4f0ef6a7e79302fc71065a573e462e4d280116d47317b2e52bd0c8b1a8c97081

Resubmissions

03/08/2026, 08:45

260803-kn67aaeh537

03/08/2026, 08:42

260803-kl4ndat1gx8

Analysis

user interaction
yes
max time kernel
79s
max time network
40s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BorisFX Vegas uni-patch 2026.exe
Size 3.5MB
Sample260803-kn67aaeh53
SHA256 4f0ef6a7e79302fc71065a573e462e4d280116d47317b2e52bd0c8b1a8c97081
MD5 7220609dc7cc675bfb395590d24bdd50
SHA1 b2ae719782e2e4c90d4469bbcc118620a8c9f8ca
SHA512 e1eeb87813da5e9d01d4236ff416761089dc88fcba3be3d15a569967b911241230ce783a5fd2c95f12a29bfd0c662a3ad552cee7d4f65db93481b2f1154b55a5
SSDEEP 49152:q7JCXWKZ1b16sfZkBsad7F53pwJm/Y2IfdOb5PFsAJ7BDxyCb1Tg2jaw:q7EF1b16qkBlBWr2IfdObnTxP1E2j7
TLSH
T1DEF5F11AB65EF13DD8593A3545B3C2305A377F29A43A8D1BC6F8380CCFA74442E2B665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 45 IoCs

pid	Process
4824	BorisFX Vegas uni-patch 2026.tmp
1128	perl.exe
1732	perl.exe
3240	perl.exe
752	perl.exe
616	perl.exe
3308	perl.exe
4828	perl.exe
1868	perl.exe
6024	perl.exe
5784	perl.exe
3004	perl.exe
3468	perl.exe
5188	perl.exe
1056	perl.exe
1744	perl.exe
1392	perl.exe
6080	perl.exe
4216	perl.exe
3144	perl.exe
4572	perl.exe
4340	perl.exe
5712	perl.exe
2652	perl.exe
3296	perl.exe
1832	perl.exe
3392	perl.exe
4540	perl.exe
4520	perl.exe
3152	perl.exe
2644	perl.exe
3888	perl.exe
3224	perl.exe
3672	perl.exe
1324	perl.exe
5936	perl.exe
2596	perl.exe
5648	perl.exe
4456	perl.exe
6132	perl.exe
5844	perl.exe
5552	perl.exe
3256	perl.exe
3276	perl.exe
4252	perl.exe

Loads dropped DLL 64 IoCs

pid	Process
1128	perl.exe
1128	perl.exe
1128	perl.exe
1128	perl.exe
1128	perl.exe
1732	perl.exe
1732	perl.exe
1732	perl.exe
1732	perl.exe
1732	perl.exe
3240	perl.exe
3240	perl.exe
3240	perl.exe
3240	perl.exe
3240	perl.exe
752	perl.exe
752	perl.exe
752	perl.exe
752	perl.exe
752	perl.exe
616	perl.exe
616	perl.exe
616	perl.exe
616	perl.exe
616	perl.exe
3308	perl.exe
3308	perl.exe
3308	perl.exe
3308	perl.exe
3308	perl.exe
4828	perl.exe
4828	perl.exe
4828	perl.exe
4828	perl.exe
4828	perl.exe
1868	perl.exe
1868	perl.exe
1868	perl.exe
1868	perl.exe
1868	perl.exe
6024	perl.exe
6024	perl.exe
6024	perl.exe
6024	perl.exe
6024	perl.exe
5784	perl.exe
5784	perl.exe
5784	perl.exe
5784	perl.exe
5784	perl.exe
3004	perl.exe
3004	perl.exe
3004	perl.exe
3004	perl.exe
3004	perl.exe
3468	perl.exe
3468	perl.exe
3468	perl.exe
3468	perl.exe
3468	perl.exe
5188	perl.exe
5188	perl.exe
5188	perl.exe
5188	perl.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5476	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorisFX Vegas uni-patch 2026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorisFX Vegas uni-patch 2026.tmp

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3352-1-0x0000000000400000-0x00000000004F1000-memory.dmp	innosetup

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4824	BorisFX Vegas uni-patch 2026.tmp
4824	BorisFX Vegas uni-patch 2026.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4824	BorisFX Vegas uni-patch 2026.tmp

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 4824	3352	BorisFX Vegas uni-patch 2026.exe	89
PID 4824 wrote to memory of 4500	4824	BorisFX Vegas uni-patch 2026.tmp	90
PID 4500 wrote to memory of 3452	4500	net.exe	92
PID 4824 wrote to memory of 5476	4824	BorisFX Vegas uni-patch 2026.tmp	93
PID 5476 wrote to memory of 1128	5476	cmd.exe	95
PID 5476 wrote to memory of 1732	5476	cmd.exe	96
PID 5476 wrote to memory of 3240	5476	cmd.exe	97
PID 5476 wrote to memory of 752	5476	cmd.exe	98
PID 5476 wrote to memory of 616	5476	cmd.exe	99
PID 5476 wrote to memory of 3308	5476	cmd.exe	100
PID 5476 wrote to memory of 4828	5476	cmd.exe	101
PID 5476 wrote to memory of 1868	5476	cmd.exe	102
PID 5476 wrote to memory of 6024	5476	cmd.exe	103
PID 5476 wrote to memory of 5784	5476	cmd.exe	104
PID 5476 wrote to memory of 3004	5476	cmd.exe	105
PID 5476 wrote to memory of 3468	5476	cmd.exe	106
PID 5476 wrote to memory of 5188	5476	cmd.exe	107
PID 5476 wrote to memory of 1056	5476	cmd.exe	108
PID 5476 wrote to memory of 1744	5476	cmd.exe	109
PID 5476 wrote to memory of 1392	5476	cmd.exe	110
PID 5476 wrote to memory of 6080	5476	cmd.exe	111
PID 5476 wrote to memory of 4216	5476	cmd.exe	112
PID 5476 wrote to memory of 3144	5476	cmd.exe	113
PID 5476 wrote to memory of 4572	5476	cmd.exe	114
PID 5476 wrote to memory of 4340	5476	cmd.exe	115
PID 5476 wrote to memory of 5712	5476	cmd.exe	116
PID 5476 wrote to memory of 2652	5476	cmd.exe	117
PID 5476 wrote to memory of 3296	5476	cmd.exe	118
PID 5476 wrote to memory of 1832	5476	cmd.exe	119
PID 5476 wrote to memory of 3392	5476	cmd.exe	120
PID 5476 wrote to memory of 4540	5476	cmd.exe	121
PID 5476 wrote to memory of 4520	5476	cmd.exe	122
PID 5476 wrote to memory of 3152	5476	cmd.exe	123
PID 5476 wrote to memory of 2644	5476	cmd.exe	124
PID 5476 wrote to memory of 3888	5476	cmd.exe	125
PID 5476 wrote to memory of 3224	5476	cmd.exe	126
PID 5476 wrote to memory of 3672	5476	cmd.exe	127
PID 5476 wrote to memory of 1324	5476	cmd.exe	128
PID 5476 wrote to memory of 5936	5476	cmd.exe	129
PID 5476 wrote to memory of 2596	5476	cmd.exe	130
PID 5476 wrote to memory of 5648	5476	cmd.exe	131
PID 5476 wrote to memory of 4456	5476	cmd.exe	132
PID 5476 wrote to memory of 6132	5476	cmd.exe	133
PID 5476 wrote to memory of 5844	5476	cmd.exe	134
PID 5476 wrote to memory of 5552	5476	cmd.exe	135
PID 5476 wrote to memory of 3256	5476	cmd.exe	136
PID 5476 wrote to memory of 3276	5476	cmd.exe	137
PID 5476 wrote to memory of 4252	5476	cmd.exe	138

C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas uni-patch 2026.exe
"C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas uni-patch 2026.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\is-B23H1.tmp\BorisFX Vegas uni-patch 2026.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-B23H1.tmp\BorisFX Vegas uni-patch 2026.tmp" /SL5="$400A0,2435199,928256,C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas uni-patch 2026.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop RLM-BorisFX
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop RLM-BorisFX
      4⤵
      PID:3452
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-N2DR3.tmp\unlocker_vegas.cmd""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "C:\Program Files\BorisFX\Vegas Pro 2026\vegas2026.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Vegas Pro 2026\bfx-license-tool\pylib\_license_activation.pyd"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Vegas Pro 2026\bfx-license-tool\pylib\_user_licensing_wrap.pyd"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\x28\xA3\x10\x00\x06\x2D\x07\x16/\x28\xA3\x10\x00\x06\xDE\x07\x16/g" "c:\Program Files\BorisFX\Vegas Pro 2026\ScriptPortal.Vegas.dll"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:752
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Forge2026.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:616
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Chorus_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Compressor_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Delay_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Expander_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Flanger_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Gate_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Limiter_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_TwoPointCompressor_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Utility_x64.vst3"
      4⤵
      Executes dropped EXE
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Volume_Former_x64.vst3"
      4⤵
      Executes dropped EXE
      PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\eqFX\APU_dynamicEQ_x64.vst3"
      4⤵
      Executes dropped EXE
      PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\eqFX\APU_modernEQ_x64.vst3"
      4⤵
      Executes dropped EXE
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\wizardFX\APU_wFX_ModernReverb_x64.vst3"
      4⤵
      Executes dropped EXE
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2026\Optics.exe"
      4⤵
      Executes dropped EXE
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2026\resources\plugins\Continuum\lib\Continuum_Common_OFX.dll"
      4⤵
      Executes dropped EXE
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2026\resources\plugins\Continuum\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2026\resources\plugins\Sapphire\lib64\Sapphire.ofx"
      4⤵
      Executes dropped EXE
      PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2026\resources\plugins\Sapphire\Sapphire.ofx.bundle\Contents\Win64\Sapphire.ofx"
      4⤵
      Executes dropped EXE
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\SoundApp\SoundApp.exe"
      4⤵
      Executes dropped EXE
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete AudioDenoise.vst3\Contents\x86_64-win\CrumplePop Complete AudioDenoise.vst3"
      4⤵
      Executes dropped EXE
      PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete ClipRemover.vst3\Contents\x86_64-win\CrumplePop Complete ClipRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete EchoRemover.vst3\Contents\x86_64-win\CrumplePop Complete EchoRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete Levelmatic.vst3\Contents\x86_64-win\CrumplePop Complete Levelmatic.vst3"
      4⤵
      Executes dropped EXE
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete PopRemover.vst3\Contents\x86_64-win\CrumplePop Complete PopRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete RustleRemover.vst3\Contents\x86_64-win\CrumplePop Complete RustleRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete TrafficRemover.vst3\Contents\x86_64-win\CrumplePop Complete TrafficRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete Voice Enhance.vst3\Contents\x86_64-win\CrumplePop Complete Voice Enhance.vst3"
      4⤵
      Executes dropped EXE
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete WindRemover.vst3\Contents\x86_64-win\CrumplePop Complete WindRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\CrumplePop\SoundApp\SoundApp.exe"
      4⤵
      Executes dropped EXE
      PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\MochaPro2026\Resources\mochaui\bin\mocha.dll"
      4⤵
      Executes dropped EXE
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\MochaPro2026\Resources\mochaui\bin\GUI.dll"
      4⤵
      Executes dropped EXE
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\MochaPro2026\Resources\mochaui\bin\bsc.dll"
      4⤵
      Executes dropped EXE
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\Continuum\BCCPlus\BCC+.ofx.bundle\Contents\Win64\BCC+.ofx"
      4⤵
      Executes dropped EXE
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.1 OFX Vegas\19\lib\Continuum_Common_OFX.dll"
      4⤵
      Executes dropped EXE
      PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.1 OFX Vegas\19\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.5 OFX Vegas\19\lib\Continuum_Common_OFX.dll"
      4⤵
      Executes dropped EXE
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.5 OFX Vegas\19\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.5 OFX\19\lib\Continuum_Common_OFX.dll"
      4⤵
      Executes dropped EXE
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Continuum 2026.5 OFX\19\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BorisFX Vegas uni-patch 2026.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-B23H1.tmp\BorisFX Vegas uni-patch 2026.tmp
Size 3.6MB
SHA256 6be1a3b58590f35b64d214a41b4b2427451dbdd7e737b5b07d06d56874164468
MD5 565b0a8a2e35b81c3d7f3d84fb9a7505
SHA1 5c60cbe43f0819b90bbb6e555d0590af62f7ebc3
SHA512 27c69faee9c3fbd3d804e5d28e4021c67049b47dbe337bd0300adf9768bf249ce28e6dc81e4586006b2f3cfdf168d04702e300a9d6a75b5c2536e7c43e9e359b
SSDEEP 49152:LrHHFnKA0otwLU/g2SmYXFuaYQ4mQVHYEXQcmpeDxjT/f3338:LrnwboEuM4mQiEC0DB3338
TLSH
T134063913F244F93ED45A3A354637C664993777626A2ADC12ABFC2D4C8F361403E3B686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unlocker_vegas.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-N2DR3.tmp\unlocker_vegas.cmd
Size 16KB
SHA256 3154c0bc7c5ca9c0a56de85f96bd06ff7a99347106473de3181bfa3ea9853a78
MD5 666c0b4634431b9df6c68755c42f4f1d
SHA1 ab2fa5edd6d2cb47e39448bb0247fab9e51e5675
SHA512 2fb504d54c03c6fa6cd74665d2c0c11077b6c735b9240f0eda57277d4cd3dc3b036643f6a0392b5324f2e27b8b3584d69ca853359e9048f7b6680367c1ce6e00
SSDEEP 96:xmX1I/nUK5j/hj8NImI2Yt2Kne3ieieieNePCA4+wgmAM8m6o6n6ueOuiRwe:uY1Xe3999sxN6e
TLSH
T1917282D38740C9861069E5C55F213B484C6FD168CAAA178A9F1FE38F1F46A8742EFC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 711KB
SHA256 cb96718f7ef83319472e4ca3fcdf6d002226d3a6ff4d0d64b6e221aba58016a3
MD5 97ba9d2d7090a7d265cefed7fa40b1bf
SHA1 04231941ab6681e445c529d35f91d4a2a80f92ec
SHA512 e0ed771116902e2aae3650fed86f2c07fc164134cbaa4961665d7ba33a8f4ef7c6fdbda93046eaa3832df3882d730487a77a973bee9578caa333c83e894bf601
SSDEEP 6144:sbtQeWsyqCyeYJxCMMAmivzouBFBdyjW11jQ1UYggO0Ukuh7RZ5ztkXy3j9acKiV:beWAJUpg3/1sggO0Ukuh7RZ55k5EV
TLSH
T167F43A847B9DB49BC03002B5569B025B1330A98533D4BB6B7E6D7A38DD933D8CF886D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 2.2MB
SHA256 d747bb93d4e936ddd57b6258355a977e210ad308c0f832d3d47fab6f9191c2ce
MD5 b1852a4962ea7185dc353fe6f0ab4553
SHA1 b4335332bfc3033e5465db6eb56b344cbe2270b1
SHA512 e7cfba7553879df5df57275e65509f18069ddd8c3c5c18676a2a326bc91204145ddf6be5013380613257b398734e11c513647e86878ec9525533b772d929d2d5
SSDEEP 49152:pbxE3cqZXY88ZxCx7x+vrHpH4cW5aYThxsYiv3c1QD:XEMqcxCx7x+vyZa/3c1QD
TLSH
T177B55B03D6974D7CC9DBE7B4925B92769A20FC298538BD2E5E9CC7302B12E40972FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 85KB
SHA256 8ae45c5928698df7da6780e282bc5053a7b1a87a1cba0a2083aa26c473c3f7f9
MD5 59a112452ceccba063cc85d0513fd0a7
SHA1 f046c7d16606bcd8b1104270cdbba545549ea311
SHA512 40bc9c0966dfa13167c59b14eb0c9e2096a30408c65977dec9e86628183505b877aacf5f444b59ff2dd12d42a6e406c68c276b60a598b501d6ff0ea0a87f9115
SSDEEP 1536:Tb4A1X+bp4B4gepS7k8G9rS6nBPm3YB+ZQF69Z6:T9Obp4GkQ8G9rS6nBPm3YB+ZQFOZ6
TLSH
T15383C237E6B388ACC1DB92B0B7C691F175B6FC100520AA1E134596343F5FDA42FAD989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl.exe

Path C:\Users\Admin\AppData\Local\Temp\perl.exe
Size 43KB
SHA256 13f689c7c8d93a546ae207e28000a0b163851dd0a148d5d329618ffc7daff554
MD5 98a571d345034f8ff5953714a18b68a1
SHA1 118da15a20c31845d64de6a1bfeeaf1046d16263
SHA512 6daee529e6dea6648bad518cc86c8d0bfd59399908eda24ff622c1cb6f60115fd6a6dc21886a86beefe36e476077101ebbc4c4a9a11af5247c0d7853e67a7fc8
SSDEEP 768:u95VKDDsyfhw1111111111111111111111111111Tb4YMz8vEUDCFFtFF9vQ4:rHsyobCzKIFFtFFK4
TLSH
T17F13D75EF722C899C5C552B4F48986F1D6A0FCF1C850462F22377F697B727884F69282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl538.dll

Path C:\Users\Admin\AppData\Local\Temp\perl538.dll
Size 3.0MB
SHA256 68bef13493195a03f812c8f6dc15ff1c429010644605e5f9dc66388e77fe2eaf
MD5 a6764a022dc825aba978297546603e0f
SHA1 a8ff5ac32cd4848534b68c95b9df44fdb6f57a25
SHA512 564ba6f9a9e1b12488bf6768af7f8a456730449d82ce88cba17944ea0c52c081117dec57828eb612ac41bba0dcb38ab0c580733f126e057a38023cae29ebffbf
SSDEEP 49152:B+lFF8N8QewIPGm4CKzGNR7OPlTmKZ9kjCr4WmKME0YHAnGlJO12RIT5kqBGV9Px:0lWHzh
TLSH
T141E54A47ECA2D674C46D82754EAF07667332F08C66267B1F25289A303E53B241F9E36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-92-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/616-90-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/616-94-0x0000024954560000-0x0000024954798000-memory.dmp

Download

memory/616-93-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/616-91-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/752-81-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/752-79-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/752-80-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/752-82-0x0000022179960000-0x0000022179B98000-memory.dmp

Download

memory/752-78-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/1128-43-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/1128-46-0x000001A500000000-0x000001A500238000-memory.dmp

Download

memory/1128-45-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/1128-42-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/1128-44-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/1732-56-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/1732-57-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/1732-55-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/1732-58-0x0000021EED3F0000-0x0000021EED628000-memory.dmp

Download

memory/1732-54-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/1868-126-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/1868-130-0x00000200E34C0000-0x00000200E36F8000-memory.dmp

Download

memory/1868-128-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/1868-127-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/1868-129-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/3004-156-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/3004-154-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/3004-157-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/3004-155-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/3004-158-0x00000223C3A00000-0x00000223C3C38000-memory.dmp

Download

memory/3240-66-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/3240-69-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/3240-68-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/3240-70-0x00000200A8E60000-0x00000200A9098000-memory.dmp

Download

memory/3240-67-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/3308-106-0x00000217EFD90000-0x00000217EFFC8000-memory.dmp

Download

memory/3308-103-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/3308-105-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/3308-102-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/3308-104-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/3352-1-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/3468-163-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/3468-161-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/3468-164-0x0000025153340000-0x0000025153578000-memory.dmp

Download

memory/3468-162-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/3468-160-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/4824-359-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download

memory/4824-6-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download

memory/4828-116-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/4828-114-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/4828-117-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/4828-115-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/4828-118-0x0000021140150000-0x0000021140388000-memory.dmp

Download

memory/5188-169-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/5188-166-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/5188-168-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/5784-148-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/5784-150-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/5784-151-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/5784-149-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/5784-152-0x0000023352030000-0x0000023352268000-memory.dmp

Download

memory/6024-138-0x00007FF75CC90000-0x00007FF75CCA3000-memory.dmp

Download

memory/6024-141-0x00007FFA43C90000-0x00007FFA43CAD000-memory.dmp

Download

memory/6024-139-0x00007FFA32060000-0x00007FFA3237A000-memory.dmp

Download

memory/6024-140-0x00007FFA3D490000-0x00007FFA3D535000-memory.dmp

Download

memory/6024-142-0x0000027F8B5D0000-0x0000027F8B808000-memory.dmp

Download