4f0ef6a7e79302fc71065a573e462e4d280116d47317b2e52bd0c8b1a8c97081

Analysis

user interaction
yes
max time kernel
87s
max time network
74s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BorisFX Vegas uni-patch 2026.exe
Size 3.5MB
Sample260714-e11blses5m
SHA256 4f0ef6a7e79302fc71065a573e462e4d280116d47317b2e52bd0c8b1a8c97081
MD5 7220609dc7cc675bfb395590d24bdd50
SHA1 b2ae719782e2e4c90d4469bbcc118620a8c9f8ca
SHA512 e1eeb87813da5e9d01d4236ff416761089dc88fcba3be3d15a569967b911241230ce783a5fd2c95f12a29bfd0c662a3ad552cee7d4f65db93481b2f1154b55a5
SSDEEP 49152:q7JCXWKZ1b16sfZkBsad7F53pwJm/Y2IfdOb5PFsAJ7BDxyCb1Tg2jaw:q7EF1b16qkBlBWr2IfdObnTxP1E2j7
TLSH
T1DEF5F11AB65EF13DD8593A3545B3C2305A377F29A43A8D1BC6F8380CCFA74442E2B665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 45 IoCs

pid	Process
5212	BorisFX Vegas uni-patch 2026.tmp
2368	perl.exe
3176	perl.exe
3248	perl.exe
2980	perl.exe
2628	perl.exe
2436	perl.exe
1244	perl.exe
1588	perl.exe
4976	perl.exe
4920	perl.exe
664	perl.exe
2172	perl.exe
3892	perl.exe
4484	perl.exe
4356	perl.exe
4988	perl.exe
5240	perl.exe
2972	perl.exe
3492	perl.exe
5256	perl.exe
5388	perl.exe
5296	perl.exe
5272	perl.exe
5356	perl.exe
5432	perl.exe
5480	perl.exe
5428	perl.exe
5684	perl.exe
5884	perl.exe
5904	perl.exe
5528	perl.exe
2664	perl.exe
1728	perl.exe
4984	perl.exe
1236	perl.exe
1448	perl.exe
1644	perl.exe
5216	perl.exe
1084	perl.exe
5920	perl.exe
2480	perl.exe
1296	perl.exe
1748	perl.exe
768	perl.exe

Loads dropped DLL 64 IoCs

pid	Process
2368	perl.exe
2368	perl.exe
2368	perl.exe
2368	perl.exe
2368	perl.exe
3176	perl.exe
3176	perl.exe
3176	perl.exe
3176	perl.exe
3248	perl.exe
3248	perl.exe
3248	perl.exe
3248	perl.exe
2980	perl.exe
2980	perl.exe
2980	perl.exe
2980	perl.exe
2628	perl.exe
2628	perl.exe
2628	perl.exe
2628	perl.exe
2436	perl.exe
2436	perl.exe
2436	perl.exe
2436	perl.exe
1244	perl.exe
1244	perl.exe
1244	perl.exe
1244	perl.exe
1588	perl.exe
1588	perl.exe
1588	perl.exe
1588	perl.exe
4976	perl.exe
4976	perl.exe
4976	perl.exe
4976	perl.exe
4920	perl.exe
4920	perl.exe
4920	perl.exe
4920	perl.exe
664	perl.exe
664	perl.exe
664	perl.exe
664	perl.exe
2172	perl.exe
2172	perl.exe
2172	perl.exe
2172	perl.exe
3892	perl.exe
3892	perl.exe
3892	perl.exe
3892	perl.exe
4484	perl.exe
4484	perl.exe
4484	perl.exe
4484	perl.exe
4356	perl.exe
4356	perl.exe
4356	perl.exe
4356	perl.exe
4988	perl.exe
4988	perl.exe
4988	perl.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorisFX Vegas uni-patch 2026.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorisFX Vegas uni-patch 2026.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/812-1-0x0000000000400000-0x00000000004F1000-memory.dmp	innosetup

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5212	BorisFX Vegas uni-patch 2026.tmp
5212	BorisFX Vegas uni-patch 2026.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5212	BorisFX Vegas uni-patch 2026.tmp

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 5212	812	BorisFX Vegas uni-patch 2026.exe	80
PID 5212 wrote to memory of 1436	5212	BorisFX Vegas uni-patch 2026.tmp	81
PID 1436 wrote to memory of 4688	1436	net.exe	83
PID 5212 wrote to memory of 2388	5212	BorisFX Vegas uni-patch 2026.tmp	84
PID 2388 wrote to memory of 2368	2388	cmd.exe	86
PID 2388 wrote to memory of 3176	2388	cmd.exe	87
PID 2388 wrote to memory of 3248	2388	cmd.exe	88
PID 2388 wrote to memory of 2980	2388	cmd.exe	89
PID 2388 wrote to memory of 2628	2388	cmd.exe	90
PID 2388 wrote to memory of 2436	2388	cmd.exe	91
PID 2388 wrote to memory of 1244	2388	cmd.exe	92
PID 2388 wrote to memory of 1588	2388	cmd.exe	93
PID 2388 wrote to memory of 4976	2388	cmd.exe	94
PID 2388 wrote to memory of 4920	2388	cmd.exe	95
PID 2388 wrote to memory of 664	2388	cmd.exe	96
PID 2388 wrote to memory of 2172	2388	cmd.exe	97
PID 2388 wrote to memory of 3892	2388	cmd.exe	98
PID 2388 wrote to memory of 4484	2388	cmd.exe	99
PID 2388 wrote to memory of 4356	2388	cmd.exe	100
PID 2388 wrote to memory of 4988	2388	cmd.exe	101
PID 2388 wrote to memory of 5240	2388	cmd.exe	102
PID 2388 wrote to memory of 2972	2388	cmd.exe	103
PID 2388 wrote to memory of 3492	2388	cmd.exe	104
PID 2388 wrote to memory of 5256	2388	cmd.exe	105
PID 2388 wrote to memory of 5388	2388	cmd.exe	106
PID 2388 wrote to memory of 5296	2388	cmd.exe	107
PID 2388 wrote to memory of 5272	2388	cmd.exe	108
PID 2388 wrote to memory of 5356	2388	cmd.exe	109
PID 2388 wrote to memory of 5432	2388	cmd.exe	110
PID 2388 wrote to memory of 5480	2388	cmd.exe	111
PID 2388 wrote to memory of 5428	2388	cmd.exe	112
PID 2388 wrote to memory of 5684	2388	cmd.exe	113
PID 2388 wrote to memory of 5884	2388	cmd.exe	114
PID 2388 wrote to memory of 5904	2388	cmd.exe	115
PID 2388 wrote to memory of 5528	2388	cmd.exe	116
PID 2388 wrote to memory of 2664	2388	cmd.exe	117
PID 2388 wrote to memory of 1728	2388	cmd.exe	118
PID 2388 wrote to memory of 4984	2388	cmd.exe	119
PID 2388 wrote to memory of 1236	2388	cmd.exe	120
PID 2388 wrote to memory of 1448	2388	cmd.exe	121
PID 2388 wrote to memory of 1644	2388	cmd.exe	122
PID 2388 wrote to memory of 5216	2388	cmd.exe	123
PID 2388 wrote to memory of 1084	2388	cmd.exe	124
PID 2388 wrote to memory of 5920	2388	cmd.exe	125
PID 2388 wrote to memory of 2480	2388	cmd.exe	126
PID 2388 wrote to memory of 1296	2388	cmd.exe	127
PID 2388 wrote to memory of 1748	2388	cmd.exe	128
PID 2388 wrote to memory of 768	2388	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas uni-patch 2026.exe
"C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas uni-patch 2026.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\is-R18DM.tmp\BorisFX Vegas uni-patch 2026.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-R18DM.tmp\BorisFX Vegas uni-patch 2026.tmp" /SL5="$50116,2435199,928256,C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas uni-patch 2026.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5212
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop RLM-BorisFX
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop RLM-BorisFX
      4⤵
      PID:4688
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-U3AVC.tmp\unlocker_vegas.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "C:\Program Files\BorisFX\Vegas Pro 2026\vegas2026.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Vegas Pro 2026\bfx-license-tool\pylib\_license_activation.pyd"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Vegas Pro 2026\bfx-license-tool\pylib\_user_licensing_wrap.pyd"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\x28\xA3\x10\x00\x06\x2D\x07\x16/\x28\xA3\x10\x00\x06\xDE\x07\x16/g" "c:\Program Files\BorisFX\Vegas Pro 2026\ScriptPortal.Vegas.dll"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Forge2026.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Chorus_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Compressor_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Delay_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Expander_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Flanger_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Gate_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:664
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Limiter_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_TwoPointCompressor_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Utility_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Volume_Former_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\eqFX\APU_dynamicEQ_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\eqFX\APU_modernEQ_x64.vst3"
      4⤵
      Executes dropped EXE
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\wizardFX\APU_wFX_ModernReverb_x64.vst3"
      4⤵
      Executes dropped EXE
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2026\Optics.exe"
      4⤵
      Executes dropped EXE
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2026\resources\plugins\Continuum\lib\Continuum_Common_OFX.dll"
      4⤵
      Executes dropped EXE
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2026\resources\plugins\Continuum\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2026\resources\plugins\Sapphire\lib64\Sapphire.ofx"
      4⤵
      Executes dropped EXE
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2026\resources\plugins\Sapphire\Sapphire.ofx.bundle\Contents\Win64\Sapphire.ofx"
      4⤵
      Executes dropped EXE
      PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\SoundApp\SoundApp.exe"
      4⤵
      Executes dropped EXE
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete AudioDenoise.vst3\Contents\x86_64-win\CrumplePop Complete AudioDenoise.vst3"
      4⤵
      Executes dropped EXE
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete ClipRemover.vst3\Contents\x86_64-win\CrumplePop Complete ClipRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete EchoRemover.vst3\Contents\x86_64-win\CrumplePop Complete EchoRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete Levelmatic.vst3\Contents\x86_64-win\CrumplePop Complete Levelmatic.vst3"
      4⤵
      Executes dropped EXE
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete PopRemover.vst3\Contents\x86_64-win\CrumplePop Complete PopRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete RustleRemover.vst3\Contents\x86_64-win\CrumplePop Complete RustleRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete TrafficRemover.vst3\Contents\x86_64-win\CrumplePop Complete TrafficRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete Voice Enhance.vst3\Contents\x86_64-win\CrumplePop Complete Voice Enhance.vst3"
      4⤵
      Executes dropped EXE
      PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete WindRemover.vst3\Contents\x86_64-win\CrumplePop Complete WindRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\CrumplePop\SoundApp\SoundApp.exe"
      4⤵
      Executes dropped EXE
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\MochaPro2026\Resources\mochaui\bin\mocha.dll"
      4⤵
      Executes dropped EXE
      PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\MochaPro2026\Resources\mochaui\bin\GUI.dll"
      4⤵
      Executes dropped EXE
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\MochaPro2026\Resources\mochaui\bin\bsc.dll"
      4⤵
      Executes dropped EXE
      PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\Continuum\BCCPlus\BCC+.ofx.bundle\Contents\Win64\BCC+.ofx"
      4⤵
      Executes dropped EXE
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.1 OFX Vegas\19\lib\Continuum_Common_OFX.dll"
      4⤵
      Executes dropped EXE
      PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.1 OFX Vegas\19\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.5 OFX Vegas\19\lib\Continuum_Common_OFX.dll"
      4⤵
      Executes dropped EXE
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.5 OFX Vegas\19\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.5 OFX\19\lib\Continuum_Common_OFX.dll"
      4⤵
      Executes dropped EXE
      PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.5 OFX\19\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4408

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1588

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BorisFX Vegas uni-patch 2026.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-R18DM.tmp\BorisFX Vegas uni-patch 2026.tmp
Size 3.6MB
SHA256 6be1a3b58590f35b64d214a41b4b2427451dbdd7e737b5b07d06d56874164468
MD5 565b0a8a2e35b81c3d7f3d84fb9a7505
SHA1 5c60cbe43f0819b90bbb6e555d0590af62f7ebc3
SHA512 27c69faee9c3fbd3d804e5d28e4021c67049b47dbe337bd0300adf9768bf249ce28e6dc81e4586006b2f3cfdf168d04702e300a9d6a75b5c2536e7c43e9e359b
SSDEEP 49152:LrHHFnKA0otwLU/g2SmYXFuaYQ4mQVHYEXQcmpeDxjT/f3338:LrnwboEuM4mQiEC0DB3338
TLSH
T134063913F244F93ED45A3A354637C664993777626A2ADC12ABFC2D4C8F361403E3B686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unlocker_vegas.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-U3AVC.tmp\unlocker_vegas.cmd
Size 16KB
SHA256 3154c0bc7c5ca9c0a56de85f96bd06ff7a99347106473de3181bfa3ea9853a78
MD5 666c0b4634431b9df6c68755c42f4f1d
SHA1 ab2fa5edd6d2cb47e39448bb0247fab9e51e5675
SHA512 2fb504d54c03c6fa6cd74665d2c0c11077b6c735b9240f0eda57277d4cd3dc3b036643f6a0392b5324f2e27b8b3584d69ca853359e9048f7b6680367c1ce6e00
SSDEEP 96:xmX1I/nUK5j/hj8NImI2Yt2Kne3ieieieNePCA4+wgmAM8m6o6n6ueOuiRwe:uY1Xe3999sxN6e
TLSH
T1917282D38740C9861069E5C55F213B484C6FD168CAAA178A9F1FE38F1F46A8742EFC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 711KB
SHA256 cb96718f7ef83319472e4ca3fcdf6d002226d3a6ff4d0d64b6e221aba58016a3
MD5 97ba9d2d7090a7d265cefed7fa40b1bf
SHA1 04231941ab6681e445c529d35f91d4a2a80f92ec
SHA512 e0ed771116902e2aae3650fed86f2c07fc164134cbaa4961665d7ba33a8f4ef7c6fdbda93046eaa3832df3882d730487a77a973bee9578caa333c83e894bf601
SSDEEP 6144:sbtQeWsyqCyeYJxCMMAmivzouBFBdyjW11jQ1UYggO0Ukuh7RZ5ztkXy3j9acKiV:beWAJUpg3/1sggO0Ukuh7RZ55k5EV
TLSH
T167F43A847B9DB49BC03002B5569B025B1330A98533D4BB6B7E6D7A38DD933D8CF886D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 2.2MB
SHA256 d747bb93d4e936ddd57b6258355a977e210ad308c0f832d3d47fab6f9191c2ce
MD5 b1852a4962ea7185dc353fe6f0ab4553
SHA1 b4335332bfc3033e5465db6eb56b344cbe2270b1
SHA512 e7cfba7553879df5df57275e65509f18069ddd8c3c5c18676a2a326bc91204145ddf6be5013380613257b398734e11c513647e86878ec9525533b772d929d2d5
SSDEEP 49152:pbxE3cqZXY88ZxCx7x+vrHpH4cW5aYThxsYiv3c1QD:XEMqcxCx7x+vyZa/3c1QD
TLSH
T177B55B03D6974D7CC9DBE7B4925B92769A20FC298538BD2E5E9CC7302B12E40972FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 85KB
SHA256 8ae45c5928698df7da6780e282bc5053a7b1a87a1cba0a2083aa26c473c3f7f9
MD5 59a112452ceccba063cc85d0513fd0a7
SHA1 f046c7d16606bcd8b1104270cdbba545549ea311
SHA512 40bc9c0966dfa13167c59b14eb0c9e2096a30408c65977dec9e86628183505b877aacf5f444b59ff2dd12d42a6e406c68c276b60a598b501d6ff0ea0a87f9115
SSDEEP 1536:Tb4A1X+bp4B4gepS7k8G9rS6nBPm3YB+ZQF69Z6:T9Obp4GkQ8G9rS6nBPm3YB+ZQFOZ6
TLSH
T15383C237E6B388ACC1DB92B0B7C691F175B6FC100520AA1E134596343F5FDA42FAD989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl.exe

Path C:\Users\Admin\AppData\Local\Temp\perl.exe
Size 43KB
SHA256 13f689c7c8d93a546ae207e28000a0b163851dd0a148d5d329618ffc7daff554
MD5 98a571d345034f8ff5953714a18b68a1
SHA1 118da15a20c31845d64de6a1bfeeaf1046d16263
SHA512 6daee529e6dea6648bad518cc86c8d0bfd59399908eda24ff622c1cb6f60115fd6a6dc21886a86beefe36e476077101ebbc4c4a9a11af5247c0d7853e67a7fc8
SSDEEP 768:u95VKDDsyfhw1111111111111111111111111111Tb4YMz8vEUDCFFtFF9vQ4:rHsyobCzKIFFtFFK4
TLSH
T17F13D75EF722C899C5C552B4F48986F1D6A0FCF1C850462F22377F697B727884F69282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl538.dll

Path C:\Users\Admin\AppData\Local\Temp\perl538.dll
Size 3.0MB
SHA256 68bef13493195a03f812c8f6dc15ff1c429010644605e5f9dc66388e77fe2eaf
MD5 a6764a022dc825aba978297546603e0f
SHA1 a8ff5ac32cd4848534b68c95b9df44fdb6f57a25
SHA512 564ba6f9a9e1b12488bf6768af7f8a456730449d82ce88cba17944ea0c52c081117dec57828eb612ac41bba0dcb38ab0c580733f126e057a38023cae29ebffbf
SSDEEP 49152:B+lFF8N8QewIPGm4CKzGNR7OPlTmKZ9kjCr4WmKME0YHAnGlJO12RIT5kqBGV9Px:0lWHzh
TLSH
T141E54A47ECA2D674C46D82754EAF07667332F08C66267B1F25289A303E53B241F9E36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/664-151-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/664-152-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/664-153-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/664-154-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/664-155-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/812-1-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/1244-110-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/1244-109-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/1244-108-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/1244-107-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/1244-111-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/1588-121-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/1588-122-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/1588-119-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/1588-118-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/1588-120-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/2172-162-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/2172-161-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/2172-159-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/2172-160-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/2172-163-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/2368-44-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/2368-45-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/2368-43-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/2368-42-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/2368-41-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/2436-100-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/2436-99-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/2436-98-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/2436-97-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/2436-96-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/2628-85-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/2628-86-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/2628-88-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/2628-89-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/2628-87-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/2980-75-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/2980-74-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/2980-77-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/2980-78-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/2980-76-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/3176-53-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/3176-55-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/3176-56-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/3176-52-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/3176-54-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/3248-63-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/3248-65-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/3248-64-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/3248-67-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/3248-66-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/3892-166-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/3892-165-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/3892-167-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/4920-143-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/4920-144-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/4920-142-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/4920-141-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/4920-140-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/4976-129-0x00007FF6D1020000-0x00007FF6D1033000-memory.dmp

Download

memory/4976-133-0x00007FF8D74E0000-0x00007FF8D74FD000-memory.dmp

Download

memory/4976-132-0x00007FF8CE010000-0x00007FF8CE248000-memory.dmp

Download

memory/4976-131-0x00007FF8CE250000-0x00007FF8CE2F5000-memory.dmp

Download

memory/4976-130-0x00007FF8CE300000-0x00007FF8CE61A000-memory.dmp

Download

memory/5212-5-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/5212-358-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download