3e0f7468e80784bef674ac1ad77ee5c5e103bc84678c9796ef07c12de53abe22

Analysis

user interaction
yes
max time kernel
74s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BorisFX Vegas patch 2026.0.3.exe
Size 3.5MB
Sample261102-vjmxysff78
SHA256 3e0f7468e80784bef674ac1ad77ee5c5e103bc84678c9796ef07c12de53abe22
MD5 1098cca01ab02f7418d52353e8472c15
SHA1 b5b228f968b70d639ff8296bd0c1173443725ae5
SHA512 790337ad5b411137ba2eec4d21715b11bb1fc2436fd8a000bb12dce461051938ddf344b170e4468350d8deec05fa0593f2add9f3119df856087836241884d789
SSDEEP 49152:W7J92Nf/cACKnMlNlOcyacYWmEWNIdlksjGWKRpT6ZYrD+LPdcpbVtjiDhy3lg/b:W7I/aaO6Y4mEW+kBjRpxeLPdS4D4+/b
TLSH
T1C0F5E02AB65EF13DD8593A3545B3C2305A377E69743A8C1FC2F83508CFA34486E2B665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 19 IoCs

pid	Process
1204	BorisFX Vegas patch 2026.0.3.tmp
2336	perl.exe
4848	perl.exe
4084	perl.exe
5592	perl.exe
1760	perl.exe
3268	perl.exe
2868	perl.exe
484	perl.exe
692	perl.exe
5964	perl.exe
1504	perl.exe
976	perl.exe
5580	perl.exe
2116	perl.exe
5408	perl.exe
3744	perl.exe
1944	perl.exe
4080	perl.exe

Loads dropped DLL 64 IoCs

pid	Process
2336	perl.exe
2336	perl.exe
2336	perl.exe
2336	perl.exe
2336	perl.exe
4848	perl.exe
4848	perl.exe
4848	perl.exe
4848	perl.exe
4084	perl.exe
4084	perl.exe
4084	perl.exe
4084	perl.exe
5592	perl.exe
5592	perl.exe
5592	perl.exe
5592	perl.exe
1760	perl.exe
1760	perl.exe
1760	perl.exe
1760	perl.exe
3268	perl.exe
3268	perl.exe
3268	perl.exe
3268	perl.exe
2868	perl.exe
2868	perl.exe
2868	perl.exe
2868	perl.exe
484	perl.exe
484	perl.exe
484	perl.exe
484	perl.exe
692	perl.exe
692	perl.exe
692	perl.exe
692	perl.exe
5964	perl.exe
5964	perl.exe
5964	perl.exe
5964	perl.exe
1504	perl.exe
1504	perl.exe
1504	perl.exe
1504	perl.exe
976	perl.exe
976	perl.exe
976	perl.exe
976	perl.exe
5580	perl.exe
5580	perl.exe
5580	perl.exe
5580	perl.exe
2116	perl.exe
2116	perl.exe
2116	perl.exe
2116	perl.exe
5408	perl.exe
5408	perl.exe
5408	perl.exe
5408	perl.exe
3744	perl.exe
3744	perl.exe
3744	perl.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4200	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorisFX Vegas patch 2026.0.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorisFX Vegas patch 2026.0.3.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3132-1-0x0000000000400000-0x00000000004F1000-memory.dmp	innosetup
behavioral2/memory/3132-68-0x0000000000400000-0x00000000004F1000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{4076A4AB-8F44-4736-BC99-7E4EF75C3DAA}	ShellHost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
1204	BorisFX Vegas patch 2026.0.3.tmp
1204	BorisFX Vegas patch 2026.0.3.tmp
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3240	ShellHost.exe
Token: SeCreatePagefilePrivilege	3240	ShellHost.exe
Token: SeShutdownPrivilege	3240	ShellHost.exe
Token: SeCreatePagefilePrivilege	3240	ShellHost.exe
Token: SeShutdownPrivilege	3240	ShellHost.exe
Token: SeCreatePagefilePrivilege	3240	ShellHost.exe
Token: SeShutdownPrivilege	3240	ShellHost.exe
Token: SeCreatePagefilePrivilege	3240	ShellHost.exe
Token: SeDebugPrivilege	2072	taskmgr.exe
Token: SeSystemProfilePrivilege	2072	taskmgr.exe
Token: SeCreateGlobalPrivilege	2072	taskmgr.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
1204	BorisFX Vegas patch 2026.0.3.tmp
3240	ShellHost.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe
2072	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3240	ShellHost.exe
704	ShellHost.exe
2072	taskmgr.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 1204	3132	BorisFX Vegas patch 2026.0.3.exe	90
PID 1204 wrote to memory of 576	1204	BorisFX Vegas patch 2026.0.3.tmp	91
PID 576 wrote to memory of 4440	576	net.exe	93
PID 1204 wrote to memory of 4200	1204	BorisFX Vegas patch 2026.0.3.tmp	94
PID 4200 wrote to memory of 2336	4200	cmd.exe	96
PID 4200 wrote to memory of 4848	4200	cmd.exe	97
PID 4200 wrote to memory of 4084	4200	cmd.exe	98
PID 4200 wrote to memory of 5592	4200	cmd.exe	99
PID 4200 wrote to memory of 1760	4200	cmd.exe	100
PID 4200 wrote to memory of 3268	4200	cmd.exe	101
PID 4200 wrote to memory of 2868	4200	cmd.exe	102
PID 4200 wrote to memory of 484	4200	cmd.exe	103
PID 4200 wrote to memory of 692	4200	cmd.exe	104
PID 4200 wrote to memory of 5964	4200	cmd.exe	105
PID 4200 wrote to memory of 1504	4200	cmd.exe	106
PID 4200 wrote to memory of 976	4200	cmd.exe	107
PID 4200 wrote to memory of 5580	4200	cmd.exe	108
PID 4200 wrote to memory of 2116	4200	cmd.exe	109
PID 4200 wrote to memory of 5408	4200	cmd.exe	110
PID 4200 wrote to memory of 3744	4200	cmd.exe	111
PID 4200 wrote to memory of 1944	4200	cmd.exe	112
PID 4200 wrote to memory of 4080	4200	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas patch 2026.0.3.exe
"C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas patch 2026.0.3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Users\Admin\AppData\Local\Temp\is-95S9F.tmp\BorisFX Vegas patch 2026.0.3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-95S9F.tmp\BorisFX Vegas patch 2026.0.3.tmp" /SL5="$4018A,2435132,928256,C:\Users\Admin\AppData\Local\Temp\BorisFX Vegas patch 2026.0.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop RLM-BorisFX
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop RLM-BorisFX
      4⤵
      PID:4440
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-5G5PQ.tmp\unlocker_vegas.cmd""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "C:\Program Files\BorisFX\Vegas Pro 2026\vegas2026.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Vegas Pro 2026\bfx-license-tool\pylib\_license_activation.pyd"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Vegas Pro 2026\bfx-license-tool\pylib\_user_licensing_wrap.pyd"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\x28(.)\x10\x00\x06\x2D\x07\x16/\x28$1\x10\x00\x06\xDE\x07\x16/g" "c:\Program Files\BorisFX\Vegas Pro 2026\ScriptPortal.Vegas.dll"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Forge2026.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Chorus_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Compressor_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Delay_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:484
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Expander_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:692
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Flanger_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Gate_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Limiter_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:976
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_TwoPointCompressor_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Utility_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\coreFX\cFX_Volume_Former_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\eqFX\APU_dynamicEQ_x64.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\eqFX\APU_modernEQ_x64.vst3"
      4⤵
      Executes dropped EXE
      PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\perl.exe
      C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\BorisFX\Sound Forge\2026\Boris FX Plugins\wizardFX\APU_wFX_ModernReverb_x64.vst3"
      4⤵
      Executes dropped EXE
      PID:4080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:6052

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B4 0x00000000000004C0
1⤵
PID:4428

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3240

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:704

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vr.lic

Path C:\ProgramData\GenArts\rlm\vr.lic
Size 2KB
SHA256 a9dda27ba33f86c912f0a6d5f3907172ed73c02199448df46758bb62df9a2899
MD5 f5eb8a36eb0e763e2bb2e9d391a9d464
SHA1 d55b0ff7f6ba3f906834a5097419392fc46c1ad0
SHA512 a7471a07d95f4c058bad01ebfb05867ad78fda5da4f898602d5ab40b66f9c43242f5d830ecf337c63a60c1a3b7aec0dcfefdc7aef9b40e7e1cae6a6046bb8def
TLSH
T114419C4097C853F8F78A26CA726E3229B691731152E6790704EC5B9454E3D7EFC070F8
MD5 SHA1 SHA512 TLSH

Submit Download

unlocker_vegas.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-5G5PQ.tmp\unlocker_vegas.cmd
Size 6KB
SHA256 223631e104ad0b93a42e06e9597173ecb3103c2d08c30267c124f30216f1757d
MD5 d8353886765317ea51bcf60eca8da360
SHA1 a6e6900e1713b421040c215d13b41c698f35d181
SHA512 c898fcdd27ff0be7f3a8c8432e79628bdbd7276e85eb02e285ba4c27c25a8be88c71f1d244b286c59b14f27484a5a22ecb861e640f085e948f94b131170e3ec4
SSDEEP 48:0ApA+A1vAV3OAfLAlA8AiAGAkAiALAoAvApAI5AYt5AKK+0N:xmX1IdnUK5j/hj8NImI2Yt2Km
TLSH
T15DE17DD28340C8C65469E6C55F213B480C6FD128DAAA134A9F5FE38B0F46A9742EFC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BorisFX Vegas patch 2026.0.3.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-95S9F.tmp\BorisFX Vegas patch 2026.0.3.tmp
Size 3.6MB
SHA256 ffc811c14a83950693507fffa5750dc96581d909386841a90b8244b7a5503f98
MD5 798f7c11075e9a3aa2faf8b70a114dfc
SHA1 12c6c192d5abe35d7e270c4e99725c92221ccab7
SHA512 fa79a33bb0b6c9a6aae3011e8d61e3d99e6b946f061298f94203ae5836cb7a37d6804cede459f31f03dc7b6b05d822d1103b7887d690e1d58a177fe6b4cb5153
SSDEEP 49152:xviYUtaivJlWSM0WXo7FhDGS6Yh2ewYAJpg7xmUzWc8UecQ3/fmmowkTOW333J:OgoDyS6Oy/+t333J
TLSH
T150064A13F244B13FD75E2E35443B866499377761692A8D26ABFCAC4C4F760402E3BB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 711KB
SHA256 cb96718f7ef83319472e4ca3fcdf6d002226d3a6ff4d0d64b6e221aba58016a3
MD5 97ba9d2d7090a7d265cefed7fa40b1bf
SHA1 04231941ab6681e445c529d35f91d4a2a80f92ec
SHA512 e0ed771116902e2aae3650fed86f2c07fc164134cbaa4961665d7ba33a8f4ef7c6fdbda93046eaa3832df3882d730487a77a973bee9578caa333c83e894bf601
SSDEEP 6144:sbtQeWsyqCyeYJxCMMAmivzouBFBdyjW11jQ1UYggO0Ukuh7RZ5ztkXy3j9acKiV:beWAJUpg3/1sggO0Ukuh7RZ55k5EV
TLSH
T167F43A847B9DB49BC03002B5569B025B1330A98533D4BB6B7E6D7A38DD933D8CF886D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 2.2MB
SHA256 d747bb93d4e936ddd57b6258355a977e210ad308c0f832d3d47fab6f9191c2ce
MD5 b1852a4962ea7185dc353fe6f0ab4553
SHA1 b4335332bfc3033e5465db6eb56b344cbe2270b1
SHA512 e7cfba7553879df5df57275e65509f18069ddd8c3c5c18676a2a326bc91204145ddf6be5013380613257b398734e11c513647e86878ec9525533b772d929d2d5
SSDEEP 49152:pbxE3cqZXY88ZxCx7x+vrHpH4cW5aYThxsYiv3c1QD:XEMqcxCx7x+vyZa/3c1QD
TLSH
T177B55B03D6974D7CC9DBE7B4925B92769A20FC298538BD2E5E9CC7302B12E40972FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 85KB
SHA256 8ae45c5928698df7da6780e282bc5053a7b1a87a1cba0a2083aa26c473c3f7f9
MD5 59a112452ceccba063cc85d0513fd0a7
SHA1 f046c7d16606bcd8b1104270cdbba545549ea311
SHA512 40bc9c0966dfa13167c59b14eb0c9e2096a30408c65977dec9e86628183505b877aacf5f444b59ff2dd12d42a6e406c68c276b60a598b501d6ff0ea0a87f9115
SSDEEP 1536:Tb4A1X+bp4B4gepS7k8G9rS6nBPm3YB+ZQF69Z6:T9Obp4GkQ8G9rS6nBPm3YB+ZQFOZ6
TLSH
T15383C237E6B388ACC1DB92B0B7C691F175B6FC100520AA1E134596343F5FDA42FAD989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl.exe

Path C:\Users\Admin\AppData\Local\Temp\perl.exe
Size 43KB
SHA256 13f689c7c8d93a546ae207e28000a0b163851dd0a148d5d329618ffc7daff554
MD5 98a571d345034f8ff5953714a18b68a1
SHA1 118da15a20c31845d64de6a1bfeeaf1046d16263
SHA512 6daee529e6dea6648bad518cc86c8d0bfd59399908eda24ff622c1cb6f60115fd6a6dc21886a86beefe36e476077101ebbc4c4a9a11af5247c0d7853e67a7fc8
SSDEEP 768:u95VKDDsyfhw1111111111111111111111111111Tb4YMz8vEUDCFFtFF9vQ4:rHsyobCzKIFFtFFK4
TLSH
T17F13D75EF722C899C5C552B4F48986F1D6A0FCF1C850462F22377F697B727884F69282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl538.dll

Path C:\Users\Admin\AppData\Local\Temp\perl538.dll
Size 3.0MB
SHA256 68bef13493195a03f812c8f6dc15ff1c429010644605e5f9dc66388e77fe2eaf
MD5 a6764a022dc825aba978297546603e0f
SHA1 a8ff5ac32cd4848534b68c95b9df44fdb6f57a25
SHA512 564ba6f9a9e1b12488bf6768af7f8a456730449d82ce88cba17944ea0c52c081117dec57828eb612ac41bba0dcb38ab0c580733f126e057a38023cae29ebffbf
SSDEEP 49152:B+lFF8N8QewIPGm4CKzGNR7OPlTmKZ9kjCr4WmKME0YHAnGlJO12RIT5kqBGV9Px:0lWHzh
TLSH
T141E54A47ECA2D674C46D82754EAF07667332F08C66267B1F25289A303E53B241F9E36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-139-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download

memory/484-140-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/484-137-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/484-141-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/484-138-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/692-148-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/692-150-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download

memory/692-152-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/692-149-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/692-151-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/976-182-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/976-181-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/976-179-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/976-180-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download

memory/976-178-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/1204-6-0x0000000002A00000-0x0000000002A01000-memory.dmp

Download

memory/1204-70-0x0000000002A00000-0x0000000002A01000-memory.dmp

Download

memory/1204-69-0x0000000000400000-0x00000000007AB000-memory.dmp

Download

memory/1504-173-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/1504-170-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/1504-172-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download

memory/1504-174-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/1504-171-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/1760-104-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/1760-106-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download

memory/1760-107-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/1760-105-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/1760-108-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/2336-57-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/2336-60-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/2336-59-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download

memory/2336-61-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/2336-58-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/2868-128-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download

memory/2868-130-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/2868-126-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/2868-127-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/2868-129-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/3132-1-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/3132-68-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/3268-117-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download

memory/3268-118-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/3268-116-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/3268-119-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/3268-115-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/4084-83-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/4084-85-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/4084-86-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/4084-82-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/4084-84-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download

memory/4848-75-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/4848-71-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/4848-73-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download

memory/4848-72-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/4848-74-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/5580-184-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/5592-95-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download

memory/5592-93-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/5592-97-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/5592-94-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/5592-96-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/5964-159-0x00007FF6B42C0000-0x00007FF6B42D3000-memory.dmp

Download

memory/5964-162-0x00007FF8ABF80000-0x00007FF8AC1B8000-memory.dmp

Download

memory/5964-160-0x00007FF8AC3B0000-0x00007FF8AC6CA000-memory.dmp

Download

memory/5964-163-0x00007FF8B84F0000-0x00007FF8B850D000-memory.dmp

Download

memory/5964-161-0x00007FF8B7380000-0x00007FF8B7425000-memory.dmp

Download