8c14ba06d6c68eab5f1105d89ff6389ce9a18c41b77f8dc18afa9ff03500dcdf

Analysis

user interaction
yes
max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BorisFX uni-patch 2025.exe
Size 7.5MB
Sample261023-s3nbqaex9q
SHA256 8c14ba06d6c68eab5f1105d89ff6389ce9a18c41b77f8dc18afa9ff03500dcdf
MD5 7e52f7baa90de63825de75bcaddbf3dd
SHA1 b2f3f5354701d1d9587d4ccf708699aef3b9080f
SHA512 59933efe80fdfa6e0b566221419dbbe9695d52d8efd75032ff4ea62350935f20789c8fe6b7d680604dce2cc05a458cf638d87387e689d47092ab321681bd1269
SSDEEP 98304:17m4SBJM5dXfM9GvhOs9VlQNIExk5ywXC333z:17mdJMTkGvhOs9VlQero
TLSH
T1E4867B03F399A52DE0BB2F315937C2A489377E62A936CC5E5BE8390C4E315406A37767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
792	BorisFX uni-patch 2025.tmp
3136	perl.exe
4960	perl.exe
4892	perl.exe
2516	perl.exe
4852	perl.exe
4792	perl.exe
3380	perl.exe
3164	perl.exe
4464	perl.exe
5488	perl.exe
2776	perl.exe
4144	perl.exe
4628	perl.exe
5296	perl.exe
2336	perl.exe
4224	perl.exe
5380	perl.exe
4188	perl.exe
5132	perl.exe
5924	perl.exe
4316	perl.exe
3528	perl.exe
1132	perl.exe
5028	perl.exe
4520	perl.exe
5156	perl.exe
1936	perl.exe
1784	perl.exe
2016	perl.exe
2600	perl.exe
3588	perl.exe
776	perl.exe
1376	perl.exe
1056	perl.exe
4880	perl.exe
5408	perl.exe
3184	perl.exe
1172	perl.exe
3260	perl.exe
4460	perl.exe
1708	perl.exe
2944	perl.exe
1164	perl.exe
256	perl.exe
3304	perl.exe
4208	perl.exe
3356	perl.exe
5340	perl.exe
5000	perl.exe
6016	perl.exe
3428	perl.exe
4992	perl.exe
1608	perl.exe
3644	perl.exe
5456	perl.exe
2336	perl.exe
2820	perl.exe
1216	perl.exe
4700	perl.exe
4236	perl.exe
3880	perl.exe
1984	perl.exe
3156	perl.exe

Loads dropped DLL 64 IoCs

pid	Process
792	BorisFX uni-patch 2025.tmp
792	BorisFX uni-patch 2025.tmp
3136	perl.exe
3136	perl.exe
3136	perl.exe
3136	perl.exe
4960	perl.exe
4960	perl.exe
4960	perl.exe
4960	perl.exe
4892	perl.exe
4892	perl.exe
4892	perl.exe
4892	perl.exe
2516	perl.exe
2516	perl.exe
2516	perl.exe
2516	perl.exe
4852	perl.exe
4852	perl.exe
4852	perl.exe
4852	perl.exe
4792	perl.exe
4792	perl.exe
4792	perl.exe
4792	perl.exe
3380	perl.exe
3380	perl.exe
3380	perl.exe
3380	perl.exe
3164	perl.exe
3164	perl.exe
3164	perl.exe
3164	perl.exe
4464	perl.exe
4464	perl.exe
4464	perl.exe
4464	perl.exe
5488	perl.exe
5488	perl.exe
5488	perl.exe
5488	perl.exe
2776	perl.exe
2776	perl.exe
2776	perl.exe
2776	perl.exe
4144	perl.exe
4144	perl.exe
4144	perl.exe
4144	perl.exe
4628	perl.exe
4628	perl.exe
4628	perl.exe
4628	perl.exe
5296	perl.exe
5296	perl.exe
5296	perl.exe
5296	perl.exe
2336	perl.exe
2336	perl.exe
2336	perl.exe
2336	perl.exe
4224	perl.exe
4224	perl.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorisFX uni-patch 2025.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorisFX uni-patch 2025.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1672-0-0x0000000000400000-0x00000000004FD000-memory.dmp	innosetup
behavioral2/memory/1672-44-0x0000000000400000-0x00000000004FD000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
792	BorisFX uni-patch 2025.tmp
792	BorisFX uni-patch 2025.tmp
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	taskmgr.exe
Token: SeSystemProfilePrivilege	4860	taskmgr.exe
Token: SeCreateGlobalPrivilege	4860	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
792	BorisFX uni-patch 2025.tmp
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe

Suspicious use of SendNotifyMessage 63 IoCs

pid	Process
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4860	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 792	1672	BorisFX uni-patch 2025.exe	89
PID 792 wrote to memory of 4292	792	BorisFX uni-patch 2025.tmp	90
PID 4292 wrote to memory of 2576	4292	net.exe	92
PID 792 wrote to memory of 916	792	BorisFX uni-patch 2025.tmp	93
PID 916 wrote to memory of 3136	916	cmd.exe	95
PID 916 wrote to memory of 4960	916	cmd.exe	96
PID 916 wrote to memory of 4892	916	cmd.exe	97
PID 916 wrote to memory of 2516	916	cmd.exe	98
PID 916 wrote to memory of 4852	916	cmd.exe	99
PID 916 wrote to memory of 4792	916	cmd.exe	100
PID 916 wrote to memory of 3380	916	cmd.exe	101
PID 916 wrote to memory of 3164	916	cmd.exe	102
PID 916 wrote to memory of 4464	916	cmd.exe	103
PID 916 wrote to memory of 5488	916	cmd.exe	104
PID 916 wrote to memory of 2776	916	cmd.exe	105
PID 916 wrote to memory of 4144	916	cmd.exe	106
PID 916 wrote to memory of 4628	916	cmd.exe	107
PID 916 wrote to memory of 5296	916	cmd.exe	108
PID 916 wrote to memory of 2336	916	cmd.exe	109
PID 916 wrote to memory of 4224	916	cmd.exe	110
PID 916 wrote to memory of 5380	916	cmd.exe	111
PID 916 wrote to memory of 4188	916	cmd.exe	112
PID 916 wrote to memory of 5132	916	cmd.exe	113
PID 916 wrote to memory of 5924	916	cmd.exe	114
PID 916 wrote to memory of 4316	916	cmd.exe	115
PID 916 wrote to memory of 3528	916	cmd.exe	116
PID 916 wrote to memory of 1132	916	cmd.exe	117
PID 916 wrote to memory of 5028	916	cmd.exe	118
PID 916 wrote to memory of 4520	916	cmd.exe	119
PID 916 wrote to memory of 5156	916	cmd.exe	120
PID 916 wrote to memory of 1936	916	cmd.exe	121
PID 916 wrote to memory of 1784	916	cmd.exe	122
PID 916 wrote to memory of 2016	916	cmd.exe	123
PID 916 wrote to memory of 2600	916	cmd.exe	124
PID 916 wrote to memory of 3588	916	cmd.exe	125
PID 916 wrote to memory of 776	916	cmd.exe	126
PID 916 wrote to memory of 1376	916	cmd.exe	127
PID 916 wrote to memory of 1056	916	cmd.exe	128
PID 916 wrote to memory of 4880	916	cmd.exe	129
PID 916 wrote to memory of 5408	916	cmd.exe	130
PID 916 wrote to memory of 3184	916	cmd.exe	131
PID 916 wrote to memory of 1172	916	cmd.exe	132
PID 916 wrote to memory of 3260	916	cmd.exe	133
PID 916 wrote to memory of 4460	916	cmd.exe	134
PID 916 wrote to memory of 1708	916	cmd.exe	135
PID 916 wrote to memory of 2944	916	cmd.exe	136
PID 916 wrote to memory of 1164	916	cmd.exe	137
PID 916 wrote to memory of 256	916	cmd.exe	138
PID 916 wrote to memory of 3304	916	cmd.exe	139
PID 916 wrote to memory of 4208	916	cmd.exe	140
PID 916 wrote to memory of 3356	916	cmd.exe	141
PID 916 wrote to memory of 5340	916	cmd.exe	142
PID 916 wrote to memory of 5000	916	cmd.exe	143
PID 916 wrote to memory of 6016	916	cmd.exe	144
PID 916 wrote to memory of 3428	916	cmd.exe	145
PID 916 wrote to memory of 4992	916	cmd.exe	146
PID 916 wrote to memory of 1608	916	cmd.exe	147
PID 916 wrote to memory of 3644	916	cmd.exe	148
PID 916 wrote to memory of 5456	916	cmd.exe	149
PID 916 wrote to memory of 2336	916	cmd.exe	109
PID 916 wrote to memory of 2820	916	cmd.exe	151
PID 916 wrote to memory of 1216	916	cmd.exe	152
PID 916 wrote to memory of 4700	916	cmd.exe	153
PID 916 wrote to memory of 4236	916	cmd.exe	154

C:\Users\Admin\AppData\Local\Temp\BorisFX uni-patch 2025.exe
"C:\Users\Admin\AppData\Local\Temp\BorisFX uni-patch 2025.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\is-G8E6R.tmp\BorisFX uni-patch 2025.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-G8E6R.tmp\BorisFX uni-patch 2025.tmp" /SL5="$4018A,3189823,976384,C:\Users\Admin\AppData\Local\Temp\BorisFX uni-patch 2025.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop RLM-BorisFX
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop RLM-BorisFX
      4⤵
      PID:2576
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-UL4VN.tmp\unlocker2025.cmd""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Samplitude Suite\2025\Sam_x64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Samplitude\2025\Sam_x64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Music Studio\2025\MusicStudio_x64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sequoia\2025\Sequoia_x64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\SynthEyes 2025.5\SynthEyes64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Particle Illusion Standalone\18\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Silhouette 2025.0\resources\modules\Continuum\lib\Continuum_Common_OFX.dll"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Silhouette 2025.0\resources\modules\Continuum\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Silhouette 2025.0\resources\modules\MochaPro2025\Resources\mochaui\bin\bsc.dll"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Silhouette 2025.0\resources\modules\MochaPro2025\Resources\mochaui\bin\GUI.dll"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Silhouette 2025.0\resources\modules\MochaPro2025\Resources\mochaui\bin\mocha.dll"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Silhouette 2025.0\resources\modules\Sapphire\lib64\Sapphire.ofx"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Silhouette 2025.0\resources\modules\Sapphire\Sapphire.ofx.bundle\Contents\Win64\Sapphire.ofx"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Silhouette 2025.0\resources\modules\Tracker.module"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Silhouette 2025.0\sfxcmd.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Silhouette 2025.0\Silhouette.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\ContinuumAE\18\lib\Continuum_Common_AE.dll"
      4⤵
      Executes dropped EXE
      PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\ContinuumAE\18\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\ContinuumAE\18\plugins64\BorisFX\Continuum\BCCPlus.dll"
      4⤵
      Executes dropped EXE
      PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\Continuum\BCCPlus.dll"
      4⤵
      Executes dropped EXE
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\bin\bsc.dll"
      4⤵
      Executes dropped EXE
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\bin\GUI.dll"
      4⤵
      Executes dropped EXE
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\ADOBE\Common\Plug-ins\7.0\MediaCore\BorisFX\MochaPro2025.5\Resources\mochaui\bin\mocha.dll"
      4⤵
      Executes dropped EXE
      PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sapphire 2025.5 Adobe\lib64\sapphire_ae.dll"
      4⤵
      Executes dropped EXE
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\ContinuumAVX\18\lib\Continuum_Common_AVX.dll"
      4⤵
      Executes dropped EXE
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\ContinuumAVX\18\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\AViD\AVX2_Plug-ins\BorisFX\Continuum\BCCPlus\BCCPlus.avx"
      4⤵
      Executes dropped EXE
      PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Avid\AVX2_Plug-ins\BorisFX\MochaPro2025.5\Resources\mochaui\bin\bsc.dll"
      4⤵
      Executes dropped EXE
      PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Avid\AVX2_Plug-ins\BorisFX\MochaPro2025.5\Resources\mochaui\bin\GUI.dll"
      4⤵
      Executes dropped EXE
      PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Avid\AVX2_Plug-ins\BorisFX\MochaPro2025.5\Resources\mochaui\bin\mocha.dll"
      4⤵
      Executes dropped EXE
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sapphire 2025.5 AVX\lib64\sapphire-avx2.avx"
      4⤵
      Executes dropped EXE
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Avid\AVX2_Plug-ins\Sapphire-avx2.avx"
      4⤵
      Executes dropped EXE
      PID:776
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\ContinuumOFX\18\lib\Continuum_Common_OFX.dll"
      4⤵
      Executes dropped EXE
      PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\ContinuumOFX\18\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\Continuum\BCCPlus\BCC+.ofx.bundle\Contents\Win64\BCC+.ofx"
      4⤵
      Executes dropped EXE
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\MochaPro2025.5\Resources\mochaui\bin\bsc.dll"
      4⤵
      Executes dropped EXE
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\MochaPro2025.5\Resources\mochaui\bin\GUI.dll"
      4⤵
      Executes dropped EXE
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\BorisFX\MochaPro2025.5\Resources\mochaui\bin\mocha.dll"
      4⤵
      Executes dropped EXE
      PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sapphire 2025.5 OFX\lib64\Sapphire.ofx"
      4⤵
      Executes dropped EXE
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\OFX\Plugins\Sapphire.ofx.bundle\Contents\Win64\Sapphire.ofx"
      4⤵
      Executes dropped EXE
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2025\Optics.exe"
      4⤵
      Executes dropped EXE
      PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2025\resources\plugins\Continuum\lib\Continuum_Common_OFX.dll"
      4⤵
      Executes dropped EXE
      PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2025\resources\plugins\Continuum\lib\ParticleIllusion\Particle Illusion.exe"
      4⤵
      Executes dropped EXE
      PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2025\resources\plugins\Sapphire\lib64\Sapphire.ofx"
      4⤵
      Executes dropped EXE
      PID:256
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Optics 2025\resources\plugins\Sapphire\Sapphire.ofx.bundle\Contents\Win64\Sapphire.ofx"
      4⤵
      Executes dropped EXE
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sapphire 2025.5 Photoshop\lib64\sapphire_ps.dll"
      4⤵
      Executes dropped EXE
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\Avid\Audio\Plug-Ins\CrumplePop Complete AudioDenoise.aaxplugin\Contents\x64\CrumplePop Complete AudioDenoise.aaxplugin"
      4⤵
      Executes dropped EXE
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\Avid\Audio\Plug-Ins\CrumplePop Complete ClipRemover.aaxplugin\Contents\x64\CrumplePop Complete ClipRemover.aaxplugin"
      4⤵
      Executes dropped EXE
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\Avid\Audio\Plug-Ins\CrumplePop Complete EchoRemover.aaxplugin\Contents\x64\CrumplePop Complete EchoRemover.aaxplugin"
      4⤵
      Executes dropped EXE
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\Avid\Audio\Plug-Ins\CrumplePop Complete Levelmatic.aaxplugin\Contents\x64\CrumplePop Complete Levelmatic.aaxplugin"
      4⤵
      Executes dropped EXE
      PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\Avid\Audio\Plug-Ins\CrumplePop Complete PopRemover.aaxplugin\Contents\x64\CrumplePop Complete PopRemover.aaxplugin"
      4⤵
      Executes dropped EXE
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\Avid\Audio\Plug-Ins\CrumplePop Complete RustleRemover.aaxplugin\Contents\x64\CrumplePop Complete RustleRemover.aaxplugin"
      4⤵
      Executes dropped EXE
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\Avid\Audio\Plug-Ins\CrumplePop Complete TrafficRemover.aaxplugin\Contents\x64\CrumplePop Complete TrafficRemover.aaxplugin"
      4⤵
      Executes dropped EXE
      PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\Avid\Audio\Plug-Ins\CrumplePop Complete Voice Enhance.aaxplugin\Contents\x64\CrumplePop Complete Voice Enhance.aaxplugin"
      4⤵
      Executes dropped EXE
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\Avid\Audio\Plug-Ins\CrumplePop Complete WindRemover.aaxplugin\Contents\x64\CrumplePop Complete WindRemover.aaxplugin"
      4⤵
      Executes dropped EXE
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\SoundApp\SoundApp.exe"
      4⤵
      Executes dropped EXE
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete AudioDenoise.vst3\Contents\x86_64-win\CrumplePop Complete AudioDenoise.vst3"
      4⤵
      Executes dropped EXE
      PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete ClipRemover.vst3\Contents\x86_64-win\CrumplePop Complete ClipRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete EchoRemover.vst3\Contents\x86_64-win\CrumplePop Complete EchoRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete Levelmatic.vst3\Contents\x86_64-win\CrumplePop Complete Levelmatic.vst3"
      4⤵
      Executes dropped EXE
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete PopRemover.vst3\Contents\x86_64-win\CrumplePop Complete PopRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete RustleRemover.vst3\Contents\x86_64-win\CrumplePop Complete RustleRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete TrafficRemover.vst3\Contents\x86_64-win\CrumplePop Complete TrafficRemover.vst3"
      4⤵
      Executes dropped EXE
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete Voice Enhance.vst3\Contents\x86_64-win\CrumplePop Complete Voice Enhance.vst3"
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Common Files\VST3\CrumplePop Complete WindRemover.vst3\Contents\x86_64-win\CrumplePop Complete WindRemover.vst3"
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Mocha Pro 2025.5\bin\GUI.dll"
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Mocha Pro 2025.5\bin\bsc.dll"
      4⤵
      PID:928

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BorisFX uni-patch 2025.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-G8E6R.tmp\BorisFX uni-patch 2025.tmp
Size 3.6MB
SHA256 c48170094cd6a052bd833885f57a65f784ed7f415a45c4e25a780c150d71e98a
MD5 0c27f580a7d61d649d68b98d05fa551e
SHA1 0fee89e25f3d4bae14c5194d7da52b9942d6925e
SHA512 f23e9011fb05e75cf5576f7b3a8d62105f00db9b1d6bca48771ee3031208099865467abcdd24f0491e5b2dcf483ec91ff762678f34e0f7f25d32d8a4a901dbdd
SSDEEP 49152:ArHHFnKA0otwLU/g2SmYXFuaYQ4mQVHYEXQcmpeDxjT/G333y:ArnwboEuM4mQiEC0Ds333y
TLSH
T10B065B13F244A93ED06A3A354637C65499377B626A2ADC176BF83D4C8F361403E3B786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-UL4VN.tmp\_isetup\_isdecmp.dll
Size 28KB
SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
MD5 077cb4461a2767383b317eb0c50f5f13
SHA1 584e64f1d162398b7f377ce55a6b5740379c4282
SHA512 b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
SSDEEP 768:BD7FEAbd+EDsIOmF+OiR9rikW/F+M9OAriXiRQU:M07sIOYRiPWkWNl9WXil
TLSH
T197D24CB31E692BA2EDF95E3492C9162FCD72B3811E4504B3707CC5865A933652B291CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unlocker2025.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-UL4VN.tmp\unlocker2025.cmd
Size 26KB
SHA256 445d9d632502776c85858ba8ceed2752d7ff3ebc9871e33290a76e912d7697b8
MD5 f2824b8e707697268be64021e4af1cb0
SHA1 ec4e600c46ac2cdbf45c0c4d2f445e5b55d605fe
SHA512 779622c82b514ccbebcadb04198242dfefc9449e123d677b21374fefcad9e4d74f3efa761d49d450cf3bb4f75bc746b40ed02a962fc857bf1d8591f3f6d5cdbd
SSDEEP 96:x9mkPAQxvhxpupnpoI0SN4IRVkfk7uk7nk7ooKs7OuOnOoL2V2iiequqnqogLem3:TmpAs7/7k7OLOm4+Hq0m9O+B9
TLSH
T15CC2AFD28740C986609995C51F303B484C6FD158CAAA178A9F1FE39F1F46B8742EFC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 711KB
SHA256 cb96718f7ef83319472e4ca3fcdf6d002226d3a6ff4d0d64b6e221aba58016a3
MD5 97ba9d2d7090a7d265cefed7fa40b1bf
SHA1 04231941ab6681e445c529d35f91d4a2a80f92ec
SHA512 e0ed771116902e2aae3650fed86f2c07fc164134cbaa4961665d7ba33a8f4ef7c6fdbda93046eaa3832df3882d730487a77a973bee9578caa333c83e894bf601
SSDEEP 6144:sbtQeWsyqCyeYJxCMMAmivzouBFBdyjW11jQ1UYggO0Ukuh7RZ5ztkXy3j9acKiV:beWAJUpg3/1sggO0Ukuh7RZ55k5EV
TLSH
T167F43A847B9DB49BC03002B5569B025B1330A98533D4BB6B7E6D7A38DD933D8CF886D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 2.2MB
SHA256 d747bb93d4e936ddd57b6258355a977e210ad308c0f832d3d47fab6f9191c2ce
MD5 b1852a4962ea7185dc353fe6f0ab4553
SHA1 b4335332bfc3033e5465db6eb56b344cbe2270b1
SHA512 e7cfba7553879df5df57275e65509f18069ddd8c3c5c18676a2a326bc91204145ddf6be5013380613257b398734e11c513647e86878ec9525533b772d929d2d5
SSDEEP 49152:pbxE3cqZXY88ZxCx7x+vrHpH4cW5aYThxsYiv3c1QD:XEMqcxCx7x+vyZa/3c1QD
TLSH
T177B55B03D6974D7CC9DBE7B4925B92769A20FC298538BD2E5E9CC7302B12E40972FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 85KB
SHA256 8ae45c5928698df7da6780e282bc5053a7b1a87a1cba0a2083aa26c473c3f7f9
MD5 59a112452ceccba063cc85d0513fd0a7
SHA1 f046c7d16606bcd8b1104270cdbba545549ea311
SHA512 40bc9c0966dfa13167c59b14eb0c9e2096a30408c65977dec9e86628183505b877aacf5f444b59ff2dd12d42a6e406c68c276b60a598b501d6ff0ea0a87f9115
SSDEEP 1536:Tb4A1X+bp4B4gepS7k8G9rS6nBPm3YB+ZQF69Z6:T9Obp4GkQ8G9rS6nBPm3YB+ZQFOZ6
TLSH
T15383C237E6B388ACC1DB92B0B7C691F175B6FC100520AA1E134596343F5FDA42FAD989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl.exe

Path C:\Users\Admin\AppData\Local\Temp\perl.exe
Size 43KB
SHA256 13f689c7c8d93a546ae207e28000a0b163851dd0a148d5d329618ffc7daff554
MD5 98a571d345034f8ff5953714a18b68a1
SHA1 118da15a20c31845d64de6a1bfeeaf1046d16263
SHA512 6daee529e6dea6648bad518cc86c8d0bfd59399908eda24ff622c1cb6f60115fd6a6dc21886a86beefe36e476077101ebbc4c4a9a11af5247c0d7853e67a7fc8
SSDEEP 768:u95VKDDsyfhw1111111111111111111111111111Tb4YMz8vEUDCFFtFF9vQ4:rHsyobCzKIFFtFFK4
TLSH
T17F13D75EF722C899C5C552B4F48986F1D6A0FCF1C850462F22377F697B727884F69282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl538.dll

Path C:\Users\Admin\AppData\Local\Temp\perl538.dll
Size 3.0MB
SHA256 68bef13493195a03f812c8f6dc15ff1c429010644605e5f9dc66388e77fe2eaf
MD5 a6764a022dc825aba978297546603e0f
SHA1 a8ff5ac32cd4848534b68c95b9df44fdb6f57a25
SHA512 564ba6f9a9e1b12488bf6768af7f8a456730449d82ce88cba17944ea0c52c081117dec57828eb612ac41bba0dcb38ab0c580733f126e057a38023cae29ebffbf
SSDEEP 49152:B+lFF8N8QewIPGm4CKzGNR7OPlTmKZ9kjCr4WmKME0YHAnGlJO12RIT5kqBGV9Px:0lWHzh
TLSH
T141E54A47ECA2D674C46D82754EAF07667332F08C66267B1F25289A303E53B241F9E36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-499-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/792-6-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/1672-44-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/1672-0-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/2516-79-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/2516-82-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download

memory/2516-81-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/2516-83-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/2516-80-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/2776-156-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/2776-160-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/2776-157-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/2776-158-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/2776-159-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download

memory/3136-49-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/3136-46-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/3136-47-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/3136-48-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/3136-50-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download

memory/3164-125-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/3164-127-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/3164-124-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/3164-126-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download

memory/3164-123-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/3380-114-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/3380-116-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/3380-115-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download

memory/3380-112-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/3380-113-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/4144-166-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download

memory/4144-167-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/4144-164-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/4144-163-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/4144-165-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/4464-137-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download

memory/4464-135-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/4464-138-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/4464-136-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/4464-134-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/4628-169-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/4628-171-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/4792-105-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/4792-104-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download

memory/4792-101-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/4792-103-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/4792-102-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/4852-92-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/4852-93-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download

memory/4852-90-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/4852-91-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/4852-94-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/4892-68-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/4892-71-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download

memory/4892-69-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/4892-72-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/4892-70-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/4960-58-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/4960-57-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/4960-59-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/4960-61-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/4960-60-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download

memory/5488-149-0x00007FFB21630000-0x00007FFB2164D000-memory.dmp

Download

memory/5488-146-0x00007FFB07370000-0x00007FFB0768A000-memory.dmp

Download

memory/5488-147-0x00007FFB21650000-0x00007FFB216F5000-memory.dmp

Download

memory/5488-145-0x00007FF79FE80000-0x00007FF79FE93000-memory.dmp

Download

memory/5488-148-0x00007FFB197E0000-0x00007FFB19A18000-memory.dmp

Download