Analysis
- user interaction
yes - max time kernel
1106s - max time network
1536s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 11:33
General
- Target Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe
- Size 595.4MB
- Sample260722-npc7datfke
- SHA256 231e5989881b9df333c2797bb8f980b31f7f19e235249d8021d5882e4bb3d728
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 1 IoCs
- Drops file in Drivers directory 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 22 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 29 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies Control Panel 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 53 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe"C:\Users\Admin\AppData\Local\Temp\Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe"C:\Users\Admin\AppData\Local\Temp\Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe"C:\Users\Admin\AppData\Local\Temp\Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\alibre\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\AlibreDesignV28_setup_x64_28.1.1.28228.exe"C:\Users\Admin\Desktop\alibre\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\AlibreDesignV28_setup_x64_28.1.1.28228.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7z.exe"C:\Users\Admin\AppData\Local\Temp\7z.exe" x -p"111111" "C:\Users\Admin\AppData\Local\Temp\edge_BITS_915.jpg" -o"C:\Windows\Microsoft.NET\Framework64" -y -bso0 -bsp1 -bse12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN "Microsoft\Windows\WindowsUpdate\UpdateHelper_915" /TR "C:\Windows\Microsoft.NET\Framework64\KB.32.278.4355.exe" /sc minute /mo 10 /DU 00:15 /RL HIGHEST2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files (x86)\Alibre Design Expert\AlibreDesignV28_setup_x64_28.1.1.28228.exe"C:\Program Files (x86)\Alibre Design Expert\AlibreDesignV28_setup_x64_28.1.1.28228.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Alibre Design Expert\AlibreDesignV28_setup_x64_28.1.1.28228.exe"C:\Program Files (x86)\Alibre Design Expert\AlibreDesignV28_setup_x64_28.1.1.28228.exe" /i "C:\Users\Admin\AppData\Roaming\Alibre LLC\Alibre Design 28.1.1.28228\install\AlibreDesign_x64.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\Alibre Design 28.1.1.28228" AS_LIB_DIR="C:\Users\Admin\Documents" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Alibre Design" MS.3207D1B0_80E5_11D2_B95D_006097C4DE24="C:\Windows\SysWOW64" MS.7EBEDD3E_AA66_11D2_B980_006097C4DE24="C:\Windows\SysWOW64" MS.8C0C59A0_7DC8_11D2_B95D_006097C4DE24="C:\Windows\SysWOW64" SECONDSEQUENCE="1" CLIENTPROCESSID="1404" AI_MORE_CMD_LINE=13⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://repackmaster.com/2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffb6cdec188,0x7ffb6cdec194,0x7ffb6cdec1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,6064497563567815030,3919342843679196936,262144 --field-trial-handle=2260,i,1949345122411969324,17392795997515940315,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,8688213244083242812,5887579307128715859,524288 --field-trial-handle=2260,i,1949345122411969324,17392795997515940315,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,15604052624306453474,10702016329201763479,524288 --field-trial-handle=2260,i,1949345122411969324,17392795997515940315,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,847852432821275405,11145164929414680401,2097152 --field-trial-handle=2260,i,1949345122411969324,17392795997515940315,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,8837535071512679143,833353808318906204,2097152 --field-trial-handle=2260,i,1949345122411969324,17392795997515940315,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,8071051926319027983,3716091047017068611,2097152 --field-trial-handle=2260,i,1949345122411969324,17392795997515940315,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,4501432738808278741,349816630162221964,2097152 --field-trial-handle=2260,i,1949345122411969324,17392795997515940315,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,8149656062890258740,4923174693958863801,524288 --field-trial-handle=2260,i,1949345122411969324,17392795997515940315,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,5248599661308805181,3548725328847778800,524288 --field-trial-handle=2260,i,1949345122411969324,17392795997515940315,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,12140676604071697411,14756826749693217399,524288 --field-trial-handle=2260,i,1949345122411969324,17392795997515940315,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffb6cdec188,0x7ffb6cdec194,0x7ffb6cdec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,7866004446901263876,2116551606061927055,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,1736765320676247529,15549815790710456630,262144 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,12650044530311782089,15069030621611248690,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,3494927953177164462,8892907544121185175,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,3494927953177164462,8892907544121185175,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,11715971969650134353,1933892984537462870,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,2452537906448182884,2681486168860552145,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,17482955908557859247,7428743265213604537,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,6916185735595169396,8212872776554250200,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,6938292626979560939,6358191404448439519,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,1252641972745929973,11135007594632470074,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,13542708263066906304,14391071292758506626,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,13253274611877500437,458960023188829257,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5360,i,6335208494954334014,16222058494678700714,262144 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,13401686767722404555,2330769411629837377,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,17161892064384142980,10855998605941028341,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,15094124860479898031,13797365591196680109,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,5672482656336925009,14044702447332897207,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,6172090767640413080,8242033108398370796,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,10082081618983237447,4128149148465941625,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3172,i,1077453443755739183,16472304148812309221,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,17136279500949653555,10581634813636041742,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,11252140711504681154,4063397555365472676,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,11983926133090080735,17838226394484941410,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,10879842318673979673,14990994966751368313,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=1084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,10745567608570880068,14671214568756488269,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,10093450043999710004,8234210469232886619,524288 --field-trial-handle=2276,i,1640738271094548847,14757169819506246950,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:144⤵
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\alibre\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\Key.txt1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\alibre\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\keygen-BTCR\BTCR\btcr.txt1⤵
-
C:\Windows\Microsoft.NET\Framework64\KB.32.278.4355.exeC:\Windows\Microsoft.NET\Framework64\KB.32.278.4355.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Alibre Design 28.1.1.28228\Program\Alibre Design.exe"C:\Program Files\Alibre Design 28.1.1.28228\Program\Alibre Design.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe logicaldisk where "DeviceID='C:'" assoc /assocclass:win32_logicaldisktopartition4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe diskdrive get deviceid,serialnumber4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\mountvol.exeC:\Windows\System32\mountvol.exe C: /L4⤵
-
-
C:\Program Files\Alibre Design 28.1.1.28228\Program\updater.exe"C:\Program Files\Alibre Design 28.1.1.28228\Program\updater.exe" /justcheck -licensendate 19/02/20304⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Alibre Design 28.1.1.28228\Program\updater.exe"C:\Program Files\Alibre Design 28.1.1.28228\Program\updater.exe" /silent -licensendate 19/02/20304⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\cdf204c711e8d0ce981bc263d5cc9449\updater.exe"C:\Users\Admin\AppData\Local\Temp\cdf204c711e8d0ce981bc263d5cc9449\updater.exe" /install silent "C:\Users\Admin\AppData\Local\Temp\cdf204c711e8d0ce981bc263d5cc9449\updater.ini"5⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\ProgramData\Alibre LLC\Alibre Design\updates\V29.0.1\AlibreDesign_setup_x64_29.0.1.29069.exe"C:\ProgramData\Alibre LLC\Alibre Design\updates\V29.0.1\AlibreDesign_setup_x64_29.0.1.29069.exe"6⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Alibre LLC\Alibre Design\updates\V29.0.1\AlibreDesign_setup_x64_29.0.1.29069.exe"C:\ProgramData\Alibre LLC\Alibre Design\updates\V29.0.1\AlibreDesign_setup_x64_29.0.1.29069.exe" /i "C:\Users\Admin\AppData\Roaming\Alibre LLC\Alibre Design 29.0.1.29069\install\AlibreDesign_x64.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\Alibre Design 29.0.1.29069" AS_LIB_DIR="C:\Users\Admin\Documents" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Alibre Design" MS.3207D1B0_80E5_11D2_B95D_006097C4DE24="C:\Windows\SysWOW64" MS.7EBEDD3E_AA66_11D2_B980_006097C4DE24="C:\Windows\SysWOW64" MS.8C0C59A0_7DC8_11D2_B95D_006097C4DE24="C:\Windows\SysWOW64" SECONDSEQUENCE="1" CLIENTPROCESSID="7732" AI_MORE_CMD_LINE=17⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\{39BE3C8C-FFF6-4308-9C16-575E8930B455}..bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\{39BE3C8C-FFF6-4308-9C16-575E8930B455}..bat" "7⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"7⤵
-
-
-
-
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\alibre\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\keygen-BTCR\BTCR\Keygen.exe"C:\Users\Admin\Desktop\alibre\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\keygen-BTCR\BTCR\Keygen.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Alibre Design 29.0.1.29069\Program\Alibre Design.exe"C:\Program Files\Alibre Design 29.0.1.29069\Program\Alibre Design.exe"3⤵
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption4⤵
-
-
C:\Program Files\Alibre Design 29.0.1.29069\Program\updater.exe"C:\Program Files\Alibre Design 29.0.1.29069\Program\updater.exe" /justcheck -licensendate 19/02/20304⤵
-
-
-
C:\Program Files\Alibre Design 29.0.1.29069\Program\Alibre Design.exe"C:\Program Files\Alibre Design 29.0.1.29069\Program\Alibre Design.exe"3⤵
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption4⤵
-
-
-
C:\Users\Admin\Desktop\Keygen.exe"C:\Users\Admin\Desktop\Keygen.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 56 -s 16804⤵
- Program crash
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\asd.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Users\Admin\Desktop\Keygen.exe"C:\Users\Admin\Desktop\Keygen.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 25564⤵
- Program crash
-
-
-
C:\Program Files\Alibre Design 29.0.1.29069\Program\Alibre Design.exe"C:\Program Files\Alibre Design 29.0.1.29069\Program\Alibre Design.exe"3⤵
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption4⤵
-
-
-
C:\Program Files\Alibre Design 29.0.1.29069\Program\Alibre Design.exe"C:\Program Files\Alibre Design 29.0.1.29069\Program\Alibre Design.exe"3⤵
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption4⤵
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\asd.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F5E0A03B31DB7D9C12039BDA7093E548 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TestWriteAccess.exe"C:\Users\Admin\AppData\Local\Temp\TestWriteAccess.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3A2D42D6CB151197AA0E282A2EAEE0FE2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 95267A626D7B9D32D9A07870646119DF E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Installer\MSI3CAE.tmp"C:\Windows\Installer\MSI3CAE.tmp" "C:\Program Files\Alibre Design 28.1.1.28228\AlibreInstall.reg"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg.exe" IMPORT "C:\Program Files\Alibre Design 28.1.1.28228\AlibreInstall.reg"3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CD9E66A0DDCBB59CDA1C06CB6756EBA7 C2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Alibre LLC\Alibre Design\updates\V29.0.1\AlibreDesign_setup_x64_29.0.1.29069.exe"C:\ProgramData\Alibre LLC\Alibre Design\updates\V29.0.1\AlibreDesign_setup_x64_29.0.1.29069.exe" /groupsextract:101; /out:"C:\Users\Admin\AppData\Local\Temp\{880F8C30-655D-4679-9B3C-021AB445C39F}" /callbackid:77403⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\{880F8C30-655D-4679-9B3C-021AB445C39F}\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\{880F8C30-655D-4679-9B3C-021AB445C39F}\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe" /q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{213787E8-44A4-4F63-8980-085B52BEE87B}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{213787E8-44A4-4F63-8980-085B52BEE87B}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{880F8C30-655D-4679-9B3C-021AB445C39F}\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe" -burn.filehandle.attached=600 -burn.filehandle.self=596 /q /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{89E28DFE-1B4C-44CB-B235-D5DAA1F147F0}\.be\VC_redist.x64.exe"C:\Windows\Temp\{89E28DFE-1B4C-44CB-B235-D5DAA1F147F0}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{FD89EFCA-B043-47AD-9147-0C582561E47F} {961621BE-FD6D-4EF2-97B9-E01A4F9FE308} 69165⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{784698E7-7167-4346-805F-599900081423} {FA31DAE6-1E10-4071-9F56-0C2E3ADB4FE7} 39966⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{784698E7-7167-4346-805F-599900081423} {FA31DAE6-1E10-4071-9F56-0C2E3ADB4FE7} 39967⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{90D9CE6B-FC63-47B7-9441-640E7BDA7105} {AB0B18F0-2507-4975-A973-B65B4E0E5ECA} 36128⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TestWriteAccess.exe"C:\Users\Admin\AppData\Local\Temp\TestWriteAccess.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 98F037082330DA0E9DDD4811BD72C8942⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 956DA02A9ACD9697A5664DDAF28E1218 E Global\MSI00002⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss2997.ps1" -propFile "C:\Windows\SystemTemp\msi2984.txt" -scriptFile "C:\Windows\SystemTemp\scr2985.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr2986.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\system32\whoami.exe"C:\Windows\system32\whoami.exe"4⤵
-
-
-
-
C:\Windows\Installer\MSI2457.tmp"C:\Windows\Installer\MSI2457.tmp" "C:\Program Files\Alibre Design 29.0.1.29069\AlibreInstall.reg"2⤵
- Executes dropped EXE
-
C:\Windows\system32\reg.exe"reg.exe" IMPORT "C:\Program Files\Alibre Design 29.0.1.29069\AlibreInstall.reg"3⤵
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\Microsoft.NET\Framework64\KB.32.278.4355.exe"C:\Windows\Microsoft.NET\Framework64\KB.32.278.4355.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 56 -ip 561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4316 -ip 43161⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
e61f57c.rbs
e61f583.rbs
e61f58f.rbs
e61f596.rbs
e61f5a5.rbs
e61f5a8.rbs
Alibre Design.exe
updater.ini
updater.ini
Alibre Design.exe
System.Memory.dll
updater.ini
updater.ini
AD_Updates.aiu
VersionSelector.log
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_D189AF395FC7D76E0D8F1A6D70CDE45D
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_D189AF395FC7D76E0D8F1A6D70CDE45D
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
67e1e40593013dc8f6.lic
67e1e40593013dc8f6.lic
67e1e40593013dc8f6.lic
67e1e40593013dc8f6.lic
67e1e40593013dc8f6.lic
67e1e40593013dc8f6.lic
67e1e40593013dc8f6.lic
67e1e40593013dc8f6.lic
67e1e40593013dc8f6.lic
67e1e40593013dc8f6.lic
67e1e40593013dc8f6.lic
RegFile.xml
te3lkevm.newcfg
settings.dat
settings.dat
settings.dat
2e6b02d7-dbcd-4716-813f-a58efe1eaf67.tmp
LOG.old
the-real-index
the-real-index~RFe6518d3.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
cbd59e30-539a-4f35-88e5-3ea80a9a6e9b.tmp
Local State
Local State
Local State
Local State
Local State
Local State
data_1
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
a7e666f0-6b92-468f-91e9-924e3fa0df60.tmp
iconcache_idx.db
prep_Activatable Class_Hermes_perf.cache
7967b3d7-e00e-4c76-a43c-9e3546e668e2.tmp
7z.dll
7z.exe
background.png
frame_bottom_left.bmp
frame_bottom_left_inactive.bmp
frame_bottom_mid.bmp
frame_bottom_mid_inactive.bmp
frame_bottom_right.bmp
frame_bottom_right_inactive.bmp
frame_caption.bmp
frame_caption_inactive.bmp
frame_left.bmp
frame_left_inactive.bmp
frame_right.bmp
frame_right_inactive.bmp
frame_top_left.bmp
frame_top_left_inactive.bmp
frame_top_mid.bmp
frame_top_mid_inactive.bmp
frame_top_right.bmp
frame_top_right_inactive.bmp
jpg
jpg_1
jpg_2
jpg_3
sys_close_down.bmp
sys_close_hot.bmp
sys_close_inactive.bmp
sys_close_normal.bmp
sys_min_down.bmp
sys_min_hot.bmp
sys_min_inactive.bmp
sys_min_normal.bmp
AlibreThreadsResultTemp.xlsx
AlibreThreads_Update_V1.xlsx
AlibreThreads_Update_V1.xlsx
MSI154D.tmp
MSI59AC.tmp
MSI6AD9.tmp
MSI6DCA.tmp
MSI7526.tmp
TestWriteAccess.exe
updater.dat
updater.ini
edge_BITS_915.jpg
fe4b35e5-78c3-4f86-bec8-b81a79b2bfe8.tmp
INetC.dll
System.dll
md5dll.dll
nsDialogs.dll
nsExec.dll
OpenXml4Net639203225905624793b689809a-2d73-4fed-95de-c80c06445b5d.tmp
content_new.js
AlibreDesign_x64.msi
AlibreDesign_x64.msi
f01b4d95cf55d32a.automaticDestinations-ms
Key.txt
btcr.txt
MaxCellSize.jpg
NormalDeviation.jpg
Part Exporter.py
STL Exporter.py
SurfaceDeviation.jpg
Equation Sketcher.py
EquationSketcher.png
Gear Generator.py
GearGenerator.png
File Copier.py
Image to Python.py
Pattern Along.py
PatternAlong.png
Sketch Copier.py
SketchCopier.png
Joint Creator.py
JointCreatorIcon.png
Pocket Hole Creator.py
PocketHoleCreatorIcon.png
AlibreSymbols.ttf
MSI2457.tmp
MSI3D97.tmp
e61f590.msi
KB.32.278.4355.exe
VCRUNTIME140.dll
IronPython.Modules.dll
IronPython.Wpf.dll
IronPython.dll
Microsoft.Bcl.AsyncInterfaces.dll
Microsoft.CodeAnalysis.CSharp.Scripting.dll
Microsoft.CodeAnalysis.CSharp.dll
Microsoft.CodeAnalysis.Scripting.dll
Microsoft.CodeAnalysis.dll
Microsoft.Dynamic.dll
Microsoft.Scripting.AspNet.dll
Microsoft.Scripting.Debugging.dll
Microsoft.Scripting.Metadata.dll
Microsoft.Scripting.dll
RestSharp.dll
System.Buffers.dll
System.Collections.Immutable.dll
System.IO.Pipelines.dll
System.Numerics.Vectors.dll
System.Reflection.Metadata.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Text.Encodings.Web.dll
System.Text.Json.dll
System.Threading.Tasks.Extensions.dll
System.ValueTuple.dll
DCRCVDrv.sys
logo.png
VC_redist.x64.exe
ICSharpCode.SharpZipLib.dll
System.Text.Json.dll
Microsoft.Bcl.AsyncInterfaces.dll
memory/56-16799-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/56-16801-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/1468-10277-0x000001D3E3F50000-0x000001D3E40AF000-memory.dmp
memory/1468-5048-0x000001D3E3F50000-0x000001D3E40AF000-memory.dmp
memory/1468-14270-0x000001D3E3F50000-0x000001D3E40AF000-memory.dmp
memory/1468-10180-0x000001D3E3F50000-0x000001D3E40AF000-memory.dmp
memory/1836-134-0x0000000180000000-0x0000000180450000-memory.dmp
memory/1836-137-0x0000000180000000-0x0000000180450000-memory.dmp
memory/1836-136-0x0000000180000000-0x0000000180450000-memory.dmp
memory/1836-135-0x0000000180000000-0x0000000180450000-memory.dmp
memory/1836-145-0x0000000180000000-0x0000000180450000-memory.dmp
memory/1836-138-0x0000000180000000-0x0000000180450000-memory.dmp
memory/1940-68-0x00000166AC0F0000-0x00000166AC16C000-memory.dmp
memory/2044-583-0x0000000000120000-0x0000000000128000-memory.dmp
memory/2064-9794-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2064-9789-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2064-10017-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2064-9788-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2064-9793-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2064-9795-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2064-9830-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2152-147-0x0000000000010000-0x000000000003D000-memory.dmp
memory/2388-144-0x0000000140000000-0x0000000140323000-memory.dmp
memory/2564-5086-0x0000000000ED0000-0x00000000014CB000-memory.dmp
memory/2564-13745-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/2564-13744-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/2564-13746-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/2564-13743-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/2564-13751-0x0000000000ED0000-0x00000000014CB000-memory.dmp
memory/2564-10275-0x0000000000ED0000-0x00000000014CB000-memory.dmp
memory/2564-5087-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/2564-13748-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/2564-13747-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/2564-5216-0x0000000000ED0000-0x00000000014CB000-memory.dmp
memory/2564-5093-0x0000000000ED0000-0x00000000014CB000-memory.dmp
memory/2564-5089-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/3612-10229-0x0000000000210000-0x0000000000287000-memory.dmp
memory/4212-4412-0x000001DE1A340000-0x000001DE1A440000-memory.dmp
memory/4212-3995-0x000001DE16500000-0x000001DE16600000-memory.dmp
memory/4212-415-0x000001DE027B0000-0x000001DE027D0000-memory.dmp
memory/4212-434-0x000001DE02A10000-0x000001DE02A30000-memory.dmp
memory/4212-404-0x000001DE00100000-0x000001DE00200000-memory.dmp
memory/4212-417-0x000001DE02C10000-0x000001DE02D10000-memory.dmp
memory/4212-448-0x000001DE02F90000-0x000001DE02FB0000-memory.dmp
memory/4212-402-0x000001DE00100000-0x000001DE00200000-memory.dmp
memory/4316-16877-0x0000000007230000-0x0000000007231000-memory.dmp
memory/4316-16879-0x0000000007230000-0x0000000007231000-memory.dmp
memory/4648-10230-0x0000000000210000-0x0000000000287000-memory.dmp
memory/4656-82-0x0000000010000000-0x000000001000A000-memory.dmp
memory/4656-77-0x0000000010000000-0x000000001000A000-memory.dmp
memory/4696-3351-0x000002AC1EF80000-0x000002AC1EFAC000-memory.dmp
memory/4696-3357-0x000002AC1EFB0000-0x000002AC1EFD6000-memory.dmp
memory/4696-10117-0x000002AC20EA0000-0x000002AC21844000-memory.dmp
memory/4696-3348-0x000002AC1E980000-0x000002AC1E98A000-memory.dmp
memory/4696-3710-0x000002AC20EA0000-0x000002AC21844000-memory.dmp
memory/4696-3354-0x000002AC1EBB0000-0x000002AC1EBBA000-memory.dmp
memory/4696-2231-0x000002AC20EA0000-0x000002AC21844000-memory.dmp
memory/4696-955-0x000002AC1F1F0000-0x000002AC1F280000-memory.dmp
memory/4696-952-0x000002AC1EFE0000-0x000002AC1F03A000-memory.dmp
memory/4696-949-0x000002AC1ED60000-0x000002AC1ED84000-memory.dmp
memory/4696-946-0x000002AC221B0000-0x000002AC2244A000-memory.dmp
memory/4696-943-0x000002AC1EBA0000-0x000002AC1EBAC000-memory.dmp
memory/4696-10273-0x000002AC20EA0000-0x000002AC21844000-memory.dmp
memory/4696-940-0x000002AC21D00000-0x000002AC221AE000-memory.dmp
memory/4696-916-0x000002AC1EC50000-0x000002AC1EC6C000-memory.dmp
memory/4696-913-0x000002AC1EC20000-0x000002AC1EC48000-memory.dmp
memory/4696-910-0x000002AC1EC00000-0x000002AC1EC14000-memory.dmp
memory/4696-3344-0x000002AC1F160000-0x000002AC1F198000-memory.dmp
memory/4696-3360-0x000002AC1ED90000-0x000002AC1EDAE000-memory.dmp
memory/4696-3363-0x000002AC1EBC0000-0x000002AC1EBC8000-memory.dmp
memory/4696-3366-0x000002AC1F040000-0x000002AC1F056000-memory.dmp
memory/4696-907-0x000002AC1EBE0000-0x000002AC1EBF2000-memory.dmp
memory/4696-10414-0x000002AC20EA0000-0x000002AC21844000-memory.dmp
memory/4696-3369-0x000002AC1FA80000-0x000002AC1FB12000-memory.dmp
memory/4696-3372-0x000002AC1EC70000-0x000002AC1EC7A000-memory.dmp
memory/4696-904-0x000002AC1F070000-0x000002AC1F152000-memory.dmp
memory/4696-901-0x000002AC1EB90000-0x000002AC1EB98000-memory.dmp
memory/4696-898-0x000002AC1ECA0000-0x000002AC1ED5C000-memory.dmp
memory/4696-3375-0x000002AC1EC80000-0x000002AC1EC88000-memory.dmp
memory/4696-895-0x000002AC1EDB0000-0x000002AC1EF72000-memory.dmp
memory/4696-660-0x000002AC20EA0000-0x000002AC21844000-memory.dmp
memory/4696-13371-0x000002AC1E9F0000-0x000002AC1EA08000-memory.dmp
memory/4696-12950-0x000002AC1ECB0000-0x000002AC1ED64000-memory.dmp
memory/4696-12944-0x000002AC1E8C0000-0x000002AC1E8D8000-memory.dmp
memory/4696-12938-0x000002AC1E870000-0x000002AC1E87A000-memory.dmp
memory/5724-5245-0x0000016444550000-0x0000016444A7A000-memory.dmp
memory/5724-5254-0x00007FFB59820000-0x00007FFB59A54000-memory.dmp
memory/5724-3755-0x00000164358B0000-0x0000016435B18000-memory.dmp
memory/5724-3756-0x000001643D700000-0x000001643D812000-memory.dmp
memory/5724-3757-0x000001643D600000-0x000001643D612000-memory.dmp
memory/5724-3758-0x000001643D660000-0x000001643D69A000-memory.dmp
memory/5724-5207-0x0000016444CD0000-0x00000164477DC000-memory.dmp
memory/5724-5215-0x00000164477E0000-0x0000016448D76000-memory.dmp
memory/5724-5217-0x0000016442440000-0x00000164426B6000-memory.dmp
memory/5724-5219-0x0000016448D80000-0x000001644A10E000-memory.dmp
memory/5724-5220-0x0000016442C10000-0x0000016443160000-memory.dmp
memory/5724-5221-0x000001643E200000-0x000001643E23C000-memory.dmp
memory/5724-5222-0x000001643E1C0000-0x000001643E1C8000-memory.dmp
memory/5724-5223-0x00000164421C0000-0x0000016442376000-memory.dmp
memory/5724-5224-0x0000016442910000-0x0000016442B5C000-memory.dmp
memory/5724-5225-0x000001643E370000-0x000001643E468000-memory.dmp
memory/5724-5226-0x000001643E4F0000-0x000001643E5E8000-memory.dmp
memory/5724-5313-0x0000016442BD0000-0x0000016442BF0000-memory.dmp
memory/5724-5244-0x000001643E260000-0x000001643E27A000-memory.dmp
memory/5724-5312-0x0000016450770000-0x0000016450950000-memory.dmp
memory/5724-6177-0x000001644A710000-0x000001644A754000-memory.dmp
memory/5724-6653-0x000001644F2B0000-0x000001644F338000-memory.dmp
memory/5724-5243-0x00000164426C0000-0x0000016442872000-memory.dmp
memory/5724-5315-0x00000164511F0000-0x000001645140A000-memory.dmp
memory/5724-5246-0x000001644A7C0000-0x000001644AE6C000-memory.dmp
memory/5724-5247-0x000001644B650000-0x000001644BE2C000-memory.dmp
memory/5724-5248-0x000001643E280000-0x000001643E28A000-memory.dmp
memory/5724-5250-0x000001643E2A0000-0x000001643E2AA000-memory.dmp
memory/5724-5251-0x000001643E2D0000-0x000001643E2EA000-memory.dmp
memory/5724-5252-0x000001643E290000-0x000001643E298000-memory.dmp
memory/5724-5253-0x00007FFB57B50000-0x00007FFB57D51000-memory.dmp
memory/5724-3726-0x000001641ADF0000-0x000001641AE4C000-memory.dmp
memory/5724-6969-0x000001644F340000-0x000001644F3BE000-memory.dmp
memory/5724-7258-0x0000016444CC0000-0x0000016444CCA000-memory.dmp
memory/5724-5311-0x000001644B4D0000-0x000001644B602000-memory.dmp
memory/5724-7460-0x0000016442C00000-0x0000016442C0C000-memory.dmp
memory/5724-7484-0x0000016444C30000-0x0000016444C3E000-memory.dmp
memory/5724-5255-0x000001643E9B0000-0x000001643E9B1000-memory.dmp
memory/5724-5262-0x0000016442890000-0x00000164428A0000-memory.dmp
memory/5724-5285-0x0000016442B60000-0x0000016442BCC000-memory.dmp
memory/5724-5282-0x000001644FFA0000-0x0000016450408000-memory.dmp
memory/5724-9704-0x000001645C520000-0x000001645C8CE000-memory.dmp
memory/5724-5281-0x000001644F440000-0x000001644F654000-memory.dmp
memory/5724-5263-0x00000164428B0000-0x00000164428B8000-memory.dmp
memory/5724-5264-0x00000164428C0000-0x00000164428C8000-memory.dmp
memory/5724-5269-0x000001644A510000-0x000001644A6B4000-memory.dmp
memory/5724-5279-0x0000016444520000-0x0000016444540000-memory.dmp
memory/5724-5280-0x000001644B420000-0x000001644B4CA000-memory.dmp
memory/6100-3614-0x0000000000D90000-0x0000000000D96000-memory.dmp
memory/6500-5047-0x0000019B3D290000-0x0000019B3D3EF000-memory.dmp
memory/7192-10227-0x0000000000210000-0x0000000000287000-memory.dmp
memory/7504-14334-0x000001C008630000-0x000001C008742000-memory.dmp
memory/7504-14336-0x000001C008590000-0x000001C0085CA000-memory.dmp
memory/7504-14335-0x000001C008530000-0x000001C008542000-memory.dmp
memory/7504-14558-0x00007FFB5B7E0000-0x00007FFB5BA39000-memory.dmp
memory/7504-14333-0x000001C000350000-0x000001C0005D0000-memory.dmp
memory/7504-14332-0x000001C065AC0000-0x000001C065B1C000-memory.dmp
memory/7504-14537-0x000001C00F700000-0x000001C01269E000-memory.dmp
memory/7504-14539-0x000001C009160000-0x000001C00919C000-memory.dmp
memory/7504-14540-0x000001C009130000-0x000001C009138000-memory.dmp
memory/7960-13756-0x00000276FCA00000-0x00000276FCA22000-memory.dmp