8gWt8C1dCuf9jour:fVidQr0UZqnnSw7Pu6V4aGCWRZX0bhpC
- TLSH T13273BC6143E98A19F1F2AF742EB49390BE36FDE6BE35D60E1610618D4871F40DE61B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120enu_x64
- Size 63KB
- SHA256 e463f38fa6b6157398ad224a462538bd8e36b75031fa711e567c5505a9092df6
- MD5 19b7b852ac2dec695e6a52801e59c421
- SHA1 cd72265e1a6a64c761984980895d92cb93bc61b7
- SHA512 d0fd9f75820d3dbdc4001ed6262a940f062655ebb5f31f3d45d984e38b1bae2e5a958665b79b5b4aeb899e39348ba987c82148bfd85477e69249d3a59a076017
- SSDEEP 768:UTijcBEhCgyPj6B1CLPLNq5f/nWHBNheOU2fd53irQxMEBKelMG9:UGzfyPj6B8PLNYf/nWHNTdBqQOEBKSMK
- TLSH T12353DA5267FC8605F5F77F702EB596516E3ABCA2AD34CA0E1640A14E0972F40EE60B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120esn_x64
- Size 72KB
- SHA256 db4fc3652d24224d5375d1a5696144ac8881332cc20f5992ed1488236e64c120
- MD5 9ef2dc352d20b615a556be53b449b17c
- SHA1 933b2a39f3d730c6b5d437558d0db68c5d2c22b7
- SHA512 8031a4d0e44beb290c48292a0987108ed6d6f56950dfb17ee4671e692407fcbb8dc652d82907d8f98db2f841689f9480aee6fbce60cf2bfa1d0d6294c3f6da91
- SSDEEP 768:zqj0KnBU60E6rg/PKuCOCF3OKWRElJRZRIvpLiyj3HEBFKui7el2:pwq60E68/PKuFm3OKWkRZRIVHrEBFSS2
- TLSH T11873825117F8520AF6F3BF34AAB94A945E3BBD96AD39C50E4610619E0CB1F40DE24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120fra_x64
- Size 73KB
- SHA256 e7cb6c2818ca27c864bda635d5b5d9f7bdb308f4b5d4bbc206ee1e135b7dbbf7
- MD5 06473191b67c8b3d1a26b76474c5daeb
- SHA1 94c72bb597c365cb77f621e6e2cf3920954df2d7
- SHA512 237c144cd3cd78c4a4eeb5c6a22043a8e604bdbd7182b89bacb81135b1e3de08780061dfa3664508cfbdc01e918fa2610e317f9441b10c4df8def1ca444de4eb
- SSDEEP 768:O26iNYajZELpjYImN8YxAaTafCp5eFQZmZUjyyyyyyyyyyyyyyyUGQFUbWo2Negk:ONuqLpjQA2SCHj0jkVEBIm
- TLSH T144735F1163F88606F6F27F3069B846555E3BBC8AED35C61E1A00A58E1CB2F54DE64B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120ita_x64
- Size 71KB
- SHA256 9cfc5985440df4e70b57869b32c8ee69eb6fc570a98cc94a53141a0dc7535e10
- MD5 713e30e13c1998e035cf4ace66b03230
- SHA1 2d244e01c2bd9f3f17dfa0b74c19ce6bc512e1b5
- SHA512 8a2581aaa125eb45543e679e58be7040d151cfcfe0625f6e62dccc3fcf87872d3504b30082036d5219dc4c8493600838d31b2ddfde3ba0bc1b2b6ef97078e29a
- SSDEEP 768:h3E6XaCyqbK15Md+igDGxNIlW3gyCQQQjeqS1hDsiiUWTVNviNZLEBFPrl:zass5Md+igSxNIlW37oETHUEBFPrl
- TLSH T17A63A52163FD8609F6F3BF306A7996515E3BBE96AD38C50E0650608E0872F54DE60B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120jpn_x64
- Size 52KB
- SHA256 83fb72fd2142d54bff6280e7c4d4ff22d43c3a81fa4ff8881003abbe5e21ec3b
- MD5 689b5f0061a67ac95f59a64744702186
- SHA1 52227dd2c8a66c0528bff28475846faf7036340f
- SHA512 30b4e01d20c6c3ac1b799dd4d23fda3ca988eadb59356f84aff0a0760572b5c4119ef21467494e47a7d74dd6b136633a6ae40f45ec051d5cacbe44b5d6255d42
- SSDEEP 768:y8anVn/ZBtJxtr10/euKRHIWHvifhEBafXA:y7np/ZT/uMhSEBafXA
- TLSH T11C33D7DD3AB88A0BE0E2C5300190F2D57A39FA449AA18E132F48F54F54556CAEF15F3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120kor_x64
- Size 52KB
- SHA256 b2c7fc2c95b13bac36316d298c94d842dd2574f78e9c22e4d4e4af1c3fcc0fd9
- MD5 7d03ffc6a8fb686abd660efdc3aaf223
- SHA1 3d04c53971a525cc3255ff1eab05ff0cbad75bb7
- SHA512 b5d41294630e342f2242a91c9dcf9085cddbd2389860e14c741147cb695425971cf79339b523d28fd3189589e5f948115359b89f59a03186e3c6a103f854f4e1
- SSDEEP 768:fCzO54LQTNyDraHniJNB2I7CvqliwfiEBA1AQ:f951TNyiniJv2I7Cvql2EBAyQ
- TLSH T1F933296716B8D903E8608575A7A2C797B7399780AB234E07EB00F2AD146A7D4FF10F5C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120rus_x64
- Size 69KB
- SHA256 3238676035d9c1595248ef65ef5b044384b473ab9bdfe8d1077e10e4fe7bc983
- MD5 a99ad214ccd1e7bc1f609b972467b0ca
- SHA1 9ee79954fdb2338026c3c81da00ab6e7e6c2e1ff
- SHA512 da1f8a4dd82559635ea53dfeac1817a9ced1d247a170a8153a54c05c371fc80aa2fa958bc5c515c026815c505f70fb374178f8ccf94836b66c4a7e23dab1c083
- SSDEEP 768:gq/gFXOvijuqN9TMIVhtZ3FckD+SsMipzEB88L5:/6XOvilhTVcMaEBfF
- TLSH T118634E5FEA7CD611E864C2701F9289D7207AB700672986CBDA8FBD6D602C33577285CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120u_x64
- Size 5.4MB
- SHA256 75497de4aec4b5f0f258164672db2eb55eef5138c028317860e05f11030f7b7c
- MD5 ee4af4ceb4b7fded7cdda37faef69704
- SHA1 5ab8f2ace2f4a1892ea4a2a26df5ee7e9cd497b2
- SHA512 4f807157e6bd57ac37bd1d8a52ffdc38e330e517101a1ea603096d8728b04c9c2ae96e510b961c87536e957587ce169fdece6bc3ed5e5025aa87c0f276da0ece
- SSDEEP 98304:afQjxbHkzO6QhbMi0cFLOAkGkzdnEVomFHKnPK:afAbHkz0hbFLOyomFHKnPK
- TLSH T17F468C5A2AFC8059D0A7E135C55B8F4BD7F3FD902935D76F042222AEAF77721190A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120_x64
- Size 89KB
- SHA256 864958960b8dd2890d47f2774ba836954f2c4f5ad6e4d529b13138caefcce73e
- MD5 0d5451a0050f7acc970ca02459c63d9a
- SHA1 2de9febca0b1d48014081907e835237c832c65b0
- SHA512 4d0b3d3d494c1774ae4575eb945f3c0742b723d6583d98dd36cc51a1d099b8f1a090d4b18c54897d1d58a67381b800604724cb609447860105bc2e0e8d5094a8
- SSDEEP 1536:lHTxHw36oFacndsFjFoTc+sgqv4G4DG/88W8uzOZwKbrEzeBB7OAv9wxpEBgq:hTx2JdAD588W8uzOZqiFOAv9wxpEyq
- TLSH T1C1937D4A6A75C6FFF58B49710A53CF42223AD3936B61D7471234B79C1C873D0AB05B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120u_x64
- Size 89KB
- SHA256 a78e7988c9f99bcbe02d29441b0dcbdebafa616d2a4652aad867b81f554a0476
- MD5 43aae7bfb0c911e7e98003e2b45667e6
- SHA1 0c6c7d96cd0eca734e425b1ddef178c3ab6c31ce
- SHA512 33d1293a7905ee9ec58b9a7744981006d6dadafb75ef64769723de02ba273f344a20e20d206d64d2453746549fe471328a035e2b5cc8e485e7cfd2c2fbc7c6a9
- SSDEEP 1536:wHTxEJCfkrRasN/cfvSpauyd/nbzLVicuGJOZwKXXEPFNFOAAucNqh+EBDgn2:MTx1YTcXMapRVicuGJOZ2tOAAucNqh+D
- TLSH T147937C0A6A76C6EFF49A59725A13CE42223BD3936B61C7871130A79D0C973C0BF16B47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcp120_x64
- Size 644KB
- SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
- MD5 edef53778eaafe476ee523be5c2ab67f
- SHA1 58c416508913045f99cdf559f31e71f88626f6de
- SHA512 7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8
- SSDEEP 12288:EOB4p+q4N8d4l2ms4cTHN+m+gy/vEPYysExtvsIvX71A+2EKZm+GWodEEpvYG:jAtvsIvL2EKZm+GWodEEpvYG
- TLSH T158E45B13FB150AB0E192D37891D78741D7F1BC898822F30752ABE27D5F67391AA2B361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcr120_x64
- Size 940KB
- SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
- MD5 aeb29ccc27e16c4fd223a00189b44524
- SHA1 45a6671c64f353c79c0060bdafea0ceb5ad889be
- SHA512 2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006
- SSDEEP 24576:cj7dDxvo5outISmDa5HSueghIHkCvf44lmWymt:cnLLSl1tCX44h
- TLSH T1CE25BE4576A106F9D473D2B4CA679647F2B2B85A0530DB6F02E08A6D3F23B30966F317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcamp120_x64
- Size 470KB
- SHA256 88a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b
- MD5 f0ec8a3ddf8e0534983a05a52bce8924
- SHA1 5f6d0265273f00ffe8e30cf507f0d05d330ff296
- SHA512 d7b084d7f20de29ff16341df2756861bb7ac22eab0711869b3e77a84d841fb76a898d7459ca1be62eed522caa1f022c891a7d30c94bf0fff1bb4d016be8aa9bb
- SSDEEP 6144:iU03ZYl14gzlZrGo2QgeapeUQdUyyO9tIUosLAV2SAD17pFHVhDnnV0tOA6Y1qkZ:i+G6gS7hAV2SGn3I1qkZ
- TLSH T1E8A43B19FA5C8C61D063923E84EBD6C6F3B234585F32DB4B6159933D2F77A90AD2C221
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vccorlib120_x64
- Size 348KB
- SHA256 1b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc
- MD5 ea1e99dec990691d41f938085f68bcc7
- SHA1 5fdcbcd777e10e765d593994dc66f930c1377b0e
- SHA512 e90a40bd8e20bbca3c6188a78ad75578e51d88aa638e0bbfed4f6f6efdd0917e92b08ef4b0ccc2dee08774f08658b189e25234270e8ce1ca60a7e0ec8e3fbcf8
- SSDEEP 6144:eg5dgFfqaKFJyHrBye4/RAHq0KzO9OAgfVgYCDlicdY:eOdc4/RAHqkeX0icm
- TLSH T18E741A127BA88CE3D43391764AA78B45E7B2B8920F71E30B2594432E5F773616C1F672
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcomp120_x64
- Size 134KB
- SHA256 22d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70
- MD5 d7dbc7c92177837431ae2fd7fb569e2c
- SHA1 c26140204a6db421842ad36599326a5369fd1b5d
- SHA512 4f2b197ea912b5ea1a82ac84e1c15ca8e3787460cd79a32733ea920dcf3b1db5cf0507ad7c94f4e4ccab9dfc6773a9d05a8eeaa7bd7c61b63d780b69ed7ae0d8
- SSDEEP 3072:2cjMv1qzORu8kLSiHHUswXIhEXniHJfshjcsdQoLqUi25/+MWRATg/TKEfB6:MqnTSiUswDnipy1dQoFqA8/H6
- TLSH T195D36C4B32E4007BE5A79630CD638D59D776BC5706709B4E07A402EE1F233E6AE29736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{2043F21B-D42C-4038-BBD9-A095649CDE7B}\.ba\license.rtf
- Size 9KB
- SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
- MD5 04b33f0a9081c10e85d0e495a1294f83
- SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
- SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
- SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
- TLSH T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{2043F21B-D42C-4038-BBD9-A095649CDE7B}\.ba\thm.xml
- Size 8KB
- SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
- MD5 f62729c6d2540015e072514226c121c7
- SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
- SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
- SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
- TLSH T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1028\thm.wxl
- Size 3KB
- SHA256 c1fe572ca3dd4387e473272bc9f2a2da5dbee58fa8ad6010eb308e119c903da0
- MD5 e4078555659b35d1cee0543e982a89d0
- SHA1 373ce4e38440c564c4bcba9407f0e7e526cc4a9b
- SHA512 559aca722fa9002b71e890433fa16ac7197e2e2066e837f597c76f8fac7930c446c8383c7e729d134903c0475e5e74c20c15158b471d82ffbc4cb4ab32a5a652
- TLSH T166519BAA3CDF16D096735150E8825ABA1420D1AC527B6CF1FE0A0A479B8D8336373F17
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1029\thm.wxl
- Size 3KB
- SHA256 1aa579e8e2cb828c9bbbd598e837d6923262fc4c8fbc1ee30b166cfcb10a849c
- MD5 2864746eeee13f9a89de0fa028996674
- SHA1 f6882727c755a86c431793d8049b910e2d944ff0
- SHA512 9d24fb6e54b458efff07275bc208658f7656ee04424efa44005cc03b19a59ce5e6aed5ac922598fad62ccdce90604412bfb41212dd9858079d4ccf772dd77ff6
- TLSH T1D3610C5778CF679065336115FDE216682A04C5A8423B6CF1FC8B8A07878992B6373F27
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1031\thm.wxl
- Size 3KB
- SHA256 4f3601c2c80999ca9a2ab7c42c1170220f1ff4d958d210d12e50168631c303ab
- MD5 a24abcea822b5a95633b3e9c54bd7e70
- SHA1 b59f0000da534e0389c268c74127f8d1867b2824
- SHA512 792268c275c8c0b9e405e119a24b81e8f99ffd0f3bb7c3c145acdae6cb8600ccdffb14d4904516f24e5d060c3b95e879293c9a3e48f781d2f0d20ff1c37b760f
- TLSH T16E71DD977CCF378464336221FA825A6A2914C198427B1DF5F94B869BC7494339327B63
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1036\thm.wxl
- Size 3KB
- SHA256 4127145ea3ccc42f9364fefa3eaf7f50e3229eb6ab2ebcdca33a0609003a69a5
- MD5 e94e0a99e62862b1510a82f4313680b8
- SHA1 f84874945d80bae0bbfb38aaa868579b35637385
- SHA512 125f0fcb56b3243bbc5f6ee5a4f2aa5935ae9289c82e8dd2c3a771b23e1b14151e6b98146064a3b38d3275d06f55e8af2053d2091df877f2f8fef46a60bf2557
- TLSH T1F171BF9378EF57906463121AFD8359696830D188523F59F1FD87490B838A836A373B63
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1040\thm.wxl
- Size 3KB
- SHA256 5d3c97e5ac0b8bac06f6a0c6e3edd92ab5c2c8978543c770b826139edf624c24
- MD5 e6ebe02be8fcce661bff874e70a902e0
- SHA1 ffe37de7296a782c0844cea479095a941f5f2aa4
- SHA512 151dea27a0a2f1a0838f3aa319e4f2989bf8e2bccd39fb27f03dd1db58943107da328efbf764d5d934b6cd36e311ba71511e1aaccad760271a53dc884f395e18
- TLSH T12861F06378DF665425732208ED82A56A6918D4DDD73F29F0FC87464B838A822632BF13
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1041\thm.wxl
- Size 4KB
- SHA256 04ce070c6f65c85958cd1d5518327bcd615469910f02254dcbbd5f95eebb2212
- MD5 86627b0f5c005ee4e8fd8fae61091f76
- SHA1 dda670f7be0527fa28546493a44727be01270f46
- SHA512 923c615290062b79d1bb2e4903fff8db71ed5e517deae7a2e64d3c53766749aced80682456e37083e5e4908e468950edee714f7716499b3638ca8572ba8fd085
- SSDEEP 96:uDiTlDuB1n+RNmvFo6bnpojeTPk0R/vueR8H5OA17IHdGWz:5uB1+gD1Dj4EdGE
- TLSH T17181DF6DB6DA219199331160B8826AE52411CC99D63B2CF1F90EC857BB5C47FD223F37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1042\thm.wxl
- Size 3KB
- SHA256 cd825881d63ea021d6002eb8375d51a508fcb784fb90753e6323776a3e651aaa
- MD5 7c81e4b9028b4c03cda439f1f19fd651
- SHA1 4426337213e46934a37ca9a3fee2b24bbce6886d
- SHA512 40c073037857e78fe7aa1f74fedbb877e23103882ef90bf144b01459496cb27e80b4a89ead441524e13b9d363c7b33d73860e6af0187209fce6d324b20066749
- TLSH T14261DDA338DB56C0A5736404AD92A6766610C2E8637B1CF1FE469987CB8C8335373F67
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1045\thm.wxl
- Size 3KB
- SHA256 49323aaa73e4dfa7dff2dfce004d89cc1d2d4f7d7d530f4cae0b67cf9f91c789
- MD5 5e2dfde3c269732ec60c8c574b6815c0
- SHA1 8250e01432e0140a3302b35d35fa5c45feb000b6
- SHA512 db6f10759d4253df4cec84af3fb379f4bab8812ed07334f25816ba002fc5ac5a826f5e4eab4dcfcd7a142804a6199ec114a82b4ed7d7ebb8186fd93c2ee1cf7b
- TLSH T1F8610E8778EAAAD06A331154FD8359692804C9DC423B1EF5FD8B141BC78E9226333F5B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1046\thm.wxl
- Size 3KB
- SHA256 cc146b6e1788bff1d0363ca894229b13632b8546a76a55ea1a4cc2dbb4470aba
- MD5 bd21898fd74bbc36c7bc36c94aef743d
- SHA1 ac6c4677e9e76d3fd2580b1fbc60e4b0f8550238
- SHA512 95bcb7cedaca45ad70318e88b34961f1270577fd3453af3314c2646db18259b838bf43650c0167881a8d60393950dad716626da05ca26c81d769806d3555fbad
- TLSH T1B161ED6738CF169122331215FD935A2A2400D9D8823B5DF1FD8B8A47878E963A337F23
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1049\thm.wxl
- Size 4KB
- SHA256 8fa0e3b51a00c5559d1120b1c66b2a00c7693147257b2911fe038a7bf7b8fd94
- MD5 4380f92828541a722f1927f4aa90a5a8
- SHA1 1735c040ebe13e16a330b34c2b9f31c84fef9e6f
- SHA512 c83c1364e5af76719d821846a06a96ed27f9f23aceb3f7e2e0cd99b0d6c4919cf0e2d02220727ae0513a6c03dadfaf1cfcd70c589f837100608dc17664ca1a05
- SSDEEP 48:c5DiTlDhQt9esbrohDTWJt49kAr7DHN3m5GNDCNvNLNkwIkflhrWncPingGdZwKV:uDiTlDYVgmt4xJ88k1Zf3ipzjvL
- TLSH T14191EF52289E21DD1122B027DC409D1D3C96D0FE673B5AF2BD456D6FB2E64328333B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\1055\thm.wxl
- Size 3KB
- SHA256 90085069fdf4dcd699579209dbfd62a6719fe1a6e07168b938b92913da3287a3
- MD5 76737f2332167e2f2dc04772e96bb529
- SHA1 120f9dee6162cc700dcce332be188c13328afe82
- SHA512 e30e93210062733974bfae37cf3e471f5599aca316af3a028f4e2889f2afbf2039ab725d33a700571900fe01dd1b396a6cdeba5da94476e31714b013c94be093
- TLSH T1C7611B4338CB6A9469332266FD92562A6918C4C8933B2DF2F94B850787CD4332373F1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\2052\thm.wxl
- Size 3KB
- SHA256 62bdb8fa52dcf8b5298da5fc7a745aa9481eadb3f32862f2996d070c29f21d2c
- MD5 96312bf0a2a534049a0952b128e2f2dd
- SHA1 bdafa950c2d6f5ede2c960376f0c895db1fe68d2
- SHA512 5adb6228abbf1f71acf28de64aa878cdcdfe4b4bdd8a5e51b690e7f68eca72f4cb1c3b515ec2d285a10aa4f83dc28f1492a84882018cd79cd20200b04ab97370
- TLSH T1BE518BE778DB1AE0A9332050B99215B92420D28853BB6DF1FD4B5957978C83353B3F17
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\3082\thm.wxl
- Size 3KB
- SHA256 2c6f29f040da15f2b6a63cfbf47e07f569afdb778f178feec9e0079199644aca
- MD5 41adf40ed1a4dd3ff8fc983a7c952720
- SHA1 aecc47f7fd35cffb4784f688487f12c9eba4d0be
- SHA512 30a8cc65fbdd454e10d6cd256fbc7eb0e9bcb5693686a190a0fa54ec12f83ac713fe5166a91aa060c361dd3b4687a5ce638b940e29092be76530078f10ce76aa
- TLSH T16461F16738CF5B9079736018F8C2963A5810D4A8623F9DF1FE874A57838A9665333F63
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{53B7D7D6-FCA6-4558-945D-D57664D15BBF}\.ba\BootstrapperApplicationData.xml
- Size 5KB
- SHA256 6eb6c71de94b32df79fd63ca06ab2d27bdd221fe937fd2988edfbe16dca89473
- MD5 666ba09919c96f608a773393a4b32dd8
- SHA1 8c1eba42a8cde5f89de78a00b3dca9cd16ed69f9
- SHA512 85614fe150b2215ab30967c14d0b469a3f79e5bdd254d210bec89585a1025d188625758e1ab0b39224da9736fe11b37d5494cc230cf7b88356f7a884dd838240
- SSDEEP 96:XeV2VjYeten6ue84h0wPycYn6qLoewc8p0wMLvycNLp9nI+15rtQa5rtwNBL+qLb:X0sk4eF5FzxLon6zLa0Lp9nPWBBLFLUG
- TLSH T1E1B1DA652BFD0119F1F34B48EEF55862AA36FC562A35C82D01622D0F4973E429C61FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{974A6CF8-18F8-4291-BD45-ACD5C5A8F894}\.ba\BootstrapperApplicationData.xml
- Size 7KB
- SHA256 1ce95b466c776490014e99096c7f96785147d99f5488fa8e297ad9bf60730493
- MD5 bfe4d981ae47390ee730bb33b24b19f3
- SHA1 9d5ea01920a9fc2c2b022ad5039429811ba6b7b8
- SHA512 64aa0cbad750c8771aafb23b66bcba697a9091fc128140abde39e1246a6c185b2b587793541ea8f516f0ca5f780380ec2ce80bdd3cc7f33e6d0d024c668d9b86
- SSDEEP 192:X0skBDp0pIntHxLUr7zLG0LIwftHJN5cU+0oI0dOBL5LYLVLGlLYLWotB:X0s6ntR0PJkwftaUwIVVEp+EV
- TLSH T10CF119642BFD0119F1F34F88EEF545529E76FCA62938C81D01612E0F4972E819962FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{9E2BC9EA-4D60-4524-8D0C-3EFFB208CD71}\.cr\VC_redist.x64.exe
- Size 615KB
- SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
- MD5 e5237fba0388d7d5ac22e823da709438
- SHA1 d772562f32eec346f0ba6260877a3caffc0d8dac
- SHA512 af99bc56c4c1f1ed0fb4302a301a7a1a6a85baf8343e3abbfa38533085ffa3cc5fe5d004efeadb22daddc8f7800fb27b040eacbaece4a234b8fcf49e3a1e183a
- SSDEEP 12288:P3mgqnIZuYfCYqFet4CovkM7wVYnEvIhqFxVKLxYGHLNJk:P3WnIZuMCxezot76gTqFxVKLxVk
- TLSH T11CD48D32A5614033F7F105B3B928A6303E7CE728275189A9D7D4BD1D7EA84C2A7F7216
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\.ba\wixstdba.dll
- Size 215KB
- SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
- MD5 f68f43f809840328f4e993a54b0d5e62
- SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
- SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
- SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
- TLSH T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
- Size 5.4MB
- SHA256 62a859b0db8bca416c7b6ad2ad5d2c84a4890a39e5d45cbec75f90a2fd328749
- MD5 504150d63e81e949371003f6639fb1f9
- SHA1 f1a665c19dcdc2d88b985935108c7a660a004339
- SHA512 87fd95adb97a26dbf168523f838eb07ed9720a62c1f4c266bb33cbff66ef0993678f5f09c92cd85dde6bc4d39d1c781ea3879fcaa166ebc3a5da257f24e45a07
- SSDEEP 98304:E7ja9ivJoWIR34H7Xk2aXpdoearQ3KmTT0oVGdrK8qqjlYxtO2mqvwiIBXcQ4qj:QGTebX8XpOea03WhLjn2m4cb
- TLSH T19B463334908E8339396AFE68251F7BCF0B319EAE2D315537B4D784158EAD9432534A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\cab5046A8AB272BF37297BB7928664C9503
- Size 967KB
- SHA256 c346d91193246b18301cce532f2ae784fb377cb068d77bd22edec238e5746aa7
- MD5 b1e651d0456b9fc783e96122e835f7dd
- SHA1 8e8a4e9fc1a1e6ef34855b036c6737dad81af95f
- SHA512 7fbdfe78c047dc6f73afda097a90da007a06bfcc490f25ddbc3958691ada652f2269ceeb7cec6f35d577ae4a8af41d30c407238eba65b7ee874e625dde4593db
- SSDEEP 24576:zE3+9Eaeu1l82zQGjLhQPV7dr/UY/UEWYDxy24EBgbog4wi:zefeSoQGXSd5/UEWYDxnNnFH
- TLSH T1F5253379685DBAC058FF4E1A44C1F5FC08F7489F869CEF160E2C9F6A3E8AA741345099
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\vcRuntimeAdditional_x64
- Size 208KB
- SHA256 275d770dc4332bf6f3eae9ebc544ed07e3b169de791ba3d20ad50f04d9d222df
- MD5 e4e29cb648ac2ea9451639e95395b9b0
- SHA1 d32a6cd7705b5eba5544175d4a8f9f4da1abb29e
- SHA512 bbf76d5008d263adb3fb38e67e6d703774a268d454b98ebb90b39766cb78ef7cf65d77750182ef5e24d13dc1792a23c425dd955f468a39204f68943e9838f547
- SSDEEP 3072:u9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTqn:AlaZeKFxCnBheIdlum
- TLSH T12924AF12B5808033DAFE1A311178DB615F3DBE608F544A9B6364B6AD1E717C08F369BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{B01849F1-2952-4617-B0E8-9137D3F6E5E7}\vcRuntimeMinimum_x64
- Size 208KB
- SHA256 57d65221ca418dabfcc6320215b2c05eec907690aa4f93384f2007eb9e1394b0
- MD5 d44663b4fd6516e849efc5b7532c8d08
- SHA1 57e9da2129e87a5433cdf585de8d23c0ca926365
- SHA512 5a4f077f6f86b2a277641e36b37b77d11fdb7bf05fdcb7915b7b386d525b1e7a50985c3f1a826586064b2c70285519f9f2655e681820990fc062af15c7499394
- SSDEEP 3072:I9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTLFI:elaZeKFxCnBheIdlu/2
- TLSH T1C624AE12B5808033DAFE1A311178DB615F3D7E608F54899B6364B6AD1E717C08F3AAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{C3188CEE-DB53-4491-BBB7-FE8354E39387}\.ba\wixstdba.dll
- Size 191KB
- SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
- MD5 eab9caf4277829abdf6223ec1efa0edd
- SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
- SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
- SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
- TLSH T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{D8D7D094-4AF9-4998-A844-311C14AB16A8}\.cr\VC_redist.x86.exe
- Size 614KB
- SHA256 3d37aa9541cbdab5361c4776304ded5a497a45b486277db14bbfd26cd436f997
- MD5 b8e7d895c331e7cf60adf1663c16d211
- SHA1 5561a123a862dfa434b2950ff2ea28fda7ac8aaf
- SHA512 7af74f826cbefa2798ee13194c316f9811d93753c5876136b0cfdca8065e40faee03cbaa1042a03d9df6072ea2d4d0b875ec4a9e058b7c1facbf7482ca38ff70
- SSDEEP 12288:B3mgqnIZuYfCYqFet4CovkM7cBYnERq8SoQ:B3WnIZuMCxezot7agPTZ
- TLSH T1FBD48D32A5614033FBF10573B928A6303E7CE7282B5188A9D7D4BD1D7EA48D1A7F7216
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\.ba\thm.wxl
- Size 3KB
- SHA256 21a76eb702fe727ca06de6632be2294ed1caa9e1d3798d01ed1428e0f40e19ea
- MD5 8d7baa10be22463697654d8aca5d2a1f
- SHA1 67a757111562a216f8b7da791a0151bb1b0fb3e4
- SHA512 9935a5da93d229ea879f1b1dba01ba42655517e68797bb65fcb0ad9c07f1bb92c2ddfbca702c256afd7cae81cac8d048e5f26db7bd9a5988b7098dab0f9dfddc
- TLSH T133519AA77CCF639028735125EAD2596A6920C19C923F2DF1FC4A914B838D532A373F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\.ba\thm.xml
- Size 8KB
- SHA256 8d67851408a62b0f04dbaaddc588cd98499cf3630ec5df9f7c0699f0d367f79c
- MD5 c29a69f34ff31ff63c3ec6b2d4f903e5
- SHA1 44e58eb62821c8d023bc91b51975162841647abd
- SHA512 b46d13206c1a6064fe4857dc3de96769a773711fbdf5f8cc979216bd6b8e62703f1bdc3d3b86ed07405249613eb22697f0cdd039963f741bf2b13a4e3addd199
- SSDEEP 96:8L2HdQG+3UzHfz96zYFGaPSWXdHRAmImlqFQKFBiUxn7ye5tM82rkO/pWL3nswP:ZH9z//S
- TLSH T126026AB546DDB801D232FB1166E231D27F126971C0C46E99F90C3AFB5FE1140A8B72AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\cab54A5CABBE7274D8A22EB58060AAB7623
- Size 840KB
- SHA256 8b177ce7ea07fcf055dee844c567d3feeee40abc15cc5aa21acbf9e97a9dbfae
- MD5 63ce93ae9e0008c3e913d742fce336d1
- SHA1 cb683bf1e3a86ee865be0033d95e32b6b43515d9
- SHA512 b71e948c3fa6bf224e24aaba21357d519ca2f4c5bfa92496d3ed386cf8722a67a832da23c20fb0bd98dab75ede5e9205ecc09b059ede662e9be9abf9bc8bcf43
- SSDEEP 24576:NMGOKehVppofbOVioh2DAWHjwnJSA9OB3Mwt8qI7e5:MKY/OFbDlDw0AcxMwt8Ta
- TLSH T1210533CCC83FB706DA430D14E154ECD21837A698B818676F7E2B644A29F9345C758EEA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\cabB3E1576D1FEFBB979E13B1A5379E0B16
- Size 4.9MB
- SHA256 951657e869eb42149ccaa66d4c3f4465ebd29c490285f24c51c8492993861c25
- MD5 8d61eda1e9a0deb5d309098bf45f2f2d
- SHA1 e4c171460fb2df06df53ffcd62a2aa1fee6c8d24
- SHA512 565fc9ee145b96e12c0fd056009174ef135d560457ba0a33f65ec96f686250ea89ad68afb3a3e686b7cca7bf24e47f7fdf997c70cfa9122b210bb3dee8373e3a
- SSDEEP 98304:E5QnIVB09bp2QtU51QYECjGMyLa7rr/BMDfaPr615b9dVABB8kv6JaQrm:E56IVBwv251ZECjGPuroE8b9dVABLvCq
- TLSH T17A36337BCC0D561A9DEE72579561C05CFE26F8D674889C2BBD1B9AA0017A00FF272C1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\vcRuntimeAdditional_x86
- Size 200KB
- SHA256 21e993652e0cab41bbbc8c8a6df9baa1a25e9147a50700cf956e24e6b15f63d6
- MD5 b03c4ab93231dda79101329f32100780
- SHA1 f50c9558311a95287a882adeffc97ee5b998de10
- SHA512 a2e706c8dbcead1fd994ea4f0cd21bfa8b61401dd812fbca2be426f1cbae96089c3d450c99bf06531732b20781922d8794ffd02c7cd2092483b05710c57cec19
- SSDEEP 3072:E9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTMB:ilaZeKFxCnBheIdlu4
- TLSH T13D14AE12B5808032DAFE19351178DB715F3DBE608F54499B2364B6AD1E717C08F3AABB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DC03A1E5-64FA-4AA7-A62E-EA3F47A53563}\vcRuntimeMinimum_x86
- Size 200KB
- SHA256 15aa329341a7df570ca75769e44bb820a301e58ff566a00e1db29db7fe8dcedd
- MD5 1905ab2a4d72e1a360308fe7aea2fa06
- SHA1 fa28ad85acf7b997a34e63948c688c3fa0b1c65f
- SHA512 0106605696b3b49210b4f345bd929fe31f2cec6bd28a657b8b3a3320faeee26e0c4c12d375850084bf4496b5aa3c004d7eb22cd7974bf1b38ff72facca7f9301
- SSDEEP 3072:7t9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT+a:DlaZeKFxCnBheIdlua
- TLSH T17514AE12B5808032DAFE19351178DB615F3D7E608F5449AB6364B6AC1E717C0CF3AAB7
- MD5 SHA1 SHA512 SSDEEP TLSH