07185c974629ca3e1458a385de6bba1868506a6febe62e0d1c92921340386049

Analysis

user interaction
yes
max time kernel
299s
max time network
302s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
14/08/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
yt.exe
Size 19.8MB
Sample260814-c8zzpstamb
SHA256 07185c974629ca3e1458a385de6bba1868506a6febe62e0d1c92921340386049
MD5 757572e7b9a1e3d42a5c115ebe63a4b4
SHA1 199fbdceb4fefdbb77029db9be4147a0fed4833f
SHA512 f6fa6149671cbb9bb010cf68d8a79905a736db16f9896ea0f4dc2df54742d2e1d2359c873341fd67bcf44a53c47c790a0bcab53b4069f137a2264d82f3c18188
SSDEEP 393216:eRuBsncDZ/7fGqR5aAdWNB0q9PPaRJHLe2n7DqK:eRuB2cDxfGqRVWn0q9XaRJHl5
TLSH
T15B27336C76666D9AEFB384F011BB051B4EF5E9B8C669D3194BB03AD93D07A00C5ECB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5720 created 3428	5720	yt.exe	57

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\YT\resources\Country.mmdb	yt.exe
File opened for modification	C:\Program Files\YT\resources\clash-verge-service.exe	yt.exe
File opened for modification	C:\Program Files\YT\resources\enableLoopback.exe	yt.exe
File opened for modification	C:\Program Files\YT\resources\geoip.dat	yt.exe
File created	C:\Program Files\YT\resources\install-service.exe	yt.exe
File created	C:\Program Files\YT\verge-mihomo.exe	yt.exe
File created	C:\Program Files\YT\resources\clash-verge-service.exe	yt.exe
File created	C:\Program Files\YT\resources\geoip.dat	yt.exe
File created	C:\Program Files\YT\uninstall.exe	yt.exe
File created	C:\Program Files\YT\YT.exe	yt.exe
File created	C:\Program Files\YT\resources\geosite.dat	yt.exe
File opened for modification	C:\Program Files\YT\resources\geosite.dat	yt.exe
File created	C:\Program Files\YT\resources\uninstall-service.exe	yt.exe
File opened for modification	C:\Program Files\YT\verge-mihomo.exe	yt.exe
File created	C:\Program Files\YT\resources\Country.mmdb	yt.exe
File created	C:\Program Files\YT\resources\enableLoopback.exe	yt.exe
File opened for modification	C:\Program Files\YT\resources\install-service.exe	yt.exe
File opened for modification	C:\Program Files\YT\resources\uninstall-service.exe	yt.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_172658603\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_172658603\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_286556081\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_2120753929\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_172658603\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_172658603\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1117548283\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1553998776\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1553998776\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_286556081\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_2120753929\manifest.json	msedgewebview2.exe

Executes dropped EXE 2 IoCs

pid	Process
5956	YT.exe
4300	verge-mihomo.exe

Loads dropped DLL 12 IoCs

pid	Process
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yt.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311493417297337"	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{39BC94E8-4387-4205-9E83-A1AEEA49C2E7}	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5720	yt.exe
5956	YT.exe
2544	msedgewebview2.exe
2544	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5956	YT.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3500	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4300	verge-mihomo.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5956	YT.exe
5956	YT.exe
5956	YT.exe
5956	YT.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5956	YT.exe
5956	YT.exe
5956	YT.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5720 wrote to memory of 5956	5720	yt.exe	92
PID 5956 wrote to memory of 3500	5956	YT.exe	94
PID 3500 wrote to memory of 5600	3500	msedgewebview2.exe	95
PID 3500 wrote to memory of 5200	3500	msedgewebview2.exe	96
PID 3500 wrote to memory of 5200	3500	msedgewebview2.exe	96
PID 3500 wrote to memory of 5200	3500	msedgewebview2.exe	96
PID 3500 wrote to memory of 5952	3500	msedgewebview2.exe	97
PID 3500 wrote to memory of 456	3500	msedgewebview2.exe	98
PID 3500 wrote to memory of 456	3500	msedgewebview2.exe	98
PID 3500 wrote to memory of 1248	3500	msedgewebview2.exe	99
PID 3500 wrote to memory of 1248	3500	msedgewebview2.exe	99
PID 3500 wrote to memory of 1248	3500	msedgewebview2.exe	99
PID 5956 wrote to memory of 4300	5956	YT.exe	100
PID 3500 wrote to memory of 3724	3500	msedgewebview2.exe	104
PID 3500 wrote to memory of 3724	3500	msedgewebview2.exe	104
PID 3500 wrote to memory of 3728	3500	msedgewebview2.exe	105
PID 3500 wrote to memory of 5176	3500	msedgewebview2.exe	107
PID 3500 wrote to memory of 5176	3500	msedgewebview2.exe	107
PID 3500 wrote to memory of 2928	3500	msedgewebview2.exe	108
PID 3500 wrote to memory of 2928	3500	msedgewebview2.exe	108
PID 3500 wrote to memory of 4640	3500	msedgewebview2.exe	109
PID 3500 wrote to memory of 4640	3500	msedgewebview2.exe	109
PID 3500 wrote to memory of 2544	3500	msedgewebview2.exe	110
PID 3500 wrote to memory of 5340	3500	msedgewebview2.exe	111
PID 3500 wrote to memory of 5340	3500	msedgewebview2.exe	111
PID 3500 wrote to memory of 696	3500	msedgewebview2.exe	112
PID 3500 wrote to memory of 696	3500	msedgewebview2.exe	112
PID 3500 wrote to memory of 6124	3500	msedgewebview2.exe	113
PID 3500 wrote to memory of 6124	3500	msedgewebview2.exe	113

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3428
- C:\Users\Admin\AppData\Local\Temp\yt.exe
  "C:\Users\Admin\AppData\Local\Temp\yt.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in Program Files directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5720
- C:\Program Files\YT\YT.exe
  C:\Program Files\YT\YT.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --enable-features=msWebView2EnableDraggableRegions --lang=en-US --mojo-named-platform-channel-pipe=5956.3464.4523064010955969478
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9ae1db078,0x7ff9ae1db084,0x7ff9ae1db090
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1816,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1932,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=828,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:8
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3624,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4556,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4308,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
      4⤵
      Modifies registry class
      PID:3728
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5072,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:8
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=780,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3956,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5080,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2544
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2836,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:8
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1036,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView" --webview-exe-name=YT.exe --webview-exe-version=3.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4404,i,18093270903837121612,1689376865343831332,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=OverscrollHistoryNavigation,msExperimentalScrolling --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:8
      4⤵
      PID:6124
- - C:\Program Files\YT\verge-mihomo.exe
    "\\?\C:\Program Files\YT\verge-mihomo.exe" -d C:\Users\Admin\AppData\Roaming\com.nextvpn.fastest.yt -f C:\Users\Admin\AppData\Roaming\com.nextvpn.fastest.yt\clash-verge.yaml
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YT.exe

Path C:\Program Files\YT\YT.exe
Size 12.2MB
SHA256 bfe5588d3bd5c7444a0d69413579388422c37cbc0b17b3cad375c105448d0f95
MD5 9f39daf36af38d850222e9dbc47b9e7e
SHA1 d5045d91bc92f518049d1c5efae27e6b84f0c0ee
SHA512 061617cfe5d8f00a188f7153fcf6d2a4d5ee29f60e1085b2b06bca01348d1dd5631ca801bb23d87cee11ca8ed83d97f51eb92aafd0bca26181515a24a4f7a1a8
SSDEEP 196608:SwazUB9DKhFM9jBMxf3IpDdT9m9Lu/jCfbon:ZadhFP3IpDO8/jCA
TLSH
T105D69D03F69181E9C09DC1B8C35BA633EB32B88D0625B65B1BE44F212F66F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Country.mmdb

Path C:\Program Files\YT\resources\Country.mmdb
Size 6.4MB
SHA256 e70989285d5b9da2622f4706571592a6c86ce69bf9af5f107be2a03016113fd0
MD5 24e67c4560c32426313866b5501565a0
SHA1 606355808a4b1f6a3c0c6d11fa2c7ae8fb0b313c
SHA512 0864da456eb047320d321ea20e1eba6047f7614df56cb7352c8a2c1e90d3155b3d0de0c4d634a0a59fc542aae42a85e475cc2e41d7ecf63f55de55d6e52f0c49
SSDEEP 98304:DVPrUMVQKCo4Uwxg+TjFAYSqNElOs9UMd/U+jqE/QPb3vUl/Lqg4RJAuwJ7CR/hB:hPYMG552bYM0
TLSH
T15B66F861EF21B2A5538FE9793B67FD48146052DB9029992EA90D3BD330886C3DB3D1DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip.dat

Path C:\Program Files\YT\resources\geoip.dat
Size 13.8MB
SHA256 5f1aa31e6f620dd5b02589a6d41900894c05c32b880591640e36a51ca8e561ef
MD5 af64e1f1c28930feae8ad14d83e42763
SHA1 70a137f4027005a1db1f85bd936c78b881e1066d
SHA512 cb62502a3bb5da8be5c97a9ae2fa6b003ae4e09eb5123359ff017e199f70be25af2ad3673d745a702b41390fb523a0cb21bfd939857ecaf931888027e02cf741
SSDEEP 98304:pzJsmDygWVZuBDncOksSCssLk9xXbK3FHQ/ECOJ5Mcm:njLuFcm
TLSH
T12DE6BC33D63550F5EEABD53DC35E28665F0FB4A498A0C0B0A2C55448FEA8A90F536F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geosite.dat

Path C:\Program Files\YT\resources\geosite.dat
Size 3.3MB
SHA256 ada71b66cf61c315e7fc1cc644e47038768fe8a20c93a4130e15579debc3ea3f
MD5 612e708fe023b55bc4021e62b97a0554
SHA1 de769dfd1495c006ec46a70c9ca18f4c990630be
SHA512 fbe2af41c2799d6ae063be201e7edf609b5232a1b31a1b1b93973f69bff373d0443a0fcc3a2e5e443ee581965d9e4573e493d18f93e4870fc149819c896a047b
SSDEEP 24576:BAxqAyXVd1oK3DR4MUKoIOVH9A4aDZBg8EqRgNS8ITdPEO:BALWVd1oU6KoIadA4aDjg8zONS9TdPEO
TLSH
T147F562FF4C15469132686539A30D20C8340CA3B566ECDFD28A645AA7F2F4A7673C4AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verge-mihomo.exe

Path C:\Program Files\YT\verge-mihomo.exe
Size 26.4MB
SHA256 f4f9820ff5e5eb424680cd8c6b00f4d6423de10a946801f416406498a61a3d1c
MD5 80591ecb709c13706f41329d02ad6980
SHA1 91ac7eaa714f6e5db8a0d118a8b3a330b3971da0
SHA512 05cdc4b742008d85ea4ad67dafebb015bec597fc2bf6a73bb60a1236102521b0d9f4b8f4c3578adcda8f3de5b09caadb50cb223b4cd8473f1b03ae8f71611f7c
SSDEEP 196608:0tNd/qX1HtU/MvIp7ALcJWplh4teraZP:03d/i/U/M+lJW5KN
TLSH
T14E574A47ECA584E4C5A9C834C66692237B717C494F2427D72BA0F7283F76FD06ABA740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleSC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3EBC.tmp\SimpleSC.dll
Size 1.1MB
SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
MD5 7b89329c6d8693fb2f6a4330100490a0
SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
TLSH
T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3EBC.tmp\StartMenu.dll
Size 7KB
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3EBC.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsi3EBC.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3EBC.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3EBC.tmp\nsis_tauri_utils.dll
Size 29KB
SHA256 c0f2b928bc4c81cc5ca30a8932a6dc8cd617dd016679c057e23355fe732b2333
MD5 8def0196223484f8aed4106148dd3f08
SHA1 e0fc0951deb0e5e741df10328f95c7d6678ad3aa
SHA512 9ffa66181bce5aa5210da0fe5edc6c80aa9e46e2bd1fafd840f468965f4d06bc03f9a77e04b975ffc9f25c886c274196e3fedae6cfb57f366ef39f1e31e1ada7
SSDEEP 768:97F3QRyGmiZZ1FCeu2rcFKpnq0jdhK7W+qdxi:hJQRtmaF7YMX/q
TLSH
T11FD23A18FCC97EBAC7DF05B119088D6E529FC8180754CEABE3B25E52D5A23322ED514E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1ee0dbd262a14f6220ad6c7f5b9e27a16cc7927c1d1233917582bc121f26c0bc
MD5 544053eeebf4a188a7071e2b19a00649
SHA1 024d845ef808ddf3cd3ee9d3dff0d446362f2d03
SHA512 0dd6eb358fc9b374eaeb87d0cc8388ff3b1118a06b796ed09aa9f44b43be390a723504d4e89ba1286de8567ff22c840c4dc96a26512935c8a563d2033f8b16d1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a57ef70fcff85b7045b788e90167b587b0ddb874f078cda6d1f73a5bc09afd42
MD5 54cd465e8f662e5fa514b24a00d38444
SHA1 88fcb545616d7bd697274afd4c8555422fb0c2ed
SHA512 da07619804eea9c79d721d962227f29eaa06a6b24875397ebdfabae39cbf2f6287c7535aa7c50ea6082a5f3eff354def3d84eb3b8929196b681393b0ad9bafc8
TLSH
T1CBD0122A72410574C01020330016A20C1C02D11B400A40407428852D2E180581E07441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 b0dcfe537e3e480df4b566f5a40f950b507e2c9e5619ce3685def75242b2f1e2
MD5 37aa2c1648f0ba9f2e251025bcd4c55f
SHA1 13178b28d8ad13fd75f67d20be31abbd92c0bea5
SHA512 db7f51a687d8cfd3a96d424d9b8bc549efe2dd3b60d5cad3a43751b56e50ae2e71f58469c01a232b676fe7ef0968ca64761531071c557570851f4a884d672283
TLSH
T194C08C10412C2C5ECB48013620A23CCC7ABBCC2840822E74E3509E20A820FA894CA904
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2afb5a7190088f458c57233d0662105352b5a410645e2285db212f5d2b8c264f
MD5 ea50ce53bdc7fb6bf638470f2131d089
SHA1 2d2d7584ece4c03149a2f7e1f299d449c1e2d771
SHA512 30285abc1526f3829b0ec3f00c740bff212b4d0b8a77256d5a9f195870512ed32591ab4a447468f440a58fe4c265164445339297f40b802bf18f521a6f3a5873
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 da3a26bac1bb730d6882c54f79b1e10eeffc2764e6adfc99806403a1490e8816
MD5 33d9fc1bb62fe918c301a807e6e4f645
SHA1 142a3c07c068e0b328111934ce264d9174379231
SHA512 6f86c359fa1cd36436d9050971cc082eb0232f44421d911d5f2060e048a91fcaf2638a947e3a70f0fdc3dba72a53b926f98df379bd2222d392ff47bc06656a21
TLSH
T18C2198B747F085AD8A6195FC1A103D1BCF9D041D4BBC69698AE0EF8347A14F1E20598F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a47d8.TMP

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\Network\Network Persistent State~RFe5a47d8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 6a07cc0ccc0cc04793bf5621d32908d7eb9a6d3bc13c23e8641547e885cae348
MD5 e6b8e2fdfdfc2090fabcd0969ed94054
SHA1 28b157ca975437833defd49c13f365051bda3c2d
SHA512 2620a1786e36b65def97786dd965ad8ca5f3179a7d36be7dc6ae51996ad9c3c446169b2833a381646b35c6bcbbf817e9b2bc3d656b70902b26399a6db9eaad2b
TLSH
T196C0226280AEE032907806250880AD006E36A138058269EC8663023C90612B78203002
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5991f5.TMP

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\Network\TransportSecurity~RFe5991f5.TMP
Size 188B
SHA256 3db84fbdd8f5d969cf01651fc1c8a4fad573865f0ef55b7174d6240c333373db
MD5 b71805b9da1f62fefae7ee02be35c89f
SHA1 73696154296f3ec25d59dc9b833c6bda3ecc21dc
SHA512 b8ae706803c29747d4cab22e3d65b890111a1fa47fd5277a64fd66312da4ee9b3b0b61607b3c0616b55b8adeab26f10285c9171da7bb1f079e94885a545aebfa
TLSH
T177C022E2802DE0B3203805214880BD006F36B53205825CEC8642113CA1801674503002
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\Preferences
Size 6KB
SHA256 f0b3c5847154227007b7af065cfd9338993caf5c8eae29bc72ab96d07a319cad
MD5 6e2d5c9d6619dec74d8e8c8e2d00e7f4
SHA1 616b04c36c4591c422cee7a3f18cce8671b001b3
SHA512 4b3968d9c4427b7100555e26bd54669aa4fbb6045700c7eda1e64a560868ea77dce75fd1ee09b56061867a6384c576da8caf9656f1ed8b5a254abbe2fc047fe1
SSDEEP 192:stM0YJQfGqHZ8paF1/S+Wi7+vwdOpY+MC:stNYJQ/2+/VkwzvC
TLSH
T186E1A702AEA86D778CC7F6597A25BF16E3F6107255C50E58EFFC861C04EA6CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\Preferences
Size 6KB
SHA256 bcd5dda8fa26fe936956ad1e7fc7561dcc56c85f3ce80ef970d2e9f71fcf75bc
MD5 800b7c61ab59ff19b466994fbeb7a117
SHA1 8498c7de949e1ee4c8a1ba28e2c8117085e9cf7b
SHA512 93d5cbdb9231654f5545afb1ffc2d9290bd0d529edfa301f5be1b1679879bac3136c96595112ef48605d5a185ae54f7e5a59a92d9eedb6a528b0601f7e75791c
SSDEEP 192:stM0YJ7fGqHZ8paF1/S+Wi7+vwdO1Y+M8:stNYJ7/2+/Vkwtv8
TLSH
T19DD19602AEA8B9778CC7F6197A25BF16D3F6107265D50E58EFFC851C08DA6DC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5985e0.TMP

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\Preferences~RFe5985e0.TMP
Size 6KB
SHA256 b02b0ff87e72bc66027f45981b16751f778793f26ff20e8e37ca1c90de6a6a65
MD5 3c51ead3449606a2bbc13993d1f29ad7
SHA1 8ddbce5c218af5665927700953ce03862ee1be37
SHA512 514282f0edbf337a6b72a35eda922ae62d365675b5ed3d2f37c5281f4346b1bc2dbfb544548f2df79d94e9c4c9183f2c9a12f2098694309bdaa5b714e5c01794
SSDEEP 96:stM05GJZ0ab9JffqmUHZ8i0vhEvkUsm/7qx+WVHMSm+uecp+v1idQjT+gzY+MEB:stM0YJ7fyHZ8paF1/S+Wi7+vwdO1Y+M8
TLSH
T143D18602AEA8A9778CC7F6197A25BF16D3F6107265D50E58EFFC851C08DA6DC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Local State
Size 2KB
SHA256 ab31de3050d24755acaedd8ec5e2db0b6f3b0df15bae127d223d374b14e2f06c
MD5 63b8a9ebfc8cd455bffeb5a53ed69388
SHA1 d158078715e4f03e44d99a649de369825e6a5eb1
SHA512 16d288263a66c311a11947ad84d5bd6cd8900d835eb954e87a8924a06890c1583d23bfc994e75b89635f4e66b8399afcf739100be392a689275db6bdc9963d17
TLSH
T17951B732B8949E7689F39914B9497F13DB3550F5A7522FA0A9EC0B1C01DE65C2352C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Local State
Size 16KB
SHA256 09351cfc8c1539da19e9c49cab633db026d7abe98cd6123c4f43710021d56893
MD5 2c4e05927a65fb8d9dc3f9e254c657d4
SHA1 e12734311441b4abcca7535ec0308a019295aa3e
SHA512 4211ecb4f6bec4e4dd9ca20b3cc283326f1fc3d158e8910b6e3a8fdba02a04aa0e4b805aa05dbe99102146f29086ee533e15a116b91ddd2e4d2c424269d79284
SSDEEP 192:zv7DFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4kiNbicooDUhu7ml:zr+aQikB+z/xvxjg/qhEmNb/zb1ve9z/
TLSH
T1BE728D3795A87E3795F2E905790C0B4BDBB984B290C12FB84EED5F09068B7941342D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Local State
Size 3KB
SHA256 8e94787b2232148ebdd221c898e27a89f1277a8dbb166db937b71326fc315b44
MD5 b19d7adbe06e40c4ce0e63d0800d73b6
SHA1 249c7d19c0cabb33859976781dc2c27c83a36a04
SHA512 fa63f5c0edd423122fb4350ed8c56a8d9a4d9d9a014ec4f2c972386e10aeac72a7d14533f50ed01a58c6afc4becc0d131e71e13950d517939bf5f8d286b24125
TLSH
T162718432A9A4A9374EF39905B9852F02B7655176E2953FA4D9EC0F1D02DB7882392C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe592d8e.TMP

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\Local State~RFe592d8e.TMP
Size 1KB
SHA256 fd95746f4b1a60f02125544b9987db47f0e6ad9026b1293ac5d1a660a125cc5b
MD5 2860fed9429790f75b2c4a5737e87fa1
SHA1 363ff945d939cfe86570e85f002c319678a5e8a3
SHA512 87e4936b262770a3c477133a99759917e182befcc0e583c705b87922d9e5ed043c21931e110dba78efa34dcea80687843b4f9ca162b2805cbf7db6649ca690ef
TLSH
T136219532D4D05E7159E14409B201EE032F1010B9A3119F58A5DC071D03EEECC92F7C33
MD5 SHA1 SHA512 TLSH

Submit Download

e3546d9d-64c5-4c39-b1f5-ade5d03ba6f9.tmp

Path C:\Users\Admin\AppData\Local\com.nextvpn.fastest.yt\EBWebView\e3546d9d-64c5-4c39-b1f5-ade5d03ba6f9.tmp
Size 1KB
SHA256 d859830641ae94a32a1cffca672e53434fc49a7c1a7d83e1d6ac1b87480f9d15
MD5 8a80423c349e2602a70b948376d4d9b0
SHA1 3b40082bc2706e09a8a31a1bdd3edfc26a50d0c8
SHA512 9794dbe4e74c2f3a43c784399670082839afc0662c83b457105749bbffe72bf7a506b13ccccfb1d141733c7f0f5f5b3686b41dcceff14022eb5aba487147a06d
TLSH
T17E318772A4D01F715DE15546B205AE03AF2010B993115F9475ED4B1D02EEACC91B7D33
MD5 SHA1 SHA512 TLSH

Submit Download

clash-verge.yaml

Path C:\Users\Admin\AppData\Roaming\com.nextvpn.fastest.yt\clash-verge.yaml
Size 372B
SHA256 c7eb57df2741206c56dbe3122b27cee1136dde64d75a94085ee56980ae3f9257
MD5 df87acc554d03652d48de788522743be
SHA1 fd044f8ad996b59fc6dbca9776d639a3d31335d4
SHA512 8ca87e011442970d10fa719617bd0a288feda4a9f9b42245a5f6f58f7d4bf01b33bec1abf84da2dae5a481db5caef37526882fd3a650e5d3562445d0ba7af062
TLSH
T1D2E06103E1547035A1D4016DB653B942F832CE4C915735F05C4B02091D5213CC0E7D42
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1291359972\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-200-0x00007FF9CB420000-0x00007FF9CB421000-memory.dmp

Download

memory/456-201-0x00007FF9CACF0000-0x00007FF9CACF1000-memory.dmp

Download

memory/1248-218-0x00007FF9CB0E0000-0x00007FF9CB0E1000-memory.dmp

Download

memory/2544-508-0x000001A1825D0000-0x000001A1825D1000-memory.dmp

Download

memory/2544-496-0x000001A1825D0000-0x000001A1825D1000-memory.dmp

Download

memory/2544-502-0x000001A1825D0000-0x000001A1825D1000-memory.dmp

Download

memory/2544-504-0x000001A1825D0000-0x000001A1825D1000-memory.dmp

Download

memory/2544-507-0x000001A1825D0000-0x000001A1825D1000-memory.dmp

Download

memory/2544-506-0x000001A1825D0000-0x000001A1825D1000-memory.dmp

Download

memory/2544-505-0x000001A1825D0000-0x000001A1825D1000-memory.dmp

Download

memory/2544-503-0x000001A1825D0000-0x000001A1825D1000-memory.dmp

Download

memory/2544-497-0x000001A1825D0000-0x000001A1825D1000-memory.dmp

Download

memory/2544-498-0x000001A1825D0000-0x000001A1825D1000-memory.dmp

Download

memory/5200-134-0x00007FF9CB0E0000-0x00007FF9CB0E1000-memory.dmp

Download

memory/5720-57-0x00000000060D0000-0x00000000061EC000-memory.dmp

Download