f5f19e870163c20ec63a656d6f5d0c123e07c4254899380ebeec51b00766e615

Analysis

user interaction
yes
max time kernel
88s
max time network
78s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
calibre-64bit-9.13.0.msi
Size 212.9MB
Sample260808-sdhd6ss1aw
SHA256 f5f19e870163c20ec63a656d6f5d0c123e07c4254899380ebeec51b00766e615
MD5 cec98a2aad2d25218b50765308502755
SHA1 b297865400de6d37475ecfe52beab604cfd83b87
SHA512 ee58583e91550ecee269d6c8d6f95ef70733f8645abc1624794d4e2471c9fd93107ed1d27c72066e90f1ea97205ceffcbc272d40b988b844b71f3dee2e177007
SSDEEP 6291456:4c2MUmJXb8HM8D9F1h8PpeQklInxhKk9SjuNxcgvbz:4ROb8HX53OPNklIt9Sjmzvbz
TLSH
T1A2B833B571B12CADF46A8072D2B2B3A68AB92D1C771541B74276F46C1EB35E133F8309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 17 IoCs

pid	Process
1184	calibre.exe
4780	calibre-parallel.exe
940	calibre-parallel.exe
472	calibre-parallel.exe
3044	calibre-parallel.exe
6580	calibre-parallel.exe
5604	calibre-parallel.exe
4520	calibre-parallel.exe
5180	calibre-parallel.exe
6388	calibre-parallel.exe
4592	QtWebEngineProcess.exe
7096	QtWebEngineProcess.exe
476	QtWebEngineProcess.exe
4508	QtWebEngineProcess.exe
6904	calibre-parallel.exe
6524	calibre-parallel.exe
4548	calibre-parallel.exe

Loads dropped DLL 64 IoCs

pid	Process
4240	MsiExec.exe
4240	MsiExec.exe
904	MsiExec.exe
4240	MsiExec.exe
1200	MsiExec.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe
1184	calibre.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4128	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Calibre2\app\resources\mathjax\output\chtml\fonts\woff-v2\MathJax_Size2-Regular.woff	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\ca_dict	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\es_dict	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\apsw._unicode.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\btreeinfo.dll	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\crypto.Hash._MD2.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\images\format-justify-center.png	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\mozilla-ca-certs\a89d74c2.0	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\uz_dict	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\lang\art\py	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\lang\gmw\af	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\crypto.Hash._SHA224.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\crypto.Protocol._scrypt.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\crypto.PublicKey._curve448.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\lang\roa\pap	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\piper-voices.json	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\images\subset-fonts.png	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\images\tweaks.png	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\lang\myn\quc	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\lang\sai\gn	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\pyqt6.QtSql.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\zipfile.dll	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\templates\new_nav.html	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\bn_dict	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\voices\!v\Mr serious	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\_testinternalcapi.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\netifaces.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\pyqt6.QtQuick.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\plugins\platforms\qdirect2d.dll	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\fts_sqlite.sql	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\viewer.html	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\images\marked.png	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\Qt6Sql.dll	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\_sqlite3.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\plugins\imageformats\qjpeg.dll	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\mathjax\output\chtml\fonts\tex.js	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\ko_dict	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\lang\azc\nci	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\lang\gmw\en-GB-x-rp	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\lang\trk\az	msiexec.exe
File created	C:\Program Files\Calibre2\lrs2lrf.exe	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\matcher.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\podofo.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\lang\art\piqd	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\voices\!v\ian	msiexec.exe
File created	C:\Program Files\Calibre2\app\translations\qtwebengine_locales\ar.pak	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\winsound.pyd	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\calibre-portable.bat	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\images\book.png	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\images\exec.png	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\voices\!v\Andrea	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\voices\!v\travis	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\api-ms-win-core-timezone-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\api-ms-win-crt-private-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\images\filter.png	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\images\fts.png	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\mathjax\input\mml\entities.js	msiexec.exe
File created	C:\Program Files\Calibre2\app\share\espeak-ng-data\voices\!v\belinda	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\api-ms-win-core-processthreads-l1-1-1.dll	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\api-ms-win-core-synch-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Calibre2\app\bin\postproc-58.dll	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\jacket\template.xhtml	msiexec.exe
File created	C:\Program Files\Calibre2\app\resources\mozilla-ca-certs\0a775a30.0	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI63B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3165.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FDC3D8F7-59E0-45CB-908E-4DC97B3411B4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84F.tmp	msiexec.exe
File created	C:\Windows\Installer\{FDC3D8F7-59E0-45CB-908E-4DC97B3411B4}\main_icon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3790.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF795C60D5D4C33194.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI91B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF32FA0BDB5410CBA9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{FDC3D8F7-59E0-45CB-908E-4DC97B3411B4}\main_icon	msiexec.exe
File created	C:\Windows\Installer\e59f3dc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f3dc.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB22723193C63846B.TMP	msiexec.exe
File created	C:\Windows\Installer\e59f3de.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6D07747F4DCCFE8A.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4128	msiexec.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5828	cmd.exe
2208	cmd.exe
6132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.POBI	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.HTM\PerceivedType = "Document"	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.POBI\DefaultIcon	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.AZW\shell\open\command	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.AZW1\DefaultIcon\ = "C:\\Program Files\\Calibre2\\calibre.exe,0"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreEditor64bit.AssocFile.HTM\ = "HTM Document"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreEditor64bit.AssocFile.AZW3\DefaultIcon\ = "C:\\Program Files\\Calibre2\\ebook-edit.exe,0"	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.CHM	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.BOOK\DefaultIcon\ = "C:\\Program Files\\Calibre2\\calibre.exe,0"	calibre.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\.cb7\OpenWithProgIDs\calibre64bit.AssocFile.CB7 = "0"	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreEditor64bit.AssocFile.DOCX\shell\open	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.TXT\shell\open\command	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.MARKDOWN\shell\open	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.CBZ\shell	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.PML\DefaultIcon\ = "C:\\Program Files\\Calibre2\\ebook-viewer.exe,0"	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.CBZ	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.PRC\DefaultIcon	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.AZW3\ = "AZW3 Document"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.MD\DefaultIcon\ = "C:\\Program Files\\Calibre2\\ebook-viewer.exe,0"	calibre.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F8D3CDF0E95BC5409E8D49CB743114B\ProductIcon = "C:\\Windows\\Installer\\{FDC3D8F7-59E0-45CB-908E-4DC97B3411B4}\\main_icon"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.MARKDOWN\PerceivedType = "Document"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.PRC\ = "PRC Document"	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.PRC\shell\open	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.DOCM	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.PS\shell\open	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.PDB\DefaultIcon\ = "C:\\Program Files\\Calibre2\\calibre.exe,0"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.CBZ\FriendlyTypeName = "CBZ Document"	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.AZW\DefaultIcon	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.TXT\shell\open	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.MARKDOWN\ = "MARKDOWN Document"	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.LRX\shell\open\command	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\.cb7\OpenWithProgIDs	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.SHTML\shell\open	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.CBZ\shell\open\command	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreEditor64bit.AssocFile.HTML\shell\open	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.POBI\DefaultIcon\ = "C:\\Program Files\\Calibre2\\ebook-viewer.exe,0"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.MARKDOWN\shell\open\command\ = "\"C:\\Program Files\\Calibre2\\ebook-viewer.exe\" \"%1\""	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.CHM\FriendlyTypeName = "CHM Document"	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.CBC\shell	calibre.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\.docx\OpenWithProgIDs\calibre64bit.AssocFile.DOCX = "0"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.HTML\PerceivedType = "Document"	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreEditor64bit.AssocFile.HTM	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.PDF\shell\open	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.CB7\DefaultIcon	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\.cbz	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.IMP\shell	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.TPZ\PerceivedType = "Document"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.CHM\DefaultIcon\ = "C:\\Program Files\\Calibre2\\ebook-viewer.exe,0"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.HTML\DefaultIcon\ = "C:\\Program Files\\Calibre2\\ebook-viewer.exe,0"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.PRC\DefaultIcon\ = "C:\\Program Files\\Calibre2\\calibre.exe,0"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.TXT\shell\open\command\ = "\"C:\\Program Files\\Calibre2\\calibre.exe\" \"%1\""	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.CBZ	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.DOCM\DefaultIcon\ = "C:\\Program Files\\Calibre2\\ebook-viewer.exe,0"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.PDF\PerceivedType = "Document"	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreEditor64bit.AssocFile.EPUB\DefaultIcon\ = "C:\\Program Files\\Calibre2\\ebook-edit.exe,0"	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.DJV\shell	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.AZW3\shell\open	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.DOCX\shell\open\command\ = "\"C:\\Program Files\\Calibre2\\calibre.exe\" \"%1\""	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.CBR\shell\open\command	calibre.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibreViewer64bit.AssocFile.PDB\PerceivedType = "Document"	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\.docm	calibre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F8D3CDF0E95BC5409E8D49CB743114B\Version = "151846912"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\calibre64bit.AssocFile.AZW\shell\open	calibre.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\.docx\OpenWithProgIDs	calibre.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1184	calibre.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1696	msiexec.exe
1696	msiexec.exe
4240	MsiExec.exe
4240	MsiExec.exe
4240	MsiExec.exe
4240	MsiExec.exe
4240	MsiExec.exe
4240	MsiExec.exe
4240	MsiExec.exe
4240	MsiExec.exe
4592	QtWebEngineProcess.exe
4592	QtWebEngineProcess.exe
7096	QtWebEngineProcess.exe
7096	QtWebEngineProcess.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
476	QtWebEngineProcess.exe
476	QtWebEngineProcess.exe
4508	QtWebEngineProcess.exe
4508	QtWebEngineProcess.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1184	calibre.exe
6580	calibre-parallel.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4128	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4128	msiexec.exe
Token: SeSecurityPrivilege	1696	msiexec.exe
Token: SeCreateTokenPrivilege	4128	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4128	msiexec.exe
Token: SeLockMemoryPrivilege	4128	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4128	msiexec.exe
Token: SeMachineAccountPrivilege	4128	msiexec.exe
Token: SeTcbPrivilege	4128	msiexec.exe
Token: SeSecurityPrivilege	4128	msiexec.exe
Token: SeTakeOwnershipPrivilege	4128	msiexec.exe
Token: SeLoadDriverPrivilege	4128	msiexec.exe
Token: SeSystemProfilePrivilege	4128	msiexec.exe
Token: SeSystemtimePrivilege	4128	msiexec.exe
Token: SeProfSingleProcessPrivilege	4128	msiexec.exe
Token: SeIncBasePriorityPrivilege	4128	msiexec.exe
Token: SeCreatePagefilePrivilege	4128	msiexec.exe
Token: SeCreatePermanentPrivilege	4128	msiexec.exe
Token: SeBackupPrivilege	4128	msiexec.exe
Token: SeRestorePrivilege	4128	msiexec.exe
Token: SeShutdownPrivilege	4128	msiexec.exe
Token: SeDebugPrivilege	4128	msiexec.exe
Token: SeAuditPrivilege	4128	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4128	msiexec.exe
Token: SeChangeNotifyPrivilege	4128	msiexec.exe
Token: SeRemoteShutdownPrivilege	4128	msiexec.exe
Token: SeUndockPrivilege	4128	msiexec.exe
Token: SeSyncAgentPrivilege	4128	msiexec.exe
Token: SeEnableDelegationPrivilege	4128	msiexec.exe
Token: SeManageVolumePrivilege	4128	msiexec.exe
Token: SeImpersonatePrivilege	4128	msiexec.exe
Token: SeCreateGlobalPrivilege	4128	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4128	msiexec.exe
4128	msiexec.exe

Suspicious use of SetWindowsHookEx 62 IoCs

pid	Process
4128	msiexec.exe
1696	msiexec.exe
4240	MsiExec.exe
904	MsiExec.exe
1200	MsiExec.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe
6580	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
3044	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe
6580	calibre-parallel.exe
3044	calibre-parallel.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 4240	1696	msiexec.exe	91
PID 1696 wrote to memory of 904	1696	msiexec.exe	92
PID 1696 wrote to memory of 1200	1696	msiexec.exe	95
PID 1200 wrote to memory of 1184	1200	MsiExec.exe	96
PID 1184 wrote to memory of 4780	1184	calibre.exe	97
PID 1184 wrote to memory of 940	1184	calibre.exe	99
PID 1184 wrote to memory of 472	1184	calibre.exe	100
PID 1184 wrote to memory of 3044	1184	calibre.exe	101
PID 1184 wrote to memory of 6580	1184	calibre.exe	102
PID 6580 wrote to memory of 5604	6580	calibre-parallel.exe	103
PID 3044 wrote to memory of 4520	3044	calibre-parallel.exe	104
PID 6580 wrote to memory of 5180	6580	calibre-parallel.exe	105
PID 3044 wrote to memory of 6388	3044	calibre-parallel.exe	106
PID 6580 wrote to memory of 4592	6580	calibre-parallel.exe	108
PID 6580 wrote to memory of 7096	6580	calibre-parallel.exe	109
PID 3044 wrote to memory of 476	3044	calibre-parallel.exe	107
PID 3044 wrote to memory of 4508	3044	calibre-parallel.exe	110
PID 6580 wrote to memory of 6904	6580	calibre-parallel.exe	111
PID 3044 wrote to memory of 6524	3044	calibre-parallel.exe	112
PID 3044 wrote to memory of 4548	3044	calibre-parallel.exe	113
PID 6580 wrote to memory of 2208	6580	calibre-parallel.exe	114
PID 6580 wrote to memory of 6132	6580	calibre-parallel.exe	117
PID 6580 wrote to memory of 5828	6580	calibre-parallel.exe	120

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\calibre-64bit-9.13.0.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4128

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E5BE8EF38EF5B0919C820BD087E60EF9
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4240
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 83E9403222C2DE6BA95D404D28A472F5 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:904
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3EDB6102204F9FA956C0376E1F9D00D3 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Program Files\Calibre2\calibre.exe
    "C:\Program Files\Calibre2\calibre.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Program Files\Calibre2\calibre-parallel.exe
      "C:\Program Files\Calibre2\calibre-parallel.exe" --pipe-worker "from calibre.utils.safe_atexit import main; main()"
      4⤵
      Executes dropped EXE
      PID:4780
  - - C:\Program Files\Calibre2\calibre-parallel.exe
      "C:\Program Files\Calibre2\calibre-parallel.exe" --pipe-worker "from calibre.library.page_count import worker_main; worker_main(1820)"
      4⤵
      Executes dropped EXE
      PID:940
  - - C:\Program Files\Calibre2\calibre-parallel.exe
      "C:\Program Files\Calibre2\calibre-parallel.exe" --pipe-worker "from calibre.utils.ipc.pool import run_main, worker_main; run_main(1868, worker_main)"
      4⤵
      Executes dropped EXE
      PID:472
  - - C:\Program Files\Calibre2\calibre-parallel.exe
      "C:\Program Files\Calibre2\calibre-parallel.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Program Files\Calibre2\calibre-parallel.exe
        
        "C:\Program Files\Calibre2\calibre-parallel.exe" --pipe-worker "from calibre.utils.safe_atexit import main; main()"
        5⤵
        Executes dropped EXE
        
        PID:4520
    - - C:\Program Files\Calibre2\calibre-parallel.exe
        
        "C:\Program Files\Calibre2\calibre-parallel.exe" --pipe-worker "from calibre.srv.render_book import viewer_main; viewer_main()"
        5⤵
        Executes dropped EXE
        
        PID:6388
    - - C:\Program Files\Calibre2\app\bin\QtWebEngineProcess.exe
        
        "C:\Program Files\Calibre2\app\bin\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=clbr:hs;qrc:sV --no-sandbox --disable-speech-api --touch-events=auto --disable-gpu-compositing --disable-blink-features=EyeDropperAPI,WebOTP --video-capture-use-gpu-memory-buffer --lang=pt --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --field-trial-handle=4284,i,18410820651039544705,4192092131261099640,262144 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,EyeDropper,InstalledApp,StandardCompliantNonSpecialSchemeURLParsing,WebOTP,WebPayments,WebUSB --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:476
    - - C:\Program Files\Calibre2\app\bin\QtWebEngineProcess.exe
        
        "C:\Program Files\Calibre2\app\bin\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=clbr:hs;qrc:sV --no-sandbox --disable-speech-api --touch-events=auto --disable-databases --disable-gpu-compositing --disable-blink-features=EyeDropperAPI,WebOTP --video-capture-use-gpu-memory-buffer --lang=pt --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=4284,i,18410820651039544705,4192092131261099640,262144 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,EyeDropper,InstalledApp,StandardCompliantNonSpecialSchemeURLParsing,WebOTP,WebPayments,WebUSB --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4508
    - - C:\Program Files\Calibre2\calibre-parallel.exe
        
        "C:\Program Files\Calibre2\calibre-parallel.exe" --pipe-worker "from calibre.srv.render_book import viewer_main; viewer_main()"
        5⤵
        Executes dropped EXE
        
        PID:6524
    - - C:\Program Files\Calibre2\calibre-parallel.exe
        
        "C:\Program Files\Calibre2\calibre-parallel.exe" --pipe-worker "from calibre.srv.render_book import viewer_main; viewer_main()"
        5⤵
        Executes dropped EXE
        
        PID:4548
  - - C:\Program Files\Calibre2\calibre-parallel.exe
      "C:\Program Files\Calibre2\calibre-parallel.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:6580
    - - C:\Program Files\Calibre2\calibre-parallel.exe
        
        "C:\Program Files\Calibre2\calibre-parallel.exe" --pipe-worker "from calibre.utils.safe_atexit import main; main()"
        5⤵
        Executes dropped EXE
        
        PID:5604
    - - C:\Program Files\Calibre2\calibre-parallel.exe
        
        "C:\Program Files\Calibre2\calibre-parallel.exe" --pipe-worker "from calibre.srv.render_book import viewer_main; viewer_main()"
        5⤵
        Executes dropped EXE
        
        PID:5180
    - - C:\Program Files\Calibre2\app\bin\QtWebEngineProcess.exe
        
        "C:\Program Files\Calibre2\app\bin\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=clbr:hs;qrc:sV --no-sandbox --disable-speech-api --touch-events=auto --disable-gpu-compositing --disable-blink-features=EyeDropperAPI,WebOTP --video-capture-use-gpu-memory-buffer --lang=pt --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --field-trial-handle=4172,i,8115156486957156339,17307388998987848521,262144 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,EyeDropper,InstalledApp,StandardCompliantNonSpecialSchemeURLParsing,WebOTP,WebPayments,WebUSB --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4592
    - - C:\Program Files\Calibre2\app\bin\QtWebEngineProcess.exe
        
        "C:\Program Files\Calibre2\app\bin\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=clbr:hs;qrc:sV --no-sandbox --disable-speech-api --touch-events=auto --disable-databases --disable-gpu-compositing --disable-blink-features=EyeDropperAPI,WebOTP --video-capture-use-gpu-memory-buffer --lang=pt --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=4172,i,8115156486957156339,17307388998987848521,262144 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,EyeDropper,InstalledApp,StandardCompliantNonSpecialSchemeURLParsing,WebOTP,WebPayments,WebUSB --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:7096
    - - C:\Program Files\Calibre2\calibre-parallel.exe
        
        "C:\Program Files\Calibre2\calibre-parallel.exe" --pipe-worker "from calibre.srv.render_book import viewer_main; viewer_main()"
        5⤵
        Executes dropped EXE
        
        PID:6904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:2208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:6132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:5828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59f3dd.rbs

Path C:\Config.Msi\e59f3dd.rbs
Size 665KB
SHA256 dfc7a3ec360cfa80e0954b06276a9a65658c562d316c4369d01302d3a3613ed5
MD5 486e27be495b8c6eb12c36fefe825586
SHA1 70da5e8c9d613c0c11249719c7302399b3969d8a
SHA512 95b6c5e218f7cf491b207856d7492f29e22c014a44edc5260ad15fcf2194184a340e77a994c9408b9bf128b718a7fe0200365800676a57a464800b62838244eb
SSDEEP 6144:fDtyFs/JWJqjGNa7YhzTvsGgFZFKjTMsAgzeF35cYr8XjuoY4zxu6W:Jya/2qjGaYh3UGgFjKgZF35VijuoYn6W
TLSH
T147E4F784BB7D80C5F021B9F49351A42CEE9874142F148D3F17A4D3AEDFA3AA06D396D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Program Files\Calibre2\app\bin\Qt6Core.dll
Size 9.9MB
SHA256 c277829f609d48c4cfd2c88c9de4fe1beebe0114dcaaf792c9b097f78b78dea9
MD5 8d546b6b0b667f4d77bdda42bcdad7de
SHA1 7d61a8496baa0feb10f86a476f874bfabd93d0a4
SHA512 4c70bb60f569699a72a101f5310f4b49805f7d0b549ab79c50b6763e798281d4a2b0773e0237517a2e60f41c2074d857309c79c128b412013f9f2edab21d1889
SSDEEP 98304:6PFZdZ0dgr9+tUj7KFdu9CwJsv6t9m2C5A2ko1cr//3dm:2didgrgtWKFdu9CwJsv6t9m/u//3dm
TLSH
T111A6290766FA0115F6F7D634CAB74212DBB37C466B3096DF025861182E73AF09E7A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\Calibre2\app\bin\VCRUNTIME140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Program Files\Calibre2\app\bin\VCRUNTIME140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Program Files\Calibre2\app\bin\_bz2.pyd
Size 81KB
SHA256 ee8df77c136045f31b60fc1503ac3645a1f609b18604043347eee2afe7a67ce2
MD5 6b4a16932f39ee9f677aa48fc1eb73fd
SHA1 10fa06b457481015ae350a8d6e03f76f68e9a7b9
SHA512 27f5080dee0acd38d17452c4814946222f95ebaabcccbbe4bf9228e4ac193bfc278cd154452827fdf8a7fc957a8eef302a17d2958fabb9df3a8a925e2a9a9a49
SSDEEP 1536:j9DAAdNgt5JKKQD//0+xTdG8HSADbDI+KMIG3VXvV5:jvObkLjpxHl3D1FIG3VfV5
TLSH
T1BC837C52A77016F5E55B927951800763EB30BE680350A3EFF34887153F12FA2BEB53A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Program Files\Calibre2\app\bin\_lzma.pyd
Size 153KB
SHA256 ead01617503b0592806a0ea594da903f3c121bd5713739e8763fb631ddca6675
MD5 25a159ec6cc380a4ed8d10aeaf8da4eb
SHA1 10726d0af52ae43a90c1d8246770d6a078c46030
SHA512 c09519447d74d5f42b44e89f79eb559486c43f0016d877ce54fb7f58cf73e47b394c7fac4918472914efcc59a72acbc6a0d9bfa6374ff5a42a70bff6f77d3a94
SSDEEP 3072:px2QzkIhNhiu2Zpn2PtznfZ9mNoYyEC4NUZ0OFIGI175B:px2QzkwNhm/eVhYOR4NHOUD
TLSH
T13BE33B96A6A4F0D6F3228C38D6528F93E7F6B8194350D2DA02CC477C6B1F7659D2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Program Files\Calibre2\app\bin\_socket.pyd
Size 82KB
SHA256 adb613a8fb147e198361a9fe660a08f350c99ca7f8bc271d14ebd1c9cedaf54c
MD5 69cbdb738e0566f28716d372040a8b1a
SHA1 c2c071b1ffcc3300ba7398f9b8f090103fb34427
SHA512 d315210cec08a62ddc30a1c5322828d54258bf21ef1e7e180d8bb66e61e15d9146c7f5fbad70b83e52e84298abbe8619932e13bb75f1df27287a49514ff82e66
SSDEEP 1536:8GWdJ7GIuEaqkTxypvk7XP+66wSzN1TOQVaBE+KAIGGwMv5:+dJRuEFCypvk7XPz6wSz/OQovRIGGww5
TLSH
T195835A11AA6050F5DF378175C6634E62FFB0B4C02394A79F4165CA6A1F337C2AE7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Program Files\Calibre2\app\bin\_uuid.pyd
Size 23KB
SHA256 007497152598b671c105387821193365a72d3b42d604d05029de5d4c6fe64456
MD5 5fc811e6671fd9752c0399859c5439c4
SHA1 ce3c85224985e3e4ba928898990773491b2cb827
SHA512 8005502d6638c2936c3c04a0edb8d0636087d496123ce0e91bad0fc43fca18bf287418b5c82ef470a8986726e7b6df2e8d16327a3da15c392e493e55f01a1b1f
SSDEEP 384:E7YQ9KOt85LVJza+WjMIGIw1HDgvKvlIMy8RbmL4nNyJ5G:E7tptWbm+KMIGIw58v6P5ALc
TLSH
T16BB27E53CA741C46ED1BCAB0E4E94E06E9B2BB624F9183CB232DC1651F513C367A63D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Program Files\Calibre2\app\bin\_zstd.pyd
Size 487KB
SHA256 779c5b0921aeb53b26f51fdc7cc67a15235f950d521ebab217346fafaa8cb36c
MD5 16dfd8762c6d99c85ca32d32c523f951
SHA1 0b3e577adaa86046c9ea58437925776a287b73a5
SHA512 7ff834241b34921c762f2a1f36e343aa03839c44860d3ec9980db05772c0c469b5aa54a459725fed180264e4c083cf9c7c92ad7d7f35e874aa8f25cd2202f6b4
SSDEEP 6144:sgOp7JKvOfOGKPdIlPG2PJgt2DGDe1ebi7Vj4kjdd1aUg8sHYnhUngpwewDgp5+L:sgO9smf/G2CengYnhiFDgp5BCl9VDusz
TLSH
T11FB4AF43F29953ECD43BC4B4CE4A9653FBB2784A221452578395CBA93F07B318F6A358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

calibre-launcher.dll

Path C:\Program Files\Calibre2\app\bin\calibre-launcher.dll
Size 488KB
SHA256 ea9a242a62da05de99718f862943d36342b6c0a8302a085d35e56a08911f428a
MD5 401248cbff40db1d23c20e511d632ec7
SHA1 3e4de4efe775256c07256a87bf69a7d4b826cd9f
SHA512 0e93ade87205dcb7d544b408ad42773f13c0209da7105328ffbea3c937b6dcd323c75ce67b5e717b932fbe7645b383ac169796cca3127cda43799c878934a9f5
SSDEEP 3072:t5erblww/IxO2qgwy+BspesUqMFbJAXFlBB8JpF32QnYRRCGNi2aCO3+j1guPgox:rolkxDB68pVKbDyLVNaCOORg6pRIIB
TLSH
T132B4A4425329892FF1652D39A133461886A3BD907680D297B4D3095F6EB7FFC623EB1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icu.pyd

Path C:\Program Files\Calibre2\app\bin\icu.pyd
Size 57KB
SHA256 0f859bb78c708c3c88c60dd5c7ec7105d4f85c71e1eee1edd46f2f3008f34718
MD5 1feda32c67e3bae05f598dc757606a12
SHA1 c2a1c456cd806c9c894b9a3eb319f782a03029fb
SHA512 ea52bebbeca902b77a56483eb43c429e39abaaf9654a64e96a4cd1b57b81469338de77963a862fcc3bbe67f4641d84db1270abf565a7644d11a147403afd1d45
SSDEEP 1536:P1a7Gbf7w07QtvnTNyETbGpHSdxB3M+77UkFZZCr0pvK:PpbkjnTNyEXWH6T0kFLhK
TLSH
T1E7437B93D2400099CAA7C778C0679D53E678B0645B0092DFA768C99E2F137E3773ABE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudt78.dll

Path C:\Program Files\Calibre2\app\bin\icudt78.dll
Size 31.6MB
SHA256 676b8d695daf4e1d5d0ca88a2f85d341c745cfed84d0681b1232c75beae55ddd
MD5 7b352f01080b00ad7b8f08fb1f4956cf
SHA1 a73f1a4b4364056a1d512fd3a8198614594e0c14
SHA512 3c77156eb9482f6d30d75290a2b804367d3274a2c0f8fbf1b752b45067c5f8ac8fda2e18108c6fd1ab088f3c2648246506aaa8b4386213b2a88dc8953f2cbe5b
SSDEEP 393216:UeVBjdGiPBHFpsiXUx7WT0wWlF3I3Ul2noJg9WbkxyfS/CO47Ty9tf0PsKSoKnzT:Z1dGW0i
TLSH
T16B77074267FB09C1FDFB9F32A8F652634467FD06BE31844E52042B2A5D733A09967722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icuin78.dll

Path C:\Program Files\Calibre2\app\bin\icuin78.dll
Size 3.4MB
SHA256 d4116c55d60d3c51732294b08c6207a201488b756474112fdeddc12d82fb8cf3
MD5 380050d0674d5e811e8bfe4965759787
SHA1 c7f57dc5f1237ebb50d73134d9fe857624c852c2
SHA512 d6a60f827010405fd806cdc9ca41011d41f8ff883c67ccb518fa1b354796af1cd3b55c32c01e9631c8ec5adb4ef23179dcc91dfcf040a3f8328867f2d44efde0
SSDEEP 49152:b8LnZVlUOwATBjNCGYsj6rLZrU8BhERiUrhWOlow66+H5OuAHYDvgofWn6xdqGW2:b+HELOpYHsGAb0t
TLSH
T1EEF56C57B3A54196D03AC17CD99B5107EAB2783443139FDB0219876E3F23AE25AFE350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icuuc78.dll

Path C:\Program Files\Calibre2\app\bin\icuuc78.dll
Size 2.6MB
SHA256 6eca6a36e9fc2adf6722ce2a623aab514a848831e0e999a7779ab86347bbcee2
MD5 df420161e70e293763287ccd80cc7e54
SHA1 f1a28e21d72949f0d38acf510963aa323cc5734e
SHA512 1664353ecdfd9213a3a3d9bf6656edc630aca08bdde8ea811ead9728cfa5d90d3a737d53395e00fc0be330b86feb90f08cd1ded963358621f79261d13c5d88bd
SSDEEP 49152:szUbykNcAlcVpgbj1x9j3F5EsHHky1nEpTABt59nrgm:QM1F5E0iU759nrgm
TLSH
T198D57C17F1D700A9D06BC238C9B75367E6B278240FA1DAEB029946253F97BF112BD394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msgpack._cmsgpack.pyd

Path C:\Program Files\Calibre2\app\bin\msgpack._cmsgpack.pyd
Size 135KB
SHA256 cf5e915ac749a8e4feefdb2d9361e543528e32be78dc14822e5a3500b0eccc1e
MD5 364f74b6468eb30dce34713f49343d95
SHA1 0722aaf239e98d4a8c78713205bc920ec4251b9c
SHA512 898ae3cf364dc5112a114d02c28bb929bd65f72356459dd9f92ac84b899f3db45310a0f6ece471afb32f1a42cbbc4731a20a224b4ff0c8129dee8906103e856b
SSDEEP 1536:SXApPz+6YrKi6eqWs/tTYfN9D66lJQLYCvx/h504qptM/JI5tR7RcIvGtrZnfvM8:SQN+fG54RF0c4qprRcI+zWYyaXTkU
TLSH
T120D33947729644D6EEA78438CD27A883EF35F00137206BCF1650C6A61F5A3E2BE7A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\Calibre2\app\bin\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files\Calibre2\app\bin\msvcp140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyqt6.QtCore.pyd

Path C:\Program Files\Calibre2\app\bin\pyqt6.QtCore.pyd
Size 2.2MB
SHA256 b254d0ddb1ba05a2670883426122c4f383875c646ae45e253ac4faf9e33d31fe
MD5 398e7880cb27a917e5c355eefd03d565
SHA1 1aa7e0a220c47ec35495b950991fb0cc3d163cb3
SHA512 1826804328c8a54e729be107e218355fb166493bebe8ebdeba0c4733e574ed81387923c109d9657031df64827af001eedd44ac0fb9015833ea5ae32247d2fece
SSDEEP 49152:N1zogqX1W8Zv4tNVMpJk6ugbYh3Ky1eSYbTMQOGVzNh7a9Ox5GYdm2v6NL7IPCbL:PiX1W8N4t7MpJk6ugbYh3Ky1eSYbTMQq
TLSH
T1ECB50903936D21C8C9EADB7CC52F5A02FFF2B015138197DB04648A696F177E6AA3DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyqt6.sip.pyd

Path C:\Program Files\Calibre2\app\bin\pyqt6.sip.pyd
Size 116KB
SHA256 2a0b6892a6b19394506a403d3771b9b280be798a2f01292d9005f6e887c17151
MD5 6b96a33573891b9bafa185e185c3c60e
SHA1 2d289533253cf323aa171515cc550395a9c54cb6
SHA512 ac76c087f3efa66600c3152f8545da47038eccde3474410f601b76dbe0ed7a8bcc2c3bba6af057d8a16ec059695422a0aa5a62cbdddf19736affb63d7a35bb56
SSDEEP 1536:vLFqVQ8UqT5RJZRxfpJ+C8xOG1TDLGHgm+21G/8bnTSoIsz6ZF/P0BJzv1:vLFOVtzZRxfHbef1DCgm+4GETS6z861
TLSH
T184C35C5676E80084EAA6817DCE739907CBB2F4602B1093CF42A1C6562F57BF33DBA751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Program Files\Calibre2\app\bin\python3.dll
Size 69KB
SHA256 d996f474ec66ede1aa3064a3ec034177109e2dd7a65488dd45d81e54669b9ee1
MD5 134074ce1a0e76afc4ebc82838559b92
SHA1 f5548813963ad88b6502d2624cd59579d52d941f
SHA512 2c73a4ed5eb8d633b431c190f008818f3ed0b5d1ffc41af076c84da450f34daf88f8659ac8a1a5d1ffcedc3b469c75bd04d00cc3fbaff156909cc22564ed7a8f
SSDEEP 768:0QlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKI2:VbTrnXngXMx+KAIGG0Hv+e
TLSH
T180635E1E6B54F8A2DAF629FC78D199DE142B12FC8F2584DFA47CD3920E1A310A52734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.DLL

Path C:\Program Files\Calibre2\app\bin\python314.DLL
Size 6.5MB
SHA256 e2e0dfd86f3bb2548e3695a15c40921e3a142eee5036218cc1d0bb775aae78fe
MD5 072e3eaa3ec482995ea954d838b5b795
SHA1 af737d740eecc05e56be9ba61cc145155a73550d
SHA512 2439746dd29e5778145a53b12eaebbc77f90409ee3627d6c48fab17e5c63a903ceaa926b8d58ea5d5fe2e944c844e1ff14517fd750964cab735a0ef863c29d4b
SSDEEP 98304:gltCD56RyE5NhcA5fKx6K1+2SxFvbHDMiE4EpFu:Gt+5syUbcA5fK1+qimm
TLSH
T1D0667CA672B941A4D8B79035C9434603DBB1BC006B30D2CB59547A9A3F733E35BFAB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

translator.pyd

Path C:\Program Files\Calibre2\app\bin\translator.pyd
Size 74KB
SHA256 5cb08c3016f2f9d067ddde858a3bc627b29466313795104f3e95108840aae846
MD5 4d7cee744457df4e62160659d2c89bf5
SHA1 85110d8be186c543b5ff861c5c93fadb0de02f58
SHA512 89d997bb3c3efeaedabc0eb4af8ee1241f1935b16dcbbe95614101ebfef0c1a1bd1764b650b0da499fcbe8068ac5f97de5c8e9795cd98d7ae5f212798e431f04
SSDEEP 768:qqTbSwqy4hh3Qp04qPEXCQXufM097DNXQtczHifcwRDn74MZsB8oChy+X8v65AL9:z4y4gpbyKCQXwVxNgqzH4/sB8oChmvv
TLSH
T137735C369D59602FC61A8CB8C6534D06EF72BC874BD1ABCB67904DE70E26AE51F3D201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winutil.pyd

Path C:\Program Files\Calibre2\app\bin\winutil.pyd
Size 75KB
SHA256 f78af5cd1616e8076a9d65189ddf437060777c7e6a7fa960d5ab9db8b41c29ab
MD5 c7611bae0a3fed36abaefd0c8d37055d
SHA1 983afa22cff37b083b17769c2a5db2d0224c2aa9
SHA512 beeebd81d8bcc6d64426124ab6932bd5d3426d01fef41ac097e3328f4be5eaf574c20febbf6cea6064e6308af40f3495ef826ead6dccbbb1cd9012b5b3f3467d
SSDEEP 1536:ykgZZzrnYY5dZKwy22TecAP9+nun52RO9o2htUzYuSLrEHWsvm7f:8Dno3TY8un52R41A0ucE2QY
TLSH
T10C737D93679404E4EB2AC67CD1B79D23E572F060279296CF4180C52D4F36BE3BA79E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zstd.dll

Path C:\Program Files\Calibre2\app\bin\zstd.dll
Size 651KB
SHA256 86b723a515809850a3e0ca587234ad963755087650db5512dd375d0427d7acdc
MD5 b66ddfc4b7087d5048be2839f2fe6a76
SHA1 90cf6f0017757b27e34e0f8f628c94a119deb444
SHA512 631cbf88a3c816ba2c1998210d71168916092ee33773aaae9e0c9ca9d205b0bbde27e8efcfc3f98177c91b9426eaa4350ddea3ba8cfa1b08136ea4cb50c4c8e8
SSDEEP 12288:UdFgvkkkrBELbqJBPWT/ZKg39+Pedp1FLuOxAtGdifBK:6inGtWT/ZKgtqedp1FqObf
TLSH
T1A8E48D83F29591ECD02BD539C6965323EBB67C4513006AEBC3A0EF652F13AE55B34386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_tweaks.py

Path C:\Program Files\Calibre2\app\resources\default_tweaks.py
Size 33KB
SHA256 9d52a840808742207f689556abcf7c9402e07e50953b5313c92603906453ae99
MD5 71881e627a6434eed9f0f9c96075081b
SHA1 fe9e35a820db1ba066ee79bc6fe49472824862f1
SHA512 4a5a700caf086f91802e4f983677e8a2c62eb9ca63041ae7cd5e0c6e205782d91a7d279bee2888ed0f3c8bbcd1cccc8e5c4c90999cfd1c229d896d0afd0282a6
SSDEEP 768:bZyiLCG/tomg5gSfsLOMtR7TkEMLlyN1yLue:bZfLCGl287TkblyN14
TLSH
T197E2D637B32613320A6502B8504EA6DAB714D07D87712DA978DCC5043743DADA2BFEF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stats.calibre_msgpack

Path C:\Program Files\Calibre2\app\resources\localization\stats.calibre_msgpack
Size 1KB
SHA256 36c6cac46ae19d8a69d8a8916971933665a3f189831d92ac01e23dd6e72bbdae
MD5 3e3319f3dee502e2d5f64fb87680accd
SHA1 b78ed9899ab9e5d5539326634fbeff35032d4d93
SHA512 a1fbfa7f6b55b48cd05c613209eb60d693c573e7d0dafd7e529fd7e130ff305e89a0c0d41c19ec87753680bd94eda9cd59584f8b5ec36d3da62b6999cca3201f
TLSH
T12621D7F9C402B2EFC4741677572522808F6311528F71FB61BF88BB23C0C099EC482A40
MD5 SHA1 SHA512 TLSH

Submit Download

calibre.exe

Path C:\Program Files\Calibre2\calibre.exe
Size 69KB
SHA256 b2c17ebba5c07837755a09d3533e87fcc342d0327d4047f32954642436297659
MD5 1615a0c2a24d09ece36cad8ad1ec05f5
SHA1 b52edda111a0187f51b04ccfab22ab0072c4aca1
SHA512 73ce485f6ef36e2b028a8fc71f4a15d209bf7d76617df52b90025ca71eb6d03ce23d238fff04012707ef0b07d1f305b2e36493e5e9f077656874f8194f2e443f
SSDEEP 768:7C6hB6BWBjufBBBCBBBwoldBTB+BBBGBBBBvBBBB4BBBBBBRBBBBBBB4BBBBBBBJ:e6+J62CmRRs2RGyUYoz5TjSGFv5
TLSH
T1DE6305D372C4681ED8C1967C58EA0B0B58A22DCF08B8967F7B34FD79BB297413505A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E-book viewer 64bit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\E-book viewer 64bit.lnk
Size 1KB
SHA256 a243ec7f88b120192785799b657e54e7f4b836754397172084cd6aa5b2c66890
MD5 8856dcacd8faef5d4332ad761f7e0efb
SHA1 030f1b8f02c0c51d299e724725e0c084ec22bd83
SHA512 1fccb6e678dbe6332cc2ddd284fa384b610f158563da9ed03666b8e2ad7e02e156af6d086729c413dfdf1a3ec16ef2bc13c560e0af9af3da7161aef9e3c5da8c
TLSH
T1D9219B154BE76B56F2F74233BD7163A98B327851F678171D40C883C909781819AA8F97
MD5 SHA1 SHA512 TLSH

Submit Download

E-book viewer 64bit.lnk~RFe5a3133.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\E-book viewer 64bit.lnk~RFe5a3133.TMP
Size 1KB
SHA256 f92fc500ce404bde9550d048fa10e03f7d137781ca11d7e42d38aaba8a5e00e8
MD5 a437efab1bad5a04da4aec3ec534c085
SHA1 c8a1c93a660179865a0de73f4c3b1506aec430e2
SHA512 26245efb90be9bd5a1db945b15f3de4b558d59987a567e51e0ee257ac6080b5f1847bf88382ac0907cc2a4b84d1e6d2d855c962a9e1b7edeaecaed4913ea9455
TLSH
T18111CC190BE72B1AF2F74277BD7153B98B32B811F6B8171D40C883C909781819AA8F97
MD5 SHA1 SHA512 TLSH

Submit Download

Edit E-book 64bit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\Edit E-book 64bit.lnk
Size 1KB
SHA256 f7c4225dac1abfdc26af5c8c208bdebe7ca266b368e88095ed7ce52b841d041f
MD5 0e14a5c90b235b2a95148caac0e09fff
SHA1 5d385eb8d492343cf218a1e7332d1476553180c2
SHA512 63d199f9ac889d981703403f480f50c27d718746bde0c7cec68aafa539b9f9a3d969017af2cda508bd8025229dc0d270178fdf2d1d25128f190f1176e4efa39e
TLSH
T1FC21BD2946E5275AF3B640376D7187A9CB33B811F67C0B1D00C883CD0DB92414A9CF96
MD5 SHA1 SHA512 TLSH

Submit Download

Edit E-book 64bit.lnk~RFe5a3143.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\Edit E-book 64bit.lnk~RFe5a3143.TMP
Size 1KB
SHA256 d96d64ba15f666d3783779b416b599ae7e5a52c0ce02fd2d81df5edfa67192c8
MD5 8f28b618394318f228b4753e188e0f33
SHA1 e15c5706e31a7fadb483527f537b5a9d8f74e67b
SHA512 ec25b2b5a872d6d756016b377cf881ea87b7c09797a8f669c1702fa3e86cb7996be14e00dd37dfd91611d36cf0e5af2739490a9ecfa8200eed57d3fbc1f59d49
TLSH
T12211CC2906E12B0AF3B641376D3147698737B811F67C1B1D00C883CD0DA52124AA8F96
MD5 SHA1 SHA512 TLSH

Submit Download

Get Involved.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\Get Involved.url
Size 152B
SHA256 77f68064e9c414ab6707065f8c0573d20130a0cadcb56eeaecc7c03cc9fda744
MD5 62e25b531c9b3c03ddc14e9b978e96e2
SHA1 90266c23f1765eb594a14ada33532fd7a23cc469
SHA512 3b78dfedda9fc56980c3766061939bfe98fd9aa83b4b7c526827c6612570d36633132cc281e93ad884071c5c017cd02f7f5f14390ec3ed37396a3730457d776f
TLSH
T101C02BFD440D8155E282081790B0FC8CDC4E7C910CEFD74D52C4DF8A0D850B1CC185BA
MD5 SHA1 SHA512 TLSH

Submit Download

User Manual.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\User Manual.url
Size 147B
SHA256 32bb10fcbc544f6d51bbcd38213d69cd0d3a7fe3fc31e41e66c4a9d47bf9dabc
MD5 e921d11bffc96b211bb6abb3cfd6efc2
SHA1 050ece8d055a203bfb876e865673031a4d9c6a77
SHA512 e2e2b0495a8504342d258f5a51c24f884ab11c7736ac5b0845a87618bfaa728878512053179bd85fb7df7daaae03a0c64ce71fd15d76c1f6f124c491733ee673
TLSH
T129C08CA9840D8195E282841680A0BC8CEC4E7DA10CEBC44D1284DE8A0D85095884467A
MD5 SHA1 SHA512 TLSH

Submit Download

calibre 64bit - E-book management.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\calibre 64bit - E-book management.lnk
Size 1KB
SHA256 16b196701c18fbe294566f3a45ea6f88702f63674f248c342fba9e0fa8717c23
MD5 98bb8002083d3f55a8ef79dcef98da7b
SHA1 09cbe19b1b72ff6e573962df299dccd0f4c1bbc3
SHA512 9cc1b7dba3052fccce3aa0df0063b325bdb4f691c9cc528534f46e511b08849cb927bda13aac2bb71749fc36569f295ec9f7cc861a8d52d5153881a55d41746a
TLSH
T12621AB1857F6271AF2B341366C7252A98F73BC03F6B80B1D00C842C90C7A241AA9CF67
MD5 SHA1 SHA512 TLSH

Submit Download

calibre 64bit - E-book management.lnk~RFe5a3123.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\calibre 64bit - E-book management.lnk~RFe5a3123.TMP
Size 1KB
SHA256 df67342925dde0e2c60a15b08f7e457d4a8a5e7e4027ec58e2cf10aa5f4bf1f3
MD5 bf5cb1a610f9d38b417a8cbbe8926a1c
SHA1 78b58eafe6fbca3d07dc22d177702a1cf8fe4d23
SHA512 66686c60a6f73aa1e56735bd04925a5c8203419550bb65a2e4de8c38342e63ffb14b82b926588887f3380d0f5b526bd7d8ce352112598af4387805e66609681f
TLSH
T10B21D01857F1271BF2B342366C7242A98F73BC02F6B40B1D00C442C90C77341AA98F67
MD5 SHA1 SHA512 TLSH

Submit Download

MSI425A.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI425A.tmp
Size 365KB
SHA256 6c2af70e8f5483ac3a8fdf68bb0157efd68cbf3e90b51416ad26198515ccd269
MD5 2edecdbb8762146c36ecc3957bc78a53
SHA1 85c90098b35e7a04a3ee3bc75cb804b5429653a8
SHA512 01b148030a9b36d9bb3ccc53495e2a0375976fe87bde71ee087ed38ce569cba741c8ced12d79862ded60033239d0affa76ebf9d00387f17eab914c360ca840f5
SSDEEP 6144:WX3Mifh2WVlnAsbE5ArxwSOCzX4jQwObE7wmu4YhyxNPdE:+M4cWVxZbyZFQIj/YIG
TLSH
T18F844A31A556703BE6FA0972F428CB706D3DB11823D885AF83D0984E78645E36BB771B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.opf

Path C:\Users\Admin\AppData\Local\Temp\calibre-la40c0us\citxaneu.pc0\9640ohhh\content.opf
Size 3KB
SHA256 9f2905ddc8b11cb7758ee56d83a5f4c76f1b76489f8848e1db6a20961be872c9
MD5 8f3a624670073cf18e6c4b0941ba0555
SHA1 91f96223860e759f7d3cde740f4268f7980dfa7b
SHA512 49f41d0ae969922d929f1e86587595f8e43d57e4411dedd035694a2bd4f92dac876a239d2bc28b102bbf4a622881e66e8c81ad78c14bb06ffc64e3b44ead13d1
TLSH
T192516BD114E316C4D5012E79BEDAD70A2AA656CAC3C24641FCAC88BF7F0374492677E5
MD5 SHA1 SHA512 TLSH

Submit Download

w8yrje1v.epub

Path C:\Users\Admin\AppData\Local\Temp\calibre-la40c0us\w8yrje1v.epub
Size 52KB
SHA256 563cd413e86a1ff1d4d3aa34cc85d4bb6378978ada64b2bdb8d00b8ccaf1d9e4
MD5 f94be7b1a7564f1e2c9940df5ebc0bed
SHA1 f08cfaa4408de3125ef70be90ce1f121893b8678
SHA512 dc707602f6aa4d94b87a1248bb0ae55e4b73af560b8ea4e7bd5f9a7a13b9dc62bf9ca81cfc5fac3f89f66cc1b92438e501dd40d8f158ce80108c7880e647d1da
SSDEEP 768:Up5dA+lWkFuAz2fW1QT20rDIlrq5Uy7IACWR8ZNIeB83e7nEpsvNzl:UvGkWkFL6fW1a/MqeYRGNFqe7nEKvNJ
TLSH
T17F33F1F405968EDEEB1F5C760E65B7CABF00F4129225F297AD18C9EA1D3C4E24162F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.opf

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-59rp3m5f\content.opf
Size 3KB
SHA256 c562b893efdb364e80ee0cea4cc389f9913614d6f1955696363e43ade3e155d0
MD5 53de3cef4ba5a207a20ad05e3f33d929
SHA1 010636a974f8faf3f764606c6c2a207b2c74e26d
SHA512 1bc6b6a2aeafe55693c2ab99ad9842663ba4467cf8b2f89eae0f81156634a701b7a93d7f194e57708cdd609eb4b6e8eed7026f57401706bb5340ffc88ef0b386
TLSH
T15B516AD114E316C4D9012E79BEDAD30A29A2568AC3C24641FCAC98BF7F0374492677E5
MD5 SHA1 SHA512 TLSH

Submit Download

mimetype

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-59rp3m5f\mimetype
Size 20B
SHA256 e468e350d1143eb648f60c7b0bd6031101ec0544a361ca74ecef256ac901f48b
MD5 4154e1f4f9c0e002cc44aae97103ebe2
SHA1 8cae3584d360f721c4dd0ca38a4f2d8b36da74c7
SHA512 f6f5ae4728dbf0f0f6b5548440f2c4fd3365e0437471102f55113bbd25f0e26cbc450981cdc5c89e947535ccbfb72f4c1ece9758f9c88c612b8cde8fd3553155
MD5 SHA1 SHA512

Submit Download

stylesheet.css

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-59rp3m5f\styles\stylesheet.css
Size 661B
SHA256 8cbc529f6c17117f6ad68ad1dc10fe853dccd1e27605e6f52117bbcf0d3ed96e
MD5 f9af52ebfa7caaa7896ab074a1bbfbf0
SHA1 bd9a02d5e9e7f98cc6cbecbbcd1e71f3c4b86a30
SHA512 0ad103bf9815ecbf3b2811b4d20ace118ec2ad65dca1184b5f02fbc4bf8828db813f12c7dbc3f8dd3fe22be2b2516d9690588dafa2f0fbb98487afb654f5efbb
TLSH
T1590199CD1EB60E05C1BBC43010D4A83933EDC8C9898BDC266AF62524EE4A30E2A9315E
MD5 SHA1 SHA512 TLSH

Submit Download

container.xml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\META-INF\container.xml
Size 252B
SHA256 2aee8bd24c6478bd8e8c6560e130321b65089d13de68d564d833f89da3390a6e
MD5 c8619c89766fee79caf77c2a20495094
SHA1 19b22574592180c17168790328de97b191805927
SHA512 5f90bbb28c4e817d9174f56df7b486664e64e9ed2891224e92bf8c5aaf4799fe23fd191308c52e09b6f324fe3819ed44818fa8eeda810728f422a98ea1ce3472
TLSH
T169D0A7A28FA592E2B943584E675CC8042FA5E16B514A764830CCD57E578922AC2924D8
MD5 SHA1 SHA512 TLSH

Submit Download

cover.jpg

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\images\cover.jpg
Size 37KB
SHA256 6b80cc5bbc832fc1946e23fb5e0549a3037508f8b8e2f6b304385b0ada12053d
MD5 95738ad490055366d87a7ec99e8d60ad
SHA1 8280a2af43e67efa6a42757beddc97d883e73eef
SHA512 37edc2bb8b3281bcd6d9bbe0fe01f0f9b309ccc037a8cae96c87262a13aff58f9f03ccb7df62c3915d9f7c4abbbc89507f43d2cf9dc1ecfff03c321aaeead191
SSDEEP 768:LopVSOFM66i4fCWElmlHppS+dcR8LYOaEa1WlQVvi/x:LobSOG6Z4nEAlDSOmQYKKVvi/x
TLSH
T1AC034803DD0EAE936559D3E8BF071CAC7B5A138C9C863AFD00A11ECB2F595164C9A06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

common_tasks.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\common_tasks.xhtml
Size 863B
SHA256 fd1a608f60d8f5e738648a5b1d5d543bff043a7773823f7a0159506ec28e6f53
MD5 dadbe58d13e328682ff1a5ec2334edcf
SHA1 aad56da18d25c2e641503326cf7c57c6ea0b3f5d
SHA512 de23b04adcb4e36c610615f050e8daa1ff8d75d2ce94021777fd4f6d06065208d92c49a27b9cfd09b9d0fa03f7ef0c848c9e457b1a53e61faf8812bc7be66e14
TLSH
T19411AB0F58C6000FD3612B589DCCB36E2A93B643C75C4C82B224BD3E9E9A64486970AF
MD5 SHA1 SHA512 TLSH

Submit Download

installing_calibre.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\installing_calibre.xhtml
Size 1KB
SHA256 8e239e468c40555b76ba382b94a8876131a671482df2226f43db4fa453db9558
MD5 e2a36bdb864764e711dcb0968e02724d
SHA1 466c5ca1e7a15137d25c0438958a9bad6d518689
SHA512 57d2b4f65f129af6ca079ef10dc582a4df75b9da9986897f2ac2090d0c09300a40e201cba88ea7f6571e46cc1bda112a91f18a24452044c525b05c6a91f58b86
TLSH
T1FE41439F924503713FE30132B4DF36DECF16614D435BA54240698125C72BAB653A79EE
MD5 SHA1 SHA512 TLSH

Submit Download

internal_titlepage.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\internal_titlepage.xhtml
Size 670B
SHA256 2f148e0e93734b7cb20b5678aea1da9bc4fa2f44d3ac5209795749281d0efd43
MD5 1115e5287cdf6b23a8178f70930c6bfb
SHA1 18e271e0f28160348adbfa908fbf1e7a747654a3
SHA512 2e130125b1d19c5aee99df8eb8d63a3a149df879b7c836631611c59f5a5ef095b6766e9c6572e3f9797fb578e623b14947dd45ee33aa659a37ed2570a4a674dd
TLSH
T1D401DD1D98CA1433FED359B2EC90771BE080F0C5816D048DF8F590A7C2FB8408B8B285
MD5 SHA1 SHA512 TLSH

Submit Download

introduction.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\introduction.xhtml
Size 2KB
SHA256 2e66f886af5d2cd5c6372358718a64cff13e304d44e5192cef402eeeb9da075f
MD5 e03b42841efe57d615860957e320bd9c
SHA1 64cf5353d94087f3f01aa705fda62ede13095734
SHA512 8f6ab9cf67ce6364e8ebb8b34de8e6899b43063ce2c004e309304fa12827b00f7020d8d5532fe47007ba97fc70bff451d6b3d65fca8d3b8919a0e24d0e0497d5
TLSH
T1E94166DBF35C2324BBB1015165CA5B9E5B15649283A409C354F0C17F636B6E092FBB9C
MD5 SHA1 SHA512 TLSH

Submit Download

task_1_organizing.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\task_1_organizing.xhtml
Size 3KB
SHA256 76e3704e8dc04b712717956974ac14abb44e9655cd43fbd9d866e9ee955bb0e4
MD5 eec73b7a4e5764d0974a738fbe17a51a
SHA1 20eb56c11555d7edd215370c651f1b7eb22dadaf
SHA512 fa2e06fefe22c34ba5083d022e934cf46d2e8074c632c13bf43f6a589bb2668944cebca0f4f5744649ec9c4d2aef66eda1fd220c38b809ca2d5ea7af2f078698
TLSH
T17861539BF144033726F21031A1CFA2DADF01F0DE87F6515718A891742237E71A2BA4DE
MD5 SHA1 SHA512 TLSH

Submit Download

task_2_conversion.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\task_2_conversion.xhtml
Size 12KB
SHA256 cb1df722ce16814ab3bbe198b8a04cd084a2cc1cffdc976fc4a77eabada143e8
MD5 7f9ca9428a98258792d1ecc259189c9e
SHA1 2f47212351900b672bf155388736887f66e58a38
SHA512 5d3aece062f2893bcc895d5cf64c9388642fe4c28a31ffdce11f2d4e35c7425c72f879ef7cbfff2e1684e33c08b6e7b4469fe60cd5d835d0ddb7790242a8ca55
SSDEEP 384:z10YNhlKXlG9adh7RReEThTdVs6HIT7CYPphhS+RKt3/UZ00mJoUETd:bNOY9aj7RRLThTdVs6HITuYPpnNs3/8/
TLSH
T17F42751EE30823B7069201A1F6CE77DBAF16807953B556A32058C0682379E65D2F77FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

task_3_the_ebook_editor.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\task_3_the_ebook_editor.xhtml
Size 1KB
SHA256 aaa175c97c2b17ffefea93ab5f6448b5c282b6dcd354d94fcf93822067a697dc
MD5 d899688b4e5478db5dccf12b3b337deb
SHA1 31b67fe0b8fc2207f94c75c2cb0056209a0178f7
SHA512 96b6fe26fe724d3c3d05cdcb57e10a2bffc48cd240d07e352bb09e7745eb6489a55cda24aa8bc47a2f329e86bd61ff8e0f5ee6c6f350ffe3dcf22473220e2a7b
TLSH
T1A721231FD349130757611523E8CD7B198E95BC8FE28849C25598C02E77AB144AEFF93D
MD5 SHA1 SHA512 TLSH

Submit Download

task_4_downloading_news.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\task_4_downloading_news.xhtml
Size 2KB
SHA256 cd614a7d0d851bdc46b6d04e8f919f08a65dd10338bc7fdad0f8d80ccb47a415
MD5 58bf38b5394fb1bca1c774660ff53ddb
SHA1 34dc24d2317c85ef6f8d90d0e1e67d2c62f0ff24
SHA512 3bfea81638663163e2590200dd36be6ceb4eba1d2ce41a7e603df0e8ddd3ba618383106887a1cbb2d04e1ac9fd980a066fa41ba3a55928db3f7c03200a09ecbf
TLSH
T14351352F220943B826613131E88EBEDB5A25A12A5373545649E4C4BDF27CD50D3F71EB
MD5 SHA1 SHA512 TLSH

Submit Download

task_5_interacting_with_ebook_readers.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\task_5_interacting_with_ebook_readers.xhtml
Size 3KB
SHA256 9299b74fb7ae6628ead6a904fdf5c4bc2194884161cd5652e62cd3b191673c27
MD5 297028a3c85a38e44ef2fd6e0b597a6e
SHA1 ab6c922cfd4d7c23de1a8dcf1c8a28a4a8261b6e
SHA512 06e374959dacdc9eb75d49a61a90e42b98e3c13a331598fbb7801a313becbff05953f32072c1d1b925b2f4fd131ddd0276543ce5240e5324747a96232b677975
TLSH
T12B71545FA108233A27E30023F9CD5EDBAF66946943E804931458C13C51BDAE9C2F76DD
MD5 SHA1 SHA512 TLSH

Submit Download

task_6_the_ebook_viewer.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\task_6_the_ebook_viewer.xhtml
Size 736B
SHA256 5291ed1ba135194fc0cfcfbc23a4bedbf07b3ff296cd91063937b7f6325d64d2
MD5 e40f0d735f35411d248dac28d197deef
SHA1 12b38ccf11e1682218f215d6f699eda6450026f8
SHA512 3d8531375a2e822372ce54d1c1dd32a41926b6e840ed0912975f521eff86104f44d6bf1f495c7aa328d022cb0c80f8b9f17c6892f38e7b00638322c8ebe9c8f7
TLSH
T17A01D08EE2B4132D7BA00072D4CEAA5A9D81F404C9E841838158D135414C99492EB9CA
MD5 SHA1 SHA512 TLSH

Submit Download

the_main_gui_window.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\the_main_gui_window.xhtml
Size 2KB
SHA256 90f26ba5d1f48f20394c0000f1ba664e52581791c47b4a69d3b27c4002a3b443
MD5 9bf6d1ba8cd5a4f874e2e882c756b26c
SHA1 1e31c639c9abf92bf60dfafbe9bc23ea583b2aeb
SHA512 ae727df6befbd315ae9d16510b51ccf93b3ee4112a4c7c2fc975a3e8f290bb7d97cd33bc9e129dc86ae90a14b34da63b441acb4410e2a6bf5a71431ff454970d
TLSH
T196512699F248333382B10123524DB7D3D70550EA93F656527C64C42853EAD7396FB5ED
MD5 SHA1 SHA512 TLSH

Submit Download

titlepage.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\titlepage.xhtml
Size 546B
SHA256 240945e35bd8712ab7c08f973d4d367eea6e8fdc587bcc2f8136273f897d1a4a
MD5 f6ec6c0a07e57579ddf1671b3f10074c
SHA1 19000f172e8dd8dad3d26e9e5f6517811b516619
SHA512 45e94fbb6ca07f7b1267373158c6d154b10b1bbee53883677ab6002c8996afc488fd58757feafcebf6c3a29fca7b624aa699e087593974e4718190fe07dbc666
TLSH
T17BF0C90909F31388D472C1E019F4128D56A8818B13698849BB9C3652DF083818C631C3
MD5 SHA1 SHA512 TLSH

Submit Download

toc.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\toc.xhtml
Size 2KB
SHA256 782701928c13d00e7dae25c575f487c982d62e7f3839fafd15db3b1d230e1685
MD5 ec9cf98ec9eeecb84a883613aee31bcf
SHA1 7b3b5896c7675a5a8a7a34a4374633bb9ba6e745
SHA512 31c3f0f92285b867615ce094c34389672f48399c3c67c33f2a4ada62c79a41e6b8506232b7288e52dac1b5d63ec22b6656db01dbd04447b425a9ad585511ba5f
TLSH
T14E416B8223C6511FB3212B1C8DDEB3652F736143D6482D82B61C8CBEAF953454AA738F
MD5 SHA1 SHA512 TLSH

Submit Download

where_to_get_help.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\text\where_to_get_help.xhtml
Size 1KB
SHA256 5a6a0e56586b0c97422a28598d762ef2e308eeedd2fcc66b6bdb31b973628d78
MD5 2f3b6669a49f8f89b807198f0feb75a4
SHA1 49fd1c52ac4151d6300139e9f3e28569cd224cdc
SHA512 dac5e1411795367cee72e4af420fa327d6231eb41dd32df0cd73efb48a04c50423bd8b9c303d702ff1d5e5dcaf33788250901068b524c9ef4448e543bf8bb10e
TLSH
T12B41848BD18823B95F7207A0654CB3F9FB2FF2AD23A8609610A85000665A5FC527F0E9
MD5 SHA1 SHA512 TLSH

Submit Download

toc.ncx

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c0-jnuirxee\toc.ncx
Size 5KB
SHA256 8846b39ebf09e9d05fe2ef1f831a8d5a15116b085e5006c073aa4fe601568e6a
MD5 8fd9e1a4273c514865dade66f87829f8
SHA1 302de1c91f0c0cbfc88af9f7fdc2bc294eabf15a
SHA512 5f684e30000cee2b1f3801dfd166a876ed7cfe8458d010b0e87e0a97a850ba1a16860d1e4a89211d1fa4eb9e240285b8fcfd0d1121bc8d2f7ebedd594039275f
SSDEEP 96:CbDgBimHFT7EgNtsKOfVTFT2P/Y6YLDXGSCSj:CUiT9TB2o4s
TLSH
T18BC116AF31F54009E398962C53FAB7836EA05243D1C0E05C33DDA65C0FA7D4A98A7F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installing_calibre.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\installing_calibre.xhtml
Size 2KB
SHA256 c4b0ca659fbc84664147be9f1c421db3240a0164b2af4f2e45422134e18e9b63
MD5 02e95fb217ff534cb9c4a673d1785a81
SHA1 3dde0416560072ab7273dbdd974c6d73c27448b7
SHA512 70f5b6eb8579ca36cef9e48ac83d83f523c3da30cf3c702d3aad21a9b9f3646d3af293a24550dfe10c9a865d57788996881e8075489b20e4e566ca38f6aa8e50
TLSH
T17F41325F920503363FF30BA1B09F26DADF2D214A13DB7512442AC21543377B953579B9
MD5 SHA1 SHA512 TLSH

Submit Download

internal_titlepage.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\internal_titlepage.xhtml
Size 996B
SHA256 dcec451dc31ea7fbf53ec1de6abd089ccbd61c27473bff08c64ec1a086a563f2
MD5 8b39b300022b14a41fc2c7ca785a7094
SHA1 5195f00ad2096e9bd4ac24ec29ea4d6c81c2d771
SHA512 ccdba9f2f7f1f24ea0fbe92212148f9e0fb63b4d9d1e66b8b5e8435ddc87856875016c5ee11b6c7d48d7dc0daa70ea36b9e7a8a9ac3094477edcbd5beab31a7c
TLSH
T1BF11031A996A557B3AA72FC1D41F5A46F8EC238173CC29248C73CF5B026A338814A170
MD5 SHA1 SHA512 TLSH

Submit Download

introduction.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\introduction.xhtml
Size 2KB
SHA256 21c3660397e22da08016676d1d3b49d4453072465fbad7bf9c4963b956df1300
MD5 894df83d580311a5f4c4df8dec770440
SHA1 8cd4b0669f4d891bd39f2624ef520137a5599bdc
SHA512 e6300b52c9a2669153d6b4644f7dee7d7ecba1d93284350185b6a125d926f3092075154ddcea15d31a2f31e4eb033563dcc768c4ca2165df07782dc5f9d8e40b
TLSH
T12D51025BE729227A367717D0514F49895D9C319263D828924831CB7B133D3B491AF7BC
MD5 SHA1 SHA512 TLSH

Submit Download

task_1_organizing.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\task_1_organizing.xhtml
Size 3KB
SHA256 63537384fe02f473b8b0bc903a8f7e7c1f32ebe78051234e7da0f54af0b0867b
MD5 768ee4d1ba31581d00104d1320b49789
SHA1 835841ab1c666539e71abd2d71c114bab4a54933
SHA512 90ac7e1fea04c23b362af54b42b445d82821cf2d8869e312a1d989e9d1cde4c26f779119b3c069c64dfcbc74cddb4e6979db39ab8ddf6be55bba408587ade0cf
TLSH
T1E571965BF104133726B31571918FA2C6EF45B0EE87FA25131CB986752232B70A27A4F9
MD5 SHA1 SHA512 TLSH

Submit Download

task_2_conversion.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\task_2_conversion.xhtml
Size 13KB
SHA256 daca94b20b8b438a460fd7062a3007cd7d644a2ea35b30d1c085c1154a445de8
MD5 fdb771e1dbc6fbdefb281856d8e04d2f
SHA1 88ff0c28ff8e9eb803ff11044c10873d7bedcb65
SHA512 d6ef164e4cc3c73be229747b4e6d5b8e171d0092d201e35be7789b3c6bea7363b0b042afa9386aeb611e8489ac363878848c06c877a65b454933aef751939707
SSDEEP 384:fc0/NhslG9a8W7RR42TeTdVshHIH7KmPpjhOYLZtCrUb05ohaUET5:PNB9aJ7RR/TeTdVshHIHGmPptTvCrc0b
TLSH
T19D52621FA3042377066302A1B28F378BAF5D50B923E965631469C6691338A74D2FB7F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

task_3_the_ebook_editor.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\task_3_the_ebook_editor.xhtml
Size 1KB
SHA256 b0722fc4f9f6b31387ca97dd60a41e00382c17fe92023e3c6869da7ed8acf993
MD5 56170f0fc8b29812732c0b92b3abd4de
SHA1 8903c93b71551a2d1447b7ae394f04d21ce91d91
SHA512 8299f14edbd07df2c89340576950d9ebfa2259d5371849e37212bf774cfae4e16cff739c014c782e6d66b0dadeda7b871928b9bb2d59c47b915889bcd9abc154
TLSH
T17E31CD2A9B75257B262B2B92D04F1905ADEC389B73C828404976CF2B133D374E27F578
MD5 SHA1 SHA512 TLSH

Submit Download

task_4_downloading_news.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\task_4_downloading_news.xhtml
Size 2KB
SHA256 1eba53795e291b11974c5ce238a4ab8afb4665afd301c52cbaa20dda4bb370ad
MD5 54ded214a0c932a7c0cb58575ad2e95d
SHA1 0e3d698c8f263e6fb5cd7ab5eb5c867427b67d19
SHA512 7d003dfb435ebb0d0bafa1d428886baec444287edda31006153ba8c475eb0e72a42827b66f80d8ab55e4c567fd1f8d22ccb82bbf377b68649115c6b3630236f0
TLSH
T1E651662F220443B936733561E44F6AC75E2D616E23E2641649B0C96E727CA60D3FB1FB
MD5 SHA1 SHA512 TLSH

Submit Download

task_5_interacting_with_ebook_readers.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\task_5_interacting_with_ebook_readers.xhtml
Size 3KB
SHA256 efab9f9fd2b6416c322d9a6fe350197bf8f6ceb2e920d9f312ccaa751175c39b
MD5 2aea9d27610968000c3f4b88ecc13886
SHA1 f68f4fe3c39fc5766c2e5ed70911ea75daab57df
SHA512 a58b4517aa8c879c2492bfa1ad699c7e78da9e2febe87949150c7fb8bbb36fc3f7259615e40936c4b511eaa27f944d601164f385960e71fc9e71172bd13d00ab
TLSH
T1DA81761F9104233A37E71523E48E5DD7AEAD50AD03E81862086AC63D117C6B9C2FB6F9
MD5 SHA1 SHA512 TLSH

Submit Download

task_6_the_ebook_viewer.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\task_6_the_ebook_viewer.xhtml
Size 868B
SHA256 93f6c2de703a966032d2fac73945275f3c4cd0912843745044b845320f29b56e
MD5 3d6cecc40c58f14dc34397492f7c3307
SHA1 7fcb1b1c0778fa4667386719c135753140d9ca2b
SHA512 0cbcc6272ac0cd71d7f94b243694deb4dedf9d7760a3790eeaf08ae5d24de6b0f57a4d8c6b7a567479412091efa19ef20c2ffe74706da532350a42f40886785a
TLSH
T170110C0FD2B0127A3B730BA1C0CF8953ACEC704193C875038026C766022CBB8929A9FA
MD5 SHA1 SHA512 TLSH

Submit Download

the_main_gui_window.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\the_main_gui_window.xhtml
Size 3KB
SHA256 890b562db8ab2cee1c453e184513132fa00089a30b35a563e445718b8c45a1be
MD5 5e64eb37cff63988564736e868eb079a
SHA1 735ce88ae3cbb12fd928d6bbcf9d37bff19b6d14
SHA512 74349c6d68664143aac65b5fbabd29ad0ce784b82de8fe78fdcba840b1b228e8fc48658948e0f4581f3b4ba556a997e11d1299ca7e35931932607bdc9695d9b5
TLSH
T10951575AE248333352771263510F6BD3EB8C20E963E525512C36CA29137A972D2FB5FC
MD5 SHA1 SHA512 TLSH

Submit Download

titlepage.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\titlepage.xhtml
Size 694B
SHA256 43c7ba12caf624be32f7fa516a13bffc85e66ed81025c625ca33609a0b5e78b8
MD5 859fad911fdad1caad2c1a6dfbfba886
SHA1 85f0b1481e4f3405cdedf93b7f2ff8d69fe8c04f
SHA512 bda060d122bf4a7a9ea4697bc84b61b5d7ed2e950e8a80dbd2be5832f0274d4f3a7c22ed323342ded89c1ac6a6cc701e9d1eae6e7ad5a4e926683c19a8046aae
TLSH
T1E801990F5DA442AA8C77DFE018FA85CD56BD7245A3DA0852FFADBAD7830839454114E2
MD5 SHA1 SHA512 TLSH

Submit Download

where_to_get_help.xhtml

Path C:\Users\Admin\AppData\Local\calibre-cache\ev2\t\c2-4xum769h\text\where_to_get_help.xhtml
Size 2KB
SHA256 b857abad97d7766983b5b1932b2d15c68b423c49172723fda33a581812b15862
MD5 586490fa377acd2b183fe894b861a29d
SHA1 ae594a7b4f3df01010ffb120765cdda0d871265e
SHA512 ebda05de0beb484fb0831c8d37b0298ed70ff600f99287ca8520594a5dfa3a77a22b62f83bfbc08342f64b2ec434587be00b6d73b0d0d378ed117a73d307e759
TLSH
T18341D20BC10823BA6A371BE0901E9695BF7EB3A933DC70624879C75523157BC922B1F4
MD5 SHA1 SHA512 TLSH

Submit Download

b0e44a26-3192-4cb2-8e44-1d8d24e5f308.tmp

Path C:\Users\Admin\AppData\Local\calibre-cache\qwe\viewer-lookup\sp\b0e44a26-3192-4cb2-8e44-1d8d24e5f308.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

global-atomic-k22ar9ey

Path C:\Users\Admin\AppData\Roaming\calibre\global-atomic-k22ar9ey
Size 1KB
SHA256 79a56b489a7e61874e5aed42ac49f381ebe46b4b95e1e9e8cb66d8700b64a3d7
MD5 5817f4d49385a5d1840b5c61e151e5bb
SHA1 e4b3bad5f07fe028d6fbc503fbcdd0487ee559fc
SHA512 09fdf2dd6c97b2584b382094418eb31fa26ce3a3f828afdb25bfdd159b048f455a6b87b98c45bd559c2d1bb8a8963d4ba3832aeebed3cae724f88132d9b0596e
TLSH
T13421A624D820CDA296E9236D58BD8A4767500CA70A403D49B3C7C41C1F0EE7F32B39AD
MD5 SHA1 SHA512 TLSH

Submit Download

global-atomic-yv5lj9gl

Path C:\Users\Admin\AppData\Roaming\calibre\global-atomic-yv5lj9gl
Size 1KB
SHA256 c69dd093a40208e7038e125c9e2d15203e73e9aaaf16fcda354109ba100cf6c5
MD5 98ebd3cd6194662dc478378d5a43212e
SHA1 ce8eda93606471681e85c9faa8c6d1a06d62d307
SHA512 85879e945d116d55576fe84f4c7c150daa62026387187d24703ae99f5e40625a22850cfc3f401d4f3966a17769d55d2d5f268dbcc7d2b947010d42005ea53d83
TLSH
T19A118924D820CDA297E913AD58BD864367504CA70A403D49B7D7C41C1F4EE7F32B36AD
MD5 SHA1 SHA512 TLSH

Submit Download

gui-atomic-uqcb0093

Path C:\Users\Admin\AppData\Roaming\calibre\gui-atomic-uqcb0093
Size 373B
SHA256 7038808f75c9f1fff9d9a8f3690e25a0f89977914878847a3cc34c374486003d
MD5 f1c0ec080f2d2c1aba616449ac501d64
SHA1 47d03a4175c9bf81ecf05acc3988d832e08fa5a3
SHA512 ceee70295292edc8730dcef8f2ba66e020fa48f1bd996775ca64771880dac795dfeb4075144663af1c29aa56c129b4cc591b4ed36c2e2c1afa4efb7d6bfd6125
TLSH
T16AE07D11E174883734F204268C7DD7A6417CAC43FD913D90F14EA68C8F0E51DA03F1A1
MD5 SHA1 SHA512 TLSH

Submit Download

viewer-webengine.json

Path C:\Users\Admin\AppData\Roaming\calibre\viewer-webengine.json
Size 279B
SHA256 7975f02b6b48adf3f822410db1885f0afc95a377363ad662afa5f61a603e65d8
MD5 52e3590a10a0886fd7c5599425cc3e99
SHA1 5743f2fd9fde9cc7acf7312b7b8c94b47369a489
SHA512 fba345c22c700aece50776000b72ec87447612541f7ce5fb333ad8dff343dd2780ae7e4d7894d44f71075a0f9e9c0f21c27995e45fce8e40ac0f34dd7a7d4a24
TLSH
T1E8D02E00D83C8D340C9A243FA87DA5425820E01348301C2C382FC18D2B2C7BB30EBAF3
MD5 SHA1 SHA512 TLSH

Submit Download

MSI84F.tmp

Path C:\Windows\Installer\MSI84F.tmp
Size 413KB
SHA256 54febbd1f0a3875df16a4b88621cc0a10729b3c94b9a68639aab27d36fe39381
MD5 ee729e752fa4e2e8b7755a138a188463
SHA1 b0048f505d180d10feb1afa01cc4d3f5f15cf2a2
SHA512 41a90d86894fbb1386099a6cccab416d88e76a4cadf83a90f8f91cf196a0feea2a4ab91daa6828303d8706cf9141ca1249425dac1df13d5d9ebd8958db909ba8
SSDEEP 6144:0JqjGNa7YhzTvsGgFZFKjTMsAgzeF35cYr8XjuoY4zxR:SqjGaYh3UGgFjKgZF35VijuoYg
TLSH
T1E6946B29B3E418EDE4B682B6C5A78034FF75744D332095AF87A4952D1F3BAA430BB705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/476-1684-0x00007FFA592B0000-0x00007FFA598E8000-memory.dmp

Download

memory/1184-1493-0x00007FFA5CB90000-0x00007FFA5CDCB000-memory.dmp

Download

memory/1184-1500-0x00007FFA5AAA0000-0x00007FFA5AC93000-memory.dmp

Download

memory/3044-1698-0x0000019A50730000-0x0000019A50740000-memory.dmp

Download

memory/3044-1706-0x0000019A507B0000-0x0000019A507C0000-memory.dmp

Download

memory/3044-1704-0x0000019A50750000-0x0000019A50760000-memory.dmp

Download

memory/3044-1708-0x0000019A507D0000-0x0000019A507E0000-memory.dmp

Download

memory/3044-1643-0x00007FFA5AAA0000-0x00007FFA5AC93000-memory.dmp

Download

memory/3044-1966-0x0000019A50BE0000-0x0000019A50BF0000-memory.dmp

Download

memory/3044-1967-0x0000019A50BF0000-0x0000019A50C00000-memory.dmp

Download

memory/3044-1642-0x00007FFA5CB90000-0x00007FFA5CDCB000-memory.dmp

Download

memory/3044-1969-0x0000019A50C10000-0x0000019A50C20000-memory.dmp

Download

memory/3044-1968-0x0000019A50C00000-0x0000019A50C10000-memory.dmp

Download

memory/3044-1718-0x0000019A507F0000-0x0000019A50800000-memory.dmp

Download

memory/4508-1686-0x00007FFA592B0000-0x00007FFA598E8000-memory.dmp

Download

memory/4592-1679-0x00007FFA4A520000-0x00007FFA4B520000-memory.dmp

Download

memory/6580-1697-0x0000014C12750000-0x0000014C12760000-memory.dmp

Download

memory/6580-1693-0x0000014C126D0000-0x0000014C126E0000-memory.dmp

Download

memory/6580-1647-0x00007FFA5CB90000-0x00007FFA5CDCB000-memory.dmp

Download

memory/6580-1702-0x0000014C12780000-0x0000014C12790000-memory.dmp

Download

memory/6580-1692-0x0000014C126C0000-0x0000014C126D0000-memory.dmp

Download

memory/6580-1700-0x0000014C12760000-0x0000014C12770000-memory.dmp

Download

memory/6580-1701-0x0000014C12770000-0x0000014C12780000-memory.dmp

Download

memory/6580-1694-0x0000014C126E0000-0x0000014C126F0000-memory.dmp

Download

memory/6580-1648-0x00007FFA5AAA0000-0x00007FFA5AC93000-memory.dmp

Download

memory/6580-1972-0x0000014C12960000-0x0000014C12970000-memory.dmp

Download

memory/6580-1971-0x0000014C12950000-0x0000014C12960000-memory.dmp

Download

memory/6580-1970-0x0000014C12930000-0x0000014C12940000-memory.dmp

Download

memory/6580-1695-0x0000014C126F0000-0x0000014C12700000-memory.dmp

Download

memory/6580-1696-0x0000014C12740000-0x0000014C12750000-memory.dmp

Download

memory/7096-1680-0x00007FFA592B0000-0x00007FFA598E8000-memory.dmp

Download