hxxps://cdn[.]discordapp[.]com/attachments/1512190408719994880/1520284146977603605/Matcha_External[.]exe?ex=6a40a272&is=6a3f50f2&hm=ad1522b39fe857601942308f241ad64dcfd9d4d7aecdf614a199c467d518caa4&

Analysis

user interaction
yes
max time kernel
690s
max time network
689s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1512190408719994880/1520284146977603605/Matcha_External.exe?ex=6a40a272&is=6a3f50f2&hm=ad1522b39fe857601942308f241ad64dcfd9d4d7aecdf614a199c467d518caa4&
Sample260627-e7e91sht9n

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
22	1508	msedge.exe

Executes dropped EXE 57 IoCs

pid	Process
5248	Matcha External.exe
5340	Matcha External.exe
5360	Startup_Apps.exe
5392	Startup_Apps.exe
5616	Matcha External.exe
5668	Startup_Apps.exe
3848	Matcha External.exe
1236	Startup_Apps.exe
4224	Matcha External.exe
5872	Startup_Apps.exe
3280	Matcha External.exe
556	Startup_Apps.exe
5972	Matcha External.exe
5960	Startup_Apps.exe
4216	Matcha External.exe
5888	Startup_Apps.exe
5020	Matcha External.exe
5224	Startup_Apps.exe
5256	Matcha External.exe
5336	Startup_Apps.exe
5640	Matcha External.exe
3012	Startup_Apps.exe
1556	Matcha External.exe
5528	Startup_Apps.exe
1216	Matcha External.exe
5052	Startup_Apps.exe
6096	Matcha External.exe
2636	Startup_Apps.exe
4736	Matcha External.exe
1172	Startup_Apps.exe
3952	Matcha External.exe
4708	Startup_Apps.exe
3492	Matcha External.exe
3344	Startup_Apps.exe
5732	Matcha External.exe
5796	Startup_Apps.exe
1860	Matcha External.exe
4360	Startup_Apps.exe
5936	Matcha External.exe
4992	Startup_Apps.exe
4172	Matcha External.exe
5908	Startup_Apps.exe
1108	Matcha External.exe
5084	Startup_Apps.exe
5996	Matcha External.exe
6048	Startup_Apps.exe
6084	Matcha External.exe
5220	Startup_Apps.exe
560	Matcha External.exe
2808	Startup_Apps.exe
676	Matcha External.exe
5144	Startup_Apps.exe
5496	Matcha External.exe
5352	Startup_Apps.exe
2176	Matcha External.exe
3148	Startup_Apps.exe
3936	Matcha External.exe

Loads dropped DLL 1 IoCs

pid	Process
3392	x64dbg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
343	raw.githubusercontent.com
330	camo.githubusercontent.com
337	camo.githubusercontent.com
338	camo.githubusercontent.com
339	camo.githubusercontent.com
340	camo.githubusercontent.com
341	camo.githubusercontent.com
342	camo.githubusercontent.com

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/408-1505-0x00007FF6D2310000-0x00007FF6D3160000-memory.dmp	ConfuserEx

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	193	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a121c1ebff31b26a	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1508	msedge.exe
436	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Checks processor information in registry 2 TTPs 60 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Startup_Apps.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Startup_Apps.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270084930009975"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell	die.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	die.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	x64dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell\SniffedFolderType = "Generic"	die.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	die.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	x64dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000020000000300000000000000ffffffff	die.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	die.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	die.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	die.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	die.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	die.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	die.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	x64dbg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{4A2CE678-82E1-42A2-89F6-1CC10FF21C0E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	x64dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\3\0	die.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	x64dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	die.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	die.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	x64dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202020202020202	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000020000000300000000000000ffffffff	x64dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	x64dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\3	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	die.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	die.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
3392	x64dbg.exe
408	die.exe
1228	x64dbg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3616	chrome.exe
3616	chrome.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3392	x64dbg.exe
408	die.exe
1228	x64dbg.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
3392	x64dbg.exe
408	die.exe
408	die.exe
408	die.exe
408	die.exe
1228	x64dbg.exe
1228	x64dbg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2780	1448	msedge.exe	85
PID 1448 wrote to memory of 1508	1448	msedge.exe	86
PID 1448 wrote to memory of 4316	1448	msedge.exe	87
PID 1448 wrote to memory of 4316	1448	msedge.exe	87
PID 1448 wrote to memory of 4316	1448	msedge.exe	87
PID 1448 wrote to memory of 1172	1448	msedge.exe	88
PID 1448 wrote to memory of 1172	1448	msedge.exe	88
PID 1448 wrote to memory of 1632	1448	msedge.exe	90
PID 1448 wrote to memory of 1632	1448	msedge.exe	90
PID 1448 wrote to memory of 1632	1448	msedge.exe	90
PID 1448 wrote to memory of 1584	1448	msedge.exe	91
PID 1448 wrote to memory of 1584	1448	msedge.exe	91
PID 1448 wrote to memory of 1584	1448	msedge.exe	91
PID 1448 wrote to memory of 2084	1448	msedge.exe	92
PID 1448 wrote to memory of 1740	1448	msedge.exe	93
PID 1448 wrote to memory of 2084	1448	msedge.exe	92
PID 1448 wrote to memory of 2084	1448	msedge.exe	92
PID 1448 wrote to memory of 1740	1448	msedge.exe	93
PID 1448 wrote to memory of 1740	1448	msedge.exe	93
PID 1448 wrote to memory of 4168	1448	msedge.exe	96
PID 1448 wrote to memory of 4168	1448	msedge.exe	96
PID 1448 wrote to memory of 456	1448	msedge.exe	97
PID 1448 wrote to memory of 456	1448	msedge.exe	97
PID 1448 wrote to memory of 3652	1448	msedge.exe	98
PID 1448 wrote to memory of 3652	1448	msedge.exe	98
PID 1448 wrote to memory of 5108	1448	msedge.exe	99
PID 1448 wrote to memory of 5108	1448	msedge.exe	99
PID 1448 wrote to memory of 5108	1448	msedge.exe	99
PID 1448 wrote to memory of 4056	1448	msedge.exe	100
PID 1448 wrote to memory of 2496	1448	msedge.exe	101
PID 1448 wrote to memory of 2496	1448	msedge.exe	101
PID 1448 wrote to memory of 1236	1448	msedge.exe	106
PID 1448 wrote to memory of 5248	1448	msedge.exe	116
PID 1448 wrote to memory of 5340	1448	msedge.exe	118
PID 5248 wrote to memory of 5360	5248	Matcha External.exe	119
PID 5340 wrote to memory of 5392	5340	Matcha External.exe	120
PID 5616 wrote to memory of 5668	5616	Matcha External.exe	133
PID 3848 wrote to memory of 1236	3848	Matcha External.exe	138
PID 4224 wrote to memory of 5872	4224	Matcha External.exe	142
PID 3280 wrote to memory of 556	3280	Matcha External.exe	146
PID 5972 wrote to memory of 5960	5972	Matcha External.exe	150
PID 4216 wrote to memory of 5888	4216	Matcha External.exe	154
PID 5020 wrote to memory of 5224	5020	Matcha External.exe	159
PID 5256 wrote to memory of 5336	5256	Matcha External.exe	163
PID 5640 wrote to memory of 3012	5640	Matcha External.exe	167
PID 1556 wrote to memory of 5528	1556	Matcha External.exe	171
PID 1216 wrote to memory of 5052	1216	Matcha External.exe	175
PID 6096 wrote to memory of 2636	6096	Matcha External.exe	179
PID 4736 wrote to memory of 1172	4736	Matcha External.exe	183
PID 3952 wrote to memory of 4708	3952	Matcha External.exe	187
PID 3492 wrote to memory of 3344	3492	Matcha External.exe	191
PID 5732 wrote to memory of 5796	5732	Matcha External.exe	195
PID 1860 wrote to memory of 4360	1860	Matcha External.exe	199
PID 5936 wrote to memory of 4992	5936	Matcha External.exe	203
PID 4172 wrote to memory of 5908	4172	Matcha External.exe	207
PID 1108 wrote to memory of 5084	1108	Matcha External.exe	211
PID 5996 wrote to memory of 6048	5996	Matcha External.exe	215
PID 6084 wrote to memory of 5220	6084	Matcha External.exe	219
PID 560 wrote to memory of 2808	560	Matcha External.exe	223
PID 676 wrote to memory of 5144	676	Matcha External.exe	227
PID 5496 wrote to memory of 5352	5496	Matcha External.exe	231
PID 2176 wrote to memory of 3148	2176	Matcha External.exe	235
PID 3480 wrote to memory of 6068	3480	chrome.exe	251
PID 3480 wrote to memory of 436	3480	chrome.exe	252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1512190408719994880/1520284146977603605/Matcha_External.exe?ex=6a40a272&is=6a3f50f2&hm=ad1522b39fe857601942308f241ad64dcfd9d4d7aecdf614a199c467d518caa4&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb1b7cc188,0x7ffb1b7cc194,0x7ffb1b7cc1a0
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,369332544675741400,16547598692108721141,524288 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,13478090915560296704,18127700484110143319,262144 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,8392881473293353042,14357726087679959091,524288 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12768050984647393355,8973859332778362204,2097152 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,16498878371696244063,11678394772275707851,2097152 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,9779895205831080590,16402766193951610684,2097152 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,9136322479951334622,9051214814668706839,2097152 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,17883231060903404640,1068753529566711260,524288 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10568709200348384337,3283812026188117038,524288 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,11684407393158107623,10388078349683259691,524288 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5668,i,9235957782335667286,10288271329102451520,2097152 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,1385008262103886208,287952537990559048,524288 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,736372961990568780,11659845482120508767,524288 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,14245962022128824333,5386998106814692631,524288 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,14245962022128824333,5386998106814692631,524288 --field-trial-handle=2312,i,7317580853580669202,12663434971309565809,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:1236
- C:\Users\Admin\Downloads\Matcha External.exe
  "C:\Users\Admin\Downloads\Matcha External.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5248
- - C:\Users\Admin\AppData\Local\Temp\62F00E7B\Startup_Apps.exe
    "C:\Users\Admin\AppData\Local\Temp\62F00E7B\Startup_Apps.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:5360
- C:\Users\Admin\Downloads\Matcha External.exe
  "C:\Users\Admin\Downloads\Matcha External.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Users\Admin\AppData\Local\Temp\63F00E7B\Startup_Apps.exe
    "C:\Users\Admin\AppData\Local\Temp\63F00E7B\Startup_Apps.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5768

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Users\Admin\AppData\Local\Temp\24360E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\24360E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5668

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\8D170E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\8D170E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:1236

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\C6670E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\C6670E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5872

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\2AA70E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\2AA70E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:556

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Users\Admin\AppData\Local\Temp\B5E70E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\B5E70E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5960

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\7A180E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\7A180E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5888

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\BB590E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\BB590E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5224

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Users\Admin\AppData\Local\Temp\3B990E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\3B990E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5336

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Users\Admin\AppData\Local\Temp\C7D90E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\C7D90E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:3012

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\7E0A0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\7E0A0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5528

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\6A3A0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\6A3A0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5052

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Users\Admin\AppData\Local\Temp\A5DA0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\A5DA0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:2636

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\690B0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\690B0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:1172

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\2E3B0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\2E3B0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4708

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\2E0C0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\2E0C0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:3344

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\D54C0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\D54C0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5796

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\CB3E0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\CB3E0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4360

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Users\Admin\AppData\Local\Temp\667E0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\667E0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4992

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\AppData\Local\Temp\E2BE0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\E2BE0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5908

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\Temp\B5EE0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\B5EE0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5084

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Users\Admin\AppData\Local\Temp\6D1F0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\6D1F0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:6048

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Users\Admin\AppData\Local\Temp\3E4F0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\3E4F0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5220

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560
- C:\Users\Admin\AppData\Local\Temp\1C7F0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\1C7F0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:2808

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676
- C:\Users\Admin\AppData\Local\Temp\D1BF0E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\D1BF0E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5144

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Users\Admin\AppData\Local\Temp\9F001E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\9F001E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5352

C:\Users\Admin\Downloads\Matcha External.exe
"C:\Users\Admin\Downloads\Matcha External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\6F301E7B\Startup_Apps.exe
  "C:\Users\Admin\AppData\Local\Temp\6F301E7B\Startup_Apps.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:3148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb2cc3c728,0x7ffb2cc3c734,0x7ffb2cc3c740
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1816,i,17508245769640804627,2940535057655975015,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,10069762013549499583,1890219445115652034,262144 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,10234091433358476838,1100207519092913237,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,10187213918218189120,1663287565809417062,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,1000870853428524558,6536153771516906053,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,7832189595206628667,14055031139157303229,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,4342710695130087823,5681839810663646536,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,17406914588140435009,6388128142840726058,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,12358905497246331484,16001238594404955580,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,2789846844122812357,3364707805787851399,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5928,i,12629401250582974083,2679297434261975778,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3700,i,8659824668249143560,1232103182643455750,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3652,i,5378833502491622992,10184103453842673298,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3932,i,12876494538718017139,7481928348140637404,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6184,i,13294454724639368889,15457583389260410266,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6088,i,14615549602818911546,16976774022611699174,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6268,i,2768288961716955311,4660433071808091753,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,16781357697041160223,13754798283394480496,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6540,i,11683047590407258728,4541792924715882413,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6544,i,4315718939301805419,13218389882993301010,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6948,i,17567081310689582447,16319753073679256859,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5988,i,15645243246271736468,8482314361257702552,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1204,i,5738701000624346709,4572559308990632209,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1148,i,8673092823024164360,5865971653282900734,262144 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3256,i,11447127264211589222,10121612243800884825,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7036,i,8037952018312861836,302572301449693381,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7156,i,2181651321237108161,4521500342413678811,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6688,i,6070063268474380333,14233758684932377181,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7080,i,4448555359871173145,5576570693799811923,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=1256,i,4886994496824206547,11018698085269854103,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,11562131712044730499,14306517039524941304,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3076 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7364,i,2735032417616278808,17087599170184323092,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,8353804665407198864,12504846888698169100,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=1556,i,12826839476890270375,13806696099364175364,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1204 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7440,i,8741467317840708929,562571851485190087,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7544,i,14619534792896359716,14043658427543228317,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7696,i,12093193472777450387,16447870928834227035,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7676 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7752,i,8695935726407270425,10088969875674574453,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7372,i,2299283453789882044,5088592254015658795,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7508,i,493069155986830529,9403141849075463055,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6596,i,5841624449439930171,15832695407462184167,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7992,i,17482191191726164657,8445592625555510071,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8024 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8008,i,18390931178766886183,16218308140045832080,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7956 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8496,i,9594546285891590718,13989919968867574730,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8440 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=4124,i,7980267626308232566,8069241177628158736,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7816,i,6720443109002762657,11818793885512467167,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7868 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6296,i,1185170854981310569,16991054094612785279,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6176,i,13657129808955591576,603759125981975938,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=240,i,1360996858929069507,1812170157441681856,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1272 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=3296,i,11638840376085870854,6474476098450470659,2097152 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7892,i,823665496870749347,3190216787507729294,524288 --field-trial-handle=2136,i,5339664395222619829,16786627008178931902,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7740 /prefetch:8
  2⤵
  PID:4008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:396

C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe
"C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3392
- C:\Users\Admin\Downloads\Matcha External.exe
  "C:\Users\Admin\Downloads\Matcha External.exe"
  2⤵
  - Executes dropped EXE
  PID:3936

C:\Users\Admin\Downloads\die_win64_portable_3.21_x64\die\die.exe
"C:\Users\Admin\Downloads\die_win64_portable_3.21_x64\die\die.exe"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:408

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\commithash.txt
1⤵
PID:3892

C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe
"C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a7ee08d7566a7946ed517f8b4b564857197e646cb6464af2e72f8098e3f16829
MD5 1ae3db6dd537d2f303793a3a33ed42e1
SHA1 9718463052503a38e76d89c41b0900e54324a767
SHA512 8a5d173fabd088ce85d0651d4d6c3456e31a008b85bf688bd1b103b6ede0ff6e31eae2ccba840b74a0744d586c0f241953641f7d189d36500df25176d0bb9924
TLSH
T151E02B69C8A5DC7718F9072DB0145742D755135B2A40D94F7A3DD21C8FB163A4585C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 68KB
SHA256 49dcedc5ab89db5b870c609cc485f05f73118eb75461fd4cebc8e57678673bc5
MD5 5f1ee10b261eb1e9bd3ebde4ba82320b
SHA1 f4df8c086a2eb0b174e64b43cfe9e2339e284662
SHA512 cae6441b23d7bd078c3618ad51e4285d88a1ce0b1a6ab075c3e3c0179e2d378ab7a122d89e8421c201595effccbb1197c124fb6c9147e5184431435a7d6d0505
SSDEEP 1536:m4LD8h9u5+UDnAQQUywwb30pf+X73gy+NZO32klJ77JS/I/MF+H:vLDxrnJQVkM8y2OGkH7lSS
TLSH
T1E563025B8D0DE0F45E1270C758A221FF54B16E6C595CDEAD477EBC286CC2E50663B09C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 82KB
SHA256 638ba85470e63f64cbf4d734c262c1a241332d0d778963125a64249dd5be5a64
MD5 7add43a82c8f4cd518773459f9aa00f2
SHA1 8415e26a24a21ab502cfadcf72853abee0977caa
SHA512 cb441f6fb7f59a523a8c9d9877657d3ccafb74fb6a537883a982c642f69091c87ece3ecec0298d03edceedf480b52909acd4a3286e867b48f62ded29725f3228
SSDEEP 1536:Pj13dXZ3bZp/7eqnkHrF6o0AtGcv08tWaO6ecpXW1H83FBV+9m0r:PJtvBqTxLQG0oWX6P9Yc3FO9m0r
TLSH
T127830282D1DDE8C96F2F40EC4E014B7423F6E0D7B8AA0A99745AC4D0EABB59467106BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 514KB
SHA256 66f86e88581c9f5d569432a13908a23f9273dd9138fe16660049642357010fe4
MD5 6b4c04b3271515c24f8ced9fb3262fd2
SHA1 b459a68b96247696a3a6c1946701b629eeace99c
SHA512 57ef9e175c2aab172be56dc90f96f85e472831355a34da8a373190f7911f731a590f91049661cbf26d29b6fc7bc1b012af055dccbd3208ee7b43577d52bf00a9
SSDEEP 12288:9gXbyeTvdZuJOfBoB/t3/eZUjRd50kJ9Lse7UI+u19e5IH:WXby0vdoPH/vjj5p8e4I+u19eyH
TLSH
T1C0B4230C4D80F896865F5719FEA809DBC61FB0FDA1BF095F852B7E8D8599C4096E0FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 41KB
SHA256 ea5c2c9ec4ebd110d4de75a76f52ae8af96387107609785a2cadd915ee866a5d
MD5 2adaf4c5e2b593ada7e311929c5ea38c
SHA1 f9642516800935a50be4b3966987d80fec822a1d
SHA512 2f82ec19a7dd56cff6e872132719fc6f341e8fa670983c2cbfab86c52c4ea1ccbe75e7b1124153a920ff9e24b2876509768a6b7e4c54192133dd9a9eb4adcba8
SSDEEP 768:aS1GIh+o3q6EIwVfpJWMT3PHw1ALy+w7W8z77ZFZpYXnso4sfkWDZVj+iQg/Yt:aq9/EIwVTT3PHGAm48F7csNsfkuDUg/S
TLSH
T12E13F1ED758F8458691D6D23DCDC23926320E6256C04D7342AFE238E461CEA3673A8DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 22KB
SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
MD5 9e38e04780525a20f28d6c455901b2cf
SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
TLSH
T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 21KB
SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
MD5 2c20035257a126aec473203c38baf276
SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
TLSH
T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 76KB
SHA256 3a513b6738d427e3b5614d36e9851564af2b3ea4323bb7437dc65503fa61d6bf
MD5 e996701b589fd57c0229e75093bd06dc
SHA1 8dc1539736cc5b0cb786523efc533d28b9c100c2
SHA512 28e922876aeec662bed8284eb2b792b07bc31104c151e660e85a39ac840d908d11bdd257d02423d328f82fdad729294cab9dd42c7ffac5c3bca3b3d41b4a9420
SSDEEP 1536:NP2s592WtuNCVIlOm2dOYDT43dCoU39+Y4Jvag+j0zWrvRZBc5UAERMb:N9592yEC6yOsM3tm9+NanYzsBciib
TLSH
T15B7302BBE0B58E7FCE61A31156EACD6C0208F9141FD5E10CB825DF98D698CEA074607E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037
Size 61KB
SHA256 23422948869a9f25e23d670677024e873287f4a659f8534817d672a2a235cd84
MD5 ced7f4026cde817df87036f70fc82130
SHA1 e52c5da26a656c0265fd7b828e4082eea0a5d623
SHA512 80acfcfdc54a8575f5dde381e1630a9814b4a131612deffdb3e2dd4031f26f3dcd62009b90f567c97a892bdd988b9e938494190d26d044ee47be06cbc0cc9f1f
SSDEEP 1536:YR3a3vb3pgIfVGVcm+6oh9vPDuZrZrWIcOLjaHk1XJ8Pp:ia3vVddGV7+68vPapNff1Z8Pp
TLSH
T1085302F53E8AD410697E141226563B5B89D7C0D2D08218370B1F0EA6DB89EDCB2E3FE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 55KB
SHA256 0d4064ba9d1405373a2dd6c65f4b60d9ca9e90eef6c6f189347d057659079562
MD5 6c8351f4de1c0a4665ca3a3fa18dc74a
SHA1 c57dc78d6fca4f6f733cc9b7494fe0c1274038e9
SHA512 1b5eeef8c7df930096e4d5041cbf95812430c21e504a7bd6d51331ac8855c03366dbaf5f8282ceb4c01b8c5c6b8ed3aa6d8141da4bd00dd5f024b9a0e820570d
SSDEEP 1536:Jifz0A1pEOl2Tv7H0fC2rU7B5DSRxixwH1AD:YfzpErgflUIx18
TLSH
T1A54302A7639315093AA98FEF5A2522756ECFE073AB34BD66071C34D14EC914C8838FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
Size 69KB
SHA256 a3524409843e3e302bf3f21c1cfe048fd7bc5a7cc0c9653416a32459378c2144
MD5 07be816ff47a8483208886cc6a1e7dea
SHA1 bf65a0765f37e961eecbba7f5e3c3cf7d2fb7d16
SHA512 a3b0c8ecbe346d1190eee2ffea7aec9ed0a6393085220a7f880e61498ca64057b1d91973c6b59362f8aaeac11c1ce07c5b825a910e0af6d7f46805814e745c83
SSDEEP 1536:T83I/L4xG6edQlUfDda045bB1qo/e7PKysjhtJr:TWM6jafDda0G1qoe7i7Jr
TLSH
T16F6312CDDE69E01947AA67C4A10A9F325BE50F360507EB02EFD3F85890796A008BE05A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000040
Size 33KB
SHA256 a30d1a851cf8f8f2d6274d83c33c484e86dc9fca2589e4d586fb85575ef75e68
MD5 502c6e3e45653e75618d9c75d54a72b8
SHA1 303e89d17c9ea418439f8203d6baae327cc7ef60
SHA512 0ff31164c0a382600d53a97fdc206305273c5415880777079ce4c0e847fb9159a2caa946146652d2fecc8aa22f6f49d938f0c666fbd6e4a5617e51ac0549b948
SSDEEP 768:gX1sdQmsYvZ6fXjVGKku6atUTyog8d+qycl2kqiJQLxAPrSFH/T5pEWtlHFEWO:uIQ7fXIKkxhTm2+il2kLJQ+SFHb5pJ+P
TLSH
T1EAE2E04A1FC9D9E1A1EAC43FDD04B42A39B4E6D531826BF9EC411EF84285B1FB001A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000041
Size 16KB
SHA256 3fb2840f50f44efc1a77eeaad5e3ee4be71f0a6ce65c68feacb98a8f2c28d801
MD5 b6d08e0173fa3e87eb0c884ec8808a69
SHA1 991e85177383c0e1ea4c31c4b9612d904fbb969e
SHA512 c6ff1f957081ea5803bf9ebdc3cfb7094c2cab94fed127b23ed491aefbd6f53e1e8c74c73ecc45d7736674bab21d208023cece22a35bc86b599a9c5db6dbd401
SSDEEP 384:Zd6TZM1x6I0IjQhTbnJDY4VJt4nns2Mtd5cbM9sa:zl1y88TbnJs4VJt4sZukD
TLSH
T16372D08F62B7CD21B47826C63EB2CAEF97605A18275B3E6810D05C36F486EC75D890C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000042
Size 22KB
SHA256 e094032144a81a9ec0a125f4657060ad569e00884d285ecabbd530551af8f775
MD5 6843675f24d7c8aeddfe7e7ae3fe116c
SHA1 cb17cf54dd5a542b0072a24631940b713b59c16d
SHA512 5d4595ca069eafe3f5133d2493d4cfbccf41b105d51f18fded4fab26b1f8a9dd06ff8883f2b662e94c01c08fe1ac78add8e9c61d462bc870a2e9a1948ed6f3f5
SSDEEP 384:yvv5/ZpQe2mu9xeCZ+RPZ/v9iLxW85nZ/jZ3OzA6euwRGY/ROHowZRfqeezOr:cFv2mu9EZn9WW8Z/F3ouuw9/RiPtlezI
TLSH
T1B2A2F19F2A49AE54E07A32A308D899DF0B77C27F1544917781FED4E4F722E39C02439A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000043
Size 42KB
SHA256 1efb6735e5d0c3910e55863e53acae3c50c807559880eda01955bc8d495a6eb9
MD5 ddccda3412ec0541759f830db37b946f
SHA1 3aecf8be7e91d5a5acb07cd2783f1deb538a6640
SHA512 317362f5ef145feba34078cdc1505ff4ac242faf844c9a31ee59b17f44716e40dbff2086d934ffb53b14507618b138acf0103203018c6d4ee1214de637d3e0ae
SSDEEP 768:lZInrEYNqYlX/CirDkYMfanwucTZJ8JUaEAxDWqJZubFbP76+Gr7Sc:7IrgY5Ci0fQRcL8JhCR8Pr7Sc
TLSH
T19413F12FF4AADDC1AB1A10DA09D414F867CC5E1DC115C4BDEC50E11B672AA1AEB05B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044
Size 20KB
SHA256 a1d6635d50dfb650f879559f5dcf67179e21106e1b92d808e6631ad8aee6cbe9
MD5 505463330b91e5973708f62a95344b9f
SHA1 af7ee48186d460f0efcf53752538aa67a254d8d9
SHA512 75d7264f135cef6d028606ebeef35ed838f544f67e442f5ea53dc498817ab5ede1347def7c6f89174065d9eb507b1e857d5d98e1e0e9a828e46ed893dd7d2629
SSDEEP 384:zhGuVjJ3y8y11l9JTiCQ9/UXSUSXUE4TsxQwlZj1c0GcCNgXRPk/U0I:zsznV9JmC8oSPkFIWwlI05cI
TLSH
T14E92E04217337826538C8F0598BE7EF4399C4756382263661D8FAB92625313E336EED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000046
Size 39KB
SHA256 d7e977a52ebb3949d1ce37bfe2b025b2a63716760ab0957ed8bd46689852c9cd
MD5 51bef9e12a62761f89de624b1873d7ce
SHA1 bfa19f2b33b16147329a1e86ec460d27f26909a6
SHA512 595f30f9368979a924b301604fba44cc862e8cc95f18deff9fb949677c32b07cf7649c34367b8e17b2b2f7e862b2565e619b288b8f08477f11bcf6004f550ea3
SSDEEP 768:czAkqXOSYazlpr+NOjyxR6ZilV+/KvbAnP4WVfo/d:czseStzlUNyyxUir+/J4WVfyd
TLSH
T1DD03F271F383594326B01A65FACC73B1E58A2251E5E49F30BEFDDD00B3AB1953482B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047
Size 18KB
SHA256 58345ccd6cceb426d276bacddec05c7b9b346dbb51f217c0d3bdb1e54b81345a
MD5 d1f425fca0455b760be6500395ad6407
SHA1 ebfd3fd923a7890c5ee1146b50813e93589f5a5c
SHA512 c89f9d46d46faaf9e422af1daa89c4ef8fa26f424779b4708311c1ff33959bc7244bd5d2985a06d9180e9558d83d9b2e63ec45d8e4042b3b69f88a10d18193b6
SSDEEP 384:OSCj/aY10cdIRchXUKVeQppQ+MXc9h6xVac2Kc4q+AIppUo6IONrw:ObjyXcdZVOXcuacJWIWw
TLSH
T1E682D009BFA003F8DF50596F8F9C158A60381BFFE48FA31290375ABE596D8405AEC569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000048
Size 18KB
SHA256 7fed8388605558565cad14b2982b21ef9fae4f9dd8c2bc8a1fdeea33a80b266f
MD5 3d8a1fd52b4215a13ec05596d58a034b
SHA1 71697b8cbb7ed62d80800b200e08937443f86102
SHA512 de02db772f13aea6bbe32866006a7f783886f38fef58d29bf21bad0d4359247f385791df8e957397e7a4e52d3ef0d6107180d7c9bf276347e7e6498138be34a6
SSDEEP 384:hTPeI57+mtd0Py51+bVggs3LahDaPJNHqO9ZxdXjGqE1gHM:h7eg+muPe1A+3+hDaBgO/xd6NgHM
TLSH
T14E82C1493518CF906B9D16ED933912BD6EEB7B2CD9652AF503C8D1ED8232CC1A04B970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000049
Size 103KB
SHA256 df7165b64242fab139037d4078bcdb844067fae63a2f1949d995665ae73c46f9
MD5 5840ff1eabdd4a055403b4c3c72715d2
SHA1 b855b65ab499f93cddce6aa47e3abed8cb665667
SHA512 ff4d649700af4644b55d311b3a8aa00909a86dfe0b41573633a140f66da3e88bf3bd3844fd311e2dd6f1efbd7196dc8f2e24165a0a5e899b56c05cdb7e9b5781
SSDEEP 3072:kSFgulXYqjnwbBeXehVjilvUxPdfOAdZIRhYuv:kSlisSBgCxilsxVmAdMCw
TLSH
T125A302EF5400F951D42A1F014CE6B9EA0B868A578645FC04CB0ECE8C5CB5FD68DBE65E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004a
Size 20KB
SHA256 1065e6a02fee8a032566b7c13d780b39379f5056a9c5a46ce04d3efd5e2efea1
MD5 e15d9bc49db370e7bf97a3486011e39d
SHA1 33657bdc979f1d7b5765f74eebfcf95f3d0958c7
SHA512 9332e2d2ee84e72a743534643c86a9b08597b136af5a419fb25765a3b63b914fd653f4a10f4998144daa21ac995d282e4172772a7bfd098fd51e6ad7da3ec1cb
SSDEEP 384:DOUZlKTn/MNwYF98Wls4aDpoSct+x2WfoAXvrmq1TDeUi8/yBMAb0jraqeqW:D3lKTn/Mj3aDfiZWf1KqxPF/yBL4n8X
TLSH
T18792E1D493266658E250D8628F3D16F29C45E62C056F200F2B7A43BBBE548F8DA1C8FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004b
Size 31KB
SHA256 2be82e554ec142d087cd060a9d7761e4ce82b7338761203b6ba155baca56a58c
MD5 6e7eb4fc296d256a4a576365b274786c
SHA1 8ebfc18e838b2b75b395485ccd83406a0866c426
SHA512 225fab5e107d16d262fc252afb6acb7ff69ac05456abb6306cc64e0ab31d9cd47ecf67f9ede714e02bc7f861444cfa2f88e6f0fd27eb4f7005265245ecbced90
SSDEEP 768:JACs5yY7VYvY8Zz2K7qGHZv1y//ZWUA375:JAloY8ZyK2uYkB
TLSH
T1ABE2F2522B16412798DB1393647DB02CB826A490C783A38821CB99CFEEEC67CADD5D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004c
Size 54KB
SHA256 953494ddf34ab06801a50c855e8cae3e2fc0a61a547a862637ac335172d9021b
MD5 370b4b7af9f932a291676bb522ddd311
SHA1 b09a57bbab66726f8e89626020c7de0a30429c47
SHA512 2fe8bfec429e00c8374cdf9a5a2846b4010a556ffed63039dd2926b551c03dd900bd94e98339f4565e4a2ce440f2131de7d3d5f63a5edd84cbae921c76bdb32a
SSDEEP 1536:sUv2/KZbhnhf9RLyi5BOJBuNRRbojR5dd+oWLMqHah:sInPYBu/qncah
TLSH
T19E430274C240A484DB15FA27BE53E370D8836ACC7494FE91CA29AD8785EF991ECDC718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004d
Size 21KB
SHA256 9439a3e1b66b0d0591163a817f4c95434c9a5611e299ea6993f89a3a4522b65a
MD5 ff2af5eb6ea0c08e908d8bbfd5d284f5
SHA1 89436b67bc3ed7f47d65421c5125c2c540364d22
SHA512 19507b120cfe396c8218dbbfeb73acdf1ab10bc39b4fa2637d4f232d9fdb54032ffd70218c9cc51512355dec61adcc46dcde47b83ad542c56e266f4111bb01f5
SSDEEP 384:y7mB79t0QhcGNP7V/hSZVKH2YruLCm28dNsueTrDDtYkd8EE2lKXfLHrAYHFBZX:+4Bl7VZS42XLK8dJUDtY68yEXfzrx1X
TLSH
T1FDA2D05F8DEA0D029BC06B8DF215AD323C0173D53A91676337A68C1459A2AF28749FF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004e
Size 25KB
SHA256 cb7fbfeba8927ab59a9bae5a9ee14b6030faed4e1439893156e96ab28671af60
MD5 4118760ea6fa17acf89c3103d5eeb8da
SHA1 279a9aa3dc48ae1ec53f7ded2ddbff61c0a405b7
SHA512 6c3a081aa7609ed37c1a31104ab1e989815bdd1788e7f575aeea45699c52982b534e1b6bec3a509bfc56baff21eac58b38a24795f361adb0430d13d9595b8560
SSDEEP 384:1VFNJkQfYONFitIwDoMIQdci0wwzyC8RMazBMT+AfbBNwBOeuARYApeUwXdSefDa:1nvwufmIQJ0AMtPbPPebYeBAkefDiJ
TLSH
T1DEC2E0D57886608DAE38BAE0306973CB71B5D1176E3767C943A2D1BA790913F88062B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004f
Size 32KB
SHA256 a8c343e78bfb1179592ce7fdf35ef414615f9f14b2d5582d92f8f70115e5e083
MD5 527812a2aa0dae69cf85c6f552e5ae46
SHA1 8f047aae573452cc8d1640d397a0686f5486d84c
SHA512 511d50cc9d3a21c21c67384cc751c4eb24b37a4a24bf291f9642f8573058527ce68504581d0520e2616ace161b4878a91902dd628e4e8662790db5e5377958c4
SSDEEP 768:wROxiMJQTkpSyyqGHnNSOyVci6b2Eg102CavSoK7QqX:RJRgHNSRuD+106FqX
TLSH
T196E2E1786541B3E7A32BF09C21E22C9AEC4C04696E1EFE6E0614ECE1305573D57D85AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000050
Size 127KB
SHA256 27369dfd7992819c71ca3754fff8bf0a54fa6628d493cb76025df0f4e712657a
MD5 489417eb7b4a53480dccbd3d028fadd4
SHA1 15db74117e49c58ba886b9a76ef2bf166e4efc68
SHA512 10b662880586f3d468386a23ed702b884086c0fad45abe71492f0b1e7d46f3c6d466f2bac0acc5ed602723c69d8b5a097ecda3088d2754e74ce94ff09a618199
SSDEEP 1536:koH9dr9Ot8EL7lj/jJBhxL4v8KbGSi3pSfg1gruHbCjCLT2VaW1M+sm3OVaRTTRI:ksr9+JXJf54kk6SqBT2VaW1FeVYHer
TLSH
T10CD312DCF2FFCDDE6ADC1DA05BF97476C0A669764CE038134FC9270A6FA20485291A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000051
Size 31KB
SHA256 75db72e65926993e088f28a2acc819a6e3e877e6d8478926b12a2546406014e1
MD5 279581b9189e69f8390364c2f1377614
SHA1 5b9a5082c180c0abc03bcf723c5bed170987d783
SHA512 c31e4dc2103159ff273ffad0a610c63742ee0e17f080585fb7a0f8d4b0d2080014062fde359e38e655740aa9eabd1558f3f9b82f6fd934693ac7fe74e694c3a1
SSDEEP 768:Gehl/9O3RmoOzYBcwAPQksk+xk8nQun/zqgX2dD916d:flO31OzaKQkdQk8nJX2dDU
TLSH
T11AE2F100943BAB182BFE859CE1445E836415A0A5F167D759F89A13386BFF02EFD229CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000052
Size 77KB
SHA256 4e47211083f1e00526c3871cfc151bcac5e55e85736af6466c516c9fba1e3817
MD5 e749cd0b1e4417db7dbb483c3dcffc77
SHA1 c72890e9b1b715ebd852206d921a2b24cfc6baac
SHA512 111f568a73e69d09b92b03268ff9bc7445ea656d75de0504079c8bea64d77118a85b613a796e5f9b1e6db458d3c8d0abc63334ccab6515a4ba0d4f5f81bc817f
SSDEEP 1536:hTDGuBJQcdbYYeh1PnONVit42ZNVYp/gswIPqlvphWWH:hvGuB1g1gEG2ZNVm7PKpL
TLSH
T1817301473BF40B91BBE1724AAF7D657E983ACDC8D1073B06F48A1E1458218AD274C1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000053
Size 154KB
SHA256 5b333ba77550edf8243e3ce910f46df78f6ea1866fc96aeee446ebe3e71863d9
MD5 76e9895f47465e1234af392533e22f8e
SHA1 92166ecb9528207f6e3fe90ac37805be6260e2fd
SHA512 dec353378e600c8add966643c559b7ff2ff0a0a83f8941280c05ab08c412e2f4132d245553e6a80b3d821d51b07ee967deeca8122b61ed5a9c4c1471bf67d285
SSDEEP 3072:Xfavhhes1JNsdfFoZ91ALr7L5PVQ3vwkKrT4FNJpztp10QPzqF2D:v2eWsdfSZ9Ebk3SrafpeA2F0
TLSH
T11EF312BC9B4A1FA7C8CB49CFE92030E171611B369AA218E521FB0764265DCB36079D2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000054
Size 87KB
SHA256 18e168962399c4dce7f6c1eef5be2e588b4112249322587b4601541620400f63
MD5 bb31112bb8e6258e3a8fa94a5d9b0d1a
SHA1 c4c4d3e797b8ab6342eaccbdb57d4e0e5914cc2c
SHA512 be4f6de3feb1dcf74c22ab618ba0e9288a8e9e99c2b8d7042b562c1f091aad3b783122b198477fa8dde70e52be8a072709b31a5fa275cc96f2a3da9f49ec38d2
SSDEEP 1536:hIusaHob4KS8pyRJtIF8GhE8IoTY1zu1maSAABWd54EgdOPS8WlgREuOc1:Wu2PZpGYF8GhTIokbFWdmEjPS8Wlg2c1
TLSH
T12393128B73BB608735F54C1EB2C9CA83126798D71853AB2905257D0B32225F2D6D6FCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000059
Size 16KB
SHA256 4111acfa54adee15e415c39ba7b63cf4f77bb4aefae66b2620aedbf45247d137
MD5 0bb67951d6a2dd67f74ca8a4dcbc3af7
SHA1 441ba902cd03b3e1341b39b284866bda4ce7376d
SHA512 952b8f2a34e18bfa062b04acbdd96bcac1039ceb48e6e91010d6175cac1ad1281802511cfb9a1b7dc69c00792e077a3c532618acbebb61db55b4209d83f64fbb
SSDEEP 384:0sEoX6ZMj83+nUyXF9QYpQsAZt5gdj0zSLvv/dPHUXdRH4Wx:0Y6ZMjGEXQYpjAZtK5Lvv/psdJ4o
TLSH
T19272D0BFAD1C73F3D257CF6C5AD61611638A6C2433B470A44AB7A0E4A46BC196839928
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005a
Size 16KB
SHA256 11bacfbddd10badde0e43548ad3ea8e25991ec72101ea541cae7ec40c71e9d03
MD5 5347c390aa0b89de39ff996859c0cdb5
SHA1 702235b762dcf544477cec407691ac82fe677545
SHA512 c47de4b4a499bea2d267d8635a1b88421a4592a7fe0643f1bc885be757452f7e2abab5bd39b1d724447675ae96a5ed80edc2f86cffa2e85b25a1ddd00c8517eb
SSDEEP 384:jpzH9vuz8kDNHYngHhIBq/lznU1tS+MoIUNqHeseR7bGjT49JTp:1cyPUU1ks7YeZijT4Xp
TLSH
T1D872D0546C914463F86F062EBD24D6F34B592EA4E96D0318E7BDD08A307D13C623A7F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b
Size 19KB
SHA256 29d8ccf1633b0d5f5e4882e208172089f1c0b9c2264585efb33e05c1bd0b5bce
MD5 194fcc66b81411bf0f533f1aa7a81734
SHA1 1d26f6facffc1e16cfa8c25784849870f223c020
SHA512 71f7c1b943a77552ddaf715500215bc05120dee425a19af241f31e10cf28c3f3b125e4a64f1b5279a5d3f7054681da4c2a93325b52b3c6381ae353c2b992477f
SSDEEP 384:TP7+R9p6s0eAdY5yFWkCPG5J9fsa3PbXyKZX7XFHQmV7IT5gW98mE2eskiJixG:D7+R/o5YcW5e5J9fs+Pbi+LXtJxlQ9uI
TLSH
T1EC92D115064B5506C97FFDF07C021F39E5280A0376A8A7F8B07DC8BB2495796927F0A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 672B
SHA256 333fb56ebbd1b1ebd0a638a7edbb0630a1402d2f459767bc92eb90f89b4ee2ea
MD5 653d7db01b6b9a8303c99ed888e5ffaf
SHA1 ef24245ce8dedf30450055e1f9570db632390fc9
SHA512 1b8dd4eed6d90b58a503371ccc8f731c1d43fb0b93a08c120103f3912ee1e3d099b687f760fd1a0e3f8c994ef1da2a5a4fdd1a41a356f1f17e79fcd65c1cd2b8
TLSH
T164012448208016C3CFE12A76E49D0B243B375A5477733F1A0EC858679A1B2F18E30855
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a8f167c2117f15c1c3e1c2e300acd6682d0dd2d9bf31899df6c23417384f5e8c
MD5 43833c1daec2dfe2047773b384339d43
SHA1 35688c2539a2adeb45e44ad5dccbc66e7230f22a
SHA512 b14a52eb925785531bcfea4e171d2d7420067178f121f469c150ada4ac59273110c969ccc4f0de047a8dc36a79acb2c701e9a109a660229057a716db9e42c7ff
TLSH
T15C31FC884AC46295DFF82A31D0F54261F332D29833F32F822DEC28A7A903BE15C79355
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 56682c5092d894759190a24c4796d6ead7a294774ae8863bf92c4c74f1d2a740
MD5 d5038c6def0f167cf21cdd966feb8f63
SHA1 a595e4889cf5e2fcc72791d3f888ba97d3e0a0cc
SHA512 6c23b94cebe50c762a5168b09a18f135c40a68bd20db89e0515ef83d63ea4084dc6767c7f71d316943001b990d1b51ec3e1906b2e6b612f2ae6b335a15ce8f1d
SSDEEP 96:E51m28rxNRKKtSKO8ufg/IntBws3hrhk+8ORffSzpbTsFEIQI53RJleS9xh007dE:328rxNRKKtSKOtfgAnrws3hrhk+8+ffc
TLSH
T1D1C1E93486B25194EBA4263FB3FD0D37B332C1855D631FC62AABF87368027ACD465255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 84de4ced87dbea29a66dbb0a5b773be05cf7cec95f48015b4993e3dbd2782577
MD5 23e932ec642e6586eaced9afcad5d3eb
SHA1 50245d66ac1a1c5bcf6dbe6f6feb3ffe3b325747
SHA512 296351c2059e5160ed015f925beeecfcab69d4c234458e4fdf3dec8acdb7514c96e2e2f10f30f534f73a48e24abd293972339dcd743f143d201475e7a07fc79d
SSDEEP 192:H28WqaeML8UzU0xw6szxb3mqf33V4lT9zbnRoSFzgSu+/cRN2v9cFWtvKhGBIasG:HlWqaeML8YhKzxb3mqfnV4J9zbnRoSJh
TLSH
T19AD10A2B838DE3C0DB61DA3DD3F105327332E135162B1F8B0EA6A8736852EADF164195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 664484427d3b4400e8e01febe377d5d4c949e2b67dd61f8a8aaed3949f124256
MD5 1476533fcb2a89270b8c6f8769366b00
SHA1 be19a5435a8c84aa7457a79b20a2cd1347518527
SHA512 0526c2cc4201d7ac8a4c6da0fe82238182f97605410d6e46d12418ae064116771c38eea71db56a67579a74244417996de179769305d6d4cde09c47aca4251383
SSDEEP 96:5I1m28rERMAK8uGJ7IntBwsRTrh3bMZXfFzpbTgEIa6RJleSChu+7cB2zq/FWt3n:f28rERMAKtGJUnrwstrh3YlfFNbTgDzu
TLSH
T1A3C1FAB586B11191DBA415BFB3FE0E37B332C1451D630FC62AABF86B68027ACC674155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 d39ba57a10a5bee71bb84a8fe51a232e7c128121ddd1f3b4358ae66fc67c0064
MD5 d4f7709a383245aa01099121caa93bf3
SHA1 fd6d542eeb3afbb9aadaaaf40c7e993ef5195e28
SHA512 ceb02f00e5c157dd3006e5eb5898ca421349642c29ebb581a34ef3f55544aa2399eac140e29759a4476d691f3a06d23e941ae9746df96cc1c123982fe6740e64
SSDEEP 192:L28W6KUVsalDzUfmw6s1bblw5f83TATV5/RrSlzg9u+kc5N2R0cFWtgKhGfSspSd:LlW6KUVs0TCbblw5fWTiV5/RrSpg9Jkc
TLSH
T13CD14D3841991240DB632B3D5BF106B173B2F105ADAFAF8B0767EC73E822A6ED068114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 56KB
SHA256 01a8b409dc8429421579254576d6a4fe002f85d088cfe2d1c478ff6b2090a32f
MD5 43ce1e4619e36564ddf11255bc672daa
SHA1 d4682fc883c91d58f819e7603d1797bf74d53f38
SHA512 0f92479258f0edd6ef2d33567c89f11892efbd4b1fb3b3d89b1c063561a335cb1f84c102ad85bc202e58cb1c659f2cab4c99f0c24aaa1fcdef7d05897ea29299
SSDEEP 384:A5wNxhU8mNQOuRIlt8+ukBLncQ+rh5m7RwuJvrEHOGTbgMWO8+dW0Wq5QS5wNxhf:WtgDW0Wq5QgtADW0W5s/kJ0
TLSH
T14C43B64C71F86C33CF771B5378F13855DE7AF2119E85CC6860520E6A83AAB81916EB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG.old
Size 339B
SHA256 e67b5289b38bdcc7973314daa069fd31cfae00166a6fee0aaed38ffc963522b9
MD5 ced444914d062f417d726b6988a9a3a9
SHA1 d6a7125d48feec8012a9e4e3bc2c4b1bf45b05a5
SHA512 7d73162c10c6b876191ae1b1d1f3418565a034fc9e6fc7ced857c472bbc655744b388c783ce7abe639a490e03385d2fd39aa0e3ebe3bc2c6bc82ba8578582796
TLSH
T1ACE0C09884C9E69F0100C0664838B70ECAF7D10CD7CC6CCD0F02D818B0C5008C4ED3B0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 eef21b98b2c4790de8b437f5050b2ea6f06ff4dd908b7c877b9eaa802008af34
MD5 e330e06e91670f91f7a579f9a87ed546
SHA1 7e736c96a7959dc607ea13d96dfb15b8720bde9b
SHA512 866a89756ba1d7b8462479d46c604b68fe9c179fbc6e7afd486c3192d36fac415636008b8c3cb14a1571e33b28ab86ca5f7ecae5953e88e6ccab396d287989e2
SSDEEP 384:DALv1AIUwJG1LxLeL/agyaIELAR4Ctmv3VkNTa6gfRJrW89Vzs+cqHANpU4vCVCN:sOOZNvly
TLSH
T15272D0F7C7E8C62D891256F5A7242F1BCE590A24431C3D66C8E5BF4FA3E2471E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 dd9aa70bd0a1136a40cf48ba0b9d7e1b92a816dc0bba51e0281884661a4e5d67
MD5 3311b1d60c1a8efbc8e58632283546f1
SHA1 2a87cf7b8864808aebc581761709bcb861a3a06a
SHA512 f2221e1bb51ff4c36e983b17b94ec6088034d9fd9f2c62e17002d2e460badd9b277e0a475f7b60ab484c13a66c5b2f0c12981f402a914fba269fa3934bbd2c07
SSDEEP 384:D0utwJJdtM5Sp6n+bEjohob9kodJmSm47qDG/JXZxX2aIEZkmrW89Vzs+cqgANph:mGYDE+iGeKhe4czCCXX1iJe
TLSH
T138A2DDF7C3E9C62D891256F4AB246E1BCE190628431C3D76C8E5BF4BA3E2471E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 23KB
SHA256 4ae5afb90c3c5de2eb602547f3bbff744419e83875948fdbadd257183db5d10a
MD5 c0b4b2d360e637bba6ba64e3872a7f3c
SHA1 747a029fb1fc7dcc1b64bb40e0335169832bbab2
SHA512 2f92dc27abd9d0f2d0d8345b6f7d3f5d5d313a413ea3ac205c1cf549d22f6a8e993263c16c2da123fd48b0fb28618adc5ca0dda3406b47bcb435fd540bb2b4d0
SSDEEP 384:DtwJJdMpblA+MuyJmCmjQqDG/JXZxXewKXuXqsRn93HQBxoaIEZkkgANpUrCVRra:aDYzBTe5h4ciC468iUqX8ZS9
TLSH
T180B2DCF783E9C62D891256F1AB246E1FCE190628431C3D76C8E4BF4BA3E2471E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 c106d2291fc05a7098e4e334df7a1a4454290ef1092bc8e077b6ce505d413a8a
MD5 6316ab4295718b7cdd1998fb8a0a4f65
SHA1 e0fd78678e3a6876019cb3b423f8613ad449c39e
SHA512 67afb7bbdc19bf82df1c90d236036e8fc4d1c737a28ccab59d3fba088896efeb2e1368df798f3d4bcbaa4c73d1ce46b41f17d1d39876599eed2c522142ed8f53
SSDEEP 384:DALv1AIUwJG1LxLeL/agKjohob9kodJmSm4faIEZkmrW89Vzs+cqHANpU4vCVCXC:sqYD3vhkzmveJ+xuPX8SE9
TLSH
T11F92E0F7C7E8C62DC91216F5AB247E1BCE590A24431C3D66C8E5BF4BA3E2471E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 23KB
SHA256 05ed5b8173281e938dabb13c1332596a2045cd06dd994019fd2202ae62032136
MD5 64065f5d657ba008a58b3933bdace5e0
SHA1 799cfc26db7a16b66f3257747123bfbc9dabfd80
SHA512 c7ddd3bb6a6dc020f2df07a854ad3bce57e04c553a40d253add11849736c29c402ef0daa10e012f93f44e6ffc91560c4d7b6d31d545baa7e55294300efbdd2aa
SSDEEP 384:DtwJJdMpblohob9kodJmSm47qDG/JXZxXewKXuXqsRn93HQBJaIEZkkgANpUrCVg:aCYDcIe7Re4czC468i65XSJ1u
TLSH
T14CB2DEF7C7E8C62DC91216F5AB147E1BCE190628831C3D66C8E5BF4BA3E2471E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 f389b6bcced8f6de57d65079875dc01ca1a923fdb13f01f225ca95ee519efe90
MD5 2d8affcd98509fce8f714f963f896b32
SHA1 dcf7824e4e15342b0ab51f39d310985dbde36ba5
SHA512 008c68d8ebaa3ed4056b69c56c69ad2f5f40be6410bf3d33c4d73f3199fc4a02f89e814546fb5020091d2537ea889f8ea77bbe64e6483572eebb1eabaf610b67
SSDEEP 384:DALv1AIUwJG1LxLeL/acaIELAR4Ctmv3VkN8qa6gfRJrW89Vzs+cqHANicPC6pUw:sNkZN5vC
TLSH
T12262EFF7C7D8C62D892255F5A7242E1BCD690A24431C3D66C8E5BF4F73E2471E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9cf84723d9f0fd5fe8b23bd442cd3012373fb8303b847a49411d108f618dc0e7
MD5 98adec1c502b1a715957fe7914abf81f
SHA1 700d80ee3876fd7fbb7ebcd9098115259ceba528
SHA512 7b01b56ce68296073ce138b5af504f2b191d0fc08deaea40a5b97c6f31186981fd11c5e0ea47483ab9153943a863c0e23b5a6fa8d1163f5c2e2feda867c3cacc
SSDEEP 192:3RmcBzG0VwiaYBv70hiPRpQd4U/NAbFI9+Hsb+WNG439fE6+IOEfNCkwHBVyIsnB:3RmmzGU1RgGX08wJFkElCne
TLSH
T10262B72BA9141EBB5DDBC229F912BB17D7F2102175951E88EAFCCA1C09E76CC312741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1be93736fdf0dcb939a37e2b861ee63c0fc9937f1eec8eac91eb43ea3b661ddf
MD5 76423192b34f4ce263fccdde9f9655c9
SHA1 a42fa23c4967cef4bb35b61a5c88f07c338a45e1
SHA512 605607c3ca9896a15a9087920dac893276312d3ca333a0467281b5a80e7423265e912bb492fd21fcaa34a30068c99d87d6e34a5223dc37fef17b9d5529fbda5a
SSDEEP 192:XRmcBzT0Vwiatuv70hAPRp2ds/6kRRI9+Hsb+WNt8WE41jeINCkwHzVyIsnAUgrK:XRmmzTUAKg8X08wIaeoCVe
TLSH
T10252C62FAA502E7B5DDAC219F9127B17D7F2102275D52E88E6FC8A1C09E76CC312741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 eb85c8eb442d60dff0d642cabe8b2e415c791411419f47d10aca1ca3c59ced22
MD5 4e73602c773a16862bed377c48d18b92
SHA1 46c1624dfe893953bc69e8370e18d2393beeaa93
SHA512 9e2972c46ea69a7f76e96f493a2505ec46ccddefa9e8e4248639b2cfef039b995d64949b330c2d36f144375ed52fa879e81d9525d5c1953806f604d33c29497a
SSDEEP 192:XRhcBzv0VwiatBv70hiPRpQds/6kRCI9+Hsb+WNt8WEEE6+1jePNCkwHBVyIsnAq:XRhmzvUARgGX38wIeAeVCne
TLSH
T13962C62FA9506E7B5DDAC219F922BB17D7F2102175952E88E7FC8A1C09E76CC312701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fcb4b36718f5c5f4268568e89e25a791b0a56010dd9c0ff79e2eb4fc475384d6
MD5 ea3395a98674131d40164b3250c400c2
SHA1 e9a465161050ec001f2f5f49854cedab282ac109
SHA512 78b2702b3b7720e3b3f8c2b0310de88b3d38612f53363e4dffca93518299c146d866c05ffa5bf798dc51df8878617649f94d12fed97256f1da0b71432385d490
SSDEEP 192:3RmcBzv0VwiaYBv70hiPRpQds/1bFI9+Hsb+WNt839fE6+IOEfNCkwHBVyIsnAUp:3RmmzvU1RgGX88wsFkElCne
TLSH
T1F862B72FA9106A775DDBC229F912BB17D7F2102175952E88EAFCCA1C09E76CC312701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 921d7c978c9d1112946aa99fe77eafbf9f76393dae24b88c417ceb7073c93c09
MD5 6f44e0eaecf515dc54bee1f15143ea13
SHA1 2b17860535e2611649adca0a48ddbc140d1aa389
SHA512 363013a31b8d8e36282d95daae23de9bf8d7acaf85613b93b2b0ebcd155b8f3b82b5c02ca267da77ffca97cc4ed0bfe905d8d806c78c21b356cf3c9c1b2b0d27
SSDEEP 192:+RmcBh10VwiaZBv70hiPRpQd4U/UxYFI9+Hsb+WNO7srvcSqE6+1yk+NCkwHBVyl:+Rmmh1U4RgGXt8wfVkJkOCno
TLSH
T19962D72BA9102E7B9DDBD219F912B717D7F2102179D11E88E6FC8A1C09E76CD322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 23ed1fdb450e4fa7d6633841be98c0a1dcbca0e9ed057be8d97c23117f923599
MD5 fb68d7c88d8593e228fc40d552da18c7
SHA1 69f502c628053836737f753872ac96beaaa7ce7b
SHA512 6859659121b3b8e0333eaba6ef2a62d3b421332d9c698d4225e71f1c5c6ec5f6a845094600ae151a5dfdce846df927929f7ec3c6a9f85acd822ef0661e9b04d8
SSDEEP 192:+RmcBh10VwiaIHv70hiPRpQd4U/UxYf39+Hsb+WNO7srvRQwE6+1ykhNCkwHBVyl:+Rmmh1UJPgGXw8wfmSJknCno
TLSH
T1BC62D72BA9142A7B9DDBD219F912B717D3F2202279D11E88E6FC8E1C09D75CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 4cefaeeb87a0aef4e22fa4dd04cfa4413d741058c36db9a4b2fe9faf75e74086
MD5 13771197b05fccd888f2561a27406f8e
SHA1 85cbf000ce6bb61b8bdea6f0b15519f8c1adb7bb
SHA512 325ff3a4eb3210a0d284bf76bf4155a420c832b0874ddfc881fbc6d0b9b737f9bc559ff3fac708d1350d7947cef63c82bb3d6910e00eb3d638f94a44a1cb8f83
SSDEEP 192:wRmcBh70Vwia+Hv70hiPRpQd4U/U/Ylb39+Hsb+WNWqf7ROk1NLzslctE6+1ykvn:wRmmh7U/PgGXUL8wtvMWJk1Cno
TLSH
T1D572B66BA9501E7B9DDBC229F912B716D3F2202279C12E84EAFC8E1C05D76CD321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b13d4700313aea9ccf0cb2de66b42bfa6db3085e33255418ca36448c4a545f32
MD5 14b0ad6c5d21dc2897ad69c4cbb77b60
SHA1 8f2c016f41e2a66c6623dcaf249e745ac30060c2
SHA512 c003a55cd8402488e765a63f9228d72dcc1786a29a0b3c0609cf2777d48e8392b65b9cdde0ca8518143df7e9e471bac2134cd6ae074c7d476f2bbe2ca5bf15d6
SSDEEP 192:3RmcBz10VwiaYBv70hiPRpQd4U/NHbFI9+Hsb+WNG439+cSqE6+IOEFNCkwHBVyr:3Rmmz1U1RgGXH8wJckkELCne
TLSH
T13A62C72BA9101EBB5DDBC225F912BB17D3F2102179951E88EAFCCA1C09E7ACC311741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 81819b6f0f6853cc01c9fec560cb53c097f82af783e28fa631ca101a19bdc4f9
MD5 7bb2814ace41ae96c89f4c8bf78773cb
SHA1 6054beb89d05b858590e7c049e75751a000f5991
SHA512 deca5fd42acf3158521d638c913fbb993c3726ce9742b7dc1865ef9134fa9fa052e944726f4070fb2055a4c3bccb0f8acb0251d91097ef65fca56643a4d855ae
SSDEEP 192:wRmcBhU0Vwia+Hv70hiPRpQd4U/URYlb39+Hsb+WNWqf7ROk1NLzRQwE6+1yktN5:wRmmhUU/PgGXiL8wtvaSJkTCno
TLSH
T12772A66BA9642E7B9DDAC215F912B716D3F2202269C11E84EBFC8E1C09D76CD321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 2f4ea809d9de1d63b84c91e1d3b75d286ba637c182f9acccbfb04f2885515eac
MD5 51ac281f516dafd92069ba8cdb6abbf0
SHA1 201f0c749abeb140679e989fcf783c5570e51aef
SHA512 56e8503348861e1635e2ee676c0ac790267740761345a2456152f801fc9264edf93ab47cf5f614754a599f30041c403d7b317017e6dee5d6539c4a4c58966fc8
SSDEEP 192:wRmcBh7UVwia+Hv70hiPRpQd4U/U/Ylb39+Hsb+WNWqf7ROk1NLzslctE6+1ykvn:wRmmh70/PgGXUL8wtvMWJk1Cno
TLSH
T11972B76BA9501E7B9DDBC219F912B716D3F2202279C11E84EAFC8E1C09D76CD321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 b22c1a8f85d4ba7e7af201cbda8bdb0dfb988c11830fe86c6a7b3f8ecbce9c6c
MD5 70b6ec1b71a4f8b9e2562329ddfef400
SHA1 00f69aa01203e1e784798c7a79c5ccd667c64bd4
SHA512 272fc96156f35aec98e8e5a2dfaa8d178c53338300991b2639d3eff77e8130aac68678bbd65ae463f33b2987dd0dbd974468f33a740a59711aa78c86d3a02eb0
SSDEEP 192:+RmcBhU0VwiaIHv70hiPRpQd4U/UxYf39+Hsb+WNO7srvRQwE6+1ykhNCkwHBVyl:+RmmhUUJPgGXw8wfmSJknCno
TLSH
T1A062D82BA9142A7B9DDBD219F912B717D3F2202279D11E88E6FC8E1C09D75CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1f7787a45a04541917dd43ae5c2060ef3ce20ac662b847cef8778148e4e8f72c
MD5 4702054a242d0b64069ca998f54b07fc
SHA1 09c035e31dece3b5c3a6da12bd1cf2dc6e6e77bf
SHA512 3580b44254f67a575c7c4133002b5c9f326969c1c9f190b72bd18e7d5a3609e25bce462a1b606a80bada234fd158c6ae5c0abc999cb79aafb1cb737735a41d5a
SSDEEP 192:XRmcBzT0VwiatIv70hAPRp2dA6k49+Hsb+WNnWE4wW2bNCkwHvVyIsnAUgtaJ:XRmmzTUAUg8XK8wZy2RCJ8
TLSH
T19B52C62EAA106E7B5DDBC219FD627B57D7F2102135952E84E6FC8A2C09E75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c3783ab5173dd9a8505f22b621404e0c1f4c37a463bb032f9cdc4183d3f31c2f
MD5 c79cf3aa5b08d59b2ffe970f15dd5f08
SHA1 d32567c6339cdac6640863e3a36632fe2fced873
SHA512 a76bc9f2b887a3341731330492d921654980259d8b298c8ac1d2aa88b461627df747122a75a2e345bed6694765b38aefde538ccca4559bc0ee2678007b718688
SSDEEP 192:XR+T0Vwiatpv70hAPRp2dj9+Hsb+WNnWE0dNCkwHvVyIsnAUgtaJ:XR+TUApg8X68wZ0DCJ8
TLSH
T1B742D62EAA106A7B5DDBC219FE627B53D7F6102135952E84EAFC8A1C09D75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 052c9797e19e04155004b129100a81f064a3c91d26373bf1e0bee901df282522
MD5 9e50a92460fb925d4c7da49d1c707c4d
SHA1 953ab0e4fe6c8bd11a5fd1e7f777612928e24b59
SHA512 cbaca03edd7ff2e420bc1792c82e3c11193107acb152918bd20bc195cb7b72cb466646b09ad960305977a8e9b7d2918239c272c05f80634aaa1249e8b5b92372
SSDEEP 192:XRmcBzT0VwiatBv70hiPRpQds/6kRCI9+Hsb+WNt8WEEE6+1jePNCkwHzVyIsnAq:XRmmzTUARgGX38wIeAeVCVe
TLSH
T1E462C62FA9502E7B5DDAC219F922BB17D7F2102175952E88E6FC8A1C09E76CC312701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9d30873f99541577c3c51cf8413bad5062ced0b349763d13e8186cb8091d8352
MD5 fc43628acf3a20b23ea4cbf7a7de0cb2
SHA1 b0ab54b6cddc276b0f1477c3edbc58f17a558938
SHA512 2751e2dd93387c07ba0290ac3b22edbe70c6fae8326acef2faf41ca9f75662f54aa639d13774a011dea1f63e0bd793c355551119487fb20780da7bc62e4bab9e
TLSH
T1C3B01211C4429103C04202B015821488B2645F30970B170243E46973C9255A18114062
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aeca3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aeca3.TMP
Size 96B
SHA256 aff36ab3428e953f5fc5f197daf7f7be051f935e844f09f18583319a550828a9
MD5 c41d5b89e4ab88802642e8c4b471f5fd
SHA1 4a8b7c0312e538aeffa19001d566dd91c9491c28
SHA512 c58c58ea2575cff7f0d708acb741c48373fe255d8333039a9bcda72a2f5a41e287d35351df8052c20f3c98f8aff011211f93e551103bad9ec9f4a82f74bde3c0
TLSH
T190B02200C002A203C08303B028A0E0CCF020EF30CB03030282E00B2ACC2C2F080200B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 36076554259b48158210b77813c18363baa84307ccbb6d17d422e683230c9050
MD5 615f57e4a22f465244ed70348495f178
SHA1 6b9e85992ea491236fdc2c80a4af65d9f33b339a
SHA512 d5f70dcdb8f5f8a3d6a4aa500fce54e19bc4dd6e184b38e3a82a4405922696d45ed009c25364294638f9ff3be8bb1e3aca0f6ac1fbcef6db0597ee4b9e771838
TLSH
T1A6A0025003D51911C810037813D583C1BB1058104395A31B50A8574989925EBA179604
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 150B
SHA256 e9c5f583729f378ad3d87f4e09e17850247f2d1337c60687675b1f391757e42b
MD5 5d621066d49dd7c2001792fb87ce03ff
SHA1 8129b082461ba47940552a380736c70fbce2c87c
SHA512 29fccb8bf7a0ce8ee33b6bd4b5bc2bb4ed26ead9262b55c2c34a7b96b33304f4dec21f195f3703aeb94a747fb2a3d10a1f706f782c044af217541a5b33147b2b
TLSH
T169C09BD7291BC59F4B70EEDC2118B53DD517454C5CC4DDF8944D51535478F334405539
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe608409.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe608409.TMP
Size 157B
SHA256 837c99a2552f9ee803e312fa59adcf7b744633ab9416a918ff9f264e19046bc3
MD5 9a96af558c6a3e60bfdb58dc1956a074
SHA1 a0e6ee3cf080d6b567d28d1cf7d35df8392e4893
SHA512 f0250a888167518d1cb57591c894665f5cc65c2343edf2d9f91ab6db7cbb3c3ca920cc6e7f15ee6959746612d7e9b2b442f45dc892ff9dfbfe8824897a9e4dfc
TLSH
T123C04CD7291B569B4B7099D82128B56DD5174D4C4CC4DDE8944A71526078E334505639
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 9badf1a70f2954343bba418d4e85936eef74359c148477a637f4ec51126df8e7
MD5 a91f80d31f703606114ffb7d651c14ed
SHA1 b2dd0fbee33c3d01d953a6fa9a4ffe9f55ccdcb2
SHA512 729ba96224546af16c56720f702b513c22a84ca258daba5e854a813930435b15fc09111ab893dc22ca3c149ba672cdb855d7e492e28ea5752bc498bfc228c33c
SSDEEP 3072:vu9XIGuh92aJlBVvtGiDEx36zLRhQ8rf/9Dy0etHk0TF61qfd7NtZL8cHQRZEQ6K:2NE8wrGXN07QqtIHk0IqZ/ZLW3ExI
TLSH
T18F341239D7A10F3B9EA10A3838739E6F7FB544F0E078E201A7AD27EB65932612503954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 47f88d94d8a7524a7f0e9e686c39e12fb98bb3498e772f02fc9ade862c4928e8
MD5 7f2b0b7a3b4c9e387fdd09b3b2541f2f
SHA1 b664ee5adf503f10449714f0c7728eee50c3f34b
SHA512 58167d629a9b244402b2e3166919753dad3cd3fc3ac6bee1be152058eccb21210dd8187f2440485080d99dd1a57588db594695a27a9530c839848304d92f68e1
SSDEEP 1536:b9LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:vqfd7NtZL8cHQRZEQ6Sps3
TLSH
T169C30237EBC21F339D92CF64B9530FD6A7B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 276KB
SHA256 70490e6be2271b63ad90ab49ee44f91254687364d46da2cec9584baf690fc8c8
MD5 0a4ee6dd9b209b19ae36ee4ca8d947e4
SHA1 eb098a49d83a75f4586419374669e585e6e71264
SHA512 c33360a5e56dc553cf2873017ad8128489f7a20fca21556db569f08916c060f6524970678ae43e8369efd43106aa052cb49c2d0cb9b94d7e581c963ed4969eb4
SSDEEP 6144:2bIamqMNk/m0NE8wrGXN07QqtIHk0IqZ/ZLW3ExI:2MQSkPNENS27Q0IHk0IqZ/piQI
TLSH
T16C542336E7641E3B8EA11E783432AE5E3FF544F0D438D641A7EE67AF76431A0A413918
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 bed8c5a7a71360cec81c7a52264dc01e033ad97a55cdd3f64dca3c65dbc7045e
MD5 5e811098823e8723f351b2828ff9e027
SHA1 6e6154e002bc05f5b67572037779dcc8fe82b2bc
SHA512 8f54184ce1a369ec1d2894a2ad78188cfa2a632dcebb11d8da692d12e06b3101c411fea7010a9fd1d85e4ba6b5e04a4b8aa6b6ba31d49c37b4843b640127fe8a
SSDEEP 3072:ui9XIGuh92aJlBVvtGiDEx36zLRhQ8rf/9Dy0etHk0TF61qfd7NtZL8cHQRZEQ6K:uiNE8wrGXN07QqtIHk0IqZ/ZLW3ExI
TLSH
T1C334233AD7A10E3B4EA10E7838229E6F7FB544F1D578E201A7BD27EB75532606903854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 2ec424b4ee16e37c5ebe49ca3da72085fe60d7d602ca22ab22c84546bc06160a
MD5 e740f320fbc43480d10ee646dbe6bd06
SHA1 8b2d9380c52db747f0b5d6478fb99dbe42af7cda
SHA512 e119226287aef8e307af9597a348a5e77976d3b0a1e03e02b11096c53ca2e4c90bc3b474b9305c8f39796d10558a458d796a29d5b45a9197a002ada06be959df
SSDEEP 3072:qi9XIGuh92aJlBVvtGiDEx36zLRhQ8rf/9Dy0etHk0TF61qfd7NtZL8cHQRZEQ6K:qiNE8wrGXN07QqtIHk0IqZ/ZLW3ExI
TLSH
T13F34233AD7A10E3B5EA10E7838329E6F7FB544F1D538E201A7BD27EB75432606903854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 60346a7fe50aad7e557f41d46c8b42860a4ef674a24f2e09dd641efd9facaf19
MD5 76ef7e7782fe6f1ab53329dd0145f054
SHA1 33a710f6a88dbf7c41ecf2627904080395d2456e
SHA512 2096430489c3a09ff07542b77507ea17ea86b624ec0b2c51a5fec1b6960ba6e43bc23f11c1131ed9553bf03b51d147b050ecdbf20faea3cd17a31747c56a78b1
SSDEEP 3072:ci9XIGuh92aJlBVvtGiDEx36zLRhQ8rf/9Dy0etHk0TF61qfd7NtZL8cHQRZEQ6K:ciNE8wrGXN07QqtIHk0IqZ/ZLW3ExI
TLSH
T1F534233AD7A10E3B5EA10E7838329E6F7FB544F1D538E201A7BD27EB79532606903854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 d1b93111cb0992f940e54ddc1bf3a473c04c721dd643b1717ab75eb729048f00
MD5 89c9c3209021afcbaed6560ba6259cb9
SHA1 d91e9536e6cb75e2dd4ae41b30e4ad96c0bc3fc2
SHA512 d14d15f7931a712ea9127d77c551f21352c16bb8a36666226d59efc704555f335543da14969f2bf0700b3152b74154d33d64969b3faf176836e7a4a1bb20cbe0
SSDEEP 3072:li9XIGuh92aJlBVvtGiDEx36zLRhQ8rf/9Dy0etHk0TF61qfd7NtZL8cHQRZEQ6K:liNE8wrGXN07QqtIHk0IqZ/ZLW3ExI
TLSH
T17934233AD7A10E3B5EA10E7838329E6F7FB544F1D538E201A7BD27EB79532606903854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 992c60235db5d7f852479c3309478683b34331ff2f82cbad2619867a5b372c62
MD5 a10ff736ac97cd77f49a8ee495fb6c33
SHA1 2433563f2036cb26bcde93fc9773a64b19b541b0
SHA512 5539299daa44c5c0ea30b386c00d19364db36f5425ec4dd42c8482a2a318a767804b67531a07bf7664d7a213ae58001207286a8485d24ced61b50ec0dbfb5cc2
SSDEEP 3072:Ji9XIGuh92aJlBVvtGiDEx36zLRhQ8rf/9Dy0etHk0TF61qfd7NtZL8cHQRZEQ6K:JiNE8wrGXN07QqtIHk0IqZ/ZLW3ExI
TLSH
T1A134233AD7A10E3B5EA10E7838329E6F7FB544F1D538E201A7BD27EB79532606903854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 49c7f9db422678b7fd31dec86d8ab9e1128a0305abf3c4de831ab00f472b135e
MD5 0ea0d836262e3a5cb432b113f3e2a489
SHA1 f8582a3dab727801d7ea0e395bc18512a2e9bd5f
SHA512 eeb601b97e6c09ec90ada61c94e941b3d516ffa2ebec23e0e9c397b53b8daa89f126079cc5a3735db8273ebecc899449daf763723e842f407359bed07a3458c2
SSDEEP 3072:7u9XIGuh92aJlBVvtGiDEx36zLRhQ8rf/9Dy0etHk0TF61qfd7NtZL8cHQRZEQ6K:yNE8wrGXN07QqtIHk0IqZ/ZLW3ExI
TLSH
T16A341239D7A10F3B9EA10A7838739E6F7FB544F0E078E201A7AD27EF65932612503954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5ef87265fb315ae353f8956fe1637a70ca75d0378e75d68dbf9b58fa31835c95
MD5 912bdf113fdea1155b0bb71c70fc62ce
SHA1 052925f70ca969f313ab3aaeed0df4da91409ba6
SHA512 5c32f1fa9e8a135369e8504b0a4a8e5eaf2a496ca55168f52d194647cc5d05ca5cd548a96e485542904dd958fd50a5f59b2b35eaebc4f4e67f470b7b723ae89a
TLSH
T1B8D023317B65AAD1D135357AA4304741BF250176239DC1176154840CDC7D4C65BC97C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

7e0bc0e0-4df6-43c7-bbf4-d7b2f395013f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e0bc0e0-4df6-43c7-bbf4-d7b2f395013f.tmp
Size 30KB
SHA256 64c62a1d41567da8dc67de6ef19f8ecadb8febc327eb67e07d1b4e60b6718747
MD5 b99d1ee0b8dd70ed5a93488768c91933
SHA1 97a5782cf65b2da70897e9325be9911c2017521e
SHA512 6857613024224798ed91b3e5a73d7cf3a4c28b45b22c7b212c2268b5a962d54196f44e68cd49aa197eaea382948fc0916f4c99b3e5a738960345fffe60749e4d
SSDEEP 768:0K8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdHroLkfUnl:0K8iJPNWvx76ru1jahALocdUIUl
TLSH
T11FD20A3B680CCB7E4F844E9CEC266F966DD801CB5B944D5447FA884C03CB6EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 284KB
SHA256 f2c1d3b70903e152c0b49a706ba0bab13ec9dfaa28dc2019e4404015968c079c
MD5 57ffb958ab444f82647b403e2f657ce9
SHA1 1c2e1e0bb9c4627453c88ae3bc2b89c964c3c31f
SHA512 ce284b924ebc9e906d9fa19a3dd777b1313f2f59c8ebbd8f39fc6e61310fac216a94b3b42fb526a4e782c334792237d39c6290915b102246167a5c50760ab534
SSDEEP 6144:At4Q2frJUO/RRe1j1F7Ex9Q5lyMBBfcEoIfpmO1eL4klR:AqQ8rJn/RIp1mDKlXXfKIhezl
TLSH
T1FF541287FF119ADCC4414B30AA1B86A1D56CBA740F710AEB276777572D36FC0893A398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e5acda2e9161204ee30ce4d3f86ca1fb9c9844c0de5a73aa348d884afb409ae5
MD5 a3eed3bb0e5dc7bd4df6b33e0d12a825
SHA1 f702a450acf6d8f001cccc26e35b9905166fbd1d
SHA512 215798c9fa5291fe189b72061771daa94435b36a152188c9bcdb5f5f6e2f3fe66de2a6cdd9b8784761eb3f8668b1cd2259f567f5b0cf2cf26155b034ac452106
TLSH
T1DE713C7911D227A6E38A3633E2F2160A30708FA90F137D211174F93ED819B166736DF8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d2fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d2fb.TMP
Size 3KB
SHA256 11b7ed60dbd8e66ee4832adc60028bf642b4cfceaf2765e13a7a0953fb179aa3
MD5 61f166288ed6d84f0357b9eb1e23b6bf
SHA1 5cf2d818107102ef18aa8ef310aa836a7959ecb8
SHA512 16aeb26141f8d067ab8d24f2bff403139ad2c298920441b0498753852b75b56bd8e31c13784085ba32b2cec8f406e895d151090600cf73cc620590c7693e70f3
TLSH
T147713C7911C267A6E38A3533E2F2160A30708FA90F137D211074F93ED809B166776DF8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 363b930adc617867e532ceb4c895956e6e202dcbc5f6af345419a7778c58a68a
MD5 e391ef0f88c211ec298f25d89eeb970e
SHA1 7c7cc293e6c5522a1071ef487a6b1bc07b019239
SHA512 8aa8eac31c90e1ed77cc5ee5daede6a76a924961874763efb7a622e75c5c0e08908e7751abcbad214f2a6ec9582a79856f1a6ef445aa5cdb5f78df3ac74dff9e
TLSH
T15121CDB3C6D9865EC84506F06A247E2BCE1D095443293D1B89E4EF5BD7E30B5E10184F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 44848f113f81673cfe60261c373d8ef2978402d7e200341d7ae77c16f791c81b
MD5 031003fa6a194b34cc519b27d114bf88
SHA1 d807eb09aefb75b9cf258270ceddf0b60c732d96
SHA512 da81f78af695f7b56ea22e05f01cd9a1f1a272c1f87f4892d6ad01801c988d634e519030b716e94df1c889df02f6f737f017ff6a15bc511459003f64f85344e1
SSDEEP 192:sxZsRSyM/jK1Ml8a9h/ftsSWpVC+uyNIdpJHW6+WNGY42L2o1IgbSAJ:sxZsw9h/ftsSWvC+uyuJHbG8z
TLSH
T13C52D916AA34997BCCDBD20DFA557F53D6F90423A6900E44A9FCCA1C05E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8007b99b5d8d7031f6b7f849b0cc4ddc3d526fd8bdf13abec4f71c90ac56a0c6
MD5 be7dfbd877450772f3f60f5681b2aeda
SHA1 9c803646f3dba6c7bb4b5066fd15afebe7a305e4
SHA512 62df869954ac705e7af9ad82f36aac287c70aec779b176908cabcb3422cbc1fda5f2cb690fca9210ac82756a89e94fae1d79b5534806094a4d48add73116eee7
SSDEEP 192:sxZsRSyM/jK1Ml8M9h/fts6+uyNIdpJHW6+WNGY4kLoI3IgrJ:sxZsw1h/fts6+uyuJHbGa9
TLSH
T1B942F8126A38597BCCDBD209FA557F93D6F90473A6900D44A9FCCA0C05E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 580adda994ffcfc8c9933574934e38d101e706e7ca158cce569ffaa045dd7719
MD5 b91c42f60771d91fcbe3f71e95e68b91
SHA1 e2e0b5b7ec9c51b0490d61ac5367871222b738a7
SHA512 0aee2c653310029314d6546cc7db1bdc2f33cbc7535dd27be6a1cb62243847a1e2211759af112ceb8c3c7b889bb0fbb150b49443ab0327529697fe8f573a1db9
SSDEEP 192:sxZsRSyM/jK1Ml8Mjh/fts6+uyNIdpJHW6+WNGY4kLUI3Ig5SAJ:sxZswbh/fts6+uyuJHbGO1
TLSH
T15052E916AA34597BCCDBD209FA557F53D6F90473A6900E44A9FCCA0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 327b0ead046092ec098989f504649f225afc4ae3d166e30557bf3f1c7e0c7727
MD5 ecad0169e8fac89f97bf95352ab89afb
SHA1 9af87d1189a2eba0f98264e4d467ae40a7bcdc49
SHA512 3e3696503c07210b1ad08d0c47e04289f54e208b51d76043ef22a7777dc7581c2eed0a4b7f853b4b5cdd7edea236bac5ecff3fd50ceb21001d2716240707d54d
SSDEEP 24:KdiflELfEyEREIaENdEBEhEx4ElEB+EsIjEdExKiEOhaEzEx1EELEhSmETMEW8Ev:KV9IhKe0sbyV1INKGQAWdIhKG08Dyu
TLSH
T11E914221F4F7A3013C3E65189654866A078279733119E47F3BA941E25F2BE250EFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 585b859c4cc93e32254d5fa06551cff794995601720443a8a53ed50edf69031b
MD5 5aa5f93f6121a33eb0370402eb669a9f
SHA1 da2d9a7d6459da10df221b6c06bd73fb07777712
SHA512 b50495ead4a83d59403c1b769a780f3adab3be565598cd2a1c933bfe2898cfb4e96bbcfd1ccecd2a935987bd76bf69bbf6cfd814339ad4360b0066fd2e9101a3
SSDEEP 192:gONv6kDfQmiUygUZ9035jzorkbravWQijaU6:gONv6gh+Z9g8kyv02U6
TLSH
T18002EA3568782CBB8EF3AD49B44B27275FE5112BEAD52F84DAE81B1C40C765C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 51da38cfbc5057c0c1b15ef2ce70259111ff668669c1c8cfa4ff3461bebfa050
MD5 7ddf1076f6a25278c4f7264050394f4a
SHA1 6523ac333928b128948c79043f1f7940da07afe9
SHA512 627e73a34d4ebfacaa465a73b3307c9e0c32bbd33f8eba177289dccd1d1b02175593a648ad47952de0ea7a79baee5b01977d8d8267642cee34281d84aae5d306
SSDEEP 192:4ON56kDQmiUyYUh9035jzorkbrav7XHNNoGcRsqeU6:4ON56I8h9g8kyv7XLoToU6
TLSH
T1A412193268786C6F5DE3A955B04B32239EE54227EBC97F94D9EC1B1C01DF29C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3bb72c166ca3361b1339a929ee6bcb5e038a3f68dc701ea9f1e230dbfd0029d2
MD5 710b3f15b4b64a74f88e9405a267f1a0
SHA1 cab5fa2f7248690b0f932c0b18fe8e1f620615c6
SHA512 c25df467e11a8d3f44b8cf0701cd88389be887bd4e8d74c193c592071cbc8d35bf8dbd4b15a9e0a1e5c763bffc55ca104e1366b26890f0c375bc5d23a1d85257
SSDEEP 384:BtNn/s3n9SesN6aht+zkg8kyv7XLoROhvFA8Bvq/oz96MQtmn15wbAjElK:Bj+9xFEbsRM68pz9hymn12bflK
TLSH
T163C27D71D8681DEB48E2D9C9B50AE2176DA8053BC6C91E1CD6F87B3931DF6F81321C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7794ef93c4f399f2c6e2ca7d4d1c795f5296f8d1630ef3afc282eeadca75035a
MD5 3a06de72dcf7d133dfb4c0116409cb56
SHA1 19aeed4cb4d24f4998812d52c00cb026196134b3
SHA512 0b82087ccbb29d4487cac2e0307c71036a936c18ff74492264d05dec62466366ae3ba86cd7c25a2f2e8002e180c3c1886d26373dbc348990ee42c0d7d5ca122e
SSDEEP 384:QtNn/s3n9S5IsNI+hz4zkg8kyv7XLoKomn15wbAjElK:Qj+9BhEbsKomn12bflK
TLSH
T16D928D365C385D3B1DE39589B00B322BAEA58537E7C82F98D5EC4B0D05DA39C131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5fd0647946ee3354d248b9f614927c54a2bfc244b950d0dff067496f23063929
MD5 ac53993edaf6efcc4ebc7ce685917623
SHA1 022d2bc7d5fbcce84661d015a253822d5c5d6f67
SHA512 8c2261234b10ca5e27d5ec8d5188d4535349ef22a0302b286579dccba3103034dfd7cdca5dd838f6de720deacfa3a1a236bb2f9cd116ba20dbc903247d2a5656
TLSH
T1DA41D858AAFA1154B7B7AF4AABF6A86E447EBC772F07D45D00110D8F0A63740C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

Startup_Apps.exe

Path C:\Users\Admin\AppData\Local\Temp\62F00E7B\Startup_Apps.exe
Size 1.1MB
SHA256 671ec5abb5b38af47b70fb8edd01dd384bfd15eeb5dd4ee1333c567afc0cdf72
MD5 d81a56aa9ef88734187fa0c6f284835e
SHA1 86d7b73ab50ddde15a59bf198a61ab1c93e4d3de
SHA512 ef19a025f8b044de1a1054a6e5b9cd85cdd38293cd062a46eda770b75c331f518506f8afdf50c10fc13f7f1216a164cdac2994545e9e06086d8b31fbb9a69b17
SSDEEP 12288:mZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGGvPqItNquB:mcb4M06WpoPrwpvP3f5
TLSH
T1BC357C83EBA3C5D8C156C8B5534BF137F9627C8E4A157196ABC41E633E67B64E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1a30578-b040-4ff9-86db-454fbfcba2e6.tmp

Path C:\Users\Admin\Downloads\b1a30578-b040-4ff9-86db-454fbfcba2e6.tmp
Size 31KB
SHA256 50330264bd58dbaa9b703a49f6c1bad438a6d4b50ebbe62c8dbec45088df6173
MD5 6f70554cc55ce90bc5fad3d0c4d07bfd
SHA1 69c6e34b656b3fdc38ecb47dd173c7c044127889
SHA512 1a5f9bd0459ebced400ee281240524e6df7ee8f3e439b646d8d6851aeedc541adf63debfe7d814ecf38743691edc0b949d4d7d4942404644d2d482a0cee0745d
SSDEEP 768:pB/biQ/HfPfk6C3rPxyWexVoylUBQyk02DtPuM2ts7oV:pBi+/Pfk6IrPx0VSjInwsMV
TLSH
T1DEE2E153E8281DD0E23B61358599768554F152F8B5D5BA2E3E60B0231EDBFCAC9C22E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

die_win64_portable_3.21_x64.zip.crdownload

Path C:\Users\Admin\Downloads\die_win64_portable_3.21_x64.zip.crdownload
Size 24.0MB
SHA256 078f2934f267392247f9c7b759a1c2457a48bc2000b25b80c2f129955ee4a3b9
MD5 039c279693597cecb3c2a67786a92149
SHA1 5343f3785f971ef9211b225d4bd5c0fe78a090ab
SHA512 b0ca7cb1f20f6d8ed73b9390d143d7bd098db77580eda95aa53351135461a1dc422ca83cebb2f9cf56edea1be591e008d577a4b6d83da64167d03113544b176a
SSDEEP 393216:XkNWJN+ZDfJt3fTodgqpeLT4rBbEzxrcG14aG8MzuFUEq9Ee7ejH1OtMlLc9lvIn:XcMgJJt3fT5q4Hr8aLIvZSLk0Kyi8f
TLSH
T1B247335AE6192347C0AFDBBF24DB8279EF54806F02B9E327076964552E836C11F3970B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-1506-0x00007FFB0E400000-0x00007FFB0E941000-memory.dmp

Download

memory/408-1505-0x00007FF6D2310000-0x00007FF6D3160000-memory.dmp

Download

memory/1228-2409-0x0000023F0A1C0000-0x0000023F0A715000-memory.dmp

Download

memory/3392-1486-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-831-0x00007FFB118A0000-0x00007FFB11DF5000-memory.dmp

Download

memory/3392-1368-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1363-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1440-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2080-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1361-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1359-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1341-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1312-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1004-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2068-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-867-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-864-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-862-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-860-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2023-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-850-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-843-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1470-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-842-0x0000000067840000-0x0000000067855000-memory.dmp

Download

memory/3392-1428-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1480-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1482-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1516-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2308-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1496-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1919-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2330-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2344-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1859-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1512-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2362-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1605-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2372-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2374-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2376-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2378-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2380-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-2383-0x0000000067840000-0x0000000067855000-memory.dmp

Download

memory/3392-2384-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1514-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1520-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download

memory/3392-1518-0x0000020630970000-0x0000020630FAD000-memory.dmp

Download