1478c1a39d7457aced4c3b9e2adb01b7c27fdea0ffe4b1fc2c125fd4e6aa80f1

Analysis

user interaction
yes
max time kernel
44s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedGiant Activation Service Unlocker 2026.0.0.exe
Size 8.9MB
Sample260604-fb1rhsa16p
SHA256 1478c1a39d7457aced4c3b9e2adb01b7c27fdea0ffe4b1fc2c125fd4e6aa80f1
MD5 6b54bfcaf95bdef652cc95d07c1f330f
SHA1 8386fa7f47eac2c550e8894227319fec15f0467f
SHA512 f917ffbe399e79bea650036bb4203d8e22408e9e28fa6a61c05fe6a056b988de420616d471ac091dcf1affd6f1b5eb1ce234dc6124214fa36a75ec9a8004b382
SSDEEP 196608:+7XFmyjAvO0kwFPzUBsGJEyAIQs80+jUlBDHrDOjkghj:GX+Iw5rGJEVIQs+jGBjfOxhj
TLSH
T14196221AB26E643DD4695B314AB3C2209A3B7E72B4368D1F86F4354CCF724441E3B7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	deep.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	deep.tmp

Executes dropped EXE 31 IoCs

pid	Process
64	RedGiant Activation Service Unlocker 2026.0.0.tmp
4196	deep.exe
6000	deep.tmp
3936	perl.exe
5992	perl.exe
3956	perl.exe
1012	perl.exe
5044	perl.exe
4712	perl.exe
4176	perl.exe
4184	perl.exe
5892	perl.exe
3344	perl.exe
3788	perl.exe
2148	perl.exe
2348	perl.exe
2368	perl.exe
1960	perl.exe
4852	perl.exe
2588	perl.exe
2168	perl.exe
4332	perl.exe
5356	perl.exe
3508	perl.exe
2248	perl.exe
5484	perl.exe
3256	perl.exe
3096	perl.exe
4156	perl.exe
2916	perl.exe
4184	perl.exe

Loads dropped DLL 64 IoCs

pid	Process
3936	perl.exe
3936	perl.exe
3936	perl.exe
3936	perl.exe
3936	perl.exe
5992	perl.exe
5992	perl.exe
5992	perl.exe
5992	perl.exe
5992	perl.exe
3956	perl.exe
3956	perl.exe
3956	perl.exe
3956	perl.exe
3956	perl.exe
1012	perl.exe
1012	perl.exe
1012	perl.exe
1012	perl.exe
1012	perl.exe
5044	perl.exe
5044	perl.exe
5044	perl.exe
5044	perl.exe
5044	perl.exe
4712	perl.exe
4712	perl.exe
4712	perl.exe
4712	perl.exe
4712	perl.exe
4176	perl.exe
4176	perl.exe
4176	perl.exe
4176	perl.exe
4176	perl.exe
4184	perl.exe
4184	perl.exe
4184	perl.exe
4184	perl.exe
4184	perl.exe
5892	perl.exe
5892	perl.exe
5892	perl.exe
5892	perl.exe
5892	perl.exe
3344	perl.exe
3344	perl.exe
3344	perl.exe
3344	perl.exe
3344	perl.exe
3788	perl.exe
3788	perl.exe
3788	perl.exe
3788	perl.exe
3788	perl.exe
2148	perl.exe
2148	perl.exe
2148	perl.exe
2148	perl.exe
2148	perl.exe
2348	perl.exe
2348	perl.exe
2348	perl.exe
2348	perl.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\sv\messages.json	msedge.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D Team Render Client.exe.local\wintrust.dll	RedGiant Activation Service Unlocker 2026.0.0.tmp
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D.exe.local\wintrust.dll	RedGiant Activation Service Unlocker 2026.0.0.tmp
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\c4dpy.exe.local	RedGiant Activation Service Unlocker 2026.0.0.tmp
File opened for modification	C:\Program Files\Red Giant\Services\Red Giant Service.exe	deep.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4544_1879723538\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\zh_CN\messages.json	msedge.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D Team Render Client.exe.local	RedGiant Activation Service Unlocker 2026.0.0.tmp
File created	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D.exe.local\is-G2GIA.tmp	RedGiant Activation Service Unlocker 2026.0.0.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\az\messages.json	msedge.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D Team Render Server.exe.local\wintrust.dll	RedGiant Activation Service Unlocker 2026.0.0.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\be\messages.json	msedge.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\c4dpy.exe.local\wintrust.dll	RedGiant Activation Service Unlocker 2026.0.0.tmp
File created	C:\Program Files\Maxon Cinema 4D 2026\Commandline.exe.local\is-K2M3E.tmp	RedGiant Activation Service Unlocker 2026.0.0.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\is\messages.json	msedge.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D.exe.local	RedGiant Activation Service Unlocker 2026.0.0.tmp
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\Cinema 4D Team Render Server.exe.local	RedGiant Activation Service Unlocker 2026.0.0.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_1659410255\_locales\hu\messages.json	msedge.exe
File opened for modification	C:\Program Files\Maxon Cinema 4D 2026\Commandline.exe.local	RedGiant Activation Service Unlocker 2026.0.0.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedGiant Activation Service Unlocker 2026.0.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedGiant Activation Service Unlocker 2026.0.0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deep.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5820	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5076-0-0x0000000000400000-0x00000000004EC000-memory.dmp	innosetup
behavioral1/memory/5076-7-0x0000000000400000-0x00000000004EC000-memory.dmp	innosetup
behavioral1/files/0x00070000000246dd-107.dat	innosetup
behavioral1/memory/4196-108-0x0000000000400000-0x00000000004EC000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
4108	timeout.exe
4128	timeout.exe
2348	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
2160	taskkill.exe
4296	taskkill.exe
4208	taskkill.exe
5976	taskkill.exe
4684	taskkill.exe
1576	taskkill.exe
3916	taskkill.exe
3224	taskkill.exe
5484	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250218096806420"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{709223C6-AC18-44CD-9413-74B54A1B46D3}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
64	RedGiant Activation Service Unlocker 2026.0.0.tmp
64	RedGiant Activation Service Unlocker 2026.0.0.tmp
6000	deep.tmp
6000	deep.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5976	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	2160	taskkill.exe
Token: SeDebugPrivilege	3224	taskkill.exe
Token: SeDebugPrivilege	4296	taskkill.exe
Token: SeDebugPrivilege	4208	taskkill.exe
Token: SeDebugPrivilege	5484	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
64	RedGiant Activation Service Unlocker 2026.0.0.tmp
4544	msedge.exe
6000	deep.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 64	5076	RedGiant Activation Service Unlocker 2026.0.0.exe	86
PID 64 wrote to memory of 4544	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	108
PID 4544 wrote to memory of 1596	4544	msedge.exe	109
PID 4544 wrote to memory of 5820	4544	msedge.exe	111
PID 4544 wrote to memory of 5760	4544	msedge.exe	112
PID 4544 wrote to memory of 5276	4544	msedge.exe	113
PID 4544 wrote to memory of 5760	4544	msedge.exe	112
PID 4544 wrote to memory of 5760	4544	msedge.exe	112
PID 4544 wrote to memory of 5276	4544	msedge.exe	113
PID 4544 wrote to memory of 4224	4544	msedge.exe	114
PID 4544 wrote to memory of 4224	4544	msedge.exe	114
PID 4544 wrote to memory of 4904	4544	msedge.exe	115
PID 4544 wrote to memory of 4224	4544	msedge.exe	114
PID 4544 wrote to memory of 4904	4544	msedge.exe	115
PID 4544 wrote to memory of 4904	4544	msedge.exe	115
PID 64 wrote to memory of 4516	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	116
PID 4516 wrote to memory of 5036	4516	net.exe	118
PID 64 wrote to memory of 2936	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	120
PID 2936 wrote to memory of 5968	2936	net.exe	123
PID 64 wrote to memory of 4108	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	124
PID 64 wrote to memory of 3140	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	126
PID 3140 wrote to memory of 1244	3140	net.exe	128
PID 64 wrote to memory of 4128	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	129
PID 64 wrote to memory of 700	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	131
PID 700 wrote to memory of 3396	700	net.exe	133
PID 64 wrote to memory of 5976	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	134
PID 64 wrote to memory of 4684	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	136
PID 64 wrote to memory of 1576	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	138
PID 64 wrote to memory of 3916	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	140
PID 64 wrote to memory of 2160	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	142
PID 64 wrote to memory of 3224	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	144
PID 64 wrote to memory of 4296	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	146
PID 64 wrote to memory of 4208	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	148
PID 64 wrote to memory of 4196	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	150
PID 4196 wrote to memory of 6000	4196	deep.exe	151
PID 4544 wrote to memory of 4464	4544	msedge.exe	152
PID 4544 wrote to memory of 4464	4544	msedge.exe	152
PID 4544 wrote to memory of 4464	4544	msedge.exe	152
PID 6000 wrote to memory of 5484	6000	deep.tmp	153
PID 6000 wrote to memory of 5124	6000	deep.tmp	155
PID 5124 wrote to memory of 3936	5124	cmd.exe	157
PID 5124 wrote to memory of 5992	5124	cmd.exe	158
PID 5124 wrote to memory of 3956	5124	cmd.exe	159
PID 5124 wrote to memory of 1012	5124	cmd.exe	160
PID 5124 wrote to memory of 5044	5124	cmd.exe	161
PID 5124 wrote to memory of 4712	5124	cmd.exe	162
PID 5124 wrote to memory of 4176	5124	cmd.exe	163
PID 5124 wrote to memory of 4184	5124	cmd.exe	164
PID 5124 wrote to memory of 5892	5124	cmd.exe	199
PID 5124 wrote to memory of 3344	5124	cmd.exe	166
PID 5124 wrote to memory of 3788	5124	cmd.exe	167
PID 5124 wrote to memory of 2148	5124	cmd.exe	168
PID 5124 wrote to memory of 2348	5124	cmd.exe	169
PID 5124 wrote to memory of 2368	5124	cmd.exe	170
PID 5124 wrote to memory of 1960	5124	cmd.exe	171
PID 5124 wrote to memory of 4852	5124	cmd.exe	172
PID 5124 wrote to memory of 2588	5124	cmd.exe	173
PID 5124 wrote to memory of 2168	5124	cmd.exe	174
PID 5124 wrote to memory of 4332	5124	cmd.exe	175
PID 5124 wrote to memory of 5356	5124	cmd.exe	176
PID 5124 wrote to memory of 3508	5124	cmd.exe	177
PID 5124 wrote to memory of 2248	5124	cmd.exe	178
PID 64 wrote to memory of 5980	64	RedGiant Activation Service Unlocker 2026.0.0.tmp	179
PID 5980 wrote to memory of 5484	5980	cmd.exe	181

C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2026.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2026.0.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\is-8IP3C.tmp\RedGiant Activation Service Unlocker 2026.0.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8IP3C.tmp\RedGiant Activation Service Unlocker 2026.0.0.tmp" /SL5="$402D8,8166887,908800,C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2026.0.0.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://codec.kyiv.ua/adobe
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x318,0x7ffa7298c188,0x7ffa7298c194,0x7ffa7298c1a0
      4⤵
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,233659151930078663,12150289013343217341,524288 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:3
      4⤵
      System Time Discovery
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,9877192389763392810,9136536895782513596,262144 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,6372383429312719301,8141659326497804829,524288 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,5394610201027646708,8511672574584824139,2097152 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,15751759448380683685,17003324982891722783,2097152 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4892,i,7225576398197454773,17542104412780770579,2097152 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5204,i,6744448981212264102,11976444689772282401,2097152 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,4917684751456379085,6586599436138168515,524288 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,9338224708594563516,4202251784080889439,524288 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6056,i,8323601600969746747,1816398146964782438,2097152 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6088,i,1217067091602126580,10411556475067796725,2097152 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,17205797436399269780,2077555882365481774,524288 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,17205797436399269780,2077555882365481774,524288 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,1615286565203513156,6430551776501984031,524288 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,7142968303495281347,15661614842799829845,524288 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,16966822698416028377,15417538874102996104,524288 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,1367744056334599518,11732964530530001201,524288 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,4515471677128666977,8237039033536654938,524288 --field-trial-handle=2644,i,13737196158451741496,14040816978217515948,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
      4⤵
      PID:212
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop "Red Giant Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Red Giant Service"
      4⤵
      PID:5036
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop "mxredirect"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "mxredirect"
      4⤵
      PID:5968
- - C:\Windows\system32\timeout.exe
    "timeout" /T 1 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:4108
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop "RLM-Redshift"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "RLM-Redshift"
      4⤵
      PID:1244
- - C:\Windows\system32\timeout.exe
    "timeout" /T 1 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:4128
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop mxredirect
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mxredirect
      4⤵
      PID:3396
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "RGContentService.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5976
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "MxNotify.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "maxon.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "c4dpy.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Commandline.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Cinema 4D Team Render Client.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Cinema 4D Team Render Server.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Cinema 4D.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\is-TNF1J.tmp\deep.exe
    "C:\Users\Admin\AppData\Local\Temp\is-TNF1J.tmp\deep.exe" /verysilent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\is-HDH8Q.tmp\deep.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HDH8Q.tmp\deep.tmp" /SL5="$F0294,5167317,908800,C:\Users\Admin\AppData\Local\Temp\is-TNF1J.tmp\deep.exe" /verysilent
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6000
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /im maxon.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5484
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-9DKUF.tmp\unlocker.cmd""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Magic Bullet Bez Friend\ParamCurve.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Magic Bullet Colorista\Colorista-IV.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Maxon Studio\MaxonStudioAE.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\MBLooks\Looks3_64.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant Universe\Universe_Glow_Glow_AE_Fx.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant Universe\Universe_Utilities_Unmult_Premium_AE_Fx.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant VFX\OpticalGlow.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant VFX\Primatte Keyer6.AEX"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Trapcode\Shine.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Universe\OFX\Universe_Glow_Glow_OFX.ofx.bundle\Contents\Win64\Universe_Glow_Glow_OFX.ofx"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Universe\OFX\Universe_Utilities_Unmult_Premium_OFX.ofx.bundle\Contents\Win64\Universe_Utilities_Unmult_Premium_OFX.ofx"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2026\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2025\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2024\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2023\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "cc:\Program Files\Adobe\Adobe After Effects 2022\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2021\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Plugins\OFX\OpticalGlow.ofx.bundle\Contents\Win64\OpticalGlow.ofx"
        6⤵
        Executes dropped EXE
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Plugins\OFX\Starglow.ofx.bundle\Contents\Win64\Starglow.ofx"
        6⤵
        Executes dropped EXE
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Plugins\OFX\Shine.ofx.bundle\Contents\Win64\Shine.OFX"
        6⤵
        Executes dropped EXE
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Plugins\OFX\MagicBulletLooks.ofx.bundle\Contents\Win64\MagicBulletLooks.ofx"
        6⤵
        Executes dropped EXE
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\x6D\x61\x78\x6F\x6E\x2E\x6E\x65\x74\x00/\x6D\x61\x78\x6F\x6E\x2E\x7A\x65\x74\x00/g" "c:\Program Files\Maxon\App Manager\Maxon.exe"
        6⤵
        Executes dropped EXE
        
        PID:2248
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-TNF1J.tmp\unlock4D.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Maxon Cinema 4D 2026\corelibs\c4d_base.xdl64"
      4⤵
      Executes dropped EXE
      PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Maxon Cinema 4D 2026\Redshift\res\libs\win64\redshift-core-vc140.dll"
      4⤵
      Executes dropped EXE
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\ProgramData\redshift\Tools\RedshiftLicensingTool.exe"
      4⤵
      Executes dropped EXE
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\ProgramData\redshift\bin\altus-cli.exe"
      4⤵
      Executes dropped EXE
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\ProgramData\redshift\bin\redshift-core-vc140.dll"
      4⤵
      Executes dropped EXE
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Maxon Cinema 4D 2026\plugins\Redshift\res\libs\win64\redshift-core-vc140.dll"
      4⤵
      Executes dropped EXE
      PID:4184
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" start "Red Giant Service"
    3⤵
    PID:2628
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start "Red Giant Service"
      4⤵
      PID:4684
- - C:\Windows\system32\timeout.exe
    "timeout" /T 1 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wintrust.dll

Path C:\Program Files\Maxon Cinema 4D 2026\c4dpy.exe.local\wintrust.dll
Size 373KB
SHA256 8c6c791e8db8728f9a610def238c61be054bfa3de487bf6ab037130a61a3ef19
MD5 b7a38368a52ff07d875e6465bd7ee26a
SHA1 99d5ea14e5ef16fc997e09f681eaad39bc5c6f61
SHA512 5a3b474f6b8731067f3a149fde53f9216cb8fb81ef5bb0aa4a622c7ceb7c4b8b65fdb91167d2a179b8c4e52a3761a42f5d06ddca2d935704d33db6f0ad7b3275
SSDEEP 6144:pmCBP6xz5/RZdpcIJJlmWnoBdM6DxlWGqrJvuxS2WeTwNLZLV/M9iQZoBNmlK/oW:UkPY/Vpc0JHWDxlRqb5qK/R
TLSH
T1C3844A2EA6F910A4D8B6913885538206D6737874237196CF429CC6BD9F2BFE47A3DF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 3a5bf018de850b586b3feaf253bad36e9b039f93d2f4dcf2821d4f14c2fd13e9
MD5 ab589e803cefd57f92bf5621d51dbbfc
SHA1 75f74463bafd67d28df54f9e7a1e57fc83a7cf7b
SHA512 b8d82772c98096d302f64fc1513f75464209e93f2ec663f3cb31f9f8c0957f5265f4c4b12c44e37a5e230efa05573656bc558ca2cefb35a29e4fb3ecc3c1c05d
TLSH
T100F02D76D821FC3718FD0B6974594B4AE75113172B80595F3B3C920C8FB463B86D591C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8f89c081551dec40c8c8e5e54e2d474cc1a836d796eaf192f4a39152ada22107
MD5 91e96359e09da7145c317109101e4c15
SHA1 b94f4893283a6428b1542c59f13e3dc0b85f84c1
SHA512 c41a5520b846b16f35d80f4fd0046d3a77a5b856b14f052d0842e6acc78774c2b30a5dafc5bfb4cfde3af14a6e7140f684d562fd42b05d1ff2b71df64fb5d081
SSDEEP 192:sxZbRMyMqZjK1Ml8MiR/fZsWMD1aZdIaRuvQzodp8FHW6+WNR/o/nt4tYIPtNwtf:sxZbhqR/fZsTxazIKYTUHbG/niqQHyB
TLSH
T13372E856AA344DBB8DD7D219FA44BB67D3F5056392904E485AFC8F0C00DBAEC620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f4cc118e75571145666942a34106e5c3200b88ff3b65f6242c0dca426aa009ef
MD5 0d70a00cf425ee748a96eec456825bcc
SHA1 e8c5431af44120b649b7c3eb973ebb342c9d51b3
SHA512 393c2f5fc31318b9b0e8f03f7c5e22df4acc3a4c4a0cbc4f64630a69169621de3b46efdc454f3ea79003fa34cbef49e6ce9524c3afcd35d7a9addd0c9143b796
SSDEEP 192:sxZLRMyMqZjK1Ml8MiR/fZssqMD1aZdIaRuvQzodp8FHW6+WNR/o/eIPtNwtw3xe:sxZL3qR/fZssXxazIKYTUHbG/eZHjB
TLSH
T13472E9566A34597B8DD7D219FA44BB53D7F5156392904E485AFCCF0C00EBAEC620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1256eb24b8435d098f6360b18787760c15b1d240ff91c5c0af2b4604bc0ba2fa
MD5 855fa227b4a0e685bb77b5cae4297800
SHA1 36a641a688a2764d950bd5058e9cbecae7ca24a3
SHA512 096945bb0174c5cebc82c5e7297781eba656d2aa71283e7f801ebe1a9c974e8d886ed7c9c8c09798cef4ea6e9169a1e81e970b20f19e0f4d349c1c819f22bf30
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzysy10LlV:eY8Od/HEnFhWvFvmXu1jaLt10Lm2NuFU
TLSH
T19DF2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5e5ee979f4977ff997d1cc5a63f712f6a4ece2475a97f15f6242fcf8bb549f40
MD5 36562bb715b89dba62ce5a5a58f8a075
SHA1 05e773326a2ce1ead7981e22c73b864658bc6b64
SHA512 edd13c74f7fc212b15c85fb8c6798c2b846b5e78e94310b4a6c9b944672d99ada2f96cef64b834c2aefee33427c156aec7dbf2d12fc8a4cdfd092cde0c4a8c16
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGZ:05ppxnY753RNBvRJJdt7p5J97rpX
TLSH
T110B25B5A703A0212393E2988B39696364F4135A37058E4AF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 07ec74612b72709fbd8b97611fef75fc26b81d3e22af6102c09150995749a6e6
MD5 a4e14303f1e65af0383c3f8b0233fe26
SHA1 8e2bd56256834cbfe24d77f55f15a14d215700c8
SHA512 c2136d7e8a50a0e79b0ee5dafbaa8e102f91fc8bca61936163fb16d2adabe3c1c2e60ebb48c9ae4ff733c8d7bdee4ae12243066df2d4083f5a72b980aa004bef
SSDEEP 384:np6iF9CcmyWCs3sNN8TUNTUlI43QckCrROopvBftGJXfhT9J8dLvEEhFvuZty/7F:pxFccps3YwggkZejGzT9J8pEEhFGw
TLSH
T1C1B24A35D868CEA7EDE74B89B74A3A43DEF01163C9CC9AD8DAD84E0C00871DD030B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f3da65ccafc8d3c23701ba46e604a4ce4b2e55323149e1aa502e9d600cad0190
MD5 9288d6df46e0372b802af87395a5a012
SHA1 19530608699562105a865f212d9a30f15b3f48c7
SHA512 aab868c2630bc9e8ddab5aa3e1814cf69fd7a183726f09500b7d025d4d57de892d231c959635a14366b0f1a814b04de697444b7c1752000a8531225a09fa23be
SSDEEP 768:pxF1jZbl3YwgWkZejGzT9J8pEEhBanMJMJ:RZ31jiKKEBaMyJ
TLSH
T1C2D26C36D865DEA7EDE74B89B74A3643AFF012A3C8C85AD8E9D85E0D00C719D130F919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 89ff91ab12163dc1262c375f1db922eea4582c3515bd3e24fba14dcf99922a1f
MD5 7f4fcfad414e81bc7e4561d25ccdafdf
SHA1 c9e77a38bb4d7e14ec3e806936c75076f5474125
SHA512 780661b2eb43654546c2517d71acb3cb4dbe9f6e26293fa85b33546e20bd22772330cba68ce29c6552d5269e0d32047aeb6cef684c3e5f20e3e98d6140405465
SSDEEP 384:npkiF9CcmyWCs3sNG8TUNTUlIm2QckCr9laKpvBftGJXfhT9J84E6pye4KV8p0/5:p/Fccps3HwgbkUUkjGzT9J84ElI8p0/Z
TLSH
T159B25D36EC68DABBEDE74F89B74A7A03DEE0526785DC59E4CAD85D0D00931DC030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7b032e52c6585d5fe1e46e24f640d59c84aca39f50731b763a3e95cd8aac4c61
MD5 17f3b21c477a7f7d9d0eb012c9955b86
SHA1 025dee81f1bbcde67377131b488a413399fe4db6
SHA512 5f3490be8ec133b184862fc40cc4a69155d9b187c95cf866c37898fdbfc0c91e43780d405dbb5dd3eaf9005f78ff6198eb00d35d0b84279347225b6e064bbf69
TLSH
T164411658B6F91148B3B76F5A9BF7B86D487EB9772E06945E10110D4F0662E00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

RedGiant Activation Service Unlocker 2026.0.0.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-8IP3C.tmp\RedGiant Activation Service Unlocker 2026.0.0.tmp
Size 3.6MB
SHA256 e8004a806c1717bc0104d197f08a79ed2e696c955e8a24b35f893cabf5398b71
MD5 25fc54a189bc2a89e9102c2d6c534b79
SHA1 ab47bcadc9a3189b30bf79f387141cf1333ecae1
SHA512 6dbf10c630b722299f432bec055db4de2d8641991f9cee1b074a42385a542a653f265e76f286bf0637def8daf90ee2807e253306bce4ee02dc8b9e2df6a31f44
SSDEEP 49152:DrHHFnKA0otwLU/g2SmYXFuaYQ4mQVHYEXQcmpeDxjT/t333jH:DrnwboEuM4mQiEC0DH333z
TLSH
T1A9064A13F248A93AD06A3A354637C65499377B626A2ADC176BFC3D4C8F361403E3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unlocker.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-9DKUF.tmp\unlocker.cmd
Size 8KB
SHA256 31452f15616a71b0298db001df08cdfb95120491ab45af98bb95e7b6cbefcc42
MD5 4cc36bcd51ad2b24c2fa73fe4797b8e8
SHA1 1d0f1a99bddb4d328b68871af1f0f43841c7aed5
SHA512 23cabe30cdb5c4fb9c2f785326743d8afd2814719ccd60b1eaacdda3b85be243e94452b04604bda624cd511bf71f608c20e036e97569f179bcec2e2505fd8154
SSDEEP 96:xkMkRxkYkpk0k/kzkQkDgcxxexlxCxLtK4xxh1hth5h94:+VR+RGtMA5Lbn/Tq
TLSH
T1AC0280D28740C9C76099D5C51E217B480C6FE158DBAA138A9B1EE39F4F42B8742EFC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deep.exe

Path C:\Users\Admin\AppData\Local\Temp\is-TNF1J.tmp\deep.exe
Size 6.0MB
SHA256 5b391a6f2128db2fc10b29058a80bb190198cfb264e22daf65de6d087b4c30ff
MD5 8e89ae29a0f1d3b27be8d9343c5e54ff
SHA1 0bdf72f98c594877ada16259461a0fd2ddd88b7b
SHA512 a085133599c4778f461721e1bff243431e9dc90063a780889c4ed7cabff6ba3d40d9dd924eddc7160db67540edac9aa085fde75e11c5985cf9e44718d0374747
SSDEEP 98304:+76ETEHMY0eI7otycBu1h4RxQ3aOojjsjL/enH1M1nIWg2zrw2U9bsIojkgI6j:+73EZbACKh4Qajc/ena1nLgAk0jkghj
TLSH
T1AF56122AB25E653DD46A1A3145B3C6209A377E72B4328D2F42F4390CCF765481E3B7B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 711KB
SHA256 cb96718f7ef83319472e4ca3fcdf6d002226d3a6ff4d0d64b6e221aba58016a3
MD5 97ba9d2d7090a7d265cefed7fa40b1bf
SHA1 04231941ab6681e445c529d35f91d4a2a80f92ec
SHA512 e0ed771116902e2aae3650fed86f2c07fc164134cbaa4961665d7ba33a8f4ef7c6fdbda93046eaa3832df3882d730487a77a973bee9578caa333c83e894bf601
SSDEEP 6144:sbtQeWsyqCyeYJxCMMAmivzouBFBdyjW11jQ1UYggO0Ukuh7RZ5ztkXy3j9acKiV:beWAJUpg3/1sggO0Ukuh7RZ55k5EV
TLSH
T167F43A847B9DB49BC03002B5569B025B1330A98533D4BB6B7E6D7A38DD933D8CF886D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 2.2MB
SHA256 d747bb93d4e936ddd57b6258355a977e210ad308c0f832d3d47fab6f9191c2ce
MD5 b1852a4962ea7185dc353fe6f0ab4553
SHA1 b4335332bfc3033e5465db6eb56b344cbe2270b1
SHA512 e7cfba7553879df5df57275e65509f18069ddd8c3c5c18676a2a326bc91204145ddf6be5013380613257b398734e11c513647e86878ec9525533b772d929d2d5
SSDEEP 49152:pbxE3cqZXY88ZxCx7x+vrHpH4cW5aYThxsYiv3c1QD:XEMqcxCx7x+vyZa/3c1QD
TLSH
T177B55B03D6974D7CC9DBE7B4925B92769A20FC298538BD2E5E9CC7302B12E40972FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 85KB
SHA256 8ae45c5928698df7da6780e282bc5053a7b1a87a1cba0a2083aa26c473c3f7f9
MD5 59a112452ceccba063cc85d0513fd0a7
SHA1 f046c7d16606bcd8b1104270cdbba545549ea311
SHA512 40bc9c0966dfa13167c59b14eb0c9e2096a30408c65977dec9e86628183505b877aacf5f444b59ff2dd12d42a6e406c68c276b60a598b501d6ff0ea0a87f9115
SSDEEP 1536:Tb4A1X+bp4B4gepS7k8G9rS6nBPm3YB+ZQF69Z6:T9Obp4GkQ8G9rS6nBPm3YB+ZQFOZ6
TLSH
T15383C237E6B388ACC1DB92B0B7C691F175B6FC100520AA1E134596343F5FDA42FAD989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl.exe

Path C:\Users\Admin\AppData\Local\Temp\perl.exe
Size 43KB
SHA256 13f689c7c8d93a546ae207e28000a0b163851dd0a148d5d329618ffc7daff554
MD5 98a571d345034f8ff5953714a18b68a1
SHA1 118da15a20c31845d64de6a1bfeeaf1046d16263
SHA512 6daee529e6dea6648bad518cc86c8d0bfd59399908eda24ff622c1cb6f60115fd6a6dc21886a86beefe36e476077101ebbc4c4a9a11af5247c0d7853e67a7fc8
SSDEEP 768:u95VKDDsyfhw1111111111111111111111111111Tb4YMz8vEUDCFFtFF9vQ4:rHsyobCzKIFFtFFK4
TLSH
T17F13D75EF722C899C5C552B4F48986F1D6A0FCF1C850462F22377F697B727884F69282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl538.dll

Path C:\Users\Admin\AppData\Local\Temp\perl538.dll
Size 3.0MB
SHA256 68bef13493195a03f812c8f6dc15ff1c429010644605e5f9dc66388e77fe2eaf
MD5 a6764a022dc825aba978297546603e0f
SHA1 a8ff5ac32cd4848534b68c95b9df44fdb6f57a25
SHA512 564ba6f9a9e1b12488bf6768af7f8a456730449d82ce88cba17944ea0c52c081117dec57828eb612ac41bba0dcb38ab0c580733f126e057a38023cae29ebffbf
SSDEEP 49152:B+lFF8N8QewIPGm4CKzGNR7OPlTmKZ9kjCr4WmKME0YHAnGlJO12RIT5kqBGV9Px:0lWHzh
TLSH
T141E54A47ECA2D674C46D82754EAF07667332F08C66267B1F25289A303E53B241F9E36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-5-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/64-8-0x0000000000400000-0x00000000007A1000-memory.dmp

Download

memory/64-9-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/1012-180-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/1012-182-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/1012-179-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/1012-181-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/1012-183-0x000001DC17CC0000-0x000001DC17EF8000-memory.dmp

Download

memory/2148-254-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/2148-253-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/2148-255-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/2148-256-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/2148-257-0x00000275461F0000-0x0000027546428000-memory.dmp

Download

memory/3344-241-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/3344-242-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/3344-243-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/3344-244-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/3344-245-0x0000022E90B60000-0x0000022E90D98000-memory.dmp

Download

memory/3788-247-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/3788-248-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/3788-249-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/3788-250-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/3788-251-0x00000253CA5D0000-0x00000253CA808000-memory.dmp

Download

memory/3936-145-0x000001FA15AB0000-0x000001FA15CE8000-memory.dmp

Download

memory/3936-144-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/3936-143-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/3936-142-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/3936-141-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/3956-167-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/3956-171-0x00000284B61D0000-0x00000284B6408000-memory.dmp

Download

memory/3956-170-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/3956-169-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/3956-168-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/4176-218-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/4176-219-0x000001290DC40000-0x000001290DE78000-memory.dmp

Download

memory/4176-217-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/4176-216-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/4176-215-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/4184-231-0x000001F2CD7B0000-0x000001F2CD9E8000-memory.dmp

Download

memory/4184-227-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/4184-228-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/4184-229-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/4184-230-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/4196-108-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4712-207-0x0000024B97490000-0x0000024B976C8000-memory.dmp

Download

memory/4712-203-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/4712-204-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/4712-205-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/4712-206-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/5044-192-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/5044-193-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/5044-191-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/5044-195-0x00000217010E0000-0x0000021701318000-memory.dmp

Download

memory/5044-194-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/5076-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/5076-7-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/5892-237-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/5892-235-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/5892-236-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/5892-238-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/5892-239-0x000002AD9B0E0000-0x000002AD9B318000-memory.dmp

Download

memory/5992-155-0x00007FF78E2B0000-0x00007FF78E2C3000-memory.dmp

Download

memory/5992-156-0x00007FFA73810000-0x00007FFA73B2A000-memory.dmp

Download

memory/5992-157-0x00007FFA81410000-0x00007FFA814B5000-memory.dmp

Download

memory/5992-158-0x00007FFA813F0000-0x00007FFA8140D000-memory.dmp

Download

memory/5992-159-0x0000029183DD0000-0x0000029184008000-memory.dmp

Download