Overview

overview

10

Static

static

3

Alibre Des...3).exe

windows11-21h2-x64

10

Alibre Des...3).exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    856s
  • max time network
    897s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/07/2026, 11:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe
  • Size 595.4MB
  • Sample260722-npc7datfke
  • SHA256 231e5989881b9df333c2797bb8f980b31f7f19e235249d8021d5882e4bb3d728
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutiononyxc2persistenceprivilege_escalationransomwarespywaretrojanupx

Malware Config

Extracted

Family

  • onyxc2

C2

  • akmuniverstall.top

Attributes
  • port

    443

  • url_path

    /7e243e2b5c5ds7he/backend/api/app.php

Signatures

  • Family: OnyxC2

    OnyxC2 is a Windows backdoor written in C++.

    backdooronyxc2
  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 64 IoCs
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 37 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe
    "C:\Users\Admin\AppData\Local\Temp\Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    PID:3684
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1108
    • C:\Users\Admin\AppData\Local\Temp\Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe
      "C:\Users\Admin\AppData\Local\Temp\Alibre Design Expert 28.1.1.28228 (x64)(passis123).exe"
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:1596
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\" -an -ai#7zMap13379:262:7zEvent5896
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:668
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\Key.txt
      1⤵
        PID:5024
      • C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\AlibreDesignV28_setup_x64_28.1.1.28228.exe
        "C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\AlibreDesignV28_setup_x64_28.1.1.28228.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Users\Admin\AppData\Local\Temp\7z.exe
          "C:\Users\Admin\AppData\Local\Temp\7z.exe" x -p"111111" "C:\Users\Admin\AppData\Local\Temp\edge_BITS_134.jpg" -o"C:\Windows\Microsoft.NET\Framework64" -y -bso0 -bsp1 -bse1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:3164
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /F /TN "Microsoft\Windows\WindowsUpdate\UpdateHelper_134" /TR "C:\Windows\Microsoft.NET\Framework64\KB.32.278.4355.exe" /sc minute /mo 10 /DU 00:15 /RL HIGHEST
          2⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2256
        • C:\Program Files (x86)\Alibre Design Expert\AlibreDesignV28_setup_x64_28.1.1.28228.exe
          "C:\Program Files (x86)\Alibre Design Expert\AlibreDesignV28_setup_x64_28.1.1.28228.exe"
          2⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4016
          • C:\Program Files (x86)\Alibre Design Expert\AlibreDesignV28_setup_x64_28.1.1.28228.exe
            "C:\Program Files (x86)\Alibre Design Expert\AlibreDesignV28_setup_x64_28.1.1.28228.exe" /i "C:\Users\Admin\AppData\Roaming\Alibre LLC\Alibre Design 28.1.1.28228\install\AlibreDesign_x64.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\Alibre Design 28.1.1.28228" AS_LIB_DIR="C:\Users\Admin\Documents" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Alibre Design" MS.3207D1B0_80E5_11D2_B95D_006097C4DE24="C:\Windows\SysWOW64" MS.7EBEDD3E_AA66_11D2_B980_006097C4DE24="C:\Windows\SysWOW64" MS.8C0C59A0_7DC8_11D2_B95D_006097C4DE24="C:\Windows\SysWOW64" SECONDSEQUENCE="1" CLIENTPROCESSID="4016" AI_MORE_CMD_LINE=1
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            PID:2544
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://repackmaster.com/
          2⤵
            PID:1592
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\Key.txt
          1⤵
            PID:6136
          • C:\Windows\Microsoft.NET\Framework64\KB.32.278.4355.exe
            C:\Windows\Microsoft.NET\Framework64\KB.32.278.4355.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1976
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
              2⤵
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2000
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\abdv2_lu" --no-first-run
                3⤵
                  PID:3732
            • C:\Windows\Temp\DCRCVDrv.sys
              C:\Windows\Temp\DCRCVDrv.sys
              1⤵
              • Executes dropped EXE
              PID:2596
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe /V
              1⤵
              • Enumerates connected drives
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2276
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding B840A19EB43CA6EFF8D924B1898E70F8 C
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5652
                • C:\Users\Admin\AppData\Local\Temp\TestWriteAccess.exe
                  "C:\Users\Admin\AppData\Local\Temp\TestWriteAccess.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2156
              • C:\Windows\system32\srtasks.exe
                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                2⤵
                  PID:860
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding A4F6DC45BCCD8E40831124C2F6B524A6
                  2⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2780
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 18FB468B641F2E80ECD9EF7FBC2A07EC E Global\MSI0000
                  2⤵
                  • Loads dropped DLL
                  • Badlisted process makes network request
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  PID:916
                • C:\Windows\Installer\MSI1EE4.tmp
                  "C:\Windows\Installer\MSI1EE4.tmp" "C:\Program Files\Alibre Design 28.1.1.28228\AlibreInstall.reg"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:2300
                  • C:\Windows\system32\reg.exe
                    "reg.exe" IMPORT "C:\Program Files\Alibre Design 28.1.1.28228\AlibreInstall.reg"
                    3⤵
                      PID:5976
                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                  1⤵
                    PID:4828
                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                    1⤵
                      PID:3364
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Checks SCSI registry key(s)
                      PID:3624
                    • C:\Windows\system32\OpenWith.exe
                      C:\Windows\system32\OpenWith.exe -Embedding
                      1⤵
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of SetWindowsHookEx
                      PID:3480
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?url=https%3A%2F%2Fwww.bing.com%2Fsearch%3Fq%3Dnotepad%252b%252b%26filters%3Dufn%253a%2522Notepad%252b%252b%2522%2Bsid%253a%25220ad0f2fd-e465-95ec-15f9-a5c5a03fb776%2522%26asbe%3DFT%26form%3DWSBEDG%26qs%3DMB%26cvid%3D7a05133476e3477389e8b96892032b98%26pq%3Dnotepad%26cc%3DUS%26setlang%3Den-US%26nclid%3D24DCECE20C4EF7E84E022FAB726D8552%26ts%3D1784721319790%26nclidts%3D1784721319%26tsms%3D790%26wsso%3DModerate%26PC%3DWSBQUF2&timestamp=1784721319790&source=WindowsSearchBox&campaign=addedgeprot&medium=AutoSuggest
                      1⤵
                      • Drops file in Windows directory
                      • Enumerates system info in registry
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:1220
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x2ec,0x7ffeeab8c188,0x7ffeeab8c194,0x7ffeeab8c1a0
                        2⤵
                          PID:3684
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,2943059278715694922,5381181409912393386,262144 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
                          2⤵
                            PID:1728
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,16812375947882575428,9100906676505241475,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
                            2⤵
                            • System Time Discovery
                            PID:2424
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,8081365225663602647,8218037383482228437,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
                            2⤵
                              PID:4044
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,5538303383829932104,17102428826656605306,2097152 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
                              2⤵
                                PID:1008
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,13839792697339508419,18441457538323236847,2097152 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
                                2⤵
                                  PID:5384
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5080,i,660110958835121558,883685863786270214,2097152 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
                                  2⤵
                                    PID:3512
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,15653593721265574342,9141812616993257892,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
                                    2⤵
                                      PID:4628
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,583251257252084983,180427760957510417,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
                                      2⤵
                                        PID:2892
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,15476298250906943890,3428686039829733927,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
                                        2⤵
                                          PID:2648
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3660,i,15453159362023423951,8132261218580196589,2097152 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:1
                                          2⤵
                                            PID:4744
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5248,i,8813550376659584224,7940102491575367388,2097152 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:9
                                            2⤵
                                              PID:4084
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5464,i,3518460818569427507,923987032336129933,2097152 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:15
                                              2⤵
                                                PID:4012
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5632,i,16890819693799598121,17990870541010011221,2097152 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
                                                2⤵
                                                  PID:232
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11995371218323532509,5574100182847969832,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
                                                  2⤵
                                                    PID:5220
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,5252445921034714919,17191627038981468953,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
                                                    2⤵
                                                      PID:584
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,2677429963940646430,7232186535086820260,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
                                                      2⤵
                                                        PID:3708
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,2677429963940646430,7232186535086820260,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
                                                        2⤵
                                                          PID:224
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,9008056813769392589,14320862824574759404,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:14
                                                          2⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2916
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                            cookie_exporter.exe --cookie-json=1132
                                                            3⤵
                                                              PID:4548
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,10789895821358385637,10304331551993752423,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
                                                            2⤵
                                                              PID:816
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,12686978775936635401,16568069634660265136,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
                                                              2⤵
                                                                PID:4956
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,96803171689935128,371911974500039830,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
                                                                2⤵
                                                                  PID:5644
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,16983613041636607444,13232419723223995629,262144 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:10
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:856
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,2979690445722997793,10762366442751006762,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14
                                                                  2⤵
                                                                    PID:1468
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,14951833047753922584,752008468237049781,524288 --field-trial-handle=1980,i,10078159325223138026,11418522200645398489,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14
                                                                    2⤵
                                                                      PID:1040
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                      2⤵
                                                                      • Drops file in Windows directory
                                                                      • Enumerates system info in registry
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:2512
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffeeab8c188,0x7ffeeab8c194,0x7ffeeab8c1a0
                                                                        3⤵
                                                                          PID:3764
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,17750546384267533913,5064899965698745299,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
                                                                          3⤵
                                                                          • System Time Discovery
                                                                          PID:5908
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,11794351412467483325,16742869286867506335,262144 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
                                                                          3⤵
                                                                            PID:2700
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,18134716820040171325,6997297484322345834,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
                                                                            3⤵
                                                                              PID:5924
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,2579003768125295568,10960143883252163542,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
                                                                              3⤵
                                                                                PID:2724
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,2579003768125295568,10960143883252163542,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
                                                                                3⤵
                                                                                  PID:892
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,12343666571722506987,3997813475798654407,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
                                                                                  3⤵
                                                                                    PID:4492
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,1005598763800253195,10596678337815428985,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
                                                                                    3⤵
                                                                                      PID:3592
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,12006806955028702263,2917750553539792268,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
                                                                                      3⤵
                                                                                        PID:1552
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,7138556536159164656,15529640737123763042,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
                                                                                        3⤵
                                                                                          PID:1424
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,5125259582442704767,10963938091089183192,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
                                                                                          3⤵
                                                                                            PID:5484
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,10045117242489598022,7925127956405999317,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
                                                                                            3⤵
                                                                                              PID:5328
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,13610578547083777112,2430177664388070806,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
                                                                                              3⤵
                                                                                                PID:4576
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4832,i,1044392526879678258,2013149356654411599,262144 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:10
                                                                                                3⤵
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:3172
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,17119421330304061524,1662567290914203183,524288 --field-trial-handle=2208,i,7834585398744384579,2319371584401188978,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:14
                                                                                                3⤵
                                                                                                  PID:7424
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                              1⤵
                                                                                                PID:3292
                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                1⤵
                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:3992
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Alibre Design 28.1.1.28228\Readme.pdf
                                                                                                1⤵
                                                                                                  PID:5272
                                                                                                • C:\Program Files\Windows NT\Accessories\wordpad.exe
                                                                                                  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
                                                                                                  1⤵
                                                                                                  • Drops file in Drivers directory
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:5888
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                                                  1⤵
                                                                                                    PID:1152
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                    1⤵
                                                                                                      PID:2148
                                                                                                    • C:\Windows\system32\NOTEPAD.EXE
                                                                                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\BTCR\btcr.txt
                                                                                                      1⤵
                                                                                                        PID:5248
                                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\BTCR\btcr.txt
                                                                                                        1⤵
                                                                                                          PID:5696
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                          1⤵
                                                                                                          • Enumerates system info in registry
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                          PID:5952
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeea7ec728,0x7ffeea7ec734,0x7ffeea7ec740
                                                                                                            2⤵
                                                                                                              PID:4776
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1908,i,671171689122692380,8557643987383580237,262144 --field-trial-handle=1936,i,17496036925166692756,18429413436995281521,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1904 /prefetch:2
                                                                                                              2⤵
                                                                                                                PID:32
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1520,i,4042196906166870001,7459355653702346154,524288 --field-trial-handle=1936,i,17496036925166692756,18429413436995281521,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2288 /prefetch:11
                                                                                                                2⤵
                                                                                                                • System Time Discovery
                                                                                                                PID:5928
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,1171099997224774430,16918961912607066532,524288 --field-trial-handle=1936,i,17496036925166692756,18429413436995281521,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2408 /prefetch:13
                                                                                                                2⤵
                                                                                                                  PID:5468
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,12411613123600444506,10403072877390290955,2097152 --field-trial-handle=1936,i,17496036925166692756,18429413436995281521,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:328
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3592,i,11371888149800022879,8114943159941448507,2097152 --field-trial-handle=1936,i,17496036925166692756,18429413436995281521,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3596 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:6036
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,13775861387805542361,6602936535674956250,2097152 --field-trial-handle=1936,i,17496036925166692756,18429413436995281521,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4524 /prefetch:9
                                                                                                                      2⤵
                                                                                                                        PID:5752
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4784,i,1808551146300418290,10041626443844243918,2097152 --field-trial-handle=1936,i,17496036925166692756,18429413436995281521,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:2780
                                                                                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                        1⤵
                                                                                                                          PID:4956
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                          1⤵
                                                                                                                            PID:2256
                                                                                                                          • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\Repackmaster.com.txt
                                                                                                                            1⤵
                                                                                                                              PID:2536
                                                                                                                            • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\keygen-BTCR\BTCR\btcr.txt
                                                                                                                              1⤵
                                                                                                                                PID:1604
                                                                                                                              • C:\Program Files\Alibre Design 28.1.1.28228\Program\Alibre Design.exe
                                                                                                                                "C:\Program Files\Alibre Design 28.1.1.28228\Program\Alibre Design.exe"
                                                                                                                                1⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Modifies registry class
                                                                                                                                • Modifies system certificate store
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:5304
                                                                                                                                • C:\Windows\System32\wbem\wmic.exe
                                                                                                                                  C:\Windows\System32\wbem\wmic.exe logicaldisk where "DeviceID='C:'" assoc /assocclass:win32_logicaldisktopartition
                                                                                                                                  2⤵
                                                                                                                                    PID:3440
                                                                                                                                  • C:\Windows\System32\wbem\wmic.exe
                                                                                                                                    C:\Windows\System32\wbem\wmic.exe diskdrive get deviceid,serialnumber
                                                                                                                                    2⤵
                                                                                                                                      PID:4908
                                                                                                                                    • C:\Windows\System32\mountvol.exe
                                                                                                                                      C:\Windows\System32\mountvol.exe C: /L
                                                                                                                                      2⤵
                                                                                                                                        PID:3320
                                                                                                                                      • C:\Program Files\Alibre Design 28.1.1.28228\Program\updater.exe
                                                                                                                                        "C:\Program Files\Alibre Design 28.1.1.28228\Program\updater.exe" /justcheck -licensendate 19/02/2030
                                                                                                                                        2⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2440
                                                                                                                                      • C:\Program Files\Alibre Design 28.1.1.28228\Program\updater.exe
                                                                                                                                        "C:\Program Files\Alibre Design 28.1.1.28228\Program\updater.exe" /silent -licensendate 19/02/2030
                                                                                                                                        2⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:6264
                                                                                                                                    • C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\keygen-BTCR\BTCR\Keygen.exe
                                                                                                                                      "C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\keygen-BTCR\BTCR\Keygen.exe"
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:2756
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1392
                                                                                                                                        2⤵
                                                                                                                                        • Program crash
                                                                                                                                        PID:4316
                                                                                                                                    • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                      C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                      1⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3748
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2756 -ip 2756
                                                                                                                                      1⤵
                                                                                                                                        PID:6076
                                                                                                                                      • C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\keygen-BTCR\BTCR\Keygen.exe
                                                                                                                                        "C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\keygen-BTCR\BTCR\Keygen.exe"
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:4796
                                                                                                                                      • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                        C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                        1⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4340
                                                                                                                                      • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                        C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                        1⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:7696

                                                                                                                                      Network

                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                            Reconnaissance

                                                                                                                                            Resource Development

                                                                                                                                            Initial Access

                                                                                                                                            Execution

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Persistence

                                                                                                                                            Event Triggered Execution

                                                                                                                                            1
                                                                                                                                            T1546

                                                                                                                                            Component Object Model Hijacking

                                                                                                                                            1
                                                                                                                                            T1546.015

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Privilege Escalation

                                                                                                                                            Event Triggered Execution

                                                                                                                                            1
                                                                                                                                            T1546

                                                                                                                                            Component Object Model Hijacking

                                                                                                                                            1
                                                                                                                                            T1546.015

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Defense Evasion

                                                                                                                                            Modify Registry

                                                                                                                                            1
                                                                                                                                            T1112

                                                                                                                                            Subvert Trust Controls

                                                                                                                                            1
                                                                                                                                            T1553

                                                                                                                                            Install Root Certificate

                                                                                                                                            1
                                                                                                                                            T1553.004

                                                                                                                                            Credential Access

                                                                                                                                            Discovery

                                                                                                                                            Browser Information Discovery

                                                                                                                                            1
                                                                                                                                            T1217

                                                                                                                                            Peripheral Device Discovery

                                                                                                                                            2
                                                                                                                                            T1120

                                                                                                                                            Query Registry

                                                                                                                                            4
                                                                                                                                            T1012

                                                                                                                                            System Information Discovery

                                                                                                                                            5
                                                                                                                                            T1082

                                                                                                                                            System Location Discovery

                                                                                                                                            1
                                                                                                                                            T1614

                                                                                                                                            System Language Discovery

                                                                                                                                            1
                                                                                                                                            T1614.001

                                                                                                                                            System Time Discovery

                                                                                                                                            1
                                                                                                                                            T1124

                                                                                                                                            Lateral Movement

                                                                                                                                            Collection

                                                                                                                                            Command and Control

                                                                                                                                            Exfiltration

                                                                                                                                            Impact

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            e5f1806.rbs
                                                                                                                                            • Path C:\Config.Msi\e5f1806.rbs
                                                                                                                                            • Size 1.9MB
                                                                                                                                            • SHA256 7b797577c7c8513be30458353273bcfc27baa12f1bf20f28d3982ec5ab23407a
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Alibre Design.exe
                                                                                                                                            • Path C:\Program Files\Alibre Design 28.1.1.28228\Program\Alibre Design.exe
                                                                                                                                            • Size 365KB
                                                                                                                                            • SHA256 fa276aed0bc99c80b5aab4cde757ac678da27e0e9fbcbc8b70f474123a50532a
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            updater.ini
                                                                                                                                            • Path C:\Program Files\Alibre Design 28.1.1.28228\Program\updater.ini
                                                                                                                                            • Size 400B
                                                                                                                                            • SHA256 7f7a97c417d9ed73dbc8276b784631286124509295d9538a488989a183ea44ab
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            AD_Updates.aiu
                                                                                                                                            • Path C:\ProgramData\Alibre LLC\Alibre Design\updates\AD_Updates.aiu
                                                                                                                                            • Size 112KB
                                                                                                                                            • SHA256 2909ad682296e08137fa082c7c2abfa27151bb38a7d0318c75358161b9f11b42
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                            • Size 471B
                                                                                                                                            • SHA256 f907216ca82f9e157d415748d530ce0a22a50f7f1baea99d1fbd4e88440bb750
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            8EC9B1D0ABBD7F98B401D425828828CE_D189AF395FC7D76E0D8F1A6D70CDE45D
                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D189AF395FC7D76E0D8F1A6D70CDE45D
                                                                                                                                            • Size 727B
                                                                                                                                            • SHA256 fae9dfe7768647bcc1c4a291c95ad24b94b155252ff9888970c4e07c9351da7d
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                            • Size 727B
                                                                                                                                            • SHA256 42c88d91147f3ac6cc927c89aecfdbac144457e65fcf5c18747f62d0f3f05d0d
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                            • Size 400B
                                                                                                                                            • SHA256 8d0f31f2c883185ced84167386db4d3c2d71f5ff91daac0608980924a4cea5e2
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            8EC9B1D0ABBD7F98B401D425828828CE_D189AF395FC7D76E0D8F1A6D70CDE45D
                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D189AF395FC7D76E0D8F1A6D70CDE45D
                                                                                                                                            • Size 408B
                                                                                                                                            • SHA256 8d4424096ff6219b586868ea5873d7c4a6c681fd85d1d3f60bb6517b3630aba7
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                            • Size 412B
                                                                                                                                            • SHA256 a731bab41afa5a86dac4772149653bde1ea17adea4458bf665ff820d61ccbee3
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            67e1e40593013dc8f6.lic
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Alibre Design\67e1e40593013dc8f6.lic
                                                                                                                                            • Size 8KB
                                                                                                                                            • SHA256 6288fd8b62ceeec5da5ccee4f8cac13ba85c888ebf34dd8ba935e4ddfa546678
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Network Persistent State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 40ad32bad17c09d7556d63a443b542b43aa0e8f5ed9cfc24c899999fde0d8ae8
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            TransportSecurity
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                            • Size 523B
                                                                                                                                            • SHA256 eb89104e979861eafad04939dd91ba177d25819a52d03e598bb92f587eb56fd0
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Preferences
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                            • Size 11KB
                                                                                                                                            • SHA256 c34b9ecd041c9ce86bb009610d5adab075321b20ece735c5728c953fd0162a96
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Secure Preferences
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                            • Size 17KB
                                                                                                                                            • SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            the-real-index
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                            • Size 120B
                                                                                                                                            • SHA256 416be2aa6751d46f39e6c813c579bd481d0ab02f2939683c2752b7338c8b83e7
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            the-real-index~RFe6228df.TMP
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe6228df.TMP
                                                                                                                                            • Size 96B
                                                                                                                                            • SHA256 9b5671fa3d7326eae347d62a2efc969d9c2488eea62dfc27383e3077ece6f483
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                            • Size 115KB
                                                                                                                                            • SHA256 80facc3bef5bed3161f414f817c5b4f5d6bec0647d124ad2064c9d74a524dfe0
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                            • Size 116KB
                                                                                                                                            • SHA256 1b52395433978f0c0a7e5e2e84233a73ff74d58340b141d32166b0746d368592
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            data_1
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                                            • Size 264KB
                                                                                                                                            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                            Submit Download

                                                                                                                                            5735da9b-682e-496e-9c19-7a36d15a595c.tmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5735da9b-682e-496e-9c19-7a36d15a595c.tmp
                                                                                                                                            • Size 24KB
                                                                                                                                            • SHA256 58cbec276c8fbdead974391fd2a47629327be6a7181b4680699b358bf9b47106
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            settings.dat
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                            • Size 280B
                                                                                                                                            • SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            settings.dat
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                            • Size 280B
                                                                                                                                            • SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            settings.dat
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                            • Size 280B
                                                                                                                                            • SHA256 0cf7657c366bc70d652805ab8ef03a2a7d29d0c55c7db2b5e25293cb8985847d
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            settings.dat
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                            • Size 280B
                                                                                                                                            • SHA256 f6627dc3feefcb903028914d6a5c0b9a4f31395daeaee46db5f10117417b2647
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            BrowsingTopicsState
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                            • Size 414B
                                                                                                                                            • SHA256 c1c101832e051372747d93ee23bac8e5d726ab1fe75dbaf845294300e68be60f
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            f_00007e
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
                                                                                                                                            • Size 38KB
                                                                                                                                            • SHA256 4392ddde86f22a921269feaf788a13509946046047df6926017041ff33d0293e
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            the-real-index
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                            • Size 7KB
                                                                                                                                            • SHA256 b9d95c874d014cbd7f2eb839ff3aa1f6bf59bb70369fdd998923474f807d52f3
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            the-real-index~RFe60c642.TMP
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe60c642.TMP
                                                                                                                                            • Size 3KB
                                                                                                                                            • SHA256 6fe3da0df1ca3583276fc1c24084d83fdb7257cb3f046fb6f3af0de78609e7f5
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            SiteList-Enterprise.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                            • Size 2B
                                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            CURRENT
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\CURRENT
                                                                                                                                            • Size 16B
                                                                                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            LOG.old
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\LOG.old
                                                                                                                                            • Size 388B
                                                                                                                                            • SHA256 8661670b904301f15b800925bf3913f0b75e5a0d4f29b44e0c0b5f91571cd3fa
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            LOG.old~RFe6015af.TMP
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\LOG.old~RFe6015af.TMP
                                                                                                                                            • Size 347B
                                                                                                                                            • SHA256 2ee2dc675cc1a33698846be8f8a764215a10dfeddf1bb5ee541b21227974d7e1
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            MANIFEST-000001
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                            • Size 23B
                                                                                                                                            • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            369a703b-623d-4e35-92f8-fc831ce95fbb.tmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\369a703b-623d-4e35-92f8-fc831ce95fbb.tmp
                                                                                                                                            • Size 6KB
                                                                                                                                            • SHA256 01eb4b4525857a4f19fa4a56a8d1d1efa4469dc930073605f42c2fc58b928128
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Network Persistent State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                            • Size 5KB
                                                                                                                                            • SHA256 793233130b1bfbc840ef3b8828e8382fbb7c812f8ca181e3a6f99d6fe630cd1e
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            SCT Auditing Pending Reports
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                            • Size 2B
                                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            Sdch Dictionaries
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                            • Size 211B
                                                                                                                                            • SHA256 e75e3a56fb23b561cb16b92e9aaa99c962e871344751a0ae934efe981624c891
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            TransportSecurity
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 cb1decf0f7f1f230fd6dd4a1a3e5ba84e9c17a59ee21e50bb66e64e71ffe1b1c
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Preferences
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                            • Size 21KB
                                                                                                                                            • SHA256 3a34c94ea95e972b1fc62091bb17b2695b4ed43607b11b1d958ba9d542827a66
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Preferences
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                            • Size 19KB
                                                                                                                                            • SHA256 fa5db252e460af0c54657f07ec860019a83080ac5275506e72c4187380d9a1ba
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Preferences
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                            • Size 18KB
                                                                                                                                            • SHA256 3fe3f2e7dc43d7a9fc966ff6b5b702e330046d5a6f85e8a31cb23457304c9c6d
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Preferences
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                            • Size 17KB
                                                                                                                                            • SHA256 67f6601efcf7df011d5d35b040a40c258b0979ca962523e07b39254cc64e8a83
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Secure Preferences
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                            • Size 36KB
                                                                                                                                            • SHA256 c0fded08c2130319574c3ffa0cda333227a5701cfcfcde1b4d66b427f88ab059
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            sync_diagnostic.log
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                            • Size 23KB
                                                                                                                                            • SHA256 88ef239c104866defb7259dc8e5d2e4758ccf12ba3129ea0cf29856015e4f99a
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            a5f8d442-7587-4e13-ae23-93cb24161391.tmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a5f8d442-7587-4e13-ae23-93cb24161391.tmp
                                                                                                                                            • Size 6B
                                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            data.txt
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.17\data.txt
                                                                                                                                            • Size 149KB
                                                                                                                                            • SHA256 fac5ec341b2f4b9c98a8bd7ec852589ee81e4938812666568752f36ae4f115ab
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            office_endpoints_list.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                                                                            • Size 9KB
                                                                                                                                            • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            wallet-checkout-eligible-sites.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
                                                                                                                                            • Size 23KB
                                                                                                                                            • SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            wallet-notification-config.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
                                                                                                                                            • Size 804B
                                                                                                                                            • SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            wallet-stable.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
                                                                                                                                            • Size 81KB
                                                                                                                                            • SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            wallet-tokenization-config.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
                                                                                                                                            • Size 34KB
                                                                                                                                            • SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                            • Size 40KB
                                                                                                                                            • SHA256 9a11ebba53d351882b5bab275baec544d1ffa7d52baa8cf7b71d0922ec4958f6
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                            • Size 24KB
                                                                                                                                            • SHA256 181d33132aad9c53733e89e7019f59215dd889eeb75d93aefbe48ca5580c31cd
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                            • Size 28KB
                                                                                                                                            • SHA256 0bc0d0b461e023b97b5aa90a898d178c86aad600960843c7b3bf70481771f562
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                            • Size 35KB
                                                                                                                                            • SHA256 9427c3ae0ba65d13970252c3f7383f1efe7323ee52daacfa95fe358136bdaa30
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                            • Size 28KB
                                                                                                                                            • SHA256 087535497d00f38f5be86ae6ba5b5658fb0d8cd9b77915432abd831be0b15955
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                            • Size 25KB
                                                                                                                                            • SHA256 3d6e8c6d839f1e7d49d2123a22710ccacfee6623f18f8d713806ef33071a480c
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                            • Size 24KB
                                                                                                                                            • SHA256 1b11986acf4b6b525c57944aa006e0aca0e741e3966f778404d576854b97cdec
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Local State
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                            • Size 24KB
                                                                                                                                            • SHA256 edac92e746081d55983a8741ee56b477d6c7a751dfacce5c69639125beac015c
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Filtering Rules
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
                                                                                                                                            • Size 2.1MB
                                                                                                                                            • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            LICENSE
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
                                                                                                                                            • Size 24KB
                                                                                                                                            • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            typosquatting_list.pb
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.20.1\typosquatting_list.pb
                                                                                                                                            • Size 738KB
                                                                                                                                            • SHA256 c45ca589e12ede5ad2d94c66891f20ba805f5109edc1a6d1cd7734851e470899
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            metadata.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                            • Size 2KB
                                                                                                                                            • SHA256 6543ed6b750ad912a40768c1f05f05d48c458b4674c4951ccafbd2daec8c1951
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            metadata.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                            • Size 2KB
                                                                                                                                            • SHA256 a8f5816e714da96ded82a58c053d10e8bb8e525a6753db714e191e17293b4bee
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            metadata.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                            • Size 2KB
                                                                                                                                            • SHA256 91f293291050a84c35b2fa77bd072d336e1fcad8de4e1dda40e7ab7a7b3e4cab
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            metadata.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                            • Size 2KB
                                                                                                                                            • SHA256 345c24959a1f78804b38fdc4b5f8368c9d58d71c6677de8e6907fa2cce039ee6
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            metadata.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                            • Size 2KB
                                                                                                                                            • SHA256 0d2e42a4bbd8272ce7a4cf7df96fc2e08f024448594d01dceb5283cc2a03bd5f
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            metadata.json
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                            • Size 2KB
                                                                                                                                            • SHA256 38b00756f2c48d3d0b5b025b144f47018e6342ae356295ae24dd8327ab2ef52c
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            7z.dll
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\7z.dll
                                                                                                                                            • Size 1.8MB
                                                                                                                                            • SHA256 5bd20fb38499d95c39594f41d4781b6181b3304b7f1f4d06b0182f514e7eaa74
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            7z.exe
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\7z.exe
                                                                                                                                            • Size 562KB
                                                                                                                                            • SHA256 4cd7d776c686427226a151789d2d61f0b2ed2c392148cc4e69c0238362fafecf
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            background.png
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\background.png
                                                                                                                                            • Size 152KB
                                                                                                                                            • SHA256 7c92de450e3e47e9193c2fcb8689a16f4b7afbbab8f5d84fffa89a01bee2cece
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_bottom_left.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_bottom_left.bmp
                                                                                                                                            • Size 92B
                                                                                                                                            • SHA256 7fafd72d425c67868b3645711b5123e45dd2893ccb56c752c0f4d9d3c09c0865
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_bottom_left_inactive.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_bottom_left_inactive.bmp
                                                                                                                                            • Size 92B
                                                                                                                                            • SHA256 e6018ee1c7d5262294ddf927eaa0927948bff643d2e182900d76dfc365cd15d5
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_bottom_mid.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_bottom_mid.bmp
                                                                                                                                            • Size 68B
                                                                                                                                            • SHA256 dae15601bb83b9335aa7048c59483ae2a78cd7aaa1922ae5f6025687dbb98c9b
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_bottom_mid_inactive.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_bottom_mid_inactive.bmp
                                                                                                                                            • Size 68B
                                                                                                                                            • SHA256 972020d91cf2d48b2f1ec0b512cad8601965803116f2fee9d8c5b49a06e723e2
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_bottom_right.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_bottom_right.bmp
                                                                                                                                            • Size 92B
                                                                                                                                            • SHA256 c597b8b33bcc9a748f82af6233824d340799b5b718a93425b00d009a4c886c87
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_bottom_right_inactive.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_bottom_right_inactive.bmp
                                                                                                                                            • Size 92B
                                                                                                                                            • SHA256 0b593ce65acd604a942c4d02f3e6e97e2dbeb34ba9c6aa9fdbbbf51636832a92
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_caption.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_caption.bmp
                                                                                                                                            • Size 144B
                                                                                                                                            • SHA256 dc9ae0a6f0ec137e1704b15503e97c0cbbd0b8cdbba9c8838e802ff7bfb8f906
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_caption_inactive.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_caption_inactive.bmp
                                                                                                                                            • Size 144B
                                                                                                                                            • SHA256 c990d5f8f486024e97d66d7353b674596ac6dde7ab7bd9ba5dc4a1d7ed2aeceb
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_left.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_left.bmp
                                                                                                                                            • Size 68B
                                                                                                                                            • SHA256 0ad5ebaf9abd224801e0282d9d0e9f6aa33b235e990a2f963634c179f4eff65d
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_left_inactive.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_left_inactive.bmp
                                                                                                                                            • Size 68B
                                                                                                                                            • SHA256 890e75dc49e816d6f5b915ce315c939da1facb00a287e3f87a8198b11c887e0a
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_right.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_right.bmp
                                                                                                                                            • Size 68B
                                                                                                                                            • SHA256 90adbf85ec6b4dff3cc9387d28864b237c4445cf7acc0b4a152932ec924069d6
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_right_inactive.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_right_inactive.bmp
                                                                                                                                            • Size 68B
                                                                                                                                            • SHA256 37aecf8426352b47117e2568ff915ee10bcfa461683fcbb32bd1d1b7e7268971
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_top_left.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_top_left.bmp
                                                                                                                                            • Size 556B
                                                                                                                                            • SHA256 956eb6e16fcecde7a31ca748315caf92412d8cec47453788d75812875297b6ae
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_top_left_inactive.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_top_left_inactive.bmp
                                                                                                                                            • Size 556B
                                                                                                                                            • SHA256 c279acf651b90a7e03837135e9342e638f761360cc2bd0e9e149976ae601de08
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_top_mid.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_top_mid.bmp
                                                                                                                                            • Size 68B
                                                                                                                                            • SHA256 06756388a1421df7d15ebd5acca6ada110b954412667d5a8fb81f2f50024b346
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_top_mid_inactive.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_top_mid_inactive.bmp
                                                                                                                                            • Size 68B
                                                                                                                                            • SHA256 7a5a8259d8310785391c89f6f35814af32632005432a467b970dca783c5f81d9
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_top_right.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_top_right.bmp
                                                                                                                                            • Size 556B
                                                                                                                                            • SHA256 cb153ea5e97472755d7dc426cbcf40706bab8e1f28f67f6025553f3ffb197c11
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            frame_top_right_inactive.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\frame_top_right_inactive.bmp
                                                                                                                                            • Size 556B
                                                                                                                                            • SHA256 329aa7679e0ff706b9c458b2d0b2db7f3acd16d3fda0566cb3a31456283109dd
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            jpg
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\jpg
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 1d23ea7e8f3cc5d20bec4e4353465feb9ae32273c3a66037c357cd11e6979b08
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            jpg_1
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\jpg_1
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 0c92db4de1bd4546e02d2f1e00a02e776f508375eddadb4613348b15c870816d
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            jpg_2
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\jpg_2
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 f5ff7db4c3b1d4c036bab307d249c8a4dc803c1eaac51da64891be6a0109185a
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            jpg_3
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\jpg_3
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 bb996452d889787ab787e4cfcc24d17a367ac8b471ab8203f233603920d345eb
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            sys_close_down.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\sys_close_down.bmp
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 26e67ca8f19f67ec1bedbdbd004a152d9796fdfb32614fd23edb622f5a94c83b
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            sys_close_hot.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\sys_close_hot.bmp
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 9e437f4636e87fb768b6cc51ad242132502f3bf19171fd0ab043de9d72cc7931
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            sys_close_inactive.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\sys_close_inactive.bmp
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 21ac5640c6a3e0c45e6fd7dc298988030bfae37157f602f6fb584245bd7d20d2
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            sys_close_normal.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\sys_close_normal.bmp
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 1f3ccffd40ae9f7b781958b5e2a82e9265591675600bd6c6b167c7cce783a09c
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            sys_min_down.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\sys_min_down.bmp
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 dffc6a43626c68b71d76aff7959e3845ac0575b20d4212865b8f89bba30edb2e
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            sys_min_hot.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\sys_min_hot.bmp
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 c4e8086118f8d1df1370e9d061e0e5cd3cc05861c4727b5a40d5b060cb9abc19
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            sys_min_inactive.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\sys_min_inactive.bmp
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 0f1a756fe848ccfdacca997eca00048115c7953da7202f6fceee394526ee9bf9
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            sys_min_normal.bmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4016\sys_min_normal.bmp
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 13e416892cdd3eda7671bb9f7c57e89919ef366ed2a0b4f6d33fe1a352b1c079
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            AlibreThreads_Update_V1.xlsx
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AlibreThreads_Update_V1.xlsx
                                                                                                                                            • Size 500KB
                                                                                                                                            • SHA256 e3557e12d3b420bf056e28d3fb3c695e20b87f9d779c7c5e54e30ef6a3275ce9
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            MSI74F0.tmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\MSI74F0.tmp
                                                                                                                                            • Size 936KB
                                                                                                                                            • SHA256 aeda49baf2d79da2f7a9266f1fb7884111c2620e187090321f5278af5131c996
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            MSI7BFF.tmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\MSI7BFF.tmp
                                                                                                                                            • Size 881KB
                                                                                                                                            • SHA256 7f4713f31958704586a9173759dc568dd48b21de022eeae19e5152ae2d011b4d
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            MSI7CEC.tmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\MSI7CEC.tmp
                                                                                                                                            • Size 320KB
                                                                                                                                            • SHA256 de9b5a675ac0f6054f4f3ec38de05a3841c18f59a6c7716c58a14cff8fa41087
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            TestWriteAccess.exe
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\TestWriteAccess.exe
                                                                                                                                            • Size 5KB
                                                                                                                                            • SHA256 85ce2d5b3037cebddacc786c477ecdc90e96d525898731dd13d3888a3d81a5b9
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            ad_5304_0.MTL
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ad_5304_0.MTL
                                                                                                                                            • Size 82KB
                                                                                                                                            • SHA256 8bea38ee001856f575075407a840ccd5d5b6b3702e92577feaae09bac2a8ca32
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            edge_BITS_134.jpg
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\edge_BITS_134.jpg
                                                                                                                                            • Size 5.9MB
                                                                                                                                            • SHA256 13422a8cbc10a69f2ab0f99d238c613938625107f014eaebb0dad19e03536b37
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            INetC.dll
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\nst1178.tmp\INetC.dll
                                                                                                                                            • Size 25KB
                                                                                                                                            • SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            System.dll
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\nst1178.tmp\System.dll
                                                                                                                                            • Size 12KB
                                                                                                                                            • SHA256 1be52c4b0f82a9e50db06ccf9a4df2e59baf7448bad4372a10a435b60c7ea1db
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            md5dll.dll
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\nst1178.tmp\md5dll.dll
                                                                                                                                            • Size 6KB
                                                                                                                                            • SHA256 32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            nsDialogs.dll
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\nst1178.tmp\nsDialogs.dll
                                                                                                                                            • Size 9KB
                                                                                                                                            • SHA256 357e519087cfc27a16a2c083389225d21af48cae138c9b0448c5d87175a3a13e
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            nsExec.dll
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\nst1178.tmp\nsExec.dll
                                                                                                                                            • Size 6KB
                                                                                                                                            • SHA256 e5f5583fc1e5229f4f44bb72d8de22f270f91577b48cd6d025ad78ee4edea357
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            OpenXml4Net63920322005556804774e769bd-f106-4b0c-ad1a-72d292831ea8.tmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\poifiles\OpenXml4Net63920322005556804774e769bd-f106-4b0c-ad1a-72d292831ea8.tmp
                                                                                                                                            • Size 368KB
                                                                                                                                            • SHA256 4f183c6039caec30babf0367f93714e6270c180433cf0976c6d949557980924b
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            shiDFAF.tmp
                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\shiDFAF.tmp
                                                                                                                                            • Size 5.0MB
                                                                                                                                            • SHA256 06285446d57089fe85b3b6127bbc92508773af458ad5cf20abf4570d41c0fee7
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            AlibreDesign_x64.msi
                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Alibre LLC\Alibre Design 28.1.1.28228\install\AlibreDesign_x64.msi
                                                                                                                                            • Size 10.2MB
                                                                                                                                            • SHA256 2174e540afe37e574c44b780935ce198fcc3f37326c75eceb8fbefcda06b25e8
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Key.txt
                                                                                                                                            • Path C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\Key.txt
                                                                                                                                            • Size 27B
                                                                                                                                            • SHA256 423c4628489f9fff5685498290b37984ed85926ebc6b90d65dbefe8b0e0e5352
                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                            Submit Download

                                                                                                                                            keygen-BTCR.rar
                                                                                                                                            • Path C:\Users\Admin\Desktop\Alibre Design Expert 28.1.1.28228 (x64)(passis123)\Alibre Design Expert 28.1.1.28228 (x64)\keygen-BTCR.rar
                                                                                                                                            • Size 3.7MB
                                                                                                                                            • SHA256 8dbfee4a6026d54a479200d225c254e9fd09e7e4adbb53b20fa41977a382ff71
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            KB.32.278.4355.exe
                                                                                                                                            • Path C:\Windows\Microsoft.NET\Framework64\KB.32.278.4355.exe
                                                                                                                                            • Size 33KB
                                                                                                                                            • SHA256 1e75fd701998008590a79fb60f57c6111ff3c6a3a23b584f061df96f17cdf6ff
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            VCRUNTIME140.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\Framework64\VCRUNTIME140.dll
                                                                                                                                            • Size 120KB
                                                                                                                                            • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            IronPython.Modules.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\IronPython.Modules\v4.0_2.7.10.0__7f709c5b713576e1\IronPython.Modules.dll
                                                                                                                                            • Size 728KB
                                                                                                                                            • SHA256 2a779de0bab56d988afc653226d2054912bbdde6eb2f4180f85419541690ce3b
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            IronPython.Wpf.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\IronPython.Wpf\v4.0_2.7.10.0__7f709c5b713576e1\IronPython.Wpf.dll
                                                                                                                                            • Size 7KB
                                                                                                                                            • SHA256 c26eb4b79848fb147bfd0e340f6d323cca3a833ba2be1e60b82ef721e3be8671
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Microsoft.Bcl.AsyncInterfaces.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Bcl.AsyncInterfaces\v4.0_7.0.0.0__cc7b13ffcd2ddd51\Microsoft.Bcl.AsyncInterfaces.dll
                                                                                                                                            • Size 26KB
                                                                                                                                            • SHA256 5dc372a10f345b1f00ec6a8fa1a2ce569f7e5d63e4f1f8631be367e46bfa34f4
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Microsoft.CodeAnalysis.CSharp.Scripting.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CodeAnalysis.CSharp.Scripting\v4.0_2.10.0.0__31bf3856ad364e35\Microsoft.CodeAnalysis.CSharp.Scripting.dll
                                                                                                                                            • Size 28KB
                                                                                                                                            • SHA256 c7b0746b960654a0cb51df95feb1fcd16b8ba99a1369a5603b00abcf31cb6b44
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Microsoft.CodeAnalysis.CSharp.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CodeAnalysis.CSharp\v4.0_2.10.0.0__31bf3856ad364e35\Microsoft.CodeAnalysis.CSharp.dll
                                                                                                                                            • Size 4.7MB
                                                                                                                                            • SHA256 75e17c4aa3d0374ecf1d04c2de449f6eee9f13cf5f291bb8c8c0d170b1cea4c8
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Microsoft.CodeAnalysis.Scripting.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CodeAnalysis.Scripting\v4.0_2.10.0.0__31bf3856ad364e35\Microsoft.CodeAnalysis.Scripting.dll
                                                                                                                                            • Size 125KB
                                                                                                                                            • SHA256 b26b6df96e24329ade914203eae33cfe305e1a5a4c193449fd759e42abcb3837
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Microsoft.CodeAnalysis.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CodeAnalysis\v4.0_2.10.0.0__31bf3856ad364e35\Microsoft.CodeAnalysis.dll
                                                                                                                                            • Size 2.6MB
                                                                                                                                            • SHA256 85bbfdb35ee97be5dd5722076f7bb2a0ec674b2cdceb15179d72b87c336f5e1b
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Microsoft.Dynamic.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Dynamic\v4.0_1.2.3.0__7f709c5b713576e1\Microsoft.Dynamic.dll
                                                                                                                                            • Size 877KB
                                                                                                                                            • SHA256 9920313e522e832fefcf6fcbe62ee4a46d3cee7ac00535fae70c5db48a411c93
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Microsoft.Scripting.AspNet.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Scripting.AspNet\v4.0_1.1.1.21__7f709c5b713576e1\Microsoft.Scripting.AspNet.dll
                                                                                                                                            • Size 43KB
                                                                                                                                            • SHA256 f960588799b53a667b0357480776738cc9b933beaed069587411805b0b2646e0
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Microsoft.Scripting.Debugging.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Scripting.Debugging\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Scripting.Debugging.dll
                                                                                                                                            • Size 57KB
                                                                                                                                            • SHA256 afaf31a77ecc6bdf1bcb8ab19a5da5da11b29cd98308f5f0917e7fa7d95a22d2
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Microsoft.Scripting.Metadata.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Scripting.Metadata\v4.0_1.1.2.22__7f709c5b713576e1\Microsoft.Scripting.Metadata.dll
                                                                                                                                            • Size 86KB
                                                                                                                                            • SHA256 862d26a64686b2736c814263dab2813dc2e9fec8069432b831965c8d5f15be33
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            Microsoft.Scripting.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Scripting\v4.0_1.2.3.0__7f709c5b713576e1\Microsoft.Scripting.dll
                                                                                                                                            • Size 138KB
                                                                                                                                            • SHA256 2cc0ac58617cb341c497507d42d34461f36189bcd00459c22facd9a15b418403
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            RestSharp.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\RestSharp\v4.0_108.0.2.0__598062e77f915f75\RestSharp.dll
                                                                                                                                            • Size 153KB
                                                                                                                                            • SHA256 9da8472c94e0663d3762186afb734eed8b1606c5c447bf0555b0c45691bae5ea
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            System.Buffers.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Buffers\v4.0_4.0.3.0__cc7b13ffcd2ddd51\System.Buffers.dll
                                                                                                                                            • Size 20KB
                                                                                                                                            • SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            System.Collections.Immutable.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections.Immutable\v4.0_1.2.3.0__b03f5f7f11d50a3a\System.Collections.Immutable.dll
                                                                                                                                            • Size 350KB
                                                                                                                                            • SHA256 eaf7deaa83774d21df863b73cb9bca25b6e869a45d90af6a6912c8767ada4fb1
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            System.Memory.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Memory\v4.0_4.0.1.2__cc7b13ffcd2ddd51\System.Memory.dll
                                                                                                                                            • Size 138KB
                                                                                                                                            • SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            System.Numerics.Vectors.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics.Vectors\v4.0_4.1.4.0__b03f5f7f11d50a3a\System.Numerics.Vectors.dll
                                                                                                                                            • Size 113KB
                                                                                                                                            • SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            System.Reflection.Metadata.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Metadata\v4.0_1.4.3.0__b03f5f7f11d50a3a\System.Reflection.Metadata.dll
                                                                                                                                            • Size 571KB
                                                                                                                                            • SHA256 ced3abd81d7d2027235f95bcea93459c457c8147cf62025e4203ae00e5e8d6eb
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            System.Runtime.CompilerServices.Unsafe.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.CompilerServices.Unsafe\v4.0_6.0.0.0__b03f5f7f11d50a3a\System.Runtime.CompilerServices.Unsafe.dll
                                                                                                                                            • Size 17KB
                                                                                                                                            • SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            System.Text.Encodings.Web.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Text.Encodings.Web\v4.0_7.0.0.0__cc7b13ffcd2ddd51\System.Text.Encodings.Web.dll
                                                                                                                                            • Size 77KB
                                                                                                                                            • SHA256 c792bfe3f43c894e20339252d159a96a20ccc6e13322b2d382570ff97939e501
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            System.Text.Json.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Text.Json\v4.0_7.0.0.0__cc7b13ffcd2ddd51\System.Text.Json.dll
                                                                                                                                            • Size 569KB
                                                                                                                                            • SHA256 f76921aab35c706d12a953484de26fb025829cac123befc70885de7578b40980
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            System.ValueTuple.dll
                                                                                                                                            • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.3.0__cc7b13ffcd2ddd51\System.ValueTuple.dll
                                                                                                                                            • Size 24KB
                                                                                                                                            • SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            manifest.json
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_2016269959\manifest.json
                                                                                                                                            • Size 53B
                                                                                                                                            • SHA256 b2574db59e08ca01a3df98d2fb2d691981bf8167321f9789caf4e456364a46fe
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            llm_user_input_extractor_config.json
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_2036867701\llm_user_input_extractor_config.json
                                                                                                                                            • Size 4KB
                                                                                                                                            • SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            manifest.json
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_2036867701\manifest.json
                                                                                                                                            • Size 165B
                                                                                                                                            • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            hyph-as.hyb
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_636548731\hyph-as.hyb
                                                                                                                                            • Size 703B
                                                                                                                                            • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            hyph-hi.hyb
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_636548731\hyph-hi.hyb
                                                                                                                                            • Size 687B
                                                                                                                                            • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            hyph-nb.hyb
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_636548731\hyph-nb.hyb
                                                                                                                                            • Size 141KB
                                                                                                                                            • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            manifest.json
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_636548731\manifest.json
                                                                                                                                            • Size 82B
                                                                                                                                            • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            manifest.json
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_644408433\manifest.json
                                                                                                                                            • Size 118B
                                                                                                                                            • SHA256 69f118c3e7f78f02e2e2a669db02f9481cab660b7c73ef5fddf5694604852b8d
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            manifest.json
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2512_141975542\manifest.json
                                                                                                                                            • Size 116B
                                                                                                                                            • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            notification_fast.bundle.js.LICENSE.txt
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2512_1882951294\Notification\notification_fast.bundle.js.LICENSE.txt
                                                                                                                                            • Size 551B
                                                                                                                                            • SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            tokenized-card.bundle.js.LICENSE.txt
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2512_1882951294\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
                                                                                                                                            • Size 1KB
                                                                                                                                            • SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            strings.json
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2512_1882951294\json\i18n-tokenized-card\fr-CA\strings.json
                                                                                                                                            • Size 2KB
                                                                                                                                            • SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            manifest.json
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2512_1882951294\manifest.json
                                                                                                                                            • Size 121B
                                                                                                                                            • SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            manifest.json
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2512_282544219\manifest.json
                                                                                                                                            • Size 1002B
                                                                                                                                            • SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            auto_open_controller.js
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2512_981166034\auto_open_controller.js
                                                                                                                                            • Size 1.2MB
                                                                                                                                            • SHA256 f5b15a2e0909b88c7043c2a23491aec5fe8dfaa67112c9369016bbeccaa42225
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            edge_checkout_page_validator.js
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2512_981166034\edge_checkout_page_validator.js
                                                                                                                                            • Size 1016KB
                                                                                                                                            • SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            manifest.json
                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2512_981166034\manifest.json
                                                                                                                                            • Size 146B
                                                                                                                                            • SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                            Submit Download

                                                                                                                                            DCRCVDrv.sys
                                                                                                                                            • Path C:\Windows\Temp\DCRCVDrv.sys
                                                                                                                                            • Size 137KB
                                                                                                                                            • SHA256 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            ICSharpCode.SharpZipLib.dll
                                                                                                                                            • Path C:\Windows\assembly\tmp\4NGV8UY8\ICSharpCode.SharpZipLib.dll
                                                                                                                                            • Size 200KB
                                                                                                                                            • SHA256 c287e9b07a8251828f35914364c89a37db606b0c1d64457f9eb8fa2258f0dee3
                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                            Submit Download

                                                                                                                                            memory/1976-117-0x0000000180000000-0x0000000180450000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1976-123-0x0000000180000000-0x0000000180450000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1976-143-0x0000000180000000-0x0000000180450000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1976-120-0x0000000180000000-0x0000000180450000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1976-121-0x0000000180000000-0x0000000180450000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/1976-122-0x0000000180000000-0x0000000180450000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-130-0x0000000140000000-0x0000000140323000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-248-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-144-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-147-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-146-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-263-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-148-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-260-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-149-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-150-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-641-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-151-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-604-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-152-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-127-0x0000000140000000-0x0000000140323000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-133-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-141-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-128-0x0000000140000000-0x0000000140323000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-129-0x0000000140000000-0x0000000140323000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-139-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-140-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-364-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-142-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-145-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-131-0x0000000140000000-0x0000000140323000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-206-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-304-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-294-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2000-247-0x0000000180000000-0x000000018030C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2156-668-0x00000000007F0000-0x00000000007F8000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-978-0x000001E4CFE20000-0x000001E4CFF02000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-990-0x000001E4CF9F0000-0x000001E4CFA0C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-969-0x000001E4CFB60000-0x000001E4CFD22000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-975-0x000001E4CF680000-0x000001E4CF688000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-972-0x000001E4CFA50000-0x000001E4CFB0C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-3432-0x000001E4CFB30000-0x000001E4CFB4E000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-3444-0x000001E4CFA10000-0x000001E4CFA1A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-3447-0x000001E4CFB10000-0x000001E4CFB18000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-3429-0x000001E4CFF40000-0x000001E4CFF66000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-3426-0x000001E4CF990000-0x000001E4CF99A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-3423-0x000001E4CFF10000-0x000001E4CFF3C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-3438-0x000001E4CFDA0000-0x000001E4CFDB6000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-3420-0x000001E4CF720000-0x000001E4CF72A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-3435-0x000001E4CF9A0000-0x000001E4CF9A8000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-3417-0x000001E4CFD60000-0x000001E4CFD98000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-984-0x000001E4CF9D0000-0x000001E4CF9E4000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-3441-0x000001E4D0AE0000-0x000001E4D0B72000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-1029-0x000001E4CFFA0000-0x000001E4D0030000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-1026-0x000001E4CFDC0000-0x000001E4CFE1A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-987-0x000001E4CFA20000-0x000001E4CFA48000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-981-0x000001E4CF9B0000-0x000001E4CF9C2000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-1014-0x000001E4D1EB0000-0x000001E4D235E000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-1017-0x000001E4CF690000-0x000001E4CF69C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-1023-0x000001E4CFD30000-0x000001E4CFD54000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2276-1020-0x000001E4D2360000-0x000001E4D25FA000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2300-4005-0x0000000000DD0000-0x0000000000DD6000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2596-126-0x0000000000010000-0x000000000003D000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2756-5379-0x0000000000F20000-0x000000000151B000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2756-5304-0x0000000000F20000-0x000000000151B000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2756-5253-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2756-5252-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2756-5251-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/2756-5250-0x0000000000F20000-0x000000000151B000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-6211-0x0000000004310000-0x0000000004311000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-8634-0x0000000004310000-0x0000000004311000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-6210-0x0000000004310000-0x0000000004311000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-6231-0x0000000000F20000-0x000000000151B000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-8632-0x0000000004310000-0x0000000004311000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-8637-0x0000000004310000-0x0000000004311000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-8635-0x0000000004310000-0x0000000004311000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-6212-0x0000000004310000-0x0000000004311000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-8633-0x0000000004310000-0x0000000004311000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-8631-0x0000000004310000-0x0000000004311000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-8636-0x0000000004310000-0x0000000004311000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4796-8639-0x0000000000F20000-0x000000000151B000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4964-66-0x0000000010000000-0x000000001000A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/4964-58-0x0000000010000000-0x000000001000A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6394-0x00007FFECFB10000-0x00007FFECFD11000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6404-0x000001AF6DA50000-0x000001AF6DA58000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6376-0x000001AF6CCA0000-0x000001AF6D1F0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6379-0x000001AF6C750000-0x000001AF6C906000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6378-0x000001AF69000000-0x000001AF69008000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6377-0x000001AF69040000-0x000001AF6907C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6380-0x000001AF6C910000-0x000001AF6CB5C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6383-0x000001AF69590000-0x000001AF69688000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6382-0x000001AF69490000-0x000001AF69588000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6385-0x000001AF690A0000-0x000001AF690BA000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6384-0x000001AF73250000-0x000001AF73402000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6386-0x000001AF73940000-0x000001AF73E6A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6387-0x000001AF74520000-0x000001AF74BCC000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6389-0x000001AF690C0000-0x000001AF690CA000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6388-0x000001AF753B0000-0x000001AF75B8C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6390-0x000001AF690E0000-0x000001AF690EA000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6392-0x000001AF690D0000-0x000001AF690D8000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6374-0x000001AF6C4D0000-0x000001AF6C746000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6391-0x000001AF69110000-0x000001AF6912A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6395-0x00007FFEE47D0000-0x00007FFEE4A04000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6396-0x000001AF69A10000-0x000001AF69A11000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6402-0x000001AF6DA20000-0x000001AF6DA30000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6403-0x000001AF6DA40000-0x000001AF6DA48000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6375-0x000001AF6DAE0000-0x000001AF6EE6E000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6405-0x000001AF74270000-0x000001AF74414000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6406-0x000001AF6DAB0000-0x000001AF6DAD0000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6407-0x000001AF74FD0000-0x000001AF7507A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6408-0x000001AF79960000-0x000001AF79B74000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6409-0x000001AF79FF0000-0x000001AF7A458000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6412-0x000001AF73090000-0x000001AF730FC000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-5186-0x000001AF68280000-0x000001AF68292000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6434-0x000001AF75200000-0x000001AF75332000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6435-0x000001AF7B240000-0x000001AF7B420000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6436-0x000001AF69250000-0x000001AF69270000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-5185-0x000001AF68380000-0x000001AF68492000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6440-0x000001AF7B420000-0x000001AF7B63A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-5184-0x000001AF604C0000-0x000001AF60728000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6452-0x000001AF74470000-0x000001AF744B4000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6453-0x000001AF7A7C0000-0x000001AF7A848000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6454-0x000001AF79F60000-0x000001AF79FDE000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6373-0x000001AF71AF0000-0x000001AF73086000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-6372-0x000001AF6EFE0000-0x000001AF71AEC000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-5187-0x000001AF682E0000-0x000001AF6831A000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-5183-0x000001AF45AD0000-0x000001AF45B2C000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-8600-0x000001AF69CE0000-0x000001AF69CEA000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-8603-0x000001AF69CA0000-0x000001AF69CAC000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-8604-0x000001AF69D00000-0x000001AF69D0E000-memory.dmp
                                                                                                                                            Download

                                                                                                                                            memory/5304-8610-0x000001AF803A0000-0x000001AF8074E000-memory.dmp
                                                                                                                                            Download