Analysis

  • user interaction
    yes
  • max time kernel
    111s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 04:38

General

  • Target
    Zapret2Setup_DEV_21_1_2_1.exe
  • Size 46.5MB
  • Sample260706-e9pw8shy6v
  • SHA256 5e5c9ce705616507f9af406ecab09bec099ff9e8cee95038ac48e3255c51a294
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Stops running service(s) 4 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 18 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Zapret2Setup_DEV_21_1_2_1.exe
    "C:\Users\Admin\AppData\Local\Temp\Zapret2Setup_DEV_21_1_2_1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5240
    • C:\Users\Admin\AppData\Local\Temp\is-BHH0E4XPHY.tmp\Zapret2Setup_DEV_21_1_2_1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BHH0E4XPHY.tmp\Zapret2Setup_DEV_21_1_2_1.tmp" /SL5="$D006E,47484517,868864,C:\Users\Admin\AppData\Local\Temp\Zapret2Setup_DEV_21_1_2_1.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -Command "Get-Process | Where-Object {$_.ProcessName -eq 'Zapret'} | ForEach-Object { $_.CloseMainWindow() | Out-Null }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3768
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM Zapret.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4968
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM Zapret.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1056
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM Zapret.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4404
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -Command "Get-Process | Where-Object {$_.ProcessName -eq 'winws'} | ForEach-Object { $_.CloseMainWindow() | Out-Null }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1652
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5720
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5580
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5152
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -Command "Get-Process | Where-Object {$_.ProcessName -eq 'winws2'} | ForEach-Object { $_.CloseMainWindow() | Out-Null }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5660
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws2.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2656
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws2.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4676
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws2.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1504
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -Command "Get-Process | Where-Object {$_.ProcessName -eq 'Zapret'} | ForEach-Object { $_.CloseMainWindow() | Out-Null }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6012
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM Zapret.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3228
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM Zapret.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4304
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM Zapret.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4920
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -Command "Get-Process | Where-Object {$_.ProcessName -eq 'winws'} | ForEach-Object { $_.CloseMainWindow() | Out-Null }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2208
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4284
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3100
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1052
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -Command "Get-Process | Where-Object {$_.ProcessName -eq 'winws2'} | ForEach-Object { $_.CloseMainWindow() | Out-Null }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3884
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws2.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2296
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws2.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1464
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /IM winws2.exe /F /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:2428
      • C:\Windows\SysWOW64\sc.exe
        "sc.exe" stop "Monkey"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4524
      • C:\Windows\SysWOW64\sc.exe
        "sc.exe" delete "Monkey"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5800
      • C:\Zapret\Dev\Zapret.exe
        "C:\Zapret\Dev\Zapret.exe"
        3⤵
          PID:5640
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            4⤵
              PID:2812
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2308
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1052
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2496
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1444

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            codicon-0.0.36.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\codicon-0.0.36.ttf
            • Size 78KB
            • SHA256 360527575395ad70f940eff1e43eb7c2ec64f4e69f89dc5861b73420d2a578f0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            codicon-charmap-0.0.36.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\codicon-charmap-0.0.36.json
            • Size 16KB
            • SHA256 84a8d9e2c5cb0587df5876714fd5012c8b21973b81203865418effeec05123d0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            elusiveicons-webfont-2.0.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\elusiveicons-webfont-2.0.ttf
            • Size 77KB
            • SHA256 29b93f3fe666bf73dcc857869aee47532f710c0a16959c6275dc5bc2e3be4c9e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            elusiveicons-webfont-charmap-2.0.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\elusiveicons-webfont-charmap-2.0.json
            • Size 7KB
            • SHA256 be05507fc31c47f89910983b030fec906ee86861a79b8e03b1f24029699679e8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fontawesome5-brands-webfont-5.15.4.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-brands-webfont-5.15.4.ttf
            • Size 130KB
            • SHA256 cda59d6efffa685830fd95b55f64ae9cb51279cd34b2410b69f84c7ec30157d9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fontawesome5-brands-webfont-charmap-5.15.4.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-brands-webfont-charmap-5.15.4.json
            • Size 11KB
            • SHA256 d00ae829ec115926c670397b7bc470656fae8dc2bdd5b48a81c753dc854ca1fa
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fontawesome5-regular-webfont-5.15.4.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-regular-webfont-5.15.4.ttf
            • Size 32KB
            • SHA256 fb5143dfe010d47b0fdedd36e4bac1ac8ff2e39b9f20b64891a88a7a219422f5
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fontawesome5-regular-webfont-charmap-5.15.4.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-regular-webfont-charmap-5.15.4.json
            • Size 3KB
            • SHA256 a6d7282a3908283443feedafd07083e33bb7e2c56e813542d4ef79f8dadd2309
            • MD5 SHA1 SHA512 TLSH

            fontawesome5-solid-webfont-5.15.4.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-solid-webfont-5.15.4.ttf
            • Size 197KB
            • SHA256 4c5431bc1b2abf8aed5c614f2f32120d666bdda640cb1a7678d70e08cdd4323f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fontawesome5-solid-webfont-charmap-5.15.4.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome5-solid-webfont-charmap-5.15.4.json
            • Size 25KB
            • SHA256 1b0cac3ed4d3b144965a45aba9ad31e8654e4735d94b4ed9bced1b5eea9804d3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fontawesome6-brands-webfont-6.7.2.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-brands-webfont-6.7.2.ttf
            • Size 205KB
            • SHA256 808443ae6c8204395add8543da8a90a60b9376fb0f87ed8e8ea37d109596d805
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fontawesome6-brands-webfont-charmap-6.7.2.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-brands-webfont-charmap-6.7.2.json
            • Size 12KB
            • SHA256 8f7ba0f01ed36b3f7a0c456556ed1f80d18f306006a9cf79929b2366e4d06649
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fontawesome6-regular-webfont-6.7.2.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-regular-webfont-6.7.2.ttf
            • Size 66KB
            • SHA256 cffc8c04d8257c600e0533bdf7cfbf0775b801b50bc39a6f8122ee0c48a1373d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fontawesome6-regular-webfont-charmap-6.7.2.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-regular-webfont-charmap-6.7.2.json
            • Size 4KB
            • SHA256 769c282ba20a9cf5b672e90bbe6ed6d52ebb1c0fbbf5614a42ac01f2f12f9365
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fontawesome6-solid-webfont-6.7.2.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-solid-webfont-6.7.2.ttf
            • Size 416KB
            • SHA256 220d6d592b543eb991b8c11137ef0082c27d6ff6fdaa25e4335945f57a487c6c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fontawesome6-solid-webfont-charmap-6.7.2.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\fontawesome6-solid-webfont-charmap-6.7.2.json
            • Size 37KB
            • SHA256 48607f738a71763a3557abe077133ff36b48b1bfa27d2f0d25b5a5c1f8a89127
            • MD5 SHA1 SHA512 SSDEEP TLSH

            materialdesignicons5-webfont-5.9.55.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\materialdesignicons5-webfont-5.9.55.ttf
            • Size 1002KB
            • SHA256 f89ca374a7545105f70a6345919083f9011badade1ff17f5e99f97853e7c33da
            • MD5 SHA1 SHA512 SSDEEP TLSH

            materialdesignicons5-webfont-charmap-5.9.55.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\materialdesignicons5-webfont-charmap-5.9.55.json
            • Size 195KB
            • SHA256 0eb43894facba7a61299088a385fcc6f293976501339682d1a2e0bdea248f68a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            materialdesignicons6-webfont-6.9.96.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\materialdesignicons6-webfont-6.9.96.ttf
            • Size 1.2MB
            • SHA256 be825c1294d3c4f046c8e496b18f8f0c7d2864e339c81bdab9297f17ffac1938
            • MD5 SHA1 SHA512 SSDEEP TLSH

            materialdesignicons6-webfont-charmap-6.9.96.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\materialdesignicons6-webfont-charmap-6.9.96.json
            • Size 245KB
            • SHA256 6317242191c4c889dec2c174f98dda0f309745d28c23c50a19bbbaf02df930a9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            phosphor-1.3.0.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\phosphor-1.3.0.ttf
            • Size 1.3MB
            • SHA256 351874de64758f3b7fb405cd078ac0ed5ffb9717fb5b9b10013ac03d4c13680b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            phosphor-charmap-1.3.0.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\phosphor-charmap-1.3.0.json
            • Size 148KB
            • SHA256 cfb725868f72d741422002f1ed4f870bdddebc32344a6407b8becb6c841b92ca
            • MD5 SHA1 SHA512 SSDEEP TLSH

            remixicon-2.5.0.ttf

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\remixicon-2.5.0.ttf
            • Size 393KB
            • SHA256 0ac8bc3ccea26ed47e96844ef26675969c669714d723c081101e51799d501520
            • MD5 SHA1 SHA512 SSDEEP TLSH

            remixicon-charmap-2.5.0.json

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\remixicon-charmap-2.5.0.json
            • Size 70KB
            • SHA256 b90a112e76fc5f7f64d20bb5ec422fc9c7511d1f32be61c0f7d3b7a3933d4c0a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            StartupProfileData-NonInteractive

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 16KB
            • SHA256 b76f223d059e0a70d06d06e8c2993af77b67742f88026472520413791ee99ac0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            StartupProfileData-NonInteractive

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 16KB
            • SHA256 f82dfa54d73dd0c7f31b9b8dc886b19898df52a324fda5e1999dd691aae734c3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            StartupProfileData-NonInteractive

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 16KB
            • SHA256 f5d8bdbfc0c9203a2aaf0e93cdab88d1f14d4df8ee5a061efe7cf7f6f081abf7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            StartupProfileData-NonInteractive

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 16KB
            • SHA256 ba59c45cf87294bda4b67ea17d75c5cc70f12d03d06d44d4146cd1a6d8f356d2
            • MD5 SHA1 SHA512 SSDEEP TLSH

            StartupProfileData-NonInteractive

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 16KB
            • SHA256 e8ec2bbde981b989f488961992907b0bb592085f261d57d8ff0521dd05eedf85
            • MD5 SHA1 SHA512 SSDEEP TLSH

            prep_Activatable Class_Hermes_perf.cache

            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 607B
            • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
            • MD5 SHA1 SHA512 TLSH

            __PSScriptPolicyTest_lwd0aekz.wc2.ps1

            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lwd0aekz.wc2.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH

            Zapret2Setup_DEV_21_1_2_1.tmp

            • Path C:\Users\Admin\AppData\Local\Temp\is-BHH0E4XPHY.tmp\Zapret2Setup_DEV_21_1_2_1.tmp
            • Size 4.2MB
            • SHA256 d52b43b946174186987cdfb84450a28aeeb57294926322f3faf6278d28b811df
            • MD5 SHA1 SHA512 SSDEEP TLSH

            Zapret 2 Dev.lnk

            • Path C:\Users\Public\Desktop\Zapret 2 Dev.lnk
            • Size 716B
            • SHA256 c562a981063c0f9a3162dcd0fd0c81094ecd3bb1a4c3d4983dfaa1c12615ef22
            • MD5 SHA1 SHA512 TLSH

            Zapret.exe

            • Path C:\Zapret\Dev\Zapret.exe
            • Size 18.1MB
            • SHA256 e4340a5a26fa4e31cd89e6323541cfb590dfb47bd481e6070287a77eb09490fd
            • MD5 SHA1 SHA512 SSDEEP TLSH

            MSVCP140.dll

            • Path C:\Zapret\Dev\_internal\PyQt6\Qt6\bin\MSVCP140.dll
            • Size 544KB
            • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            MSVCP140_1.dll

            • Path C:\Zapret\Dev\_internal\PyQt6\Qt6\bin\MSVCP140_1.dll
            • Size 35KB
            • SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            MSVCP140_2.dll

            • Path C:\Zapret\Dev\_internal\PyQt6\Qt6\bin\MSVCP140_2.dll
            • Size 273KB
            • SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            Qt6Core.dll

            • Path C:\Zapret\Dev\_internal\PyQt6\Qt6\bin\Qt6Core.dll
            • Size 10.0MB
            • SHA256 37fde8ebd11b474b806a1cf8d4564780dc51afdad3ac3611cd0aa92982f73687
            • MD5 SHA1 SHA512 SSDEEP TLSH

            Qt6Gui.dll

            • Path C:\Zapret\Dev\_internal\PyQt6\Qt6\bin\Qt6Gui.dll
            • Size 9.1MB
            • SHA256 96b445dd611f30a3e3b938d981c2b13009d65294f48a8ac5f53dde8037132b53
            • MD5 SHA1 SHA512 SSDEEP TLSH

            Qt6Widgets.dll

            • Path C:\Zapret\Dev\_internal\PyQt6\Qt6\bin\Qt6Widgets.dll
            • Size 6.3MB
            • SHA256 48deb69896f3185c8fe21221262670591ddc0ce9e7f2182be682e9f28208f7a3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            Qt6Xml.dll

            • Path C:\Zapret\Dev\_internal\PyQt6\Qt6\bin\Qt6Xml.dll
            • Size 156KB
            • SHA256 fe9aebb253ee8e1690e606e8983f2a322edefb0bf49ab4d22fd19401f42d04f1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            VCRUNTIME140_1.dll

            • Path C:\Zapret\Dev\_internal\PyQt6\Qt6\bin\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            qwindows.dll

            • Path C:\Zapret\Dev\_internal\PyQt6\Qt6\plugins\platforms\qwindows.dll
            • Size 976KB
            • SHA256 a6076030a5f0bf1b9254b0999e5260f66b1abd3b51214777e47a7c2e1d7cad81
            • MD5 SHA1 SHA512 SSDEEP TLSH

            qmodernwindowsstyle.dll

            • Path C:\Zapret\Dev\_internal\PyQt6\Qt6\plugins\styles\qmodernwindowsstyle.dll
            • Size 223KB
            • SHA256 e6902591acf14d9a9abb96130eea6a1b5b6ee4dfb3d3908d40135f3dcf085e51
            • MD5 SHA1 SHA512 SSDEEP TLSH

            QtCore.pyd

            • Path C:\Zapret\Dev\_internal\PyQt6\QtCore.pyd
            • Size 2.5MB
            • SHA256 91dd5166110b88a4f4d3acda6fe6c10ed699882dd3602328a59e9f656cc766b1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            QtGui.pyd

            • Path C:\Zapret\Dev\_internal\PyQt6\QtGui.pyd
            • Size 2.2MB
            • SHA256 cf5ae37fd119fb29a53f1f2cea1362fdf036d940191be45d83da0f98ce8752b8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            QtWidgets.pyd

            • Path C:\Zapret\Dev\_internal\PyQt6\QtWidgets.pyd
            • Size 4.8MB
            • SHA256 4f81361816e94e1ae05f178085b22d5b9b19e417713b1966dd481a4017aa3b21
            • MD5 SHA1 SHA512 SSDEEP TLSH

            QtXml.pyd

            • Path C:\Zapret\Dev\_internal\PyQt6\QtXml.pyd
            • Size 115KB
            • SHA256 395d30c4e76750a093e22b32981ca683e400cb5eb4b34f8aa3d0e100bdc0d02b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            sip.cp314-win_amd64.pyd

            • Path C:\Zapret\Dev\_internal\PyQt6\sip.cp314-win_amd64.pyd
            • Size 109KB
            • SHA256 61237093b5c263bb97f3e9088a5b7d60cfdda983bf6f0b4031634e8962fd9825
            • MD5 SHA1 SHA512 SSDEEP TLSH

            VCRUNTIME140.dll

            • Path C:\Zapret\Dev\_internal\VCRUNTIME140.dll
            • Size 117KB
            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            _bz2.pyd

            • Path C:\Zapret\Dev\_internal\_bz2.pyd
            • Size 85KB
            • SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
            • MD5 SHA1 SHA512 SSDEEP TLSH

            _ctypes.pyd

            • Path C:\Zapret\Dev\_internal\_ctypes.pyd
            • Size 139KB
            • SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            _lzma.pyd

            • Path C:\Zapret\Dev\_internal\_lzma.pyd
            • Size 157KB
            • SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
            • MD5 SHA1 SHA512 SSDEEP TLSH

            _socket.pyd

            • Path C:\Zapret\Dev\_internal\_socket.pyd
            • Size 85KB
            • SHA256 435a86973131c5d5dc90f828e72d7bb0607578a48ab5bc5377f4a280a6beb8f7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            _wmi.pyd

            • Path C:\Zapret\Dev\_internal\_wmi.pyd
            • Size 39KB
            • SHA256 eccb72a070d63f0ddde054c7a15d375b11b1dfc3362452c55ccabb487dee87fc
            • MD5 SHA1 SHA512 SSDEEP TLSH

            _zstd.pyd

            • Path C:\Zapret\Dev\_internal\_zstd.pyd
            • Size 491KB
            • SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            base_library.zip

            • Path C:\Zapret\Dev\_internal\base_library.zip
            • Size 1.3MB
            • SHA256 f07f64c8b029047c995e89f344fbe0f0235def2930bef3aea931796e932a4ab2
            • MD5 SHA1 SHA512 SSDEEP TLSH

            libffi-8.dll

            • Path C:\Zapret\Dev\_internal\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            python3.DLL

            • Path C:\Zapret\Dev\_internal\python3.DLL
            • Size 72KB
            • SHA256 1dd696f02326e32e67b52c25b249b3acce3238176212d16e8fb1a050a1455ae9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            python314.dll

            • Path C:\Zapret\Dev\_internal\python314.dll
            • Size 6.5MB
            • SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            unicodedata.pyd

            • Path C:\Zapret\Dev\_internal\unicodedata.pyd
            • Size 740KB
            • SHA256 58013696b4f08717aee2885aefa24031f4b18b3e62faa8125248cc3e0a86af2a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            is-9K8QUX39ZA.tmp

            • Path C:\Zapret\Dev\bin\is-9K8QUX39ZA.tmp
            • Size 517B
            • SHA256 d6d63c53bc0e1d97e913a43fc4db34f6558bb807228bf6100e3b6863f0720404
            • MD5 SHA1 SHA512 TLSH

            is-BI71K60AVJ.tmp

            • Path C:\Zapret\Dev\bin\is-BI71K60AVJ.tmp
            • Size 652B
            • SHA256 e5938780152169f720383f80eabb309e9477369b83b5ec40cc137c397f862cde
            • MD5 SHA1 SHA512 TLSH

            is-T5LABYC3DS.tmp

            • Path C:\Zapret\Dev\bin\is-T5LABYC3DS.tmp
            • Size 681B
            • SHA256 936c2bee4cfb80aa3c426b2dcbcc834b3fbcd1adb17172959dc569c73a14275c
            • MD5 SHA1 SHA512 TLSH

            is-TW0JPWH07B.tmp

            • Path C:\Zapret\Dev\bin\is-TW0JPWH07B.tmp
            • Size 1KB
            • SHA256 f4589c57749f956bb30538197a521d7005f8b0a8723b4707e72405e51ddac50a
            • MD5 SHA1 SHA512 TLSH

            is-X3LTOQMKF9.tmp

            • Path C:\Zapret\Dev\bin\is-X3LTOQMKF9.tmp
            • Size 1KB
            • SHA256 f86d488593a65132c10e7e5b5e02f32ff8e0862988b30bebc6a671c5380f3976
            • MD5 SHA1 SHA512 TLSH

            .allzone.txt.i5el47w0.tmp

            • Path C:\Zapret\Dev\lists\.allzone.txt.i5el47w0.tmp
            • Size 335B
            • SHA256 13d63d7b2657073566685afde89cd1f52609efdf6994d816b68c6e4b8a1321f1
            • MD5 SHA1 SHA512 TLSH

            .amazon.txt.jlblb8o5.tmp

            • Path C:\Zapret\Dev\lists\.amazon.txt.jlblb8o5.tmp
            • Size 51B
            • SHA256 c113fa71a4147dbbfb4152879a1bbcda0fc179921cd77944b9ef15c4df85aa6a
            • MD5 SHA1 SHA512 TLSH

            .claude.txt.v963eq47.tmp

            • Path C:\Zapret\Dev\lists\.claude.txt.v963eq47.tmp
            • Size 34B
            • SHA256 4e9d8c92193d25472ee273f23795675f359debed83f50802c671c36a05dac0f9
            • MD5 SHA1 SHA512

            .cloudflare-ipset.txt.aebp5n_q.tmp

            • Path C:\Zapret\Dev\lists\.cloudflare-ipset.txt.aebp5n_q.tmp
            • Size 118KB
            • SHA256 df09a8a7f497a38051ba85c9d60893704242eea79b2cecebeed2329ae6c20ab1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .cloudflare-ipset_v6.txt.j9dt754a.tmp

            • Path C:\Zapret\Dev\lists\.cloudflare-ipset_v6.txt.j9dt754a.tmp
            • Size 40KB
            • SHA256 6d08817af2e8db889eaa861a6a526ac969119ce82c4518924a60b079c16572ba
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .cloudflare.txt.sb6t952n.tmp

            • Path C:\Zapret\Dev\lists\.cloudflare.txt.sb6t952n.tmp
            • Size 133B
            • SHA256 557989fafbcf5d96e2bf903f44f34a70bddf137cb3a3250c7dfa46251419b301
            • MD5 SHA1 SHA512 TLSH

            .cloudfront.txt.aljgp3u_.tmp

            • Path C:\Zapret\Dev\lists\.cloudfront.txt.aljgp3u_.tmp
            • Size 15B
            • SHA256 329ee15d042cf37eadf602b5622e62337605bd5010d92a6cae4694491201fdf6
            • MD5 SHA1 SHA512

            .css-rbxcdn-com.txt.8y2erh6k.tmp

            • Path C:\Zapret\Dev\lists\.css-rbxcdn-com.txt.8y2erh6k.tmp
            • Size 15B
            • SHA256 8e41ef51897b4ac99d947280fbc59f3bb3706eb78c040f4e0c710dcc8e90a083
            • MD5 SHA1 SHA512

            .deepseek.txt.zj64dlis.tmp

            • Path C:\Zapret\Dev\lists\.deepseek.txt.zj64dlis.tmp
            • Size 35B
            • SHA256 c3a0ffc11fddb1990da8d3a3fbd95e17272a7f15691c97843c90ce4892b4247f
            • MD5 SHA1 SHA512

            .discord-images.txt.dpq_1c9d.tmp

            • Path C:\Zapret\Dev\lists\.discord-images.txt.dpq_1c9d.tmp
            • Size 76B
            • SHA256 008a0b47a57f6ece4d5be9777a4c263ad342fd14c4e0c96f7dac2a91584eb6a0
            • MD5 SHA1 SHA512 TLSH

            .discord-media.txt.2h6r51eb.tmp

            • Path C:\Zapret\Dev\lists\.discord-media.txt.2h6r51eb.tmp
            • Size 14B
            • SHA256 6e0c7c0fe0e7227756d93c2752c9337f8c23535cbd9121b436da0a17bbf46f9a
            • MD5 SHA1 SHA512

            .discord-updates.txt.81k49zvi.tmp

            • Path C:\Zapret\Dev\lists\.discord-updates.txt.81k49zvi.tmp
            • Size 20B
            • SHA256 0918c3f70e09183490f7c898e67689b5c0a98a2ecd946796e14ec6d3760998bf
            • MD5 SHA1 SHA512

            .discord.txt.ta_9tdqx.tmp

            • Path C:\Zapret\Dev\lists\.discord.txt.ta_9tdqx.tmp
            • Size 672B
            • SHA256 56f8707485b80e66e8f69041799771b94d53a80026bb3c1b65aa97b53e78d40d
            • MD5 SHA1 SHA512 TLSH

            .epicgames-fortnite.txt.acua08j_.tmp

            • Path C:\Zapret\Dev\lists\.epicgames-fortnite.txt.acua08j_.tmp
            • Size 58B
            • SHA256 436f341073050cf77171afe40d670545f140bd690dd2f9dd99b8fec1cac78863
            • MD5 SHA1 SHA512 TLSH

            .facebook.txt.zo3lszzm.tmp

            • Path C:\Zapret\Dev\lists\.facebook.txt.zo3lszzm.tmp
            • Size 43B
            • SHA256 05d6c9d2262870c7761d61932e728773984d08b190351827cb7d28eeb73347ad
            • MD5 SHA1 SHA512

            .fandom.txt.txjm27cl.tmp

            • Path C:\Zapret\Dev\lists\.fandom.txt.txjm27cl.tmp
            • Size 24B
            • SHA256 42355e4f91d32670b2d6a04e68bb213c43bb8b765cdd8322d674c44de58ad3b2
            • MD5 SHA1 SHA512

            .github.txt.gyvp3__s.tmp

            • Path C:\Zapret\Dev\lists\.github.txt.gyvp3__s.tmp
            • Size 86B
            • SHA256 9a5c3e618e071a6fd73ccf393914e6d91175548e7ef8808dce71c762c0983d3c
            • MD5 SHA1 SHA512 TLSH

            .githubusercontent.txt.at0v7t3s.tmp

            • Path C:\Zapret\Dev\lists\.githubusercontent.txt.at0v7t3s.tmp
            • Size 22B
            • SHA256 6108f8b6e0603b4d9d43b5b359eac44fbbb334dc7284e65444b7c532dcb6e13a
            • MD5 SHA1 SHA512

            .google.txt.mcl6ndv7.tmp

            • Path C:\Zapret\Dev\lists\.google.txt.mcl6ndv7.tmp
            • Size 91B
            • SHA256 626e536aa8f3e217901a90d2cb25bdbb8842e57a82f4ac4454af78151fe9608c
            • MD5 SHA1 SHA512 TLSH

            .googlevideo.txt.n6ccz4c0.tmp

            • Path C:\Zapret\Dev\lists\.googlevideo.txt.n6ccz4c0.tmp
            • Size 16B
            • SHA256 ae839e9808cdcfc7163061aebb85a6ce708140e66ea585bba13cd515add9803a
            • MD5 SHA1 SHA512

            .i-ytimg.txt.yxg3qjio.tmp

            • Path C:\Zapret\Dev\lists\.i-ytimg.txt.yxg3qjio.tmp
            • Size 12B
            • SHA256 2944eb7552d850b85f59a4fe7b65e2b3f4756765b3b5246eeca47fb747d1d873
            • MD5 SHA1 SHA512

            .instagram.txt.69thwq7a.tmp

            • Path C:\Zapret\Dev\lists\.instagram.txt.69thwq7a.tmp
            • Size 31B
            • SHA256 13e540f8825fb04ee900d710d84febe799be99725ccdfd99b04fb28d973584bc
            • MD5 SHA1 SHA512

            .ipset-amazon.txt.ho2tbieb.tmp

            • Path C:\Zapret\Dev\lists\.ipset-amazon.txt.ho2tbieb.tmp
            • Size 109KB
            • SHA256 61672304d2bef258eeeaf03f72570a70b76506b58d88ab56900b9ca6f8e45297
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .ipset-anydesk.txt.kn48otmw.tmp

            • Path C:\Zapret\Dev\lists\.ipset-anydesk.txt.kn48otmw.tmp
            • Size 212B
            • SHA256 2e8a06ab97f18873c714e8eca21e2896c3bb52c44ad7f609c7da3344ab968682
            • MD5 SHA1 SHA512 TLSH

            .ipset-censorliber.txt.mr1uyg0_.tmp

            • Path C:\Zapret\Dev\lists\.ipset-censorliber.txt.mr1uyg0_.tmp
            • Size 183B
            • SHA256 61756e540d354d76f6675193fa8a4a7da891f9f233d86849053357363a85cd17
            • MD5 SHA1 SHA512 TLSH

            .ipset-claude.txt.pk44aop9.tmp

            • Path C:\Zapret\Dev\lists\.ipset-claude.txt.pk44aop9.tmp
            • Size 43B
            • SHA256 476cfb89266e661909b3ad32274965be69dd517e8f0969169ec1a7005c8098ab
            • MD5 SHA1 SHA512

            .ipset-cloudflare.txt.miwd0grm.tmp

            • Path C:\Zapret\Dev\lists\.ipset-cloudflare.txt.miwd0grm.tmp
            • Size 455B
            • SHA256 808324a11a713d3b6b7e7a61acaa32807c3080fb011ecdd34cb9bca0be40d558
            • MD5 SHA1 SHA512 TLSH

            .ipset-cloudflare1.txt.10k2tle3.tmp

            • Path C:\Zapret\Dev\lists\.ipset-cloudflare1.txt.10k2tle3.tmp
            • Size 29KB
            • SHA256 78856ab563a0bc83cd81ff91ac61bdf5416439de7882d44de6f619f6e928e2b2
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .ipset-css-rbxcdn-com.txt.8va5h17r.tmp

            • Path C:\Zapret\Dev\lists\.ipset-css-rbxcdn-com.txt.8va5h17r.tmp
            • Size 8B
            • SHA256 88f60d29a333b431a69f3325d338405ffa73295d9feef714a9abafc3817c7b9a
            • MD5 SHA1 SHA512

            .ipset-digitalocean.txt.w1qk8bz0.tmp

            • Path C:\Zapret\Dev\lists\.ipset-digitalocean.txt.w1qk8bz0.tmp
            • Size 13KB
            • SHA256 b1520a60f2db3b098c6825437325c91d347ffcdf5557d8a57cab1ed7a8fb49bd
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .ipset-discord.txt.qpfby4mm.tmp

            • Path C:\Zapret\Dev\lists\.ipset-discord.txt.qpfby4mm.tmp
            • Size 837B
            • SHA256 c909066e28e876feaa8060ca3fce856ffbdd2b74a285d94e7f05e49088185c1f
            • MD5 SHA1 SHA512 TLSH

            .ipset-dns.txt.kde04cpj.tmp

            • Path C:\Zapret\Dev\lists\.ipset-dns.txt.kde04cpj.tmp
            • Size 286B
            • SHA256 9af88b77d4a66554dd682804253f99b248723fed8f658c7139988874ac8d4bae
            • MD5 SHA1 SHA512 TLSH

            .ipset-exclude.txt.0me7qctu.tmp

            • Path C:\Zapret\Dev\lists\.ipset-exclude.txt.0me7qctu.tmp
            • Size 126B
            • SHA256 59bfca828dffa08a1d8694c03ea5378b64fa7137ca948e309a5b24c1b64c29e2
            • MD5 SHA1 SHA512 TLSH

            .ipset-facebook.txt.0qfhtoi1.tmp

            • Path C:\Zapret\Dev\lists\.ipset-facebook.txt.0qfhtoi1.tmp
            • Size 85B
            • SHA256 553570059c681ca098473227011e1ee187817d634da4b9bdc618dea977d84acc
            • MD5 SHA1 SHA512 TLSH

            .ipset-github.txt.66n_v0ol.tmp

            • Path C:\Zapret\Dev\lists\.ipset-github.txt.66n_v0ol.tmp
            • Size 109B
            • SHA256 f492fbdf7c405ee89d3357d1d95a9a84bb164a7ee81f7426e29854600de99fb3
            • MD5 SHA1 SHA512 TLSH

            .ipset-googlevideo.txt.y5q0n_xj.tmp

            • Path C:\Zapret\Dev\lists\.ipset-googlevideo.txt.y5q0n_xj.tmp
            • Size 1KB
            • SHA256 7f951d45c9539854cd606ec6419fd40871ff23bacf62335bfe26c4e20a0c290a
            • MD5 SHA1 SHA512 TLSH

            .ipset-hetzner.txt.9_plxngl.tmp

            • Path C:\Zapret\Dev\lists\.ipset-hetzner.txt.9_plxngl.tmp
            • Size 1KB
            • SHA256 a7de1d29ccce355244195fa5a48c2ae580ccfbb06cca5282141cb23adcd2e758
            • MD5 SHA1 SHA512 TLSH

            .ipset-lol-euw.txt._hh37t9p.tmp

            • Path C:\Zapret\Dev\lists\.ipset-lol-euw.txt._hh37t9p.tmp
            • Size 127B
            • SHA256 99caac1495122dd720849b78f3b54ed12f7fa53a545930a125a36a176c8c5408
            • MD5 SHA1 SHA512 TLSH

            .ipset-lol-ru.txt.90mvgoai.tmp

            • Path C:\Zapret\Dev\lists\.ipset-lol-ru.txt.90mvgoai.tmp
            • Size 106B
            • SHA256 6aaab24e764239795f48179818ea42c2fb714278e2c0a99cf73aa7a52115cfa2
            • MD5 SHA1 SHA512 TLSH

            .ipset-melbicom.txt.pu035g8y.tmp

            • Path C:\Zapret\Dev\lists\.ipset-melbicom.txt.pu035g8y.tmp
            • Size 710B
            • SHA256 f6695bbc561993339b9b8767ddcee1f427d5203ffeea6a6168bfe4052510b20f
            • MD5 SHA1 SHA512 TLSH

            .ipset-microsoft-store.txt.udyhayj8.tmp

            • Path C:\Zapret\Dev\lists\.ipset-microsoft-store.txt.udyhayj8.tmp
            • Size 16B
            • SHA256 9e0d91a79ec925fa91e66578e00c6396f991f41df36d2e871af544625240fc19
            • MD5 SHA1 SHA512

            .ipset-ovh.txt.3ai512ok.tmp

            • Path C:\Zapret\Dev\lists\.ipset-ovh.txt.3ai512ok.tmp
            • Size 5KB
            • SHA256 6d3ac9ee8d8e21803c6e3f610f870733d9a32f61cb3976de39782a68e7130ce2
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .ipset-porn.txt.6zfmvt3b.tmp

            • Path C:\Zapret\Dev\lists\.ipset-porn.txt.6zfmvt3b.tmp
            • Size 101B
            • SHA256 cbe93199550f3e3874a7e4af67892b05b38c7949952a0ae82e1053fd842d8072
            • MD5 SHA1 SHA512 TLSH

            .ipset-roblox.txt.71d6iwpf.tmp

            • Path C:\Zapret\Dev\lists\.ipset-roblox.txt.71d6iwpf.tmp
            • Size 622B
            • SHA256 e62cf683b38b264ad664ae7dd4a3ad6ccae9f5d8f3b4cf578fc690bb058bc2ec
            • MD5 SHA1 SHA512 TLSH

            .ipset-ru.txt.2jy3onl_.tmp

            • Path C:\Zapret\Dev\lists\.ipset-ru.txt.2jy3onl_.tmp
            • Size 9KB
            • SHA256 8df266c674afeb35c66096e473513b0440aa6890f36d691c7c6d9c1abc8a59dc
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .ipset-russia-youtube-rtmps.txt.0t5itp0t.tmp

            • Path C:\Zapret\Dev\lists\.ipset-russia-youtube-rtmps.txt.0t5itp0t.tmp
            • Size 495B
            • SHA256 9e0febe6ff9c17011f602f2571490da4b1cc890b029a5f0b21d40d04d3dc395d
            • MD5 SHA1 SHA512 TLSH

            .ipset-russia-youtube.txt.5m0s_f71.tmp

            • Path C:\Zapret\Dev\lists\.ipset-russia-youtube.txt.5m0s_f71.tmp
            • Size 168B
            • SHA256 fb9aafc9020b3815e76e1b98479a7debb0793d48638d2eb91661eaf2a3193cb9
            • MD5 SHA1 SHA512 TLSH

            .ipset-rutracker.txt.cwrig_iv.tmp

            • Path C:\Zapret\Dev\lists\.ipset-rutracker.txt.cwrig_iv.tmp
            • Size 42B
            • SHA256 da1bfb9054773a0573b92bb58bc8e7e074bed33e8c3d3cc4b0f36bd871a81665
            • MD5 SHA1 SHA512

            .ipset-soundcloud.txt.ojox2k4m.tmp

            • Path C:\Zapret\Dev\lists\.ipset-soundcloud.txt.ojox2k4m.tmp
            • Size 97B
            • SHA256 d04dd5c475f50627f051bef3c0fda644d837b6f846c328d85836e573cdbfa992
            • MD5 SHA1 SHA512 TLSH

            .ipset-steam.txt.y62cugg8.tmp

            • Path C:\Zapret\Dev\lists\.ipset-steam.txt.y62cugg8.tmp
            • Size 616B
            • SHA256 1711f4dbb04f29d5574881128aaa73f2c35fef5e2d8433a10eefe97331771654
            • MD5 SHA1 SHA512 TLSH

            .ipset-tankix.txt.bcl4hnpp.tmp

            • Path C:\Zapret\Dev\lists\.ipset-tankix.txt.bcl4hnpp.tmp
            • Size 272B
            • SHA256 cd8fce26f3cfb5b7d8de2c4c1541883f737b311a12e30f9adbc679221e8ec9f2
            • MD5 SHA1 SHA512 TLSH

            .ipset-telegram-bypass.txt.ln04krnf.tmp

            • Path C:\Zapret\Dev\lists\.ipset-telegram-bypass.txt.ln04krnf.tmp
            • Size 125B
            • SHA256 255a306fe6b9c8530eae2200747c7b246937c3d7132f526d7219f5d8234d8fde
            • MD5 SHA1 SHA512 TLSH

            .ipset-telegram.txt.wycq3hks.tmp

            • Path C:\Zapret\Dev\lists\.ipset-telegram.txt.wycq3hks.tmp
            • Size 274B
            • SHA256 c8fe04f1c3b121e7cc69341287089e7edf780ed6799c3bcebdd30043aa9fc1fe
            • MD5 SHA1 SHA512 TLSH

            .ipset-timeweb.txt.g9ase9th.tmp

            • Path C:\Zapret\Dev\lists\.ipset-timeweb.txt.g9ase9th.tmp
            • Size 4KB
            • SHA256 1c7edb31607bf4a99c8a44ad84d2db314fb5b9cfea05fb7518794b122ad022e2
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .ipset-twitch.txt.ob7pw2nf.tmp

            • Path C:\Zapret\Dev\lists\.ipset-twitch.txt.ob7pw2nf.tmp
            • Size 2KB
            • SHA256 26168a8cecbaf029614a8d8d0c9eeb7b5b8fb2d7891bccd3e8b1bfebb9b7795a
            • MD5 SHA1 SHA512 TLSH

            .ipset-twitter.txt.0jwf_w90.tmp

            • Path C:\Zapret\Dev\lists\.ipset-twitter.txt.0jwf_w90.tmp
            • Size 236B
            • SHA256 fb9539a0920d2dd983d505d3120504fd76d58a079feececcd3a647dbda5f4e89
            • MD5 SHA1 SHA512 TLSH

            .ipset-warp.txt.brwhyjc5.tmp

            • Path C:\Zapret\Dev\lists\.ipset-warp.txt.brwhyjc5.tmp
            • Size 157B
            • SHA256 5c9cb9c2dfa9edc074f8a836546d8d365d8a0559b45b58369a301ce2145152a6
            • MD5 SHA1 SHA512 TLSH

            .ipset-whatsapp.txt.g7yw058i.tmp

            • Path C:\Zapret\Dev\lists\.ipset-whatsapp.txt.g7yw058i.tmp
            • Size 11KB
            • SHA256 f7655c546cb8cf60ee3d631d1f1ca0c4aa11462fb9213cb2aaf94498d2175298
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .ipset-youtube.txt.66chi78b.tmp

            • Path C:\Zapret\Dev\lists\.ipset-youtube.txt.66chi78b.tmp
            • Size 223B
            • SHA256 151fc1bd95ee99939e9b308603f7a74e6e3460763ea9d2690327ad4d43694607
            • MD5 SHA1 SHA512 TLSH

            .ipset-zapretkvn.txt.q8yctqi_.tmp

            • Path C:\Zapret\Dev\lists\.ipset-zapretkvn.txt.q8yctqi_.tmp
            • Size 10KB
            • SHA256 f9ce8a7290fe6d42dde33bff0293b868c25557d1d4c69bc28c85d16286d89036
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .itch.txt.dnlflzoz.tmp

            • Path C:\Zapret\Dev\lists\.itch.txt.dnlflzoz.tmp
            • Size 76B
            • SHA256 a0473ba82ebd2be22cf8e2687b68320fb97db3c9af009500951de1afa6534556
            • MD5 SHA1 SHA512 TLSH

            .js-rbxcdn-com.txt.b0b22dqz.tmp

            • Path C:\Zapret\Dev\lists\.js-rbxcdn-com.txt.b0b22dqz.tmp
            • Size 14B
            • SHA256 febd4e9ffd5aa31ce23a7b6b0372fc58a96a9d475aaea3d4e0e8cda4ecfe85ff
            • MD5 SHA1 SHA512

            .list-exclude.txt.jybntb7v.tmp

            • Path C:\Zapret\Dev\lists\.list-exclude.txt.jybntb7v.tmp
            • Size 277B
            • SHA256 890ab68fb7cf516ace8d72a2ad44bd0d082a2e4381237a4e6d63a5c55dc447d6
            • MD5 SHA1 SHA512 TLSH

            .list-general.txt.6ic16azf.tmp

            • Path C:\Zapret\Dev\lists\.list-general.txt.6ic16azf.tmp
            • Size 812B
            • SHA256 21179eb9ccb1c69a7f96a7eeb95e00a2aee76b7f4a35f57a610772f0f59447db
            • MD5 SHA1 SHA512 TLSH

            .list-google.txt.x2vpygo9.tmp

            • Path C:\Zapret\Dev\lists\.list-google.txt.x2vpygo9.tmp
            • Size 345B
            • SHA256 4bdbb90546f7bd56baedcddfc1dab25bed9c73893e8eddb62c272a21c3e98eed
            • MD5 SHA1 SHA512 TLSH

            .microsoft-store.txt.dgs92_l8.tmp

            • Path C:\Zapret\Dev\lists\.microsoft-store.txt.dgs92_l8.tmp
            • Size 498B
            • SHA256 a12af1bff698e087c53b94ab7a0f328546c16383a71631e0c1621b76e5783630
            • MD5 SHA1 SHA512 TLSH

            .mycdnlist.txt.4cbyyrf_.tmp

            • Path C:\Zapret\Dev\lists\.mycdnlist.txt.4cbyyrf_.tmp
            • Size 202B
            • SHA256 3f8f74c125abbc343563a94176dd7cfac1ab8fbbbe63c9370714d4f1b0183eb8
            • MD5 SHA1 SHA512 TLSH

            .myhostlist.txt.2akb1nd0.tmp

            • Path C:\Zapret\Dev\lists\.myhostlist.txt.2akb1nd0.tmp
            • Size 216B
            • SHA256 a4564c3f7aff38476afeeb5a1324bbeaa9c4ac3dd7250dddd01dff888773742b
            • MD5 SHA1 SHA512 TLSH

            .ntcparty.txt.lu0lr__5.tmp

            • Path C:\Zapret\Dev\lists\.ntcparty.txt.lu0lr__5.tmp
            • Size 10B
            • SHA256 a162a1c792074c35de60574f3efe7b739063d271c90b1bc86a29cdefe5c375a4
            • MD5 SHA1 SHA512

            .obsidian.txt._u1gt3di.tmp

            • Path C:\Zapret\Dev\lists\.obsidian.txt._u1gt3di.tmp
            • Size 12B
            • SHA256 2e2d01471c331729fb6ab27b32b6d1004de4e8172160ce7e4fbed1444a14d642
            • MD5 SHA1 SHA512

            .porn.txt.76mb0gn5.tmp

            • Path C:\Zapret\Dev\lists\.porn.txt.76mb0gn5.tmp
            • Size 516B
            • SHA256 8b370085629c71cf1fe352b09ce0bb9059f54225c8758d5bd24eaf68cf3c6ec1
            • MD5 SHA1 SHA512 TLSH

            .riot-valorant.txt.yt38sxq4.tmp

            • Path C:\Zapret\Dev\lists\.riot-valorant.txt.yt38sxq4.tmp
            • Size 154B
            • SHA256 bde408887735e1f67f7c88ecb7334bc983802af99799577257a2cf9d47272215
            • MD5 SHA1 SHA512 TLSH

            .roblox.txt.33tfppp0.tmp

            • Path C:\Zapret\Dev\lists\.roblox.txt.33tfppp0.tmp
            • Size 1KB
            • SHA256 278ede5763d33be4bfcb3016790cccc4bea71d53a62d0f0a63941145a36b5185
            • MD5 SHA1 SHA512 TLSH

            .russia-blacklist.txt.bariq50t.tmp

            • Path C:\Zapret\Dev\lists\.russia-blacklist.txt.bariq50t.tmp
            • Size 1.7MB
            • SHA256 7fda7063b81ca6b61aeeb12703d2ad84a097ed35c829b3fac9a49265f525d0b9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .russia-discord-ipset.txt.h7eu7ao0.tmp

            • Path C:\Zapret\Dev\lists\.russia-discord-ipset.txt.h7eu7ao0.tmp
            • Size 11KB
            • SHA256 0a33809262ad9d3882fa2a4b957fdfe01b08797ea823ddb04a475c4e0913ceec
            • MD5 SHA1 SHA512 SSDEEP TLSH

            .russia-discord.txt.t92qlrpv.tmp

            • Path C:\Zapret\Dev\lists\.russia-discord.txt.t92qlrpv.tmp
            • Size 155B
            • SHA256 3146abcf5b451e4f0e14872d281a2b520ca0a309ab07b02b43dbc10823c35baa
            • MD5 SHA1 SHA512 TLSH

            .russia-youtube.txt.rdn2x6qc.tmp

            • Path C:\Zapret\Dev\lists\.russia-youtube.txt.rdn2x6qc.tmp
            • Size 397B
            • SHA256 955bd99c96872ff06a785f8e28760b0365dc46d27ea491431450c94de12557f7
            • MD5 SHA1 SHA512 TLSH

            .russia-youtubeQ.txt.3i9dw8ix.tmp

            • Path C:\Zapret\Dev\lists\.russia-youtubeQ.txt.3i9dw8ix.tmp
            • Size 200B
            • SHA256 d21a001802e8b512caae1b3f4ded949a1def98330a69458711bb68ce6f029726
            • MD5 SHA1 SHA512 TLSH

            .rutor.txt.lhkr0rgd.tmp

            • Path C:\Zapret\Dev\lists\.rutor.txt.lhkr0rgd.tmp
            • Size 20B
            • SHA256 769a532ae801adec50ad94f534f04608dee66dcf0d89c0026b012e3ef0ac5824
            • MD5 SHA1 SHA512

            .rutracker.txt.yvli033z.tmp

            • Path C:\Zapret\Dev\lists\.rutracker.txt.yvli033z.tmp
            • Size 205B
            • SHA256 042ca65819d10c30adf97634b1d1a6cf020079935192b416d74fcb72db583c9e
            • MD5 SHA1 SHA512 TLSH

            .soundcloud.txt.ct2mp6u6.tmp

            • Path C:\Zapret\Dev\lists\.soundcloud.txt.ct2mp6u6.tmp
            • Size 375B
            • SHA256 6655cdcb4978e624ed223f671f19e0de1fd240d9d56c5f6ceffca1775737a922
            • MD5 SHA1 SHA512 TLSH

            .speedtest.txt.pt9znu10.tmp

            • Path C:\Zapret\Dev\lists\.speedtest.txt.pt9znu10.tmp
            • Size 77B
            • SHA256 08c27a621121fd386d376d30c576fbbc036e809bdce081624480c325a36887a6
            • MD5 SHA1 SHA512 TLSH

            .static-whatsapp-net.txt.6g87ola2.tmp

            • Path C:\Zapret\Dev\lists\.static-whatsapp-net.txt.6g87ola2.tmp
            • Size 20B
            • SHA256 e3cd1285d5ec4fec3a50d170d6582cb52fbad17ee7bcfde0aa2d5b24f6943564
            • MD5 SHA1 SHA512

            .steam.txt.0rhfippp.tmp

            • Path C:\Zapret\Dev\lists\.steam.txt.0rhfippp.tmp
            • Size 243B
            • SHA256 b186fc30e7b9c0d25e5f4a7ec6c2f06e6aeb7621b9378b6b2f638a5873ccbb11
            • MD5 SHA1 SHA512 TLSH

            .tankix.txt.3czoyt2a.tmp

            • Path C:\Zapret\Dev\lists\.tankix.txt.3czoyt2a.tmp
            • Size 54B
            • SHA256 e1e32a5f19a70771c1161de02dad27b5aa844f960591c2d7f856dca869025099
            • MD5 SHA1 SHA512 TLSH

            .telegram.txt.eyfif73t.tmp

            • Path C:\Zapret\Dev\lists\.telegram.txt.eyfif73t.tmp
            • Size 122B
            • SHA256 ed0d58e4ba5af9bc70b901e0943cfb3fd96e102ae7b42aaf05539ebc8d33bcfd
            • MD5 SHA1 SHA512 TLSH

            .tr-rbxcdn-com.txt.h7cbhxdk.tmp

            • Path C:\Zapret\Dev\lists\.tr-rbxcdn-com.txt.h7cbhxdk.tmp
            • Size 14B
            • SHA256 a2b5a0ba6499f14a00de4f53c4e34bb24033bd3fd4f935eafac86230af02766b
            • MD5 SHA1 SHA512

            .twimg.txt.zt4njbz0.tmp

            • Path C:\Zapret\Dev\lists\.twimg.txt.zt4njbz0.tmp
            • Size 10B
            • SHA256 4e57abd45393a0b5df2b858d2188eb36f77c11f04bc9f7c52d763c87c2abc7ed
            • MD5 SHA1 SHA512

            .twitter.txt.g0uckzus.tmp

            • Path C:\Zapret\Dev\lists\.twitter.txt.g0uckzus.tmp
            • Size 23B
            • SHA256 3389564a601209f02df297cb2ac3ea0fc63e06fdc7de4761078bf28f96eeba4a
            • MD5 SHA1 SHA512

            .ubisoft.txt.edw_j0_0.tmp

            • Path C:\Zapret\Dev\lists\.ubisoft.txt.edw_j0_0.tmp
            • Size 65B
            • SHA256 c4a85e34d8d2f77d27853cdaac2c15846b8901c655290536469e2794b77a503a
            • MD5 SHA1 SHA512 TLSH

            .whatsapp.txt.bdsm5k6j.tmp

            • Path C:\Zapret\Dev\lists\.whatsapp.txt.bdsm5k6j.tmp
            • Size 68B
            • SHA256 a6e27669065dbd013c1cea60287afac798ed2614fae85357fd8b74508e9de257
            • MD5 SHA1 SHA512 TLSH

            .youtube.txt.g_wqyahy.tmp

            • Path C:\Zapret\Dev\lists\.youtube.txt.g_wqyahy.tmp
            • Size 406B
            • SHA256 1d7007c2db2933c63fac2c81b2ad2d26d67eadce57ec4ea9d3d1eebcd5c523b3
            • MD5 SHA1 SHA512 TLSH

            .youtubeQ.txt._qmvsnb8.tmp

            • Path C:\Zapret\Dev\lists\.youtubeQ.txt._qmvsnb8.tmp
            • Size 95B
            • SHA256 689b9d10fb79880a96b12bd5773e7dc3987b2539b22620aa756095fa7174c95c
            • MD5 SHA1 SHA512 TLSH

            .youtube_v2.txt.t4mij8f9.tmp

            • Path C:\Zapret\Dev\lists\.youtube_v2.txt.t4mij8f9.tmp
            • Size 381B
            • SHA256 ac2aaec8b5b4f751d1f1073dc27b753ada850ffe7fa850d9ee576ff21c681654
            • MD5 SHA1 SHA512 TLSH

            is-0WHOSFAAF9.tmp

            • Path C:\Zapret\Dev\lists\base\is-0WHOSFAAF9.tmp
            • Size 15B
            • SHA256 4dabcab210766e35f03e77120e6986d6e6d4752b2a9ff22980b9253d026080d8
            • MD5 SHA1 SHA512

            ipset-all.txt

            • Path C:\Zapret\Dev\lists\ipset-all.txt
            • Size 219KB
            • SHA256 3578ece419c0ad67e939883ea3515a864953ca3f81ede4d195a94d4e28e76be2
            • MD5 SHA1 SHA512 SSDEEP TLSH

            other.txt

            • Path C:\Zapret\Dev\lists\other.txt
            • Size 2KB
            • SHA256 9b85d91830b854a83ebf2c37397678b530acb22bcd940f94f479045f70770082
            • MD5 SHA1 SHA512 TLSH

            tiktok.txt

            • Path C:\Zapret\Dev\lists\tiktok.txt
            • Size 333B
            • SHA256 7169d3a00ee86df654e795d25eef0bf849adfb7a19fb75793d874b807875a090
            • MD5 SHA1 SHA512 TLSH

            twitch.txt

            • Path C:\Zapret\Dev\lists\twitch.txt
            • Size 180B
            • SHA256 9cb27c42a73b1a23711b4f8d3fc2d6681b750e3980a36ad8032e98906a37604d
            • MD5 SHA1 SHA512 TLSH

            autohostlist.txt

            • Path C:\Zapret\Dev\lists\user\autohostlist.txt
            • Size 16B
            • SHA256 a029e8a9c3faa9f8cb745caa8136503e3a6dccaac9f4c130574c0e587235970e
            • MD5 SHA1 SHA512

            zapret_log_2026-07-06_05-41-02.txt

            • Path C:\Zapret\Dev\logs\zapret_log_2026-07-06_05-41-02.txt
            • Size 1KB
            • SHA256 cf7fe97867da9aa88ba1d9822aed31d70891a0593815464a82134addb1c715bf
            • MD5 SHA1 SHA512 TLSH

            zapret_log_2026-07-06_05-41-02.txt

            • Path C:\Zapret\Dev\logs\zapret_log_2026-07-06_05-41-02.txt
            • Size 2KB
            • SHA256 3e2e99423d25ff54f59f0c8833788edef04ffdf5412fd127fda75fc31c57a906
            • MD5 SHA1 SHA512 TLSH

            zapret_log_2026-07-06_05-41-02.txt

            • Path C:\Zapret\Dev\logs\zapret_log_2026-07-06_05-41-02.txt
            • Size 3KB
            • SHA256 694aa21c7bd6aca2b5e99c8200176391d077229a5c4c7b42bdf059e4532ffab4
            • MD5 SHA1 SHA512 TLSH

            zapret_log_2026-07-06_05-41-02.txt

            • Path C:\Zapret\Dev\logs\zapret_log_2026-07-06_05-41-02.txt
            • Size 4KB
            • SHA256 b31204c443b285c2d076929a6afb64b5fbe1fa148d24a8e1edf4955f12a8b319
            • MD5 SHA1 SHA512 SSDEEP TLSH

            memory/1444-1710-0x0000024100780000-0x0000024100854000-memory.dmp

            memory/1652-29-0x00000000059D0000-0x0000000005D2B000-memory.dmp

            memory/2208-49-0x0000000005B00000-0x0000000005E5B000-memory.dmp

            memory/2496-1542-0x0000024882C00000-0x0000024882D00000-memory.dmp

            memory/2496-1534-0x0000024880000000-0x0000024880100000-memory.dmp

            memory/2496-1580-0x00000248941C0000-0x00000248941E0000-memory.dmp

            memory/2496-1541-0x00000248827E0000-0x0000024882800000-memory.dmp

            memory/2496-1564-0x0000024882BA0000-0x0000024882BC0000-memory.dmp

            memory/2596-298-0x0000000000DA0000-0x00000000011DD000-memory.dmp

            memory/2596-40-0x0000000000DA0000-0x00000000011DD000-memory.dmp

            memory/2596-1642-0x0000000000DA0000-0x00000000011DD000-memory.dmp

            memory/2596-6-0x0000000000D70000-0x0000000000D71000-memory.dmp

            memory/2596-1744-0x0000000000DA0000-0x00000000011DD000-memory.dmp

            memory/2596-1734-0x0000000000DA0000-0x00000000011DD000-memory.dmp

            memory/2596-35-0x0000000000D70000-0x0000000000D71000-memory.dmp

            memory/2596-53-0x0000000000DA0000-0x00000000011DD000-memory.dmp

            memory/2596-38-0x0000000000DA0000-0x00000000011DD000-memory.dmp

            memory/3768-14-0x0000000005850000-0x00000000058B6000-memory.dmp

            memory/3768-12-0x00000000737F0000-0x0000000073FAC000-memory.dmp

            memory/3768-8-0x0000000073802000-0x0000000073803000-memory.dmp

            memory/3768-9-0x0000000002950000-0x0000000002986000-memory.dmp

            memory/3768-10-0x00000000737F0000-0x0000000073FAC000-memory.dmp

            memory/3768-11-0x0000000005200000-0x000000000584A000-memory.dmp

            memory/3768-13-0x0000000005160000-0x0000000005182000-memory.dmp

            memory/3768-15-0x00000000058C0000-0x0000000005926000-memory.dmp

            memory/3768-26-0x00000000737F0000-0x0000000073FAC000-memory.dmp

            memory/3768-24-0x00000000074A0000-0x0000000007A5A000-memory.dmp

            memory/3768-23-0x00000000063D0000-0x00000000063F2000-memory.dmp

            memory/3768-22-0x0000000006380000-0x000000000639A000-memory.dmp

            memory/3768-21-0x0000000006E40000-0x0000000006ED6000-memory.dmp

            memory/3768-19-0x0000000005E30000-0x0000000005E4E000-memory.dmp

            memory/3768-20-0x0000000005E90000-0x0000000005EDC000-memory.dmp

            memory/3768-18-0x0000000005930000-0x0000000005C8B000-memory.dmp

            memory/5240-1750-0x00000000007B0000-0x0000000000893000-memory.dmp

            memory/5240-0-0x00000000007B0000-0x0000000000893000-memory.dmp

            memory/5240-37-0x00000000007B0000-0x0000000000893000-memory.dmp

            memory/5640-1766-0x00007FFF3C810000-0x00007FFF3CA9F000-memory.dmp

            memory/5640-1786-0x00007FFF39AA0000-0x00007FFF3A0EA000-memory.dmp

            memory/5640-1790-0x00007FFF39860000-0x00007FFF39A99000-memory.dmp

            memory/5640-1785-0x00007FFF3AA20000-0x00007FFF3AEFB000-memory.dmp

            memory/6012-41-0x0000000005A80000-0x0000000005DDB000-memory.dmp

            memory/6012-45-0x0000000006570000-0x00000000065BC000-memory.dmp