Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://github.com

windows11-ltsc_2024-x64

10

Resubmissions

05/10/2026, 11:59

261005-n53rzav1e110

04/10/2026, 23:50

261004-3vj97stt6m6

04/10/2026, 22:27

261004-2dgx3ssv3q10

04/10/2026, 17:27

261004-v1xhqatapg10

03/10/2026, 15:39

261003-s3tthasw6n10

03/10/2026, 14:49

261003-r631xadg636

03/10/2026, 11:56

261003-n4fk2sy1cv10

29/09/2026, 15:45

260929-s7aw7axtez8

26/09/2026, 13:02

260926-p9wpwstekc8

26/09/2026, 12:15

260926-pey7jatwbx10

Analysis

  • user interaction
    yes
  • max time kernel
    448s
  • max time network
    451s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/09/2026, 08:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://github.com
  • Sample260923-krnt4sha72
Score
10/10
defense_evasiondiscoveryexecutionsalatstealerpersistenceransomwarestealerupx

Malware Config

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 13 IoCs
  • Executes dropped EXE 2 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Drops file in System32 directory 3 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 16 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff83324c188,0x7ff83324c194,0x7ff83324c1a0
      2⤵
        PID:4684
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,8031027548938369302,16052088017722797785,262144 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
        2⤵
          PID:4656
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2052,i,2759983873466280918,8851243875099154133,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
          2⤵
          • System Time Discovery
          PID:3420
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,9038923121966343386,6730862043187597209,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:13
          2⤵
            PID:3032
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,1619716961724527562,17839936817022648664,2097152 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
            2⤵
              PID:5036
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,6955032366744034318,14161598907635998488,2097152 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
              2⤵
                PID:4556
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,14628938405474402905,1056932148195547991,2097152 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
                2⤵
                  PID:5644
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,12241698219791598883,13332766618711401014,2097152 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
                  2⤵
                    PID:2788
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,14275126757752083245,15568198218036419893,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
                    2⤵
                      PID:1512
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,3989699256521160426,9312031545563315442,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
                      2⤵
                        PID:5284
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,17946403935332675545,16451345234999663831,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
                        2⤵
                          PID:5304
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,1093483069090616417,17449996702733050250,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
                          2⤵
                            PID:6100
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,1093483069090616417,17449996702733050250,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
                            2⤵
                              PID:3120
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,886128579328902599,9640424903846516257,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
                              2⤵
                                PID:1360
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5312,i,9040167721558906446,14732862277846559367,2097152 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
                                2⤵
                                  PID:5796
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7080,i,6619018959696197546,6867288868733762219,2097152 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
                                  2⤵
                                    PID:3884
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,17559044536359585516,10895308922237066230,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:14
                                    2⤵
                                      PID:1860
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,9595754545787092941,3757042257308445086,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
                                      2⤵
                                        PID:3796
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,9578641275224072422,9554147983890416657,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
                                        2⤵
                                          PID:4776
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,9409305883422481949,4114221807561534935,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
                                          2⤵
                                            PID:5264
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1184,i,5167695723917998630,3379986564647539672,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:14
                                            2⤵
                                              PID:1740
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1184,i,5167695723917998630,3379986564647539672,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:14
                                              2⤵
                                                PID:1076
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=1468,i,75537075809856751,1105598695852683047,2097152 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
                                                2⤵
                                                  PID:5296
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,5529803623940423836,14937949844987986305,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:14
                                                  2⤵
                                                    PID:3376
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4316,i,18382422223358500710,8744775966734304118,262144 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:10
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2544
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4532,i,10234710777012666126,17227346567308302426,2097152 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
                                                    2⤵
                                                      PID:688
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,10072384933819487076,11657383017954168101,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
                                                      2⤵
                                                        PID:4796
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,3512076067046631708,16553565592815431171,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:14
                                                        2⤵
                                                          PID:1744
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,14724327361154829769,2177331513724261384,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:14
                                                          2⤵
                                                            PID:4492
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,18413575433765304505,7316760857393776357,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
                                                            2⤵
                                                              PID:4332
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7688,i,10528217759892886604,7029655575617756371,2097152 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:1
                                                              2⤵
                                                                PID:5516
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,6523091512879190344,944731767507559828,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
                                                                2⤵
                                                                  PID:3700
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,11387041018506573489,14183286018840468117,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
                                                                  2⤵
                                                                    PID:4732
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,16794513936907129746,3436019968144143298,524288 --field-trial-handle=2248,i,13126919941992590676,1774514678490482367,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
                                                                    2⤵
                                                                      PID:4816
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                    1⤵
                                                                      PID:2812
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                      1⤵
                                                                        PID:4688
                                                                      • C:\Windows\System32\rundll32.exe
                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                        1⤵
                                                                          PID:4292
                                                                        • C:\Windows\System32\DataExchangeHost.exe
                                                                          C:\Windows\System32\DataExchangeHost.exe -Embedding
                                                                          1⤵
                                                                            PID:1056
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\general.bat"
                                                                            1⤵
                                                                            • Executes a command shell one-liner
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4700
                                                                            • C:\Windows\system32\chcp.com
                                                                              chcp 65001
                                                                              2⤵
                                                                                PID:4732
                                                                              • C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\winws.exe
                                                                                "C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-general.txt" --hostlist="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-general.txt" --hostlist="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\tls_clienthello_4pda_to.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\tls_clienthello_4pda_to.bin" --new --filter-tcp= --ipset="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\tls_clienthello_4pda_to.bin" --new --filter-udp= --ipset="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
                                                                                2⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1744
                                                                            • C:\Windows\System32\NOTEPAD.EXE
                                                                              "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3\general.bat
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:2204
                                                                            • C:\Windows\system32\taskmgr.exe
                                                                              "C:\Windows\system32\taskmgr.exe" /0
                                                                              1⤵
                                                                              • Checks SCSI registry key(s)
                                                                              • Checks processor information in registry
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:5500
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                              1⤵
                                                                                PID:1136
                                                                              • C:\Windows\system32\mmc.exe
                                                                                "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
                                                                                1⤵
                                                                                • Drops file in System32 directory
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:5832
                                                                              • C:\Windows\System32\DataExchangeHost.exe
                                                                                C:\Windows\System32\DataExchangeHost.exe -Embedding
                                                                                1⤵
                                                                                  PID:5360
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\general (FAKE TLS AUTO ALT3).bat" "
                                                                                  1⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4860
                                                                                  • C:\Windows\system32\chcp.com
                                                                                    chcp 65001
                                                                                    2⤵
                                                                                      PID:4936
                                                                                    • C:\Users\Admin\Desktop\bin\winws.exe
                                                                                      "C:\Users\Admin\Desktop\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\Desktop\lists\list-general.txt" --hostlist="C:\Users\Admin\Desktop\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\Desktop\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\Desktop\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\Desktop\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=443 --hostlist="C:\Users\Admin\Desktop\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\Desktop\lists\list-general.txt" --hostlist="C:\Users\Admin\Desktop\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic="C:\Users\Admin\Desktop\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake,multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=8 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --dpi-desync-fake-http="C:\Users\Admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\Desktop\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n3
                                                                                      2⤵
                                                                                        PID:3656
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\general (ALT).bat" "
                                                                                      1⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5524
                                                                                      • C:\Windows\system32\chcp.com
                                                                                        chcp 65001
                                                                                        2⤵
                                                                                          PID:4872
                                                                                        • C:\Users\Admin\Desktop\bin\winws.exe
                                                                                          "C:\Users\Admin\Desktop\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\Desktop\lists\list-general.txt" --hostlist="C:\Users\Admin\Desktop\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\Desktop\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\Desktop\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\Desktop\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\Desktop\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\Desktop\lists\list-general.txt" --hostlist="C:\Users\Admin\Desktop\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\Desktop\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\Desktop\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\Desktop\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-tcp= --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\Desktop\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-udp= --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\Desktop\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n3
                                                                                          2⤵
                                                                                            PID:1352
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\general.bat" "
                                                                                          1⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:3180
                                                                                          • C:\Windows\system32\chcp.com
                                                                                            chcp 65001
                                                                                            2⤵
                                                                                              PID:4108
                                                                                            • C:\Users\Admin\Desktop\bin\winws.exe
                                                                                              "C:\Users\Admin\Desktop\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443, --wf-udp=443,19294-19344,50000-50100, --filter-udp=443 --hostlist="C:\Users\Admin\Desktop\lists\list-general.txt" --hostlist="C:\Users\Admin\Desktop\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\Desktop\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\Desktop\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-fake-stun="C:\Users\Admin\Desktop\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\Desktop\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\Desktop\lists\list-general.txt" --hostlist="C:\Users\Admin\Desktop\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\bin\tls_clienthello_4pda_to.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\Desktop\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\bin\tls_clienthello_4pda_to.bin" --new --filter-tcp= --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\Desktop\bin\tls_clienthello_4pda_to.bin" --new --filter-udp= --ipset="C:\Users\Admin\Desktop\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\Desktop\bin\quic_initial_dbankcloud_ru.bin" --dpi-desync-cutoff=n2
                                                                                              2⤵
                                                                                                PID:5460
                                                                                            • C:\Windows\System32\NOTEPAD.EXE
                                                                                              "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\general.bat
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              • Opens file in notepad (likely ransom note)
                                                                                              PID:124
                                                                                            • C:\Windows\System32\NOTEPAD.EXE
                                                                                              "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\zapret-discord-youtube.bat
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              PID:4792
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\zapret-discord-youtube.bat"
                                                                                              1⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:4452
                                                                                              • C:\Windows\system32\certutil.exe
                                                                                                certutil -decode "C:\Users\Admin\AppData\Local\Temp\vcomp140.tmp" "C:\Users\Admin\AppData\Local\Temp\vcomp140.exe"
                                                                                                2⤵
                                                                                                • Deobfuscate/Decode Files or Information
                                                                                                PID:1040
                                                                                              • C:\Users\Admin\AppData\Local\Temp\vcomp140.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\vcomp140.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2284
                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\updater_OGWvtvhn.exe
                                                                                                  C:\Users\Admin\AppData\Local\Microsoft\updater_OGWvtvhn.exe
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1908
                                                                                            • C:\Windows\system32\taskmgr.exe
                                                                                              "C:\Windows\system32\taskmgr.exe" /0
                                                                                              1⤵
                                                                                              • Checks SCSI registry key(s)
                                                                                              • Checks processor information in registry
                                                                                              • Modifies registry class
                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:240
                                                                                            • C:\Program Files\7-Zip\7zFM.exe
                                                                                              "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\vcomp140.exe"
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                              PID:6012
                                                                                            • C:\Windows\system32\mmc.exe
                                                                                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
                                                                                              1⤵
                                                                                              • Drops file in System32 directory
                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:1688
                                                                                            • C:\Windows\system32\msinfo32.exe
                                                                                              "C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\MountConvertTo.nfo"
                                                                                              1⤵
                                                                                              • Enumerates system info in registry
                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                              PID:2140
                                                                                            • C:\Windows\system32\mmc.exe
                                                                                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\diskmgmt.msc"
                                                                                              1⤵
                                                                                              • Drops file in System32 directory
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:3324
                                                                                            • C:\Windows\System32\vdsldr.exe
                                                                                              C:\Windows\System32\vdsldr.exe -Embedding
                                                                                              1⤵
                                                                                                PID:4436
                                                                                              • C:\Windows\System32\vds.exe
                                                                                                C:\Windows\System32\vds.exe
                                                                                                1⤵
                                                                                                • Checks SCSI registry key(s)
                                                                                                PID:1688

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                    • Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                    • Size 64KB
                                                                                                    • SHA256 42c4fcd383e47854e66057644f88979287b077564fa0e83dd5097623e224804c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                    • Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                    • Size 4B
                                                                                                    • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                    • Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                    • Size 960B
                                                                                                    • SHA256 565de87de825884dfdd98f37a1b05d5293eb72bb28ba1950f879e0082b0344c8
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    LOG.old
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                    • Size 334B
                                                                                                    • SHA256 ea53cde31fd05e225c3e3af4bb363db288361258625ef830ebe7cd7da6fcb791
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    LOG.old
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                    • Size 334B
                                                                                                    • SHA256 a0d2404945ce99e781553c29b99696e114e4163902bc169c689f8424eb56f5f7
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    f_00004d
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
                                                                                                    • Size 21KB
                                                                                                    • SHA256 f4ffb55e518e2d21714efd1359ecad05103289ce71a2cb632b36e2c63f134a00
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    f_00004e
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
                                                                                                    • Size 42KB
                                                                                                    • SHA256 78dded9f4efe465f42f9db4e9119a322281955a194798b6a0e8fbde84c9709fd
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    f_00004f
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
                                                                                                    • Size 39KB
                                                                                                    • SHA256 351740773d7f76fdcbc590e4877f82b43b6b302e055b4a212b5f0eeeb7d75c72
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    f_000052
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
                                                                                                    • Size 36KB
                                                                                                    • SHA256 16fd378a7fde064728239e08cb13e6f59a03b09afbf8ea3f8c029fcb18bb4ead
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    f_000056
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
                                                                                                    • Size 58KB
                                                                                                    • SHA256 c17cd0536ea6d874741569b893dab49fa9d69153f7f6c34d5fb9f3a029ead3b6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    f_00008c
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
                                                                                                    • Size 60KB
                                                                                                    • SHA256 1a127339394c609dee63eae566b450218095b4790d7e3d3b92d197baabebe57c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                    • Size 7KB
                                                                                                    • SHA256 5c23714f934eaf293643247b26fa5a66c5f9a95590c83caf08598ff4cdbffbfa
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                    • Size 7KB
                                                                                                    • SHA256 de5c4a67c3a725aff4c4b60afcf822938b6c52ec7bb91fed8a35c57796f20bf9
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                    • Size 7KB
                                                                                                    • SHA256 38517bea3cfb102d4729e3bb2cba106e102cd447fdd12f2b84720f2b23f5f5e7
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index~RFe5a24fe.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a24fe.TMP
                                                                                                    • Size 2KB
                                                                                                    • SHA256 adbb14753e9a0c1dfb8cbb9c7b40232536c4ab81c521d6e9e7e3f68119d62cc0
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    SiteList-Enterprise.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                    • Size 2B
                                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Edge Profile.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                    • Size 70KB
                                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    000003.log
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
                                                                                                    • Size 74KB
                                                                                                    • SHA256 2421d727cb7243c455baa18f9d0d9875faa26e307ea9826478bc03b59d70bb64
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    LOG
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
                                                                                                    • Size 384B
                                                                                                    • SHA256 bba62ffaeea5704c9840f3a5efc77729a60a2e69af0d9dd9df2633568e617008
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    LOG.old
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG.old
                                                                                                    • Size 343B
                                                                                                    • SHA256 82e9329f6144808f859854ef9580470367b9d4512191919c2494a1ac0d02b435
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    MANIFEST-000001
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                    • Size 23B
                                                                                                    • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 3KB
                                                                                                    • SHA256 3de9d709874348f7879c6e9e04f8faf0ec180ec294b725ef5af43f08709c2ae1
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 3KB
                                                                                                    • SHA256 54a228d15b629c3c492c00a168896137906c347e593fcabe7b24c3b713e0e372
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 3KB
                                                                                                    • SHA256 bc7406480a2508832083a1284abf2872e640ed2c5dd4938641b44288766aa9dd
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    SCT Auditing Pending Reports
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                    • Size 2B
                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Sdch Dictionaries
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                    • Size 40B
                                                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 11KB
                                                                                                    • SHA256 e7e63e7cb07ed1305a9c1f7ea6e0db7e92cfa64db7022b81d0eb567f20696479
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 cf451cacfe921cc35fa74ef4b4f029713489423a517888f23b9910a69759cad8
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 27KB
                                                                                                    • SHA256 78e635347d245ec1b45ca6f0fc9be95dc4fa946ca9a572b7a78cb16c91b922c4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 16eb95705da6588f88242769a5440521a130a18c6a4ea0c4a057f1746c98ccdc
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 e4ef271c902fdbcee83bd4b241b6dce0d56e9746f77759ba8b91e73a3fcb6d1d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 096c2d62267ca44625506c95ce870772ff5080283f17b7c31d76377c21bb5354
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 e52730708d6a0083e21205d40b208342332da653cabd09694f693fe74ec52f46
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 a06de6a53849fa7902bde65e708d42fefba012ad2097ff76a6f8232adae8c290
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 fcd4ab7a7166765ef0439bb91d1e3e2ac8528fb9205e845e9d088100a75457ec
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 bfae6dab2a0f255403205d4e36e9df6f84e09e5f77f9cc0dadbc71c6037b25f0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Secure Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                    • Size 23KB
                                                                                                    • SHA256 a6131c581cb30d5690614cd572191318bd3bfe1832cd4fb10d2ac99c4a84276b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c92e277-94c3-485a-a2df-e774118ac888\index-dir\the-real-index
                                                                                                    • Size 120B
                                                                                                    • SHA256 2c71204019a3c32c143c54a7b66672e1ed6db998545ce61b30bc0e77be265547
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index~RFe5e1da8.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c92e277-94c3-485a-a2df-e774118ac888\index-dir\the-real-index~RFe5e1da8.TMP
                                                                                                    • Size 120B
                                                                                                    • SHA256 6e65a68e8dc2a00f1f9ae27858e2d070b9a1bd5a323616f43aa5d1b33684b15e
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    index.txt.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                                                    • Size 370B
                                                                                                    • SHA256 ceb6f57a4fda91ba4fd3e2bb562b6da6cf6100454e6605ea21682ad8fe2403ff
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    CURRENT
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
                                                                                                    • Size 16B
                                                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    MANIFEST-000001
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
                                                                                                    • Size 41B
                                                                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    OperationConfig
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                    • Size 22KB
                                                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    OperationConfig~RFe5a75dd.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a75dd.TMP
                                                                                                    • Size 3KB
                                                                                                    • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 33KB
                                                                                                    • SHA256 6178046cd62a190c28f5302bf75ece9b9b9ff8c4817fb5ee239d85e02999a24e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 33KB
                                                                                                    • SHA256 ed267ff8ae46809838c53f8ce48b37317e37cfeb4b11dc218b526f35d9d02b77
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 37KB
                                                                                                    • SHA256 0c7da26e683f2055d88d4f00ab5f952791082d4b4bfb4e9453eb03c330b8e255
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 41KB
                                                                                                    • SHA256 138025e4c43ddfcb2ba52f0dc3c09e23e9ebd0544399bfda0814e5f2b2485975
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 41KB
                                                                                                    • SHA256 d975f892729f9a7a5c9291365c736c9e6fa16e0cfe4d0fa4bd2c582357e93cb7
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 41KB
                                                                                                    • SHA256 51e2b7dc7a5486d5381f50808e45c5e73293d677310f4971e9606a621ea7e9f4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 41KB
                                                                                                    • SHA256 68762d6c5f9057f9c546ee892477b671a8be6a6f5ead1abd21f2827f5f328c73
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 38KB
                                                                                                    • SHA256 6affa7d470e418fa810366075e10ed3e699945f8161414480652c9e9d236f24a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 36KB
                                                                                                    • SHA256 930a1e5603ad2ee6805de3b8e9b00a7addb4a4808201c55c6daa2a09095b8717
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    RevisitationBloomfilter
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                    • Size 392B
                                                                                                    • SHA256 b0ad85f31c7028e6f1bd9e1924c845fdc6526f249dca3ae7ec85946523c50aab
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    RevisitationBloomfilter
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                    • Size 392B
                                                                                                    • SHA256 e3bd4caf6b8d09defee5d60cb5f1904e5af6bcd8f2ea50378fc730310cf163fd
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    RevisitationBloomfilter
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                    • Size 392B
                                                                                                    • SHA256 6d0fd948d4dffa1660e5a01cb1191fb034b5677b9bfcbfb73f21f97c0e46118b
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    RevisitationBloomfilter
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                    • Size 392B
                                                                                                    • SHA256 bea02edb6949eb9658af5da113a16844cfd50d142913dcdd72a8c38a6d2690ec
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    RevisitationBloomfilter
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                    • Size 392B
                                                                                                    • SHA256 96fd914ee3a961d751952b8c4337942f1676f8886a90ba95cb589d3ab010acad
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    RevisitationBloomfilter~RFe59dfa8.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59dfa8.TMP
                                                                                                    • Size 392B
                                                                                                    • SHA256 1487be74ff82fac497ee7bc11b06e71ef55f06f4c3178bba9b0ba843c8f3014e
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    cdecf7e8-b170-4ff4-b2c8-e2e3809d23c1.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cdecf7e8-b170-4ff4-b2c8-e2e3809d23c1.tmp
                                                                                                    • Size 392B
                                                                                                    • SHA256 6f325056ce606f04e5c6da0327b4b7d594864577d96871b10f40b8406e512929
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    metadata.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                    • Size 13B
                                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    settings.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\settings.json
                                                                                                    • Size 14KB
                                                                                                    • SHA256 4da18ad5ee0f752556400f5ca458bd68cbcc48db1f6feff3c82ee4f0794a3e7f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    updater_OGWvtvhn.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\updater_OGWvtvhn.exe
                                                                                                    • Size 3.4MB
                                                                                                    • SHA256 0a9d56f0d7971548402fb30123e978e8c2d6156c180a707e242212f72325df3d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    vcomp140.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\vcomp140.exe
                                                                                                    • Size 9.4MB
                                                                                                    • SHA256 fcaf1f466fe1574055cbc2f3d6b72080e77587204d03c513a10514f2aa40c8e7
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    vcomp140.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\vcomp140.tmp
                                                                                                    • Size 8KB
                                                                                                    • SHA256 2c2a6d6e87723d72d90e3c3ef8f019cbfdefd7801bafd7ccc48f02f938d37a8d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    vcomp140.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\vcomp140.tmp
                                                                                                    • Size 12.6MB
                                                                                                    • SHA256 9f04d1219599fb2ca751249ab75d0e3800638bd4e39ce54a87596166085d584b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    taskschd
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\taskschd
                                                                                                    • Size 141KB
                                                                                                    • SHA256 4ff519c095fb989dc506f6497e40ef1a2e172d2dcfc0a1a796552ef1ce8e21c1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    default.exc
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                                                                                                    • Size 2B
                                                                                                    • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3.zip.crdownload
                                                                                                    • Path C:\Users\Admin\Downloads\FLOWSeAL-giTHuB-zAPrEt_yOUTube-1.15.3.zip.crdownload
                                                                                                    • Size 8.2MB
                                                                                                    • SHA256 a139fe377c309daef396948d8de8d9bcf44c91b9b264012309c9497cc71e1790
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    zapret-discord-youtube-1.10.3.rar.crdownload
                                                                                                    • Path C:\Users\Admin\Downloads\zapret-discord-youtube-1.10.3.rar.crdownload
                                                                                                    • Size 1.2MB
                                                                                                    • SHA256 da62821155054b94c198d8406d32bef47edb64f3cc53d29869026108eab5b937
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    zapret-discord-youtube.zip.crdownload
                                                                                                    • Path C:\Users\Admin\Downloads\zapret-discord-youtube.zip.crdownload
                                                                                                    • Size 8.2MB
                                                                                                    • SHA256 7bcdb375ac3f147e22a5d8ac66de11093d362c7c40ada26408d8ebe3b631615d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    memory/1352-1295-0x00007FF82C860000-0x00007FF82CB62000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1352-1296-0x0000000100400000-0x000000010043C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1352-1299-0x00007FF82C860000-0x00007FF82CB62000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1744-1139-0x0000000100400000-0x000000010043C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1744-1142-0x00007FF82CD40000-0x00007FF82D042000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1744-1138-0x00007FF82CD40000-0x00007FF82D042000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1744-1140-0x0000000062800000-0x0000000062813000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14476-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14478-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14531-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14533-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14521-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14519-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14518-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14539-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14477-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14542-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14516-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14536-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14510-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1908-14501-0x0000000000D70000-0x00000000019C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3656-1290-0x00007FF82BA60000-0x00007FF82BD62000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3656-1291-0x0000000100400000-0x000000010043C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3656-1294-0x00007FF82BA60000-0x00007FF82BD62000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5460-1304-0x00007FF82C860000-0x00007FF82CB62000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5460-1301-0x0000000100400000-0x000000010043C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5460-1300-0x00007FF82C860000-0x00007FF82CB62000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5500-1149-0x0000018D48380000-0x0000018D48381000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5500-1151-0x0000018D48380000-0x0000018D48381000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5500-1152-0x0000018D48380000-0x0000018D48381000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5500-1145-0x0000018D48380000-0x0000018D48381000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5500-1143-0x0000018D48380000-0x0000018D48381000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5500-1150-0x0000018D48380000-0x0000018D48381000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5500-1153-0x0000018D48380000-0x0000018D48381000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5500-1154-0x0000018D48380000-0x0000018D48381000-memory.dmp
                                                                                                    Download