Overview

overview

10

Static

static

3

tgWsproxy.exe

windows10-2004-x64

10

tgWsproxy.exe

windows11-ltsc_2024-x64

10

Resubmissions

09/08/2026, 12:29

260809-pn6b7seq5110

08/08/2026, 13:46

260808-q223dadg3610

Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 13:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tgWsproxy.exe
  • Size 37.7MB
  • Sample260808-q223dadg36
  • SHA256 3ae9f263c7a093592db83592768848686292828e0bdf80706f85f3e882b8c818
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutionsalatstealerpyinstallerstealerupx

Malware Config

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 17 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 27 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tgWsproxy.exe
    "C:\Users\Admin\AppData\Local\Temp\tgWsproxy.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Users\Admin\AppData\Local\Temp\zapretdriver.exe
      "C:\Users\Admin\AppData\Local\Temp\zapretdriver.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:820
      • C:\Users\Admin\AppData\Local\Mozilla\ShellHost.exe
        C:\Users\Admin\AppData\Local\Mozilla\ShellHost.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3408
    • C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe
      "C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe
        "C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          4⤵
          • Executes a command shell one-liner
          PID:2448

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        svc_e0f0fff2.log
        • Path C:\ProgramData\svc_e0f0fff2.log
        • Size 1KB
        • SHA256 4a6b4e3af91abdd1f6a2d86331f0bc66cc90965ef4e4456ffcb6b896f722bc20
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        svc_e0f0fff2.log
        • Path C:\ProgramData\svc_e0f0fff2.log
        • Size 1KB
        • SHA256 2776c9ca8615edd7e4b52e6deae61c67ec173c83dc6d0ea0364bd80f17eea0c7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        svc_e0f0fff2.log
        • Path C:\ProgramData\svc_e0f0fff2.log
        • Size 730B
        • SHA256 e020617535218ca332f771993592f5addbe741714b925e02cba456befb7f8ffa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        svc_e0f0fff2.log
        • Path C:\ProgramData\svc_e0f0fff2.log
        • Size 1014B
        • SHA256 f88ea328b8403ed6fb2970aaf3697e29c0957684ae6f2efe940c12bdc02d940e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        TgWsProxy_windows.exe
        • Path C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows.exe
        • Size 20.0MB
        • SHA256 840f1c7dae30f492a305f8006256cc2e09426be104c14844cb9be44f966c178d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\_bz2.pyd
        • Size 82KB
        • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\_ctypes.pyd
        • Size 121KB
        • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\_lzma.pyd
        • Size 155KB
        • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-console-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-console-l1-1-0.dll
        • Size 21KB
        • SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-datetime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-datetime-l1-1-0.dll
        • Size 21KB
        • SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-debug-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-debug-l1-1-0.dll
        • Size 21KB
        • SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-errorhandling-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 21KB
        • SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-fibers-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-fibers-l1-1-0.dll
        • Size 21KB
        • SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-fibers-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-fibers-l1-1-1.dll
        • Size 21KB
        • SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-file-l1-1-0.dll
        • Size 25KB
        • SHA256 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-file-l1-2-0.dll
        • Size 18KB
        • SHA256 d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-file-l2-1-0.dll
        • Size 18KB
        • SHA256 144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-handle-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-handle-l1-1-0.dll
        • Size 21KB
        • SHA256 39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-interlocked-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 21KB
        • SHA256 53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-kernel32-legacy-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-kernel32-legacy-l1-1-1.dll
        • Size 21KB
        • SHA256 a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-libraryloader-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 21KB
        • SHA256 7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-localization-l1-2-0.dll
        • Size 20KB
        • SHA256 6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-memory-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-memory-l1-1-0.dll
        • Size 21KB
        • SHA256 0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-namedpipe-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 21KB
        • SHA256 c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processenvironment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 21KB
        • SHA256 c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 21KB
        • SHA256 5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 18KB
        • SHA256 ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-profile-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-profile-l1-1-0.dll
        • Size 21KB
        • SHA256 7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-rtlsupport-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 21KB
        • SHA256 9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-string-l1-1-0.dll
        • Size 21KB
        • SHA256 60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-synch-l1-1-0.dll
        • Size 21KB
        • SHA256 3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-synch-l1-2-0.dll
        • Size 18KB
        • SHA256 9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-sysinfo-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 21KB
        • SHA256 b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-sysinfo-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-sysinfo-l1-2-0.dll
        • Size 21KB
        • SHA256 2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-timezone-l1-1-0.dll
        • Size 18KB
        • SHA256 5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-util-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-core-util-l1-1-0.dll
        • Size 21KB
        • SHA256 6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-conio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-conio-l1-1-0.dll
        • Size 21KB
        • SHA256 b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-convert-l1-1-0.dll
        • Size 22KB
        • SHA256 91c5966932287078d0e616d8e0369347991f39765749bbffa1ed3a9df49776d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-environment-l1-1-0.dll
        • Size 18KB
        • SHA256 8d9d3e905d072c4465e4787dd5bd843d3a5dd5ac5ad9d7f232032b25facc82ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 20KB
        • SHA256 8f9361d02f68392127fe264655eac4fef4a4a1bf63571f184ce26faa98670702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-heap-l1-1-0.dll
        • Size 18KB
        • SHA256 76dad3e04c9ff61b40ae1c9e039837cd1c077d59b6a008643e4fbf2dbdb564dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-locale-l1-1-0.dll
        • Size 18KB
        • SHA256 ba1458f730ff90009483c763926d1c74383480e529541c0ef5d4de44e7a4f14c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-math-l1-1-0.dll
        • Size 27KB
        • SHA256 5f2bb085217304006c81c55214c6093ec476e554e31808026e424da82f58aa0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-process-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-process-l1-1-0.dll
        • Size 21KB
        • SHA256 f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 22KB
        • SHA256 11aca97acda31203aeee496c9f183b49db1c54d0efa48888a15ab4ea47ee080f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 24KB
        • SHA256 cf7bbe93ae75a1c46a38204a6acef71bf2f5e3cd34501825601900e07d3d7b15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-string-l1-1-0.dll
        • Size 24KB
        • SHA256 b516d1772b75714f039440cf5d070b87a187d2f67b7f891c94cf1c60330fbfa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-time-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-time-l1-1-0.dll
        • Size 20KB
        • SHA256 a4b0f75854949980d410c5da90c36ddb94be292431c89fd3e992f9d5f8ee9983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-utility-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\api-ms-win-crt-utility-l1-1-0.dll
        • Size 18KB
        • SHA256 d675ee0c418c4cd7ff0c19c2d945331c8e6072a51abbca548e7d9d2f1bf288dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\base_library.zip
        • Size 1.4MB
        • SHA256 f5908f37a3e301cfac1d435a9ea728097717f204155c881536b17e4e5c83e5b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\python3.dll
        • Size 65KB
        • SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\python311.dll
        • Size 5.5MB
        • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46362\ucrtbase.dll
        • Size 973KB
        • SHA256 4c5b8e529854cedfa8f46cd6906952400cdbbf25efc4cf37dda2c42d8e96ddcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zapretdriver.exe
        • Path C:\Users\Admin\AppData\Local\Temp\zapretdriver.exe
        • Size 5.2MB
        • SHA256 beb6c8932196b0ca9c3c71b2a394feef961b281caf386758a684b7be1fe68650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        proxy.log
        • Path C:\Users\Admin\AppData\Roaming\TgWsProxy\proxy.log
        • Size 1KB
        • SHA256 a782bfa1b4d78ed5394b6966698f0f69f4db14f1fc04d8a239c41095e386ada0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/820-1269-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-1272-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-57-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-58-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-60-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-56-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-55-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-1265-0x00000000009C0000-0x0000000000EF6000-memory.dmp
        Download

        memory/820-1268-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-59-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-1270-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-61-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-1278-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/820-1283-0x00000000009C0000-0x0000000000EF6000-memory.dmp
        Download

        memory/820-38-0x0000000003BC0000-0x0000000004823000-memory.dmp
        Download

        memory/1652-0-0x0000000000400000-0x00000000029BC000-memory.dmp
        Download

        memory/3408-1305-0x00000000035A0000-0x0000000004203000-memory.dmp
        Download

        memory/3408-1324-0x00000000035A0000-0x0000000004203000-memory.dmp
        Download

        memory/3408-1325-0x00000000035A0000-0x0000000004203000-memory.dmp
        Download

        memory/3408-1326-0x00000000035A0000-0x0000000004203000-memory.dmp
        Download

        memory/3408-1331-0x0000000000420000-0x0000000000956000-memory.dmp
        Download

        memory/3408-1328-0x00000000035A0000-0x0000000004203000-memory.dmp
        Download

        memory/3408-1327-0x00000000035A0000-0x0000000004203000-memory.dmp
        Download

        memory/3408-1323-0x00000000035A0000-0x0000000004203000-memory.dmp
        Download