4826d76569018dd144d409ca12d7b0ac2305339c4e9f87e510bfc5ad00eccb39

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedGiant Activation Service Unlocker 2025.0.exe
Size 9.3MB
Sample260707-yy9xtaes2p
SHA256 4826d76569018dd144d409ca12d7b0ac2305339c4e9f87e510bfc5ad00eccb39
MD5 50998fc2689187bc0bd38f98f7376c56
SHA1 c6506d0f7d3ffa7108187562d3f834064ff3bff5
SHA512 063d393a61182f46d9c6518e71e9cd1974a6613902c63d02186f39f4de1d6130050e10ef9ebfb81549e10abc8cfab759cf235194e202511cf19e3c0bf16c81bb
SSDEEP 196608:a2bnbuUv7wifXroID9fKcF2kznVh1HmmRK45SNqmF1fLAV:XzbuUv7w9IRfK6zVjHmkK45StF1EV
TLSH
T134A6223BB255A73ED1BE0A364A7382109E3B76517B338D2E47F46D9CCF261401E3A646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	deep.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	deep.tmp

Executes dropped EXE 21 IoCs

pid	Process
1336	RedGiant Activation Service Unlocker 2025.0.tmp
6100	deep.exe
4784	deep.tmp
1612	perl.exe
6068	perl.exe
5320	perl.exe
4656	perl.exe
1656	perl.exe
2240	perl.exe
3416	perl.exe
2436	perl.exe
2528	perl.exe
6004	perl.exe
1872	perl.exe
2372	perl.exe
5444	perl.exe
3612	perl.exe
1544	perl.exe
1112	perl.exe
5452	perl.exe
3160	perl.exe

Loads dropped DLL 64 IoCs

pid	Process
1336	RedGiant Activation Service Unlocker 2025.0.tmp
4784	deep.tmp
1612	perl.exe
1612	perl.exe
1612	perl.exe
1612	perl.exe
1612	perl.exe
6068	perl.exe
6068	perl.exe
6068	perl.exe
6068	perl.exe
5320	perl.exe
5320	perl.exe
5320	perl.exe
5320	perl.exe
4656	perl.exe
4656	perl.exe
4656	perl.exe
4656	perl.exe
1656	perl.exe
1656	perl.exe
1656	perl.exe
1656	perl.exe
2240	perl.exe
2240	perl.exe
2240	perl.exe
2240	perl.exe
3416	perl.exe
3416	perl.exe
3416	perl.exe
3416	perl.exe
2436	perl.exe
2436	perl.exe
2436	perl.exe
2436	perl.exe
2528	perl.exe
2528	perl.exe
2528	perl.exe
2528	perl.exe
6004	perl.exe
6004	perl.exe
6004	perl.exe
6004	perl.exe
1872	perl.exe
1872	perl.exe
1872	perl.exe
1872	perl.exe
2372	perl.exe
2372	perl.exe
2372	perl.exe
2372	perl.exe
5444	perl.exe
5444	perl.exe
5444	perl.exe
5444	perl.exe
3612	perl.exe
3612	perl.exe
3612	perl.exe
3612	perl.exe
1544	perl.exe
1544	perl.exe
1544	perl.exe
1544	perl.exe
1112	perl.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Red Giant\Services\is-MR68V.tmp	deep.tmp
File opened for modification	C:\Program Files\Red Giant\Services\Red Giant Service.exe	deep.tmp

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedGiant Activation Service Unlocker 2025.0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deep.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedGiant Activation Service Unlocker 2025.0.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4192-1-0x0000000000400000-0x00000000004DE000-memory.dmp	innosetup
behavioral2/memory/4192-11-0x0000000000400000-0x00000000004DE000-memory.dmp	innosetup
behavioral2/files/0x000d00000001c4a8-31.dat	innosetup
behavioral2/memory/6100-33-0x0000000000400000-0x00000000004DE000-memory.dmp	innosetup

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
2832	timeout.exe
1412	timeout.exe
5296	timeout.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
5496	taskkill.exe
1096	taskkill.exe
4308	taskkill.exe
5840	taskkill.exe
2116	taskkill.exe
1068	taskkill.exe
4988	taskkill.exe
3564	taskkill.exe
5636	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1336	RedGiant Activation Service Unlocker 2025.0.tmp
1336	RedGiant Activation Service Unlocker 2025.0.tmp
4784	deep.tmp
4784	deep.tmp

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5496	taskkill.exe
Token: SeDebugPrivilege	1068	taskkill.exe
Token: SeDebugPrivilege	1096	taskkill.exe
Token: SeDebugPrivilege	4308	taskkill.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	4988	taskkill.exe
Token: SeDebugPrivilege	3564	taskkill.exe
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeDebugPrivilege	5636	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1336	RedGiant Activation Service Unlocker 2025.0.tmp
4784	deep.tmp

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 1336	4192	RedGiant Activation Service Unlocker 2025.0.exe	88
PID 1336 wrote to memory of 4676	1336	RedGiant Activation Service Unlocker 2025.0.tmp	89
PID 4676 wrote to memory of 3248	4676	net.exe	91
PID 1336 wrote to memory of 2832	1336	RedGiant Activation Service Unlocker 2025.0.tmp	92
PID 1336 wrote to memory of 1056	1336	RedGiant Activation Service Unlocker 2025.0.tmp	94
PID 1056 wrote to memory of 6132	1056	net.exe	96
PID 1336 wrote to memory of 1412	1336	RedGiant Activation Service Unlocker 2025.0.tmp	97
PID 1336 wrote to memory of 5324	1336	RedGiant Activation Service Unlocker 2025.0.tmp	99
PID 5324 wrote to memory of 468	5324	net.exe	101
PID 1336 wrote to memory of 5496	1336	RedGiant Activation Service Unlocker 2025.0.tmp	102
PID 1336 wrote to memory of 1068	1336	RedGiant Activation Service Unlocker 2025.0.tmp	105
PID 1336 wrote to memory of 1096	1336	RedGiant Activation Service Unlocker 2025.0.tmp	107
PID 1336 wrote to memory of 4308	1336	RedGiant Activation Service Unlocker 2025.0.tmp	109
PID 1336 wrote to memory of 5840	1336	RedGiant Activation Service Unlocker 2025.0.tmp	111
PID 1336 wrote to memory of 4988	1336	RedGiant Activation Service Unlocker 2025.0.tmp	113
PID 1336 wrote to memory of 3564	1336	RedGiant Activation Service Unlocker 2025.0.tmp	115
PID 1336 wrote to memory of 2116	1336	RedGiant Activation Service Unlocker 2025.0.tmp	117
PID 1336 wrote to memory of 6100	1336	RedGiant Activation Service Unlocker 2025.0.tmp	119
PID 6100 wrote to memory of 4784	6100	deep.exe	120
PID 4784 wrote to memory of 5636	4784	deep.tmp	121
PID 4784 wrote to memory of 2976	4784	deep.tmp	123
PID 2976 wrote to memory of 1612	2976	cmd.exe	125
PID 2976 wrote to memory of 6068	2976	cmd.exe	126
PID 2976 wrote to memory of 5320	2976	cmd.exe	127
PID 2976 wrote to memory of 4656	2976	cmd.exe	128
PID 2976 wrote to memory of 1656	2976	cmd.exe	129
PID 2976 wrote to memory of 2240	2976	cmd.exe	130
PID 2976 wrote to memory of 3416	2976	cmd.exe	131
PID 2976 wrote to memory of 2436	2976	cmd.exe	132
PID 2976 wrote to memory of 2528	2976	cmd.exe	133
PID 2976 wrote to memory of 6004	2976	cmd.exe	134
PID 2976 wrote to memory of 1872	2976	cmd.exe	135
PID 2976 wrote to memory of 2372	2976	cmd.exe	136
PID 2976 wrote to memory of 5444	2976	cmd.exe	137
PID 2976 wrote to memory of 3612	2976	cmd.exe	138
PID 2976 wrote to memory of 1544	2976	cmd.exe	139
PID 2976 wrote to memory of 1112	2976	cmd.exe	140
PID 2976 wrote to memory of 5452	2976	cmd.exe	141
PID 2976 wrote to memory of 3160	2976	cmd.exe	142
PID 1336 wrote to memory of 5448	1336	RedGiant Activation Service Unlocker 2025.0.tmp	143
PID 5448 wrote to memory of 5936	5448	net.exe	145
PID 1336 wrote to memory of 5296	1336	RedGiant Activation Service Unlocker 2025.0.tmp	146

C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2025.0.exe
"C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2025.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\is-T2M00.tmp\RedGiant Activation Service Unlocker 2025.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-T2M00.tmp\RedGiant Activation Service Unlocker 2025.0.tmp" /SL5="$40218,8713422,841728,C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2025.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop "Red Giant Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Red Giant Service"
      4⤵
      PID:3248
- - C:\Windows\system32\timeout.exe
    "timeout" /T 1 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2832
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop "RLM-Redshift"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "RLM-Redshift"
      4⤵
      PID:6132
- - C:\Windows\system32\timeout.exe
    "timeout" /T 1 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1412
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop mxredirect
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5324
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mxredirect
      4⤵
      PID:468
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "RGContentService.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "MxNotify.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "maxon.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1096
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "c4dpy.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Commandline.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Cinema 4D Team Render Client.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Cinema 4D Team Render Server.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3564
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Cinema 4D.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\is-0NDEF.tmp\deep.exe
    "C:\Users\Admin\AppData\Local\Temp\is-0NDEF.tmp\deep.exe" /verysilent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\is-V19EU.tmp\deep.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-V19EU.tmp\deep.tmp" /SL5="$11025E,5820026,841728,C:\Users\Admin\AppData\Local\Temp\is-0NDEF.tmp\deep.exe" /verysilent
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /im maxon.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5636
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-N4OUL.tmp\unlocker.cmd""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant Universe\Universe_Glow_Glow_AE_Fx.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant Universe\Universe_Utilities_Unmult_Premium_AE_Fx.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Trapcode\Shine.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant VFX\Primatte Keyer6.AEX"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant VFX\OpticalGlow.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\MBLooks\Looks3_64.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Magic Bullet Colorista\Colorista-IV.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\Magic Bullet Suite\MagicBulletLooks.ofx.bundle\Contents\Win64\MagicBulletLooks.ofx"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\Red Giant Universe\Universe_Glow_Glow_OFX.ofx.bundle\Contents\Win64\Universe_Glow_Glow_OFX.ofx"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\Red Giant Universe\Universe_Utilities_Unmult_Premium_OFX.ofx.bundle\Contents\Win64\Universe_Utilities_Unmult_Premium_OFX.ofx"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2025\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2024\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2023\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "cc:\Program Files\Adobe\Adobe After Effects 2022\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2021\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Maxon Studio\MaxonStudioAE.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Magic Bullet Bez Friend\ParamCurve.aex"
        6⤵
        Executes dropped EXE
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\x6D\x61\x78\x6F\x6E\x2E\x6E\x65\x74\x00/\x6D\x61\x78\x6F\x6E\x2E\x7A\x65\x74\x00/g" "c:\Program Files\Maxon\App Manager\Maxon.exe"
        6⤵
        Executes dropped EXE
        
        PID:3160
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" start "Red Giant Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start "Red Giant Service"
      4⤵
      PID:5936
- - C:\Windows\system32\timeout.exe
    "timeout" /T 1 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0NDEF.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
TLSH
T11051CE835239A462C41A37B426E7E509B35B467643CE4FE33590230EF8876F80C35D90
MD5 SHA1 SHA512 TLSH

Submit Download

deep.exe

Path C:\Users\Admin\AppData\Local\Temp\is-0NDEF.tmp\deep.exe
Size 6.6MB
SHA256 1c003d5b30fe29433725acedc2d082b20770ab9c694dcc9eb19ff17cbae6aaec
MD5 3cbdcb8ca2922fb9bf249cf4db314918
SHA1 c639d8d9cc1ece4c92d9da0f7b9d9e5443e4e9e0
SHA512 1376f1084bcf7eff6a051b7ae855809e77ac371a8565f3a5f2e4b4dc5d00cd840e365986fa7284cb011ac36710b8a26880ce32947183737d4bc81d44e7c33e67
SSDEEP 196608:vWdy/MUOf3vHcH6VEpd9TqyPo0U33t3h3m2rqF1fLAV:vWd/v5Ehno0U3z3m2mF1EV
TLSH
T11166122BB258A73DD57E4A32467382109E3B76617B338C2E57F42DDCDF265402E3A246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unlocker.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-N4OUL.tmp\unlocker.cmd
Size 6KB
SHA256 aff176577a3eeac4e93e51ba4e36c2f33baac2769d3f06c73cecd9170e38512e
MD5 e2827cd186407da83f2c02c1067c7e57
SHA1 1005ea31999b57c8b2bfd9056b3bffdf9ae2face
SHA512 1ea854573e1505e5a52f469f88bb4b3ad5e922ec7d73970fd881b16376b56950329fac1af760d1f119a949c1231dd505c1941efdcba621334f2e5e926f2315c0
SSDEEP 96:xk0k/kDkQkzkpkRxmy2xlxCxLtK4xxkYk24:+tMQ5AGRjORr
TLSH
T130E19FD28740C9876499D5C51E317B480C6FE118CAAA138A9B1EF39F0F42B8742EFC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGiant Activation Service Unlocker 2025.0.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-T2M00.tmp\RedGiant Activation Service Unlocker 2025.0.tmp
Size 3.2MB
SHA256 568d537b257e38891571d59f5742bc9633fc7307d96f7ddd88e9712cff4dcf91
MD5 bf52fb36404b79044bf6c9715855d557
SHA1 29d3b50325f93971915c57850eab6fad3df861af
SHA512 eba011ed6b1552b7535ac9ceb98b7b2d8c0fd5b234853308ba9f84ab1f2fbfa9ee41fe4acf856af1faf6e37ef3e1997df16b73197e27a9203d4d511087761ba7
SSDEEP 49152:QlqOSBnrDmgNHmie6R2SBu5r/Ys0YHL99Po8ibo5zBXQrEfnMw8LMHsT5N333d:Q7HGaHL9q8iazBXQrEby333d
TLSH
T184E52917F38C713ED06A3B3B4533C6909937B76169269C576BF8284C8E3A5406E3BA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 711KB
SHA256 cb96718f7ef83319472e4ca3fcdf6d002226d3a6ff4d0d64b6e221aba58016a3
MD5 97ba9d2d7090a7d265cefed7fa40b1bf
SHA1 04231941ab6681e445c529d35f91d4a2a80f92ec
SHA512 e0ed771116902e2aae3650fed86f2c07fc164134cbaa4961665d7ba33a8f4ef7c6fdbda93046eaa3832df3882d730487a77a973bee9578caa333c83e894bf601
SSDEEP 6144:sbtQeWsyqCyeYJxCMMAmivzouBFBdyjW11jQ1UYggO0Ukuh7RZ5ztkXy3j9acKiV:beWAJUpg3/1sggO0Ukuh7RZ55k5EV
TLSH
T167F43A847B9DB49BC03002B5569B025B1330A98533D4BB6B7E6D7A38DD933D8CF886D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 2.2MB
SHA256 d747bb93d4e936ddd57b6258355a977e210ad308c0f832d3d47fab6f9191c2ce
MD5 b1852a4962ea7185dc353fe6f0ab4553
SHA1 b4335332bfc3033e5465db6eb56b344cbe2270b1
SHA512 e7cfba7553879df5df57275e65509f18069ddd8c3c5c18676a2a326bc91204145ddf6be5013380613257b398734e11c513647e86878ec9525533b772d929d2d5
SSDEEP 49152:pbxE3cqZXY88ZxCx7x+vrHpH4cW5aYThxsYiv3c1QD:XEMqcxCx7x+vyZa/3c1QD
TLSH
T177B55B03D6974D7CC9DBE7B4925B92769A20FC298538BD2E5E9CC7302B12E40972FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 85KB
SHA256 8ae45c5928698df7da6780e282bc5053a7b1a87a1cba0a2083aa26c473c3f7f9
MD5 59a112452ceccba063cc85d0513fd0a7
SHA1 f046c7d16606bcd8b1104270cdbba545549ea311
SHA512 40bc9c0966dfa13167c59b14eb0c9e2096a30408c65977dec9e86628183505b877aacf5f444b59ff2dd12d42a6e406c68c276b60a598b501d6ff0ea0a87f9115
SSDEEP 1536:Tb4A1X+bp4B4gepS7k8G9rS6nBPm3YB+ZQF69Z6:T9Obp4GkQ8G9rS6nBPm3YB+ZQFOZ6
TLSH
T15383C237E6B388ACC1DB92B0B7C691F175B6FC100520AA1E134596343F5FDA42FAD989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl.exe

Path C:\Users\Admin\AppData\Local\Temp\perl.exe
Size 43KB
SHA256 13f689c7c8d93a546ae207e28000a0b163851dd0a148d5d329618ffc7daff554
MD5 98a571d345034f8ff5953714a18b68a1
SHA1 118da15a20c31845d64de6a1bfeeaf1046d16263
SHA512 6daee529e6dea6648bad518cc86c8d0bfd59399908eda24ff622c1cb6f60115fd6a6dc21886a86beefe36e476077101ebbc4c4a9a11af5247c0d7853e67a7fc8
SSDEEP 768:u95VKDDsyfhw1111111111111111111111111111Tb4YMz8vEUDCFFtFF9vQ4:rHsyobCzKIFFtFFK4
TLSH
T17F13D75EF722C899C5C552B4F48986F1D6A0FCF1C850462F22377F697B727884F69282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl538.dll

Path C:\Users\Admin\AppData\Local\Temp\perl538.dll
Size 3.0MB
SHA256 68bef13493195a03f812c8f6dc15ff1c429010644605e5f9dc66388e77fe2eaf
MD5 a6764a022dc825aba978297546603e0f
SHA1 a8ff5ac32cd4848534b68c95b9df44fdb6f57a25
SHA512 564ba6f9a9e1b12488bf6768af7f8a456730449d82ce88cba17944ea0c52c081117dec57828eb612ac41bba0dcb38ab0c580733f126e057a38023cae29ebffbf
SSDEEP 49152:B+lFF8N8QewIPGm4CKzGNR7OPlTmKZ9kjCr4WmKME0YHAnGlJO12RIT5kqBGV9Px:0lWHzh
TLSH
T141E54A47ECA2D674C46D82754EAF07667332F08C66267B1F25289A303E53B241F9E36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-13-0x0000000002640000-0x0000000002641000-memory.dmp

Download

memory/1336-46-0x0000000000400000-0x0000000000739000-memory.dmp

Download

memory/1336-12-0x0000000000400000-0x0000000000739000-memory.dmp

Download

memory/1336-6-0x0000000002640000-0x0000000002641000-memory.dmp

Download

memory/1612-61-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/1612-65-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/1612-63-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/1612-64-0x00007FFBBEF60000-0x00007FFBBF198000-memory.dmp

Download

memory/1612-62-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/1656-107-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/1656-105-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/1656-108-0x00007FFBBEF60000-0x00007FFBBF198000-memory.dmp

Download

memory/1656-106-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/1656-109-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/1872-172-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/1872-171-0x00007FFBBEF60000-0x00007FFBBF198000-memory.dmp

Download

memory/1872-168-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/1872-170-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/1872-169-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/2240-116-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/2240-119-0x00007FFBBEF60000-0x00007FFBBF198000-memory.dmp

Download

memory/2240-118-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/2240-117-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/2240-120-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/2372-175-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/2372-178-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/2372-176-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/2372-174-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/2436-141-0x00007FFBBEF60000-0x00007FFBBF198000-memory.dmp

Download

memory/2436-142-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/2436-138-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/2436-140-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/2436-139-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/2528-150-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/2528-152-0x00007FFBBEF60000-0x00007FFBBF198000-memory.dmp

Download

memory/2528-151-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/2528-153-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/2528-149-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/3416-130-0x00007FFBBEF60000-0x00007FFBBF198000-memory.dmp

Download

memory/3416-128-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/3416-131-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/3416-129-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/3416-127-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/4192-1-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/4192-11-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/4656-96-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/4656-98-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/4656-95-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/4656-97-0x00007FFBBEF60000-0x00007FFBBF198000-memory.dmp

Download

memory/4656-94-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/5320-86-0x00007FFBBEF60000-0x00007FFBBF198000-memory.dmp

Download

memory/5320-84-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/5320-83-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/5320-85-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/5320-87-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/6004-162-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/6004-163-0x00007FFBBEF60000-0x00007FFBBF198000-memory.dmp

Download

memory/6004-164-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/6004-161-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/6004-160-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/6068-75-0x00007FFBBEF60000-0x00007FFBBF198000-memory.dmp

Download

memory/6068-76-0x00007FFBD5B40000-0x00007FFBD5B5D000-memory.dmp

Download

memory/6068-74-0x00007FFBCAD30000-0x00007FFBCADD5000-memory.dmp

Download

memory/6068-72-0x00007FF675A90000-0x00007FF675AA3000-memory.dmp

Download

memory/6068-73-0x00007FFBBE9D0000-0x00007FFBBECEA000-memory.dmp

Download

memory/6100-33-0x0000000000400000-0x00000000004DE000-memory.dmp

Download