3e0f7468e80784bef674ac1ad77ee5c5e103bc84678c9796ef07c12de53abe22

Analysis

user interaction
yes
max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BorisFX Vegas patch 2026.0.3.exe
Size 3.5MB
Sample261102-vjmxysff78
SHA256 3e0f7468e80784bef674ac1ad77ee5c5e103bc84678c9796ef07c12de53abe22
MD5 1098cca01ab02f7418d52353e8472c15
SHA1 b5b228f968b70d639ff8296bd0c1173443725ae5
SHA512 790337ad5b411137ba2eec4d21715b11bb1fc2436fd8a000bb12dce461051938ddf344b170e4468350d8deec05fa0593f2add9f3119df856087836241884d789
SSDEEP 49152:W7J92Nf/cACKnMlNlOcyacYWmEWNIdlksjGWKRpT6ZYrD+LPdcpbVtjiDhy3lg/b:W7I/aaO6Y4mEW+kBjRpxeLPdS4D4+/b
TLSH
T1C0F5E02AB65EF13DD8593A3545B3C2305A377E69743A8C1FC2F83508CFA34486E2B665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 19 IoCs

pid	Process
4856	BorisFX Vegas patch 2026.0.3.tmp
4024	perl.exe
2232	perl.exe
4576	perl.exe
4836	perl.exe
4428	perl.exe
228	perl.exe
4236	perl.exe
3476	perl.exe
1348	perl.exe
5116	perl.exe
2292	perl.exe
2844	perl.exe
972	perl.exe
3772	perl.exe
364	perl.exe
2900	perl.exe
2420	perl.exe
2160	perl.exe

Loads dropped DLL 64 IoCs

pid	Process
4024	perl.exe
4024	perl.exe
4024	perl.exe
4024	perl.exe
4024	perl.exe
2232	perl.exe
2232	perl.exe
2232	perl.exe
2232	perl.exe
4576	perl.exe
4576	perl.exe
4576	perl.exe
4576	perl.exe
4836	perl.exe
4836	perl.exe
4836	perl.exe
4836	perl.exe
4428	perl.exe
4428	perl.exe
4428	perl.exe
4428	perl.exe
228	perl.exe
228	perl.exe
228	perl.exe
228	perl.exe
4236	perl.exe
4236	perl.exe
4236	perl.exe
4236	perl.exe
3476	perl.exe
3476	perl.exe
3476	perl.exe
3476	perl.exe
1348	perl.exe
1348	perl.exe
1348	perl.exe
1348	perl.exe
5116	perl.exe
5116	perl.exe
5116	perl.exe
5116	perl.exe
2292	perl.exe
2292	perl.exe
2292	perl.exe
2292	perl.exe
2844	perl.exe
2844	perl.exe
2844	perl.exe
2844	perl.exe
972	perl.exe
972	perl.exe
972	perl.exe
972	perl.exe
3772	perl.exe
3772	perl.exe
3772	perl.exe
3772	perl.exe
364	perl.exe
364	perl.exe
364	perl.exe
364	perl.exe
2900	perl.exe
2900	perl.exe
2900	perl.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4048	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorisFX Vegas patch 2026.0.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorisFX Vegas patch 2026.0.3.tmp

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3336-0-0x0000000000400000-0x00000000004F1000-memory.dmp	innosetup

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	BorisFX Vegas patch 2026.0.3.tmp
4856	BorisFX Vegas patch 2026.0.3.tmp

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4856	BorisFX Vegas patch 2026.0.3.tmp

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4856	3336	BorisFX Vegas patch 2026.0.3.exe	86
PID 4856 wrote to memory of 1280	4856	BorisFX Vegas patch 2026.0.3.tmp	92
PID 1280 wrote to memory of 4984	1280	net.exe	94
PID 4856 wrote to memory of 4048	4856	BorisFX Vegas patch 2026.0.3.tmp	95
PID 4048 wrote to memory of 4024	4048	cmd.exe	97
PID 4048 wrote to memory of 2232	4048	cmd.exe	98
PID 4048 wrote to memory of 4576	4048	cmd.exe	99
PID 4048 wrote to memory of 4836	4048	cmd.exe	100
PID 4048 wrote to memory of 4428	4048	cmd.exe	101
PID 4048 wrote to memory of 228	4048	cmd.exe	102
PID 4048 wrote to memory of 4236	4048	cmd.exe	103
PID 4048 wrote to memory of 3476	4048	cmd.exe	104
PID 4048 wrote to memory of 1348	4048	cmd.exe	105
PID 4048 wrote to memory of 5116	4048	cmd.exe	106
PID 4048 wrote to memory of 2292	4048	cmd.exe	107
PID 4048 wrote to memory of 2844	4048	cmd.exe	108
PID 4048 wrote to memory of 972	4048	cmd.exe	109
PID 4048 wrote to memory of 3772	4048	cmd.exe	110
PID 4048 wrote to memory of 364	4048	cmd.exe	111
PID 4048 wrote to memory of 2900	4048	cmd.exe	112
PID 4048 wrote to memory of 2420	4048	cmd.exe	113
PID 4048 wrote to memory of 2160	4048	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas patch 2026.0.3.exe
"C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas patch 2026.0.3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\is-B86K7.tmp\BorisFX Vegas patch 2026.0.3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-B86K7.tmp\BorisFX Vegas patch 2026.0.3.tmp" /SL5="$B006A,2435132,928256,C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas patch 2026.0.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop RLM-BorisFX
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop RLM-BorisFX
      4⤵
      PID:4984
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-161H6.tmp\unlocker_vegas.cmd""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "C:\Program Files\BorisFX\Vegas Pro 2026\vegas2026.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Vegas Pro 2026\bfx-license-tool\pylib\_license_activation.pyd"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Vegas Pro 2026\bfx-license-tool\pylib\_user_licensing_wrap.pyd"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\x28(.)\x10\x00\x06\x2D\x07\x16/\x28$1\x10\x00\x06\xDE\x07\x16/g" "c:\Program Files\BorisFX\Vegas Pro 2026\ScriptPortal.Vegas.dll"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Forge2026.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Chorus_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:228
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Compressor_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Delay_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Expander_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Flanger_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Gate_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Limiter_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_TwoPointCompressor_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:972
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Utility_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Volume_Former_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:364
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\eqFX\APU_dynamicEQ_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\eqFX\APU_modernEQ_x64.vst3"
      4⤵
      Executes dropped EXE
      PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\wizardFX\APU_wFX_ModernReverb_x64.vst3"
      4⤵
      Executes dropped EXE
      PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vr.lic

Path C:\ProgramData\GenArts\rlm\vr.lic
Size 2KB
SHA256 a9dda27ba33f86c912f0a6d5f3907172ed73c02199448df46758bb62df9a2899
MD5 f5eb8a36eb0e763e2bb2e9d391a9d464
SHA1 d55b0ff7f6ba3f906834a5097419392fc46c1ad0
SHA512 a7471a07d95f4c058bad01ebfb05867ad78fda5da4f898602d5ab40b66f9c43242f5d830ecf337c63a60c1a3b7aec0dcfefdc7aef9b40e7e1cae6a6046bb8def
TLSH
T114419C4097C853F8F78A26CA726E3229B691731152E6790704EC5B9454E3D7EFC070F8
MD5 SHA1 SHA512 TLSH

Submit Download

unlocker_vegas.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-161H6.tmp\unlocker_vegas.cmd
Size 6KB
SHA256 223631e104ad0b93a42e06e9597173ecb3103c2d08c30267c124f30216f1757d
MD5 d8353886765317ea51bcf60eca8da360
SHA1 a6e6900e1713b421040c215d13b41c698f35d181
SHA512 c898fcdd27ff0be7f3a8c8432e79628bdbd7276e85eb02e285ba4c27c25a8be88c71f1d244b286c59b14f27484a5a22ecb861e640f085e948f94b131170e3ec4
SSDEEP 48:0ApA+A1vAV3OAfLAlA8AiAGAkAiALAoAvApAI5AYt5AKK+0N:xmX1IdnUK5j/hj8NImI2Yt2Km
TLSH
T15DE17DD28340C8C65469E6C55F213B480C6FD128DAAA134A9F5FE38B0F46A9742EFC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BorisFX Vegas patch 2026.0.3.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-B86K7.tmp\BorisFX Vegas patch 2026.0.3.tmp
Size 3.6MB
SHA256 ffc811c14a83950693507fffa5750dc96581d909386841a90b8244b7a5503f98
MD5 798f7c11075e9a3aa2faf8b70a114dfc
SHA1 12c6c192d5abe35d7e270c4e99725c92221ccab7
SHA512 fa79a33bb0b6c9a6aae3011e8d61e3d99e6b946f061298f94203ae5836cb7a37d6804cede459f31f03dc7b6b05d822d1103b7887d690e1d58a177fe6b4cb5153
SSDEEP 49152:xviYUtaivJlWSM0WXo7FhDGS6Yh2ewYAJpg7xmUzWc8UecQ3/fmmowkTOW333J:OgoDyS6Oy/+t333J
TLSH
T150064A13F244B13FD75E2E35443B866499377761692A8D26ABFCAC4C4F760402E3BB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 711KB
SHA256 cb96718f7ef83319472e4ca3fcdf6d002226d3a6ff4d0d64b6e221aba58016a3
MD5 97ba9d2d7090a7d265cefed7fa40b1bf
SHA1 04231941ab6681e445c529d35f91d4a2a80f92ec
SHA512 e0ed771116902e2aae3650fed86f2c07fc164134cbaa4961665d7ba33a8f4ef7c6fdbda93046eaa3832df3882d730487a77a973bee9578caa333c83e894bf601
SSDEEP 6144:sbtQeWsyqCyeYJxCMMAmivzouBFBdyjW11jQ1UYggO0Ukuh7RZ5ztkXy3j9acKiV:beWAJUpg3/1sggO0Ukuh7RZ55k5EV
TLSH
T167F43A847B9DB49BC03002B5569B025B1330A98533D4BB6B7E6D7A38DD933D8CF886D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 2.2MB
SHA256 d747bb93d4e936ddd57b6258355a977e210ad308c0f832d3d47fab6f9191c2ce
MD5 b1852a4962ea7185dc353fe6f0ab4553
SHA1 b4335332bfc3033e5465db6eb56b344cbe2270b1
SHA512 e7cfba7553879df5df57275e65509f18069ddd8c3c5c18676a2a326bc91204145ddf6be5013380613257b398734e11c513647e86878ec9525533b772d929d2d5
SSDEEP 49152:pbxE3cqZXY88ZxCx7x+vrHpH4cW5aYThxsYiv3c1QD:XEMqcxCx7x+vyZa/3c1QD
TLSH
T177B55B03D6974D7CC9DBE7B4925B92769A20FC298538BD2E5E9CC7302B12E40972FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 85KB
SHA256 8ae45c5928698df7da6780e282bc5053a7b1a87a1cba0a2083aa26c473c3f7f9
MD5 59a112452ceccba063cc85d0513fd0a7
SHA1 f046c7d16606bcd8b1104270cdbba545549ea311
SHA512 40bc9c0966dfa13167c59b14eb0c9e2096a30408c65977dec9e86628183505b877aacf5f444b59ff2dd12d42a6e406c68c276b60a598b501d6ff0ea0a87f9115
SSDEEP 1536:Tb4A1X+bp4B4gepS7k8G9rS6nBPm3YB+ZQF69Z6:T9Obp4GkQ8G9rS6nBPm3YB+ZQFOZ6
TLSH
T15383C237E6B388ACC1DB92B0B7C691F175B6FC100520AA1E134596343F5FDA42FAD989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl.exe

Path C:\Users\Admin\AppData\Local\Temp\perl.exe
Size 43KB
SHA256 13f689c7c8d93a546ae207e28000a0b163851dd0a148d5d329618ffc7daff554
MD5 98a571d345034f8ff5953714a18b68a1
SHA1 118da15a20c31845d64de6a1bfeeaf1046d16263
SHA512 6daee529e6dea6648bad518cc86c8d0bfd59399908eda24ff622c1cb6f60115fd6a6dc21886a86beefe36e476077101ebbc4c4a9a11af5247c0d7853e67a7fc8
SSDEEP 768:u95VKDDsyfhw1111111111111111111111111111Tb4YMz8vEUDCFFtFF9vQ4:rHsyobCzKIFFtFFK4
TLSH
T17F13D75EF722C899C5C552B4F48986F1D6A0FCF1C850462F22377F697B727884F69282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl538.dll

Path C:\Users\Admin\AppData\Local\Temp\perl538.dll
Size 3.0MB
SHA256 68bef13493195a03f812c8f6dc15ff1c429010644605e5f9dc66388e77fe2eaf
MD5 a6764a022dc825aba978297546603e0f
SHA1 a8ff5ac32cd4848534b68c95b9df44fdb6f57a25
SHA512 564ba6f9a9e1b12488bf6768af7f8a456730449d82ce88cba17944ea0c52c081117dec57828eb612ac41bba0dcb38ab0c580733f126e057a38023cae29ebffbf
SSDEEP 49152:B+lFF8N8QewIPGm4CKzGNR7OPlTmKZ9kjCr4WmKME0YHAnGlJO12RIT5kqBGV9Px:0lWHzh
TLSH
T141E54A47ECA2D674C46D82754EAF07667332F08C66267B1F25289A303E53B241F9E36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-111-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/228-114-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/228-115-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/228-112-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/228-113-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/972-180-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/972-181-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/972-182-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/1348-144-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/1348-145-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/1348-146-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/1348-147-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/1348-148-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/2232-71-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/2232-68-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/2232-67-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/2232-69-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/2232-70-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/2292-166-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/2292-167-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/2292-168-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/2292-169-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/2292-170-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/2844-174-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/2844-175-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/2844-176-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/2844-177-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/2844-178-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/3336-0-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/3476-135-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/3476-133-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/3476-134-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/3476-136-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/3476-137-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/4024-56-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/4024-60-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/4024-59-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/4024-58-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/4024-57-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/4236-123-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/4236-122-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/4236-124-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/4236-125-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/4236-126-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/4428-104-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/4428-103-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/4428-102-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/4428-101-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/4428-100-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/4576-79-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/4576-78-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/4576-82-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/4576-81-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/4576-80-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/4836-91-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/4836-90-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/4836-89-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download

memory/4836-92-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/4836-93-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/4856-5-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/5116-157-0x00007FFB5F110000-0x00007FFB5F1B5000-memory.dmp

Download

memory/5116-158-0x00007FFB5E330000-0x00007FFB5E568000-memory.dmp

Download

memory/5116-159-0x00007FFB6BBF0000-0x00007FFB6BC0D000-memory.dmp

Download

memory/5116-156-0x00007FFB5E570000-0x00007FFB5E88A000-memory.dmp

Download

memory/5116-155-0x00007FF73D760000-0x00007FF73D773000-memory.dmp

Download