hxxps://mega[.]nz/file/Q3VVBJwJ#ZhpWYtgShxrz10gIA_zRjd_WOS-C0aCaUBmMqm7u-Ic

Analysis

user interaction
yes
max time kernel
900s
max time network
882s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
03/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/Q3VVBJwJ#ZhpWYtgShxrz10gIA_zRjd_WOS-C0aCaUBmMqm7u-Ic
Sample260903-ppvbbsgq41

Score

7^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Executes dropped EXE 37 IoCs

pid	Process
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
904	ffmpeg.exe
2036	ffmpeg.exe
5244	ffmpeg.exe
5400	ffmpeg.exe
5468	ffmpeg.exe
5808	ffmpeg.exe
6036	ffmpeg.exe
3472	ffmpeg.exe
5052	ffmpeg.exe
5320	ffmpeg.exe
5420	ffmpeg.exe
6048	ffmpeg.exe
1500	ffmpeg.exe
5292	ffmpeg.exe
5684	ffmpeg.exe
6076	ffmpeg.exe
5768	ffmpeg.exe
5924	ffmpeg.exe
6132	ffmpeg.exe
5396	ffmpeg.exe
4340	ffmpeg.exe
5464	ffmpeg.exe
5980	ffmpeg.exe
5308	ffmpeg.exe
5620	ffmpeg.exe
5324	ffmpeg.exe
2196	ffmpeg.exe
5444	ffmpeg.exe
184	ffmpeg.exe
6136	ffmpeg.exe
5952	ffmpeg.exe
5544	ffmpeg.exe
5352	ffmpeg.exe
5304	ffmpeg.exe
2196	ffmpeg.exe
5332	ffmpeg.exe

Loads dropped DLL 1 IoCs

pid	Process
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Upload Patcher - Kay x Kaz (audio multichunk Method).exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
70	api.ipify.org
71	ip-api.com
69	api.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3904	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329122596789446"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e8005398e082303024b98265d99428e115f0000	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 7e00310000000000235df163100055504c4f41447e310000660009000400efbe235df063235df1632e000000a9760200000005000000000000000000000000000000fba3f000550070006c006f00610064002000500061007400630068006500720020002d0020004b00610079002000780020004b0061007a00000018000000	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "4"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616257"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupView = "0"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:PID = "0"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Videos"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByDirection = "1"	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Upload Patcher - Kay x Kaz (audio multichunk Method).exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
4544	chrome.exe
4544	chrome.exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
3512	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeRestorePrivilege	2916	7zG.exe
Token: 35	2916	7zG.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
2916	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2184	4544	chrome.exe	83
PID 4544 wrote to memory of 3904	4544	chrome.exe	84
PID 4544 wrote to memory of 2188	4544	chrome.exe	85
PID 4544 wrote to memory of 2188	4544	chrome.exe	85
PID 4544 wrote to memory of 3804	4544	chrome.exe	86
PID 4544 wrote to memory of 3804	4544	chrome.exe	86
PID 4544 wrote to memory of 3572	4544	chrome.exe	87
PID 4544 wrote to memory of 1192	4544	chrome.exe	88
PID 4544 wrote to memory of 3572	4544	chrome.exe	87
PID 4544 wrote to memory of 1192	4544	chrome.exe	88
PID 4544 wrote to memory of 4656	4544	chrome.exe	89
PID 4544 wrote to memory of 4656	4544	chrome.exe	89
PID 4544 wrote to memory of 464	4544	chrome.exe	91
PID 4544 wrote to memory of 4180	4544	chrome.exe	94
PID 4544 wrote to memory of 4180	4544	chrome.exe	94
PID 4544 wrote to memory of 3436	4544	chrome.exe	96
PID 4544 wrote to memory of 3316	4544	chrome.exe	99
PID 4544 wrote to memory of 652	4544	chrome.exe	100
PID 4544 wrote to memory of 3440	4544	chrome.exe	101
PID 2580 wrote to memory of 3512	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	106
PID 3512 wrote to memory of 4716	3512	msedgewebview2.exe	107
PID 3512 wrote to memory of 4392	3512	msedgewebview2.exe	108
PID 3512 wrote to memory of 4392	3512	msedgewebview2.exe	108
PID 3512 wrote to memory of 4392	3512	msedgewebview2.exe	108
PID 3512 wrote to memory of 1072	3512	msedgewebview2.exe	109
PID 3512 wrote to memory of 4552	3512	msedgewebview2.exe	110
PID 3512 wrote to memory of 4552	3512	msedgewebview2.exe	110
PID 3512 wrote to memory of 1536	3512	msedgewebview2.exe	111
PID 3512 wrote to memory of 1536	3512	msedgewebview2.exe	111
PID 3512 wrote to memory of 1536	3512	msedgewebview2.exe	111
PID 3512 wrote to memory of 1656	3512	msedgewebview2.exe	112
PID 3512 wrote to memory of 1656	3512	msedgewebview2.exe	112
PID 2580 wrote to memory of 904	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	113
PID 2580 wrote to memory of 2036	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	168
PID 2580 wrote to memory of 5244	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	125
PID 2580 wrote to memory of 5400	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	127
PID 2580 wrote to memory of 5468	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	129
PID 2580 wrote to memory of 5808	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	131
PID 2580 wrote to memory of 6036	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	146
PID 2580 wrote to memory of 3472	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	135
PID 2580 wrote to memory of 5052	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	170
PID 2580 wrote to memory of 5320	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	139
PID 2580 wrote to memory of 5420	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	141
PID 2580 wrote to memory of 6048	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	143
PID 2580 wrote to memory of 1500	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	145
PID 2580 wrote to memory of 5292	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	147
PID 2580 wrote to memory of 5684	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	149
PID 2580 wrote to memory of 6076	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	151
PID 2580 wrote to memory of 5768	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	153
PID 2580 wrote to memory of 5924	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	155
PID 2580 wrote to memory of 6132	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	157
PID 2580 wrote to memory of 5396	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	159
PID 2580 wrote to memory of 4340	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	161
PID 2580 wrote to memory of 5464	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	163
PID 2580 wrote to memory of 5980	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	165
PID 2580 wrote to memory of 5308	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	167
PID 2580 wrote to memory of 5620	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	169
PID 2580 wrote to memory of 5324	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	171
PID 2580 wrote to memory of 2196	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	189
PID 2580 wrote to memory of 5444	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	175
PID 2580 wrote to memory of 184	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	177
PID 2580 wrote to memory of 6136	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	179
PID 2580 wrote to memory of 5952	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	181
PID 2580 wrote to memory of 5544	2580	Upload Patcher - Kay x Kaz (audio multichunk Method).exe	183

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/Q3VVBJwJ#ZhpWYtgShxrz10gIA_zRjd_WOS-C0aCaUBmMqm7u-Ic
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffd7014c728,0x7ffd7014c734,0x7ffd7014c740
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,8102842940015569477,16709296397209407592,524288 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,1977401162771632257,16106435477269854977,262144 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,15546611405281864566,14933763218919760248,524288 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,2464685872911613480,2014614703070067473,2097152 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,15609266535863859009,10811137027744631195,2097152 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,3787169268529433761,10943878466682085777,2097152 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,9388789872448118813,7670276731168784840,524288 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,13264841025450478426,14272662361331695994,524288 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,13793702758034826187,17935055497247916935,524288 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,15688885625029439194,17816603224095074672,524288 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,557066868637168477,2020775576662950656,524288 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,12107531686862980209,17200467858064450238,524288 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5204,i,12116450692394586971,5296275823159601481,262144 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1064 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,13670574551223986703,13657096400542743874,524288 --field-trial-handle=2136,i,17999028883990594182,2026034482481600170,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1228 /prefetch:8
  2⤵
  PID:5680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2920

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\" -ad -an -ai#7zMap28929:114:7zEvent8754
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2916

C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe
"C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Upload Patcher - Kay x Kaz (audio multichunk Method).exe" --user-data-dir="C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2580.1812.16130592784076407223
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a4,0x1a8,0x1ac,0x180,0x1b0,0x7ffd5e84b078,0x7ffd5e84b084,0x7ffd5e84b090
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView" --webview-exe-name="Upload Patcher - Kay x Kaz (audio multichunk Method).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1836,i,14274220545471126074,2918828870598252055,262144 --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView" --webview-exe-name="Upload Patcher - Kay x Kaz (audio multichunk Method).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1948,i,14274220545471126074,2918828870598252055,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView" --webview-exe-name="Upload Patcher - Kay x Kaz (audio multichunk Method).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2216,i,14274220545471126074,2918828870598252055,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView" --webview-exe-name="Upload Patcher - Kay x Kaz (audio multichunk Method).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3508,i,14274220545471126074,2918828870598252055,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView" --webview-exe-name="Upload Patcher - Kay x Kaz (audio multichunk Method).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4216,i,14274220545471126074,2918828870598252055,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
    3⤵
    PID:1656
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -y -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -vf scale=480:-2 -r 24 -c:v libx264 -b:v 500k -an -movflags +faststart C:\Users\Admin\AppData\Roaming\KayxeKaz\demo_compressed.mp4
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4"
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0.5 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4"
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -y -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -vf scale='min(1080,iw)':'min(1920,ih)':force_original_aspect_ratio=decrease:flags=lanczos,fps=60,setpts=N/(60*TB) -r 60 -c:v libx264 -preset slow -profile:v high -pix_fmt yuv420p -colorspace bt709 -color_primaries bt709 -color_trc bt709 -color_range tv -b:v 24000k -maxrate 30000k -bufsize 60000k -c:a aac -b:a 320k -ar 48000 -vsync cfr -video_track_timescale 15360 -movflags +faststart -metadata "artist=Kay x Kaz" -metadata "comment=Patched with Upload Patcher - Kay x Kaz" -progress pipe:1 "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original (Kay x Kaz Upload Method).mp4"
  2⤵
  - Executes dropped EXE
  PID:5468
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5808
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:6036
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0.1195 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5320
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0.3585 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5420
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0.3585 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:6048
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0.478 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:1500
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6036
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0.478 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0.5975 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5684
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0.717 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:6076
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0.8365 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5768
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0.8365 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5924
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 0.956 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:6132
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.0755 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5396
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.0755 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.195 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5464
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.3145 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5980
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.3145 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5308
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2036
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.434 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5620
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5052
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.5535 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.5535 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.673 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5444
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.673 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:184
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.7925 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:6136
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.7925 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5952
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 1.912 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5544
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 2.0315 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 2.0315 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5304
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 2.0315 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe
  "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\ffmpeg.exe" -ss 2.151 -i "C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\demo_original.mp4" -frames:v 1 -f image2pipe -vcodec mjpeg pipe:1
  2⤵
  - Executes dropped EXE
  PID:5332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 195ed6a6adbb4e7b0e11784de6be4d5f5fbb7239261f383767cdc05e30e3125b
MD5 b2ea325b4b44984e805b8b8e1245f1ac
SHA1 e8fa09cc3c3e85cfa0812b8a29dd99c8f6a9328c
SHA512 a16f1cd3c275c0380e43ba1f2ca3a88ec952cfdfbe80671109b9b64b12e7ce74b7140ee1fc0947cc8c9ab49f747f702e6b8f563c75f367773b7b751660cefe56
TLSH
T1B8E02B65C821FD3B0CFE1B1D50508A42E65463672E508E5F3B3D81098FB57364AA6C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 a4b21b1c9e492c01b983d6d2329b86c683c6a4b9d39a1c15d7be96cc1acba17b
MD5 61f456922da20f11fbefd841b345f389
SHA1 6510a2cbcd9adfb46780283ae6c6443c80029b03
SHA512 d5618a53219587ba41ab05055237d10fdd445620b555dfe3417d6a895b69046645e47026defb521d219f7fe00c8f226d1a0f4f00b2e68b00c19208779d88cfe1
TLSH
T102B0122011E68206CA5087B81061054C71504C52110113438680A05044F1295D245021
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 78babd59500194a39c072081640f2e7e3c9042a866c346941a7b7f4cce051eef
MD5 b2ae83cf2855cde620959d9c12853699
SHA1 9866529d928bc10108dd24a98e71268dcde8d0d8
SHA512 e26e76ecb56886f6e5dd3ef80aaa83c2ebb2163f07fe1f344aeaea6911ab2f47b537758b4e3b43e22530067dab17b16d993ecdce4ef0cf5c907b1f461d0968d0
TLSH
T1C551ADF783B4C67D8A1196F4EB156F1FCE290514432C3C66C8E4AE1B93E2972D10078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c3873afe9ab36fcc2a59a1b4130cdca6dbca26cac18eb095bf49427fe3e58270
MD5 0f36d3d559af71db86c3754baae7c23d
SHA1 069e0062cfaedb507171f53834bb193651a78d88
SHA512 469db0eda90592be4a46b6a5dbeef9ab7b1403c6ca95754f2e167a1e134ce733eb2cf85d396d27a1c10e94517f6e53e392334e94d99c7ecb25eb4bb9c357d5a4
TLSH
T1EF519CF783B4C66D8A5196F4DB15AF1FCE290524032C3CA6C9E4AE1B93E2572D24078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 58cd75b4222972ca6cfcb38a268b0e942ae216cd182b616f97bf9ff0aab6cb0b
MD5 4cdce72bcdf73f3fd2a22dcafe07a3e6
SHA1 7e3796b68e3a3b9fc122e3c14bdcfba8683ca329
SHA512 9f6c37c60175e19baaca7aadbccdacbb4f502925a2ae66de9a6d65f2d8a20ae5fb177d5f58814f76aea8757584e1b937d6b4d0eb7dc099a624fe5c75394f91d6
TLSH
T12B518FF783B4C57D8A1196F4EB15AF1FCE690524432C7CA688D4AE2B93E2572D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bee7ba01972c4cec66f9b7506394f9e61e79d9f1e92b34978cddf28e16433418
MD5 b0456382e3b24c82cdb0f31fe2a36d13
SHA1 4d88a68ecd28643756deaf520ecc4b36ef6db71c
SHA512 3dd6b38487c412099f28a32b1bbf8e280d093d088cb90e297fa3a250f34c2fa44979c08d811dbf8b5b1c1e8a1f65b301e7f5755337e370a14ed253a08dfdcf34
TLSH
T110518EF783E4C66D8A5196F4DB156F1FCE290514432C3C66C8E4AE1B93F2972D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 72271ea1ab67fac258f4332fff141fc5032e1b6c5af7f86686c3025d8036e8d6
MD5 c9210650968d1b157bc36a3084c70f20
SHA1 478697d7db02438e694afc205de34b124a391a78
SHA512 84d1e566986816fa849955250de4483b67c617260af5727eba87139b41dabe779a298e7901b3f44bf59becc67d4a67f8f92249e55206873a706c20528706f35f
TLSH
T1D3519CF793B4C67D8A1196F4AB146F1FCE690514436C3C66C8E4AE1B93E2972D14078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 33c78f32aabd625fc6da18e85d201991b56c56ea679be4d993b81e74b4dd7c4c
MD5 f9eb321701ab7949c88307e85712e153
SHA1 a1d632aaf9dbb46941a6870f4c7b2f34338f088b
SHA512 c1dce0dde1d7c7bb54f9dc679f40fd3bb168cc5ad649416455a8f181c250545f34ec8072bd42bf05f634887d014a943059566f3919f25e0ca3e38259958f681a
TLSH
T132518CF783B4C67D8A1196F4EB15AF1FCE690524032C3CA689D4AE2B93E2572D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 81a82cedfcbe96562cafb62034b4ca1de39dbdc1c53b252989c277863f4b57c6
MD5 e343754ab43027fbe700a10e91150781
SHA1 54419ca93535aba04c733a066ee1794d1dd2de77
SHA512 3e473199a74fc3fbb8022a675f3d992274a0c202735b31cf1eb258fc891f1a2a18e68cce03c8008751631f70407d4db3efc14bf2d43eb12fb3c6fffd12268d9d
TLSH
T1B5012B97D379F463107985AE5D08FC0D54B778360291A8E4DE6AC12CA0D55F31756813
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3ad3b07fce74262317dd772bb32645299a1571773ce6fd715e23b6f37236369a
MD5 9db1f45a98ca5b53b8d9c319d467b845
SHA1 ddf5973b98e79aea5edd46aa8a101003f109fe8b
SHA512 4d347533ade403bc4dab112d1282c480f92f343c27173ecc96198dba32678b64b7bc64a881f9dd48914dbfde3166d5130724a1c70cd1fa5f191e233d7313d04a
SSDEEP 192:CRBa2L/vh/F349Iv7bpAPRp2bd9/Hsb+WNn2HGRG2aSejX4U2KquVyIsnAUge:CRBa2xSUPUXm1wad2kX4U2Kqme
TLSH
T1CD42C829FA10753B6CDFD21AF9627BA3D7F5102221941E84EAFC8A2C05EB5CD621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 86e410075dd3570d015686293f52387f450439cad60c0964d2f68df535d4a60a
MD5 dc8280838fd2102df18f03cdf2a4fb54
SHA1 695809e98ca0d84470db49dfbe7951a7b7aec278
SHA512 a83abb1ab9db35a480a5ebe76cd8e6866dbf594ae32b45de4a4f1d38fc15f8db90414f57126b8b71adfd924d46e50065053426255c4c1840a459562779516212
SSDEEP 192:CRBWDL/vh/F349tv7bpuPRpYbd9/Hsb+WNn2HGgnerSejX4U2Kq2VyIsnAUgE:CRBWvxSNPyXc1wapevX4U2KqOE
TLSH
T15152C92AFA10793B6CDFE21AF9527B63D7F5102221901E84EBFC8A2C15EB5CD611741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5564b9d4a2f0608a8d952ea83e22317a101ec9265f29b8cb81a4e40f9e0035f7
MD5 7da563a0217e106a19cd08bfae2ca399
SHA1 75dea84d9832c830e4f838f294a8d30f5c05ec99
SHA512 255a2c8d9d5e2541a60c6f246bab6bff073d1c305e99fd053f2720206dda16e752ca0210f7d656734cdc81238404fc57f670df55afa7aee12c5014c03e4b36eb
SSDEEP 192:CRBW2L/vh/F349tv7bpAPRp2bd9/Hsb+WNn2HGgneJSejX4U2KqCVyIsnAUgE:CRBW2xSNPUXm1wapeBX4U2KqCE
TLSH
T17742C939BA10753B6CCFE21AF9627B63D7F5102221941E84EBFC8A2C05EB5CD611741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4a8de811b93ad52e9d4022e9fa8a9091cc20b5ffab88a1e0f530f17ec1f4af83
MD5 469645fc081cfe6eb6c54d3ab7d6055c
SHA1 a833172ee1a4cfdf987c031a33c493f52999a2a9
SHA512 e6874d4c0de8dab37c06cfe06c0e7f6a0485f59eca431899ec8c9501c7f2f35d5061c79cd8a90a2176dfdb88432ceb4ee67ce09a6e5a875caf924a573ae28e55
SSDEEP 384:RrjNI7KxkXqKf/pUZNCgVLH2Hfgsl4Tv7pLuLcSj/6XODNI+ErU3BtvHG+lGGEVP:RHNI7KxkXqKf/pUZNCgVLH2HfgsmT7pL
TLSH
T13D7209677C4C9A3B0F94C6CCE8177B4FADB5025B26E9886543FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 a09123b681754577e0603fcd1b4ebb452f6a3fa81c32127c8c6bf822bac40026
MD5 0e85bd1580d642b345f53d5dac56567b
SHA1 6b0383536399c580aab62c79e5e96ff25ee1f196
SHA512 0faf19f8f4aa0467120c0122fed0ff7d917a6f9c942da06b5b7e88ed08ee4bc21c15276e8cd5c8082fb2327bf9447bbb9bef8a6b0517b3683ec2776d7ae55578
TLSH
T1ABC01202C809E161C04A43B8157795A8B214EF24D70E27C896E0A912983952182271BA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dcce.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dcce.TMP
Size 96B
SHA256 6bcfeff7ecd487ddf2b65cde8f3e4699f7fcfbff9be529f52733130eb01b3c28
MD5 7e911e29de075dae1910594de52b5acd
SHA1 fbfddd302f59ba906ca28ded70f41537c04b3450
SHA512 029b05420411bf0c0a6ebbb56dee60671ae47a6d4a061c03023be2377dfa2c437687c84661e7170e6f2daf92597be61025410322d1e787fbfb6e5539c14c556a
TLSH
T128B00269C103A217C05243F036969AECF560DF25C643531692E49B67DC29E755629270
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6df37115ea615ae5572e590eab70016a8375fd5a25cebf896d2192087826086c
MD5 12809bb550d4fee09c6dd1e3f0214dc7
SHA1 447b6d682a60732ebd4b39380579a9a213d3d8b5
SHA512 59d2dfdb739ea512ce5acc4d18f20865e7916552fe382e40c89d76b5ad84e89d439ba577814ef698216cda2f5807f998301c1755f4bed2dbefc034b9f4239677
SSDEEP 3072:cTGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:cqm7Rkm1tYpBeh2BAo1
TLSH
T10AC312276E71E9375C79BB0EB08E0B1F1EF149A3C920DE8288D85B0477FA6CD1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9c8f4187827361cfe9926796bdbbb8c915c9437947fda63455357ad44b7f8338
MD5 5423f9eb37049da71eb375712111e4e9
SHA1 d549787c15cdf1bce0c46e067f652a82231dd0bc
SHA512 c1a3723b708530cb5e20bc8beae48edcfe1d61161a49f5e0e853c2c8ae7053dbf6d410923f4ad642105b6c003729040022cfde6dc21fc02ef8773c80c4669002
SSDEEP 3072:VGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:8m7Rkm1tYpBeh2BAo1
TLSH
T184C312276D64E9365CB9BB1EB04E0F1F1EF149A7C920DE92C8D45B0423E97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 62bd351a8f1117f2da9018e0132d07ce3e8614c63ebee8036082a06cab3c30f3
MD5 bd36e4ca01e80bd35d3d1368bd636823
SHA1 9d7d16ee646ae28bd32c2463f4ed4af389952e19
SHA512 0f1ce5538a84b895489057315d454378656d97be67113c3ee67ada605f49c2dc26d84f4bae8adb08a57318e37fdb27fc31b6bf0ed18584e3a6b6875a33048196
SSDEEP 3072:MGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:/m7Rkm1tYpBeh2BAo1
TLSH
T140C312276D64E9375CB9BB1EB04E0F1F1EF149A7C920DE92C8D85B0423EA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 bbcf2e4d38e2e112330caaf7d7779666da103905a918e77102030ca96bad6726
MD5 5b8e165fa0c4af7fbc07854e7cb39509
SHA1 0640933043054b570f40c48d8619e63f9600cb05
SHA512 eefcd9f1160487904256731dcfb6d58f2f40c61b8cf1d804f10d99a0c01097d5987aad7a7181ab6e98724bc84be64781d0944fce15c76e23465b3accb2fa3b2e
SSDEEP 3072:pGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:Im7Rkm1tYpBeh2BAo1
TLSH
T1CCC302279D75E8374CB9BB4EB08E0F1F1DF149A7D924EE56C8D85E0823E96CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a3e0fe85c2499562ecd5f9aadf09cde13b2e72c0fc4799847beb3093ca4e9562
MD5 51b626fac06125932e8b5d7b84881efd
SHA1 835625a55dfe2cc4ff017ac3c9d3cbf139fc28a1
SHA512 e3627e5f9b865563e0de40f3175f918cca3b32671e9fab8751c0747fbcb593c9e2aeaa42a161c28114b7f0abcdb44bedd0e9182eb989d52a459cb620c28d1efb
SSDEEP 3072:JGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:om7Rkm1tYpBeh2BAo1
TLSH
T177C302279D75E8374CB9BB4EB04E0F1F1DF149A7D924EE95C8D85E0823E96CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Upload Patcher - Kay x Kaz.rar

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz.rar
Size 35.3MB
SHA256 8db90f6fb8f258cb15fce5eb61e44b72b471b688e42fbda426c51207bf6b9e9d
MD5 828b8d3961382f4f6c92b4ab95d58e43
SHA1 87c797f5c1916f87a800968f2e1dc0243dc2e012
SHA512 9eb0255b46d6d8172954c780c58493b22279dee103c1b605bfcc82c33460dde8c16e79d153c8be8b6fe7f0cfd4f58d4c8098f236a4d893849e9bc9a98d8f631a
SSDEEP 786432:eGP7tXTLVMsvSQD8Rl4ItI++G8DrbLRISZ9yeJFvjyZ3:eGzF9Mul8IoIY2LRj61
TLSH
T1B48733AA06BCA134254C46FD2CB4CEB3425A7942B6AFD5B27D0D8E5806663443BD0FF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Upload Patcher - Kay x Kaz (audio multichunk Method).exe

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe
Size 782KB
SHA256 f326a2a1fecb08988ff5c3f84f908673620ef69ec5ec9fb219b9f46d4ee0632a
MD5 15a4c567445b5e282178b79010d4263d
SHA1 0946ea3e92ad53e53e1a3c2693c2251c076db160
SHA512 0b8897657853346d9dd287faf5a691542aac076dfb5b6da3dd6d9385eb695a6425d7e5adf60c26994bbb6cb41dc693e7533b236d529165846004ff9f987bbb29
SSDEEP 12288:V1L4s9Umo7tUulxManSqCZHtBHyVl5gG0P/ZUsZObJ8bJbvmb4HMRIbSbbsbrboZ:V1cmo7trlxMaSq0HSVlI2
TLSH
T1D6056DD8A75700F8D06590788D73D702E663FCC973669EBB16FEB6B20B164909D3A603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\CertificateRevocation\6498.2025.9.4\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Crashpad\settings.dat
Size 288B
SHA256 8158545378542f4fee90ed0772d5a5c52f114dbd0ba04167795c40ff8cd775de
MD5 13b3451b37adaa6508fc8efa856831ab
SHA1 1dcd899b9214c36556295cd0bec9388c0ee6faa5
SHA512 9d459583388be3de85277b2af76f41c7d68c297f3f4c9396bc153744af6d0428a4ae6955f5c1486d3fc4f21a63fdce8091cde3a712bfc8561da0c1d72016db5e
TLSH
T175D0C0A3F1124F70C0901373C007B0C87B02C50B23B525026838CF396F078D00D750E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 00bddb08c5ce38ffe0a1c392ceb50d73aad4ce6a091dfc7c23474f4a70ab29eb
MD5 4d6f52cef7897867e2d44f084b2b2b7b
SHA1 09a1543fedc6934497de8cab1a3e52cf1d503ada
SHA512 668348b5c8f0357ea7246f4dba95be7ce0a61bab67a6fdd5b2a93fc8db12b0c8e940d2d901ed56d5a1912b5d652153cd24725fd23cb7f18b48b062b6fd4e9dd5
TLSH
T162D02B1370409E34C8E021334003A0C93A01C40F42F12807943DC75D2F144D01D224E1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 408b965ee5a5d0c1bc716d3b9bd60127ede543d87211722eb921337ab3b00a67
MD5 d83ec18cfab570f00ba5653d48463d48
SHA1 2aa58c90e5283020ca3b7406f2bcf90e3aca2c39
SHA512 0e7bb240add6b7381f2c28a7233ec22ce294c06c8edb61340ce95215121bb3a650c08d1e7e294b8f6c22db9b387a754d3b1450cbbd1faf16298c55e02e3b4fd6
TLSH
T1A1D02B1371008E34C4E021734003A1C92B01C00F42F12807D43DC75C3F240D00D234E1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 3d0957cdb534c5d022774b7a6a5dc2eb635da9db96ff2df8296a96daabc97b8d
MD5 2d819fd71c180c4ff385a66dd25c19da
SHA1 1c7b46da25f36f5be78384c225dd30f7bb4f095e
SHA512 a5e5035ea9e9a4fd0eb48b477f6059b9f3522192db5b7732d47d9f60ed601087b2be891b8ac64b61e70ff6307570bede021349c9cebc61c87359be659351e5d2
SSDEEP 3:MsEllllkEthXllkl2zELNr:/M/xT02z81
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Cache\Cache_Data\index
Size 512KB
SHA256 eeb37b213fce342e27ffa8ecefefa81f5e5b492ddb1243809a90258d98e551a6
MD5 92beb31f3d0cb6be945c4b88aa85ef0c
SHA1 592818a0969a9d80fe3dbfd377602c9b0fb43623
SHA512 c9faedcd11a427e1d3b9deba30a8e1a940f36cecb7fa14418ca362a9bc033b58b154c97764675a0db73cace0a224dab15420884a09d1e4c54e157b1f28e78249
SSDEEP 3:LsLlkEllnllNzll:LsRkMlnllXl
TLSH
T1FFB4040407504144C70004F05041D1471075D0415C3553430031551041117C00703054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 0e502a7f5ff610ece0822801f54f90da021527fc2ff0c35f785d3b2531041d79
MD5 32e798e638bcb5ec1c15d668654ad70d
SHA1 b2dfe1f3e6e2750315de6056b0e5d39e1bd3863f
SHA512 5c6ac4de9ce377470813ed3dedeeea561761ab36de04ac43080fd8227f45ccef9503ae0ed1c7e6cb1753399b238afb74526a6d92491ba535d99c77c0fdd842b1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 88c299dd4b53c9d684f136220883457f1f49dbbd1270f780cab2a1757ca0ddbd
MD5 e665c7ece2fd311aff78ee1c5cfa0b64
SHA1 44281c6d43c6717e4b8afff6364fc3c971b1581f
SHA512 b81522ba9695b3e89ce8cf3c81e67e39f8d34d2bc6fa04befb1c2482b481f235a0c9e483abb5c0cb89d39fadefbb9fd769964aca0a318f2c2a4b460d90ba3f26
SSDEEP 3:MsEllllkEthXllkl2zEdEl/ll:/M/xT02ztXl
TLSH
T1124404447FC40C05CD0151304311C350C3F0DC100711DF4334534C535CC7DD00C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Extension Rules\000003.log
Size 76B
SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
MD5 cc4a8cff19abf3dd35d63cff1503aa5f
SHA1 52af41b0d9c78afcc8e308db846c2b52a636be38
SHA512 0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Extension Rules\LOG
Size 455B
SHA256 ddbec4d099adb08d57337cbd91e67ede3c4c691fb84c984b60c50836117b46c1
MD5 90d20693d64e29998e45af15d846c67b
SHA1 a6c8bf40c76d68c96a4f88e6cecdfd7f99746ef1
SHA512 6a78b44c68eb7d4f98e185b2764f96d5f65aadc21d5a44cb895be4875ba53a55982f708221b390005d874e4891ec17bf0bd6f862639cea4c75968fb751fed7ce
TLSH
T1D9F05493593586A5008F5DEBD1BC8362C747BA0BB6FC6F13380D960951AF64868867F1
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\History
Size 208KB
SHA256 e3184246a6b644177be57ef637545e627ad36a86b6ca8b6c3fd76a1e42544a65
MD5 ca9a55664741673616e376a606818ab6
SHA1 352a827aec96290a8586de2e4d630a5c32c777c3
SHA512 654fbf9890204439ed1b43ea1ef1f3324d382967a9f2367c3690cb73a43dbe11ea5a1f83e3b2da0c6c48c71535ccdb1c09f2013b3dc541cba2d52832f412b816
SSDEEP 96:7DWO2yN5svLNuejzH+bF+UIYysX0fxQp976LAt/6L4ZL7MvEg63Dy9bb1OfpPfQV:7eNtH+bF+UI3iWGV+AQQ7MviilX
TLSH
T1F224300E5F353712CDBD813669E654A35D7DF03F8B2226DA786104B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0144a78028fc96e7d6b17868b8df03e0ebeabd70c61700af3f09f68f77c10cf3
MD5 3ccf5b77b3b8774fb207cf11efd2999d
SHA1 5b6c8129a2b047dcdb8cc5206daafd41de9f4eff
SHA512 e106deac07259eebb95283c6f1563548b10e3823d8fd3e1231e309275f90b995775a28aacbd399c5d61120373cf5136f64819f5317f6676d89d68fe8c0e9a244
SSDEEP 24:TL4LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:TKLopFMatSaw/auUOt8B
TLSH
T159928A4E5F346220C0F44B36EDD189672F7C212CD3B72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Device Bound Sessions

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Network\Device Bound Sessions
Size 20KB
SHA256 5dea582961aea120ccfd668da5da2b09bacfa18d7d8adc3c1b741d2434ed4760
MD5 d7c66d4b4568a64f29fe7ee25182cef9
SHA1 37b7dfbb7cc0b792070fb5943fa048545fd297b7
SHA512 77b677dca2fecb3a309c29545f4786bab7f04499383d14a9df43d15448311baa2a3b09106d7a96af6441a76c63e0672cb30e85d0261fa9a06c9cbe337e763536
SSDEEP 12:TLy4Y5X14FGvRK9FxOUwa5qguKoiZ75fOS:TL0L9M96UwccKom5fB
TLSH
T13092C0CBAE1B6577F85BC77945E622F20F76951C6780DD4242B4E8009FD4EC401AD45E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 172B
SHA256 30e5e2b56757a2d6aec0ee6bf3c4e8a4da19c6cfd4c55e3ed67538bb776cc2de
MD5 83f29c1b3b4d58f7d3f0ec45fdaea70c
SHA1 2e332f377cece3079506e09ce4ec656efe4ad766
SHA512 a55edfc9b9f6d81b8cd9a5d950c2e3d9d2cf622937bdb52414711230b25745db73101d56c59234c17c2fcf863933abb11080dd70750b714c2fc7c6a2782232c6
TLSH
T11BC08049905039EF0747C754152CB433C6F940C7435CC995D93C774F53721AD581485B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 387B
SHA256 a4da7f3fb0d6d88e69b0b558bb55a888e026f847ff050bbf02d6a8168ea8ac12
MD5 1c35f621e8f81441e84b304852cbdcb0
SHA1 89e84afc355c8bf4c7eb6214350308c04c830030
SHA512 a870c092af179f9f7f3d12a7227ccc6877618d7befae69d7a7f10864eaf68ed30c18b0824cdeef195fcd1fd90b0ae19350aec2b0fb20da932ff4ef975b9d3dbd
TLSH
T1F1E0F146D0E0397D064143F023283533E2E9448A431C5C4AD9F8EB0F83E50FC540440B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 bb4b94c440df5c493a205aabc4d44cd7a9059a1424db1641a7c9022a2c1fa259
MD5 aa88833f90e6757225f1199b889c4e87
SHA1 c73cd6020d9735770bce1ebb3825c52d4af69b38
SHA512 2efb1762fb6d3380948f349736ad2a73d6f1d05734df1c3a8079b51f21461d39e4aaea8929d0f554207d8191757506c4a54437c074c8ebf088ffd5161b2d24ef
SSDEEP 48:TvIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:rIEumQv8m1ccnvS6
TLSH
T1EAF2169E0B1D3A10C4F89674EAC10DC37E7D541D8B96EFC45AEC06F2FF462A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 48dc8b9acbedb0b7de6579f89e873e9434ca389b8c6ed986f705c86fd2819599
MD5 53d7db0c6b056634da7a915aa765a209
SHA1 806ed3a88d6c29b46b1a3916ad5b5d6a29f0eeeb
SHA512 96e8e2788efd22ed57d221e93ed3dcb0f2c472d616d254a668271f0a0f25377898006634bd9484fb4d70e68dfe33a8ffec488228d465c56b2d7a91b70c07548d
SSDEEP 24:TLD3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T/31DtX5nDOvyKDhU1cSB
TLSH
T157F2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Preferences
Size 10KB
SHA256 1d6c638a09cca2e2089f4bf615a441ba0b861a84c36481940d09345b0a37d42f
MD5 83d3c21c424cb9b29913e8a7198cc327
SHA1 e57ee94060b7b6d95874b723416190b324806d97
SHA512 a364f9d1ca100f4a7b419a65207c192d1b3468c7785ee0d21d23aaf8115e8c07b9b6a73fe4b68b87cb2aaab94e23f1dd01264906644795bf9a355bc7a97f64d9
SSDEEP 192:sxRVR62BKxem5pxd4J0ANc33+WNOxdfOnF+9nKd:sxRb62BKx58HNkR+QF+9Kd
TLSH
T1C622A91AB925697B5CC7E519FA32BB53D2FD502325C15E4CA7FC4A2C05E7ACD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Preferences
Size 8KB
SHA256 3fbfd75a97007aca8316541c4c9e3ed799ef6ac7333ed197cc9a1cb9b279bec6
MD5 03ac777617c46b4630f2a46e327a5f48
SHA1 6ce2e99662b39cac091ad0a3d7e7c8725426e4a8
SHA512 51d33d17b6c4575847d879d538de15e81d655507def929f387851f6918e38fd81a29b0b91a09e87cc0af902abb44983e6e1b8862b99a84bc81055ea159cfe9a5
SSDEEP 96:sa2RMo9Lr7apHRPybyC/JUqYHWmQQQAfuY79636+WVoMPktNm+TecISljGm+gehe:sxRpR6rYysJYc36+WNOnPWnF+L9
TLSH
T14612A71ABD25AC3B5CC7E519F922B763E2F9502324C15E4C5BFC4A2C15E7ACD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Preferences
Size 10KB
SHA256 7fda50d94a6aa7f6e48312ef2ed238e5388163e36bf63a708e0e0fc6d9062afb
MD5 69ba4f5848906ba2bd14ad5f8c06450e
SHA1 0a879741f7b8c31797de210609fc29f2943122c2
SHA512 25905754424db9b9d2b04454b4e959a1fdb141e9bf2c7256b96255dd5ead5f311c8d3e1002551d99b440259f2875957ffcd17c293382e526903f058608d56e72
SSDEEP 192:sxRVR62BKxom5pxd4J0ANc33+WNOxdfWnF+96Md:sxRb62BKx/8HNkR+wF+9Dd
TLSH
T1EC22971AB965687B5CC7E519FA32BB53D2FD502325C15E48A7FC4A2C05E7ACD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Secure Preferences
Size 9KB
SHA256 1010365c53bff1788cc1d18e5be84298c5179fda5686fd233cb2f33fde644f2f
MD5 8593def04db120933818912cd6e0aa8a
SHA1 8c86244a9ffbb7e4db6cec63b39cabe9bbc87f42
SHA512 cd9961ff3c235a91d129fae333276b63b0c69966617b6f07be3c7d91ed5610dedb59a98406de0c338cf02e5a2c9e00a20c91f4370d80b242412e98f4221290f5
SSDEEP 192:H95hGAfV490I9cPeakTfEnj4aYJuVUZgRiWDwwV7WRFgiS+6QvN:dRfV49K2PqlgFnxV
TLSH
T1D412FAF3892DCD766F489AF9E93DB9C7D959418F85C80C055AD2C24C02C2BEA21D94E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Secure Preferences
Size 9KB
SHA256 5845a1e3eb31cf7b972c7821212aba52a20c905d9e19a8c231050dcee17323af
MD5 57ec657a5c38c4d4b637300daa6b3b17
SHA1 fc02c194192b01cbc148a2b5fe52c031c5e3465d
SHA512 65642ff7013f45e56c6b7e1f521599afd28c0dd4836e4a5a123aa8c931cf40efa1ae674721f3c3b491947329919533471a73deaa788d771f57264902aee0d18b
SSDEEP 192:HXRowMWGWCowo9lSWRCdPezxHsafEnT/4NPMV7vfPJ1OW+hwV/WyGegi5Qvq:3ywbtwo9oX25sENa7lJGenei
TLSH
T159120BF3492CCE365F495AFAED3DBAC7D956409F8AC80C0656D2818C06C1BEE21D94E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 04b3004a10a2d42dd0935ebb477fa894e117c058603133339ab8e281290d77a8
MD5 23e3fd00c8085429cac32cdc2cd9c2be
SHA1 90655c1c261439a0c4d70e982863898548b91d70
SHA512 96ed47ae901daed9ca872deb8e9dc7daf4b9b6177ae7f6aedf9355ac0c554919b49e71390a8c4b4ded2e276f35fa6b38eaa315b8966c0fdec4a1ce7e41403685
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 db9734c1e3001f7abd08bcc472a7b4f5daf8076eaee708f04ba98b11bd70131d
MD5 7c3b6a65c4634f5e466568aaee0bd06a
SHA1 ceb64e84b9c5de7c1f450273f4f93abe40b4423b
SHA512 f082cad4da67cc1fa7bc1fe3ef37cd2005337bc3dedb82d33dfc1aef058f2aab671271288b1cc35d01052ed721ff98caec19f52a6601e9dcce1a37602593cdde
SSDEEP 24:TL6kgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:TOOIy4m1b3fbUdeqSB
TLSH
T12D13BB0F1E187555D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE211C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Site Characteristics Database\LOG
Size 524B
SHA256 f607db051e5fd9a00114b76c9dff6088b21f12e2de77a6a1d97552083a53c8db
MD5 32eae29a45b334b3fb824271e2f76517
SHA1 dfb2999ee72e08f524a944700c6ca50af3e1df46
SHA512 c56c20141352927e36b0b1b68a197bf97b2690a26ed9d5c3949453597115730fcf8d21252af96db908d0d5132d03846aeacc16388df93b753d8e5e53cd9cb1de
TLSH
T1D0F0F6E0AAB9866A008B249FC169C62186877A27F5FD0E633A0DD6048266B442981BE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Site Characteristics Database\LOG.old
Size 524B
SHA256 c37cc0cfc6ce1e053b6e96e36ee10be49fb1f4b0bf686fe248fee3604be1f019
MD5 7bc0761e2012772fdf4cada14c8b39a9
SHA1 fb39d94002b86173561705677fdaabfcc114aa56
SHA512 8f83b4656ff9e9b3d36c5f5e088dfed1d727fe35e1e22865a3dede5effd05a24006eb20e8fb5573ec63fac8b97736dd6ec402612c5c2c69699a99e1d03b296d9
TLSH
T19AF046E15D7A86AA008A158BD2ACD61182D77A13B9FC8E23390C92868266A4029816F0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 65B
SHA256 8ff00d859349a3ea206706cdd3fa2762ae7c8efe2fdd33a95a72fee45aac6bc4
MD5 b14764cd1bc1aa64a1f0551cd3682b81
SHA1 21fe0b213419ad4efa4ea03b856f8da1b3ae9351
SHA512 86b372fe41c4c2a8e75b5e3cb8979425ca07e6cf0142ef88959c8fd3c35890d8eca2b83e77bf19cb19900b1c4c296d94abca81c135f1d40329c4e3470bdc302a
TLSH
T150A0029A6B145012D1459D7C4468B3406320D9452024C256C19060542D402CB9F5515A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Sync Data\LevelDB\LOG
Size 500B
SHA256 b9c5bb23e774e7357e97079fe4e877b1d511002cce1d86ecb13adf6938c242d7
MD5 a9c0ea60cb24afc9038439ed7ab63663
SHA1 3f3ce6f515df01e7b3310e55a143c97a93d880c8
SHA512 ff721a3e5344a2197f365ba21329b78a6c95515b4e42abe1c1462017a610861f7a221c8a5ca6d025de28a3a9061a6c3530e23382ff1a8dd2e6406f4b6e1deb0e
TLSH
T169F02BF05AB587B9008A5597C1B8C73186967E27B7FD1F53760CC5048262B042DD0BF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Sync Data\LevelDB\LOG.old
Size 500B
SHA256 df36db159f21db084d74a3ccace6b9039cd4207e907575aecfa10bb211fb190a
MD5 8ddfc2e3c9384d33d348956c1c199a41
SHA1 6b102c9bbf074208d626b701f15e9fa738a184e3
SHA512 b857390db87fca356f16f8fa15582fb1a108d823dd19359fcab75f56b4cbde0c207a3d7fa7ce08e05bbb810e1af75427d2f4b617b64f85b9b4ccedf22d0b55cf
TLSH
T1B5F050F19875C6B9448A5587C1BCDB2183D77E17BFFC9E63360C4545D16170429D06F0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Default\Web Data
Size 230KB
SHA256 229b9b8e3536e5bd9f8c1b74e8cf58f0458066d463f83f22ac2e9c171fed0655
MD5 025c014c9218816a76e29027301941c1
SHA1 be00a170137d3426a085cbeb9ae7c3b143c63316
SHA512 509ca2410aee1f06eed58f5c0b17ba3fded689ed398748cc00743251b9da0383a2c0e8035603be1a0b28066b938dbb84e5c57066f32313eea50f0bc0165b5d68
SSDEEP 192:i0KMPGvkSSzun7+vnM76vhQe8o/kyyDyaGNzH7KDdZsqVLVMdze:iiGvxSzuavnM76vhQzSaDytL7ZU
TLSH
T18434740B7B747001EDD2D9B25CF080771E3C616D8F2696C16DA258694DF2853A63D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Local State
Size 19KB
SHA256 a6d41028d78010721efbfc3e2c3199cadd3407b6f9f67bf6086415b26ec38957
MD5 b215104ff228b4fd345bf152ecdbb1ce
SHA1 c332624b1ce48d9eb6378a58344259ba4bd6496f
SHA512 c392454408ca12bc9994d49fc64616e27eba760c83afccfcb4f83ea23916bb94fbbcb137f52a5a7e06d6f01e73d1a82fecac54ecca490602819435a22367f21c
SSDEEP 384:zf+aQikB+z/xvxjg/qhE4ENRrgGF1wR335J+X2U59zK:C/UxvxjgC+4KVbw1JgX2U5FK
TLSH
T1E7927C3AB479AE2398F3AA46B759674BE6F5849240C41EE8C9E91F0D06C73CD1707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Local State
Size 13KB
SHA256 18c6dd50d41a91f3bd5b9f97e10ed3025ed828ffdc3df65fbfcd93d9a2399ee6
MD5 a25d8df78ed44357ffdb2715ea6ed280
SHA1 33f2fe14d5e5354e299f7450e4a52ccc588c7cf8
SHA512 dba65ed1aa850a3b699af2cea10d6781ea788d2d80c82d8f5c396269ba4a3d9268d41aaacc835af1082eeecee9d0b2217f55b2f74d3e1f043f3f7f31b04ebb89
SSDEEP 384:zlZcIJNRBp5gfYj357rL3Ug9xR4uSI2+/3:RQfGJfTUMxRq+3
TLSH
T15E523A3BAC34A93F58DFB745A64A210B9DE5C133D2F85E94CAE81F0C41B7199A707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Local State
Size 13KB
SHA256 0fd3735740b15094bcf249200963ef714c7d157396a0348c8ca543e8a1d9fae0
MD5 9526b8a432e786ea1a2f5ce2c4ef115a
SHA1 a5f185e21cecd4623cbfc59627ed6ada62be6fea
SHA512 c1bccf5c53775b95c2ab8cd0ebdcb2198ab7b75c4f1156f1be34b56a0fa30ebc73ea20935f7d630d596abc4bba17f2a4617f95a687ce21c40a05d603c92e6c57
SSDEEP 384:zfZcIJNRBfg5gfYj357g6sUg9xR4uSI2+i:r7vfGJs6sUMxRqJ
TLSH
T1F852493AAC34A53F5CEFB745B64A250BADD58033D2B85E94C6EC1F0C40B7199A707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Local State
Size 10KB
SHA256 1467bab97f04321d114f8e501fb9aca08a6cd6348f14d449a31ec6841a078fa8
MD5 0f5bb3741ad10b3d675594cba4d734e6
SHA1 c8e08d7bc6a174f60d7a2dc0d815469ff19e4f7a
SHA512 67d842ea3884ed3b2f34820414134beadd09ab194c23739c96cbee5535266f3edd7edaf3694541124c584628ca13d7112c1238651dd187b3a8bffaeabeb96d41
SSDEEP 192:ztE+xasuheOwQxMsNTlRnGySJrEmiUadF2O2J335VnK966F:z0ZcIJNRBfg5yfY335Vc6q
TLSH
T176322B31F875E97358F79A86B646760BE6E5811392DC5ED4C8E84F0C00D759E1707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Local State
Size 19KB
SHA256 e572d05da5c6804e802a4448a28906386b30aa0e36473c82e842b1a2ba0b1e26
MD5 5a23b3a19663bb1cc169907bd42ab127
SHA1 f1555d227ba370c0b630cac9ffcdc0e1653deff0
SHA512 0a944922498bffd3cca713c44b452c2e45ac445e4eb9db3a42e789f7c55672a2d8a66a1c88fdec8b7855926bbd9da0221063468f81b702d54d9a6ffc93b79907
SSDEEP 384:zn+aQikB+z/xvxjg/qhEXNRrgw2XR335J+6W2U59zK:y/UxvxjgC+jEX1Jg6W2U5FK
TLSH
T190927C3AF479AE2398F3AA45B759274BE6F5849241841EE8C9E91F0D06C73CD1707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Local State
Size 10KB
SHA256 b4ac71c34b6e72cc7b3c9dd9a6429df1f05234ccbb3c964ec2bd6b59c092b821
MD5 780386b95e6c5cbfb334b121826ea31f
SHA1 a0bcb55d8659757ce6e083243d6d960a5899139b
SHA512 b1c5a9d0f2ad9f081e82b986556e64e8598382d2dbb22247863c631abedb7374a83bb3b2f581118daf058bf671c2e59d77f7f9d56252082f7d2f2ec5e6bac192
SSDEEP 192:zyf+xasuheOwQxMsNTlR0ySJwEmiUhYF2q2a335JnIH6P1F:zwZcIJNRrgw2XR335J+6P/
TLSH
T1AC220932E875E97758F79686BA867A0BB6F4801392DC5ED8C8E80F0D00D76DA1707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 ea3c3ea3e1edecf3ee52b1d341b23add4248afe3a95c240a85dd5caea10eb11e
MD5 b7f8309b465bc074adcb73aaa3540de1
SHA1 01e0b9e791d86092e3a1b92799f6b676b63c69ee
SHA512 d63d82e6e0b8d311648648770a3e7489610a0a93904f5b8e01c28b511f8a972d8dcb53d7e03f6e6caa61e1576c30db2cdb886a1bb820904e920f03cedc739946
SSDEEP 3:MsEllllkEthXllkl2zEb+/l:/M/xT02zs+/l
TLSH
T16D4402046BC40806D91038704011875013A0E81005119B47356348126C8A5804D00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\ShaderCache\index
Size 256KB
SHA256 6c573e3ecaf9dc3b40f85856806a46bf6a42322f68682f7339d4ada972ab29f0
MD5 894c2266977a62e02bb432ddd20d0ae1
SHA1 5ffc9bb403db5e9ca7e5d38184d8368bd8780db9
SHA512 7ba0c9e1001a5b94bccaadebe11fba885b9650546e4c80b8f786451a9ec83576cac5bc02e8db807d4a73ea14f19931b25d87cc329ec093f97881f00d90a03f4c
SSDEEP 3:Ls0llllklkXlqO2N7tl:LsKlPq1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\Upload Patcher - Kay x Kaz (audio multichunk Method).exe.WebView2\EBWebView\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\Downloads\Upload Patcher - Kay x Kaz\WebView2Loader.dll
Size 161KB
SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
MD5 61f430f292f85b18b57f06ea6d3d8b82
SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
TLSH
T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/904-669-0x00007FF78D570000-0x00007FF78E570000-memory.dmp

Download

memory/1536-728-0x000001B8C02D0000-0x000001B8C0623000-memory.dmp

Download

memory/1536-629-0x00007FFD803A0000-0x00007FFD803A1000-memory.dmp

Download

memory/2580-849-0x000001CC5C260000-0x000001CC5C40E000-memory.dmp

Download

memory/2580-791-0x000001CC5C260000-0x000001CC5C40E000-memory.dmp

Download

memory/2580-740-0x000001CC5C260000-0x000001CC5C40E000-memory.dmp

Download

memory/4392-695-0x00000283AB8D0000-0x00000283ABC23000-memory.dmp

Download

memory/4392-567-0x00007FFD803A0000-0x00007FFD803A1000-memory.dmp

Download

memory/4552-621-0x00007FFD7F900000-0x00007FFD7F901000-memory.dmp

Download

memory/4552-622-0x00007FFD7F940000-0x00007FFD7F941000-memory.dmp

Download