zapret-discord-youtube-1[.]9[.]9c[.]zip

resource	yara_rule
static1/unpack001/zapret-discord-youtube-1.9.9c/bin/.wd/wdvcache.exe	upx
static1/unpack001/zapret-discord-youtube-1.9.9c/bin/.wd/webrat.exe	upx
static1/unpack001/zapret-discord-youtube-1.9.9c/bin/.wd/zapret.exe	upx

resource
unpack001/zapret-discord-youtube-1.9.9c/bin/.wd/wdvcache.exe
unpack001/zapret-discord-youtube-1.9.9c/bin/.wd/webrat.exe
unpack001/zapret-discord-youtube-1.9.9c/bin/.wd/zapret.exe
unpack001/zapret-discord-youtube-1.9.9c/bin/WinDivert.dll
unpack001/zapret-discord-youtube-1.9.9c/bin/cygwin1.dll
unpack001/zapret-discord-youtube-1.9.9c/bin/winws.exe

zapret-discord-youtube-1.9.9c.zip

SHA256 fa415439d4795f64b1b2e736ee9b74df1aab827c8cefcd13dad5ce5d64ebee80
MD5 067205f3b9a38e2eb1a1127d2d33ccb1
SHA1 152ed867ff7774e7646650cb4a228129a840268f
SHA512 e6b50e65834c2124fa946bbac0800857743b73bb485b3eaa3689279678d55ea3421b1c7237d62bc88eb5a56734a9d33d94782409fe8d4ef9beb7b423da57a0cb
SSDEEP 393216:Mcc37br2AJmvcIy1Icc37br2AJmvcIy15cc37br2AJmvcIy1ZOZwVAoEnVGYmG:dcrbjh1pcrbjh1Ccrbjh1AZwVWnViG
TLSH
T1C00733F785290A97E87B470036035C73B8F1951928588E8B3AFDB0CDA559CB7F47AC68
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/bin/.wd/wdvcache.exe

SHA256 85bfe327c64e66f71f7da0a1b0d84e6d46ce422610ae08d265be09c59ddea514
MD5 a613ba2bc9ef26d8ce2f461e5e918bc5
SHA1 8ea5196f4408f8c552ebe5b1176784ac5ae8e744
SHA512 276ebe09017d56424fa9b0b1f040ea90b5f9a3814cede78b977d9d2c6794e8dbd668f174bab52991621e0b415e322d42d54703d44a97d39f0a4104f7750d6af2
SSDEEP 98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4O4:iJiafuIO7rhWEES4b
TLSH
T1CEF5335BF1AB47B3F7D9A931560FC66458B09FE40A20D38AD4DBAADF0886BD0C241375
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

12922784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

zapret-discord-youtube-1.9.9c/bin/.wd/webrat.exe

SHA256 85bfe327c64e66f71f7da0a1b0d84e6d46ce422610ae08d265be09c59ddea514
MD5 a613ba2bc9ef26d8ce2f461e5e918bc5
SHA1 8ea5196f4408f8c552ebe5b1176784ac5ae8e744
SHA512 276ebe09017d56424fa9b0b1f040ea90b5f9a3814cede78b977d9d2c6794e8dbd668f174bab52991621e0b415e322d42d54703d44a97d39f0a4104f7750d6af2
SSDEEP 98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4O4:iJiafuIO7rhWEES4b
TLSH
T1CEF5335BF1AB47B3F7D9A931560FC66458B09FE40A20D38AD4DBAADF0886BD0C241375
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

12922784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

zapret-discord-youtube-1.9.9c/bin/.wd/zapret.exe

SHA256 85bfe327c64e66f71f7da0a1b0d84e6d46ce422610ae08d265be09c59ddea514
MD5 a613ba2bc9ef26d8ce2f461e5e918bc5
SHA1 8ea5196f4408f8c552ebe5b1176784ac5ae8e744
SHA512 276ebe09017d56424fa9b0b1f040ea90b5f9a3814cede78b977d9d2c6794e8dbd668f174bab52991621e0b415e322d42d54703d44a97d39f0a4104f7750d6af2
SSDEEP 98304:niJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4O4:iJiafuIO7rhWEES4b
TLSH
T1CEF5335BF1AB47B3F7D9A931560FC66458B09FE40A20D38AD4DBAADF0886BD0C241375
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

12922784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

zapret-discord-youtube-1.9.9c/bin/WinDivert.dll

IMPHASH 0b649f8e17494bb31b47f6e959a1769c
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

31496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

zapret-discord-youtube-1.9.9c/bin/WinDivert64.sys

IMPHASH db584dd0570594898805dd67d7ff391c
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 20, 2022

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Sep 20, 2022

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

01

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

61:50:19:91:b1:8f:32:38:04:52:51:37:dc:25:00:5a

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2022 - May 25, 2023

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

4484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\WinDivert-2.2.2\install\MSVC\amd64\WinDivert64.pdb

ntoskrnl.exe

RtlCopyUnicodeString KeBugCheckEx IoGetRequestorProcess PsGetProcessId ExUuidCreate ObfDereferenceObject ObfReferenceObject IoWriteErrorLogEntry IoGetCurrentProcess IoFreeMdl IoAllocateMdl IoAllocateErrorLogEntry MmMapLockedPagesSpecifyCache MmBuildMdlForNonPagedPool ExFreePoolWithTag ExAllocatePoolWithTag KeReleaseInStackQueuedSpinLock KeAcquireInStackQueuedSpinLock RtlGetVersion RtlIntegerToUnicodeString

hal

KeQueryPerformanceCounter

ndis.sys

NdisAllocateNetBufferPool NdisFreeNetBufferPool NdisAllocateNetBufferListPool NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart NdisFreeNetBufferListPool

fwpkclnt.sys

FwpmTransactionAbort0 FwpmTransactionBegin0 FwpmEngineClose0 FwpmEngineOpen0 FwpsQueryPacketInjectionState0 FwpmProviderAdd0 FwpmProviderDeleteByKey0 FwpsInjectNetworkReceiveAsync0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmCalloutAdd0 FwpmCalloutDeleteByKey0 FwpmFilterAdd0 FwpmFilterDeleteByKey0 FwpmTransactionCommit0 FwpsCalloutRegister0 FwpsCalloutUnregisterByKey0 FwpsFlowAssociateContext0 FwpsFlowRemoveContext0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsAllocateNetBufferAndNetBufferList0 FwpsFreeNetBufferList0 FwpsInjectNetworkSendAsync0 FwpsInjectForwardAsync0

wdfldr.sys

WdfVersionBindClass WdfVersionUnbindClass WdfVersionBind WdfVersionUnbind

Name

.text

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

zapret-discord-youtube-1.9.9c/bin/admin_guard.cmd

SHA256 f052bc89afc47ae53e922859c580e685c07145d7f6f56d84f380a9d97fcb126e
MD5 e9a9c63502ba81e7723cd106f464999b
SHA1 4768deb0c50bd06c2f41e6f8635f76d27da23763
SHA512 7ffc4f76b32ef6778d0910664fa7d1394634be6ddf729b0cef76a6cb22d7c92177a469cf65a428588d8101aa9e7b59d206413489519071f0a2995619186933f9
TLSH
T1DFD0EB0602885A7B8AFECB0042F94AA3DACC43CF122632C230F4D211F8CA441C6C0E81
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/cygwin1.dll

IMPHASH 8f21c12c4e790805822951d4e4dcad1c
SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
MD5 a1c82ed072dc079dd7851f82d9aa7678
SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
TLSH
T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

202560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredContinueHandler AllocConsole AttachConsole CallNamedPipeA CancelIo CancelSynchronousIo ClearCommBreak ClearCommError CloseHandle CompareStringW ConnectNamedPipe CreateFileA CreateFileW CreateNamedPipeA CreatePipe CreateProcessW CreateRemoteThread CreateSymbolicLinkW CreateTapePartition CreateThread DebugBreak DeleteCriticalSection DeleteProcThreadAttributeList DeviceIoControl DisconnectNamedPipe DuplicateHandle EnterCriticalSection EraseTape EscapeCommFunction ExitProcess ExitThread ExpandEnvironmentStringsW FillConsoleOutputAttribute FillConsoleOutputCharacterW FindFirstVolumeW FindNextVolumeW FindVolumeClose FlushConsoleInputBuffer FlushFileBuffers FlushViewOfFile FreeConsole FreeEnvironmentStringsW FreeLibrary GenerateConsoleCtrlEvent GetBinaryTypeW GetCommModemStatus GetCommState GetCommandLineW GetConsoleCP GetConsoleCursorInfo GetConsoleMode GetConsoleOutputCP GetConsoleProcessList GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentConsoleFontEx GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetHandleInformation GetLastError GetLocaleInfoA GetLocaleInfoW GetLogicalDriveStringsA GetLogicalDrives GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetNamedPipeClientProcessId GetNumberOfConsoleInputEvents GetOverlappedResult GetPriorityClass GetProcAddress GetProcessAffinityMask GetProcessGroupAffinity GetProcessHeap GetProcessId GetProcessWorkingSetSize GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemWindowsDirectoryW GetTapeParameters GetTapePosition GetTapeStatus GetTempPathW GetThreadContext GetThreadGroupAffinity GetThreadId GetThreadPriority GetTickCount GetTickCount64 GetTimeZoneInformation GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree IdnToAscii IdnToUnicode InitializeCriticalSection InitializeProcThreadAttributeList IsBadStringPtrA IsDebuggerPresent IsProcessInJob LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LocaleNameToLCID MapViewOfFile MapViewOfFileEx MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA PeekConsoleInputA PeekConsoleInputW PeekNamedPipe PrepareTape PurgeComm QueryDosDeviceW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime QueueUserAPC RaiseException ReadConsoleInputA ReadConsoleInputW ReadConsoleOutputW ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind ScrollConsoleScreenBufferA ScrollConsoleScreenBufferW SetCommBreak SetCommMask SetCommState SetCommTimeouts SetComputerNameExW SetConsoleCP SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleOutputCP SetConsoleTextAttribute SetConsoleTitleW SetConsoleWindowInfo SetEnvironmentVariableW SetErrorMode SetEvent SetFilePointerEx SetHandleInformation SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessAffinityMask SetProcessWorkingSetSize SetStdHandle SetSystemTime SetTapeParameters SetTapePosition SetThreadContext SetThreadGroupAffinity SetThreadPriority SetThreadStackGuarantee Sleep SuspendThread SwitchToThread TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TransmitCommChar UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitCommEvent WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WideCharToMultiByte WriteConsoleInputW WriteConsoleOutputW WriteConsoleW WriteFile WriteProcessMemory WriteTapemark

ntdll

NtAccessCheck NtAdjustPrivilegesToken NtAllocateLocallyUniqueId NtAssignProcessToJobObject NtCancelTimer NtClose NtCommitTransaction NtCreateDirectoryObject NtCreateEvent NtCreateFile NtCreateJobObject NtCreateKey NtCreateMutant NtCreateNamedPipeFile NtCreateSection NtCreateSemaphore NtCreateSymbolicLinkObject NtCreateTimer NtCreateTransaction NtDuplicateToken NtFlushBuffersFile NtFsControlFile NtLockFile NtLockVirtualMemory NtMapViewOfSection NtOpenDirectoryObject NtOpenEvent NtOpenFile NtOpenJobObject NtOpenKey NtOpenMutant NtOpenProcessToken NtOpenSection NtOpenSemaphore NtOpenSymbolicLinkObject NtOpenThreadToken NtPrivilegeCheck NtQueryAttributesFile NtQueryDirectoryFile NtQueryDirectoryObject NtQueryEaFile NtQueryEvent NtQueryInformationFile NtQueryInformationJobObject NtQueryInformationProcess NtQueryInformationThread NtQueryInformationToken NtQueryObject NtQueryQuotaInformationFile NtQuerySecurityObject NtQuerySemaphore NtQuerySymbolicLinkObject NtQuerySystemInformation NtQuerySystemTime NtQueryTimer NtQueryTimerResolution NtQueryValueKey NtQueryVirtualMemory NtQueryVolumeInformationFile NtReadFile NtRollbackTransaction NtSetEaFile NtSetEvent NtSetInformationFile NtSetInformationJobObject NtSetInformationThread NtSetInformationToken NtSetQuotaInformationFile NtSetSecurityObject NtSetTimer NtSetValueKey NtSetVolumeInformationFile NtUnlockFile NtUnlockVirtualMemory NtUnmapViewOfSection NtWaitForSingleObject NtWriteFile RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlAddAccessAllowedAceEx RtlAddAccessDeniedAceEx RtlAllocateHeap RtlAppendUnicodeStringToString RtlAppendUnicodeToString RtlCheckRegistryKey RtlCompareUnicodeString RtlConvertSidToUnicodeString RtlCopySid RtlCopyUnicodeString RtlCreateAcl RtlCreateQueryDebugBuffer RtlCreateSecurityDescriptor RtlDestroyQueryDebugBuffer RtlDowncaseUnicodeString RtlEnterCriticalSection RtlEqualPrefixSid RtlEqualSid RtlEqualUnicodeString RtlFirstFreeAce RtlFreeHeap RtlFreeUnicodeString RtlGetAce RtlGetControlSecurityDescriptor RtlGetCurrentTransaction RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetNtVersionNumbers RtlGetOwnerSecurityDescriptor RtlGetVersion RtlIdentifierAuthoritySid RtlInitAnsiString RtlInitUnicodeString RtlInitializeSid RtlLeaveCriticalSection RtlLengthSid RtlNtStatusToDosError RtlPrefixUnicodeString RtlQueryProcessDebugInformation RtlQueryRegistryValues RtlSetControlSecurityDescriptor RtlSetCurrentDirectory_U RtlSetCurrentTransaction RtlSetDaclSecurityDescriptor RtlSetGroupSecurityDescriptor RtlSetOwnerSecurityDescriptor RtlSubAuthorityCountSid RtlSubAuthoritySid RtlUnicodeStringToAnsiString RtlUpcaseUnicodeChar RtlUpcaseUnicodeString

GetCommandLineA@0 GetCommandLineW@0 _Exit __argc __argv __assert __assert_func __assertfail __b64_ntop __b64_pton __bsd_qsort_r __check_rhosts_file __chk_fail __cpuset_alloc __cpuset_free __ctype_ptr__ __cxa_atexit __cxa_finalize __cygwin_user_data __dn_comp __dn_expand __dn_skipname __eprintf __errno __fbufsize __flbf __fpclassifyd __fpclassifyf __fpending __fpurge __freadable __freading __fsetlocking __fwritable __fwriting __getpagesize __getreent __gets_chk __gnu_basename __infinity __isinfd __isinff __isnand __isnanf __locale_ctype_ptr __locale_ctype_ptr_l __locale_mb_cur_max __main __mb_cur_max __memcpy_chk __memmove_chk __mempcpy __mempcpy_chk __memset_chk __opendir_with_d_ino __progname __rcmd_errstr __res_close __res_init __res_mkquery __res_nclose __res_ninit __res_nmkquery __res_nquery __res_nquerydomain __res_nsearch __res_nsend __res_query __res_querydomain __res_search __res_send __res_state __sched_getaffinity_sys __signbitd __signbitf __signgam __snprintf_chk __sprintf_chk __srget __srget_r __stack_chk_fail __stack_chk_fail_local __stack_chk_guard __stpcpy_chk __stpncpy_chk __strcat_chk __strcpy_chk __strncat_chk __strncpy_chk __swbuf __swbuf_r __vsnprintf_chk __vsprintf_chk __wrap__ZdaPv __wrap__ZdaPvRKSt9nothrow_t __wrap__ZdlPv __wrap__ZdlPvRKSt9nothrow_t __wrap__Znam __wrap__ZnamRKSt9nothrow_t __wrap__Znwm __wrap__ZnwmRKSt9nothrow_t __xdrrec_getrec __xdrrec_setnonblock __xpg_sigpause __xpg_strerror_r _alloca _check_for_executable _ctype_ _daylight _dll_crt0 _exit _fe_dfl_env _fe_nomask_env _feinitialise _fscanf_r _get_osfhandle _impure_ptr _longjmp _pipe _pthread_cleanup_pop _pthread_cleanup_push _setjmp _setmode _sys_errlist _sys_nerr _timezone _tzname a64l abort abs accept accept4 access acl acl_add_perm acl_calc_mask acl_check acl_clear_perms acl_cmp acl_copy_entry acl_copy_ext acl_copy_int acl_create_entry acl_delete_def_file acl_delete_entry acl_delete_perm acl_dup acl_entries acl_equiv_mode acl_error acl_extended_fd acl_extended_file acl_extended_file_nofollow acl_free acl_from_mode acl_from_text acl_get_entry acl_get_fd acl_get_file acl_get_perm acl_get_permset acl_get_qualifier acl_get_tag_type acl_init acl_set_fd acl_set_file acl_set_permset acl_set_qualifier acl_set_tag_type acl_size acl_to_any_text acl_to_text acl_valid aclcheck aclfrommode aclfrompbits aclfromtext aclsort acltomode acltopbits acltotext acos acosf acosh acoshf acoshl acosl aio_cancel aio_error aio_fsync aio_read aio_return aio_suspend aio_write alarm aligned_alloc alphasort arc4random arc4random_addrandom arc4random_buf arc4random_stir arc4random_uniform argz_add argz_add_sep argz_append argz_count argz_create argz_create_sep argz_delete argz_extract argz_insert argz_next argz_replace argz_stringify asctime asctime_r asin asinf asinh asinhf asinhl asinl asnprintf asprintf at_quick_exit atan atan2 atan2f atan2l atanf atanh atanhf atanhl atanl atexit atof atoff atoi atol atoll basename bcmp bcopy bind bindresvport bindresvport_sa bsearch btowc bzero cabs cabsf cabsl cacos cacosf cacosh cacoshf cacoshl cacosl call_once calloc canonicalize_file_name carg cargf cargl casin casinf casinh casinhf casinhl casinl catan catanf catanh catanhf catanhl catanl catclose catgets catopen cbrt cbrtf cbrtl ccos ccosf ccosh ccoshf ccoshl ccosl ceil ceilf ceill cexp cexpf cexpl cfgetispeed cfgetospeed cfmakeraw cfsetispeed cfsetospeed cfsetspeed chdir chmod chown chroot cimag cimagf cimagl clearenv clearerr clearerr_unlocked clock clock_getcpuclockid clock_getres clock_gettime clock_nanosleep clock_setres clock_settime clog clog10 clog10f clog10l clogf clogl close closedir closelog cnd_broadcast cnd_destroy cnd_init cnd_signal cnd_timedwait cnd_wait confstr conj conjf conjl connect copysign copysignf copysignl cos cosf cosh coshf coshl cosl cpow cpowf cpowl cproj cprojf cprojl creal crealf creall creat csin csinf csinh csinhf csinhl csinl csqrt csqrtf csqrtl ctan ctanf ctanh ctanhf ctanhl ctanl ctermid ctime ctime_r cuserid cwait cygwin_attach_handle_to_fd cygwin_conv_path cygwin_conv_path_list cygwin_create_path cygwin_detach_dll cygwin_dll_init cygwin_internal cygwin_logon_user cygwin_posix_path_list_p cygwin_set_impersonation_token cygwin_split_path cygwin_stackdump cygwin_umount cygwin_winpid_to_pid daemon dbm_clearerr dbm_close dbm_delete dbm_dirfno dbm_error dbm_fetch dbm_firstkey dbm_nextkey dbm_open dbm_store difftime dirfd dirname div dladdr dlclose dlerror dlfork dll_crt0__FP11per_process dll_dllcrt0 dll_entry dlopen dlsym dn_comp dn_expand dn_skipname dprintf drand48 drem dremf dreml dup dup2 dup3 duplocale eaccess ecvt ecvtbuf ecvtf endgrent endhostent endmntent endprotoent endpwent endservent endusershell endutent endutxent environ envz_add envz_entry envz_get envz_merge envz_remove envz_strip erand48 erf erfc erfcf erfcl erff erfl err error error_at_line error_message_count error_one_per_line error_print_progname errx euidaccess execl execle execlp execv execve execvp execvpe exit exp exp10 exp10f exp10l exp2 exp2f exp2l expf expl explicit_bzero expm1 expm1f expm1l fabs fabsf fabsl faccessat facl fchdir fchmod fchmodat fchown fchownat fclose fcloseall fcntl fcvt fcvtbuf fcvtf fdatasync fdim fdimf fdiml fdopen fdopendir feclearexcept fedisableexcept feenableexcept fegetenv fegetexcept fegetexceptflag fegetprec fegetround feholdexcept feof feof_unlocked feraiseexcept ferror ferror_unlocked fesetenv fesetexceptflag fesetprec fesetround fetestexcept feupdateenv fexecve fflush fflush_unlocked ffs ffsl ffsll fgetc fgetc_unlocked fgetpos fgets fgets_unlocked fgetwc fgetwc_unlocked fgetws fgetws_unlocked fgetxattr fileno fileno_unlocked finite finitef finitel fiprintf flistxattr flock flockfile floor floorf floorl fls flsl flsll fma fmaf fmal fmax fmaxf fmaxl fmemopen fmin fminf fminl fmod fmodf fmodl fnmatch fopen fopencookie fork forkpty fpathconf fprintf fpurge fputc fputc_unlocked fputs fputs_unlocked fputwc fputwc_unlocked fputws fputws_unlocked fread fread_unlocked free freeaddrinfo freeifaddrs freelocale fremovexattr freopen frexp frexpf frexpl fscanf fseek fseeko fsetpos fsetxattr fstat fstatat fstatfs fstatvfs fsync ftell ftello ftime ftok ftruncate ftrylockfile fts_children fts_close fts_get_clientptr fts_get_stream fts_open fts_read fts_set fts_set_clientptr ftw funlockfile funopen futimens futimes futimesat fwide fwprintf fwrite fwrite_unlocked fwscanf gai_strerror gamma gamma_r gammaf gammaf_r gcvt gcvtf get_avphys_pages get_current_dir_name get_nprocs get_nprocs_conf get_phys_pages getaddrinfo getc getc_unlocked getchar getchar_unlocked getcontext getcwd getdelim getdomainname getdtablesize getegid getentropy getenv geteuid getgid getgrent getgrgid getgrgid_r getgrnam getgrnam_r getgrouplist getgroups gethostbyaddr gethostbyname gethostbyname2 gethostid gethostname getifaddrs getitimer getline getloadavg getlogin getlogin_r getmntent getmntent_r getmode getnameinfo getopt getopt_long getopt_long_only getpagesize getpass getpeereid getpeername getpgid getpgrp getpid getppid getpriority getprogname getprotobyname getprotobynumber getprotoent getpt getpwent getpwnam getpwnam_r getpwuid getpwuid_r getrandom getrlimit getrusage gets getservbyname getservbyport getservent getsid getsockname getsockopt getsubopt gettimeofday getuid getusershell getutent getutid getutline getutxent getutxid getutxline getw getwc getwc_unlocked getwchar getwchar_unlocked getwd getxattr glob glob_pattern_p globfree gmtime gmtime_r grantpt h_errno hcreate hcreate_r hdestroy hdestroy_r herror hsearch hsearch_r hstrerror htonl htons hypot hypotf hypotl if_freenameindex if_indextoname if_nameindex if_nametoindex ilogb ilogbf ilogbl imaxabs imaxdiv in6addr_any in6addr_loopback index inet_addr inet_aton inet_makeaddr inet_netof inet_network inet_ntoa inet_ntop inet_pton infinity infinityf initgroups initstate insque ioctl iprintf iruserok iruserok_sa isalnum isalnum_l isalpha isalpha_l isascii isascii_l isatty isblank isblank_l iscntrl iscntrl_l isdigit isdigit_l isgraph isgraph_l isinf isinff isinfl islower islower_l isnan isnanf isnanl isprint isprint_l ispunct ispunct_l issetugid isspace isspace_l isupper isupper_l iswalnum iswalnum_l iswalpha iswalpha_l iswblank iswblank_l iswcntrl iswcntrl_l iswctype iswctype_l iswdigit iswdigit_l iswgraph iswgraph_l iswlower iswlower_l iswprint iswprint_l iswpunct iswpunct_l iswspace iswspace_l iswupper iswupper_l iswxdigit iswxdigit_l isxdigit isxdigit_l j0 j0f j1 j1f jn jnf jrand48 kill killpg l64a labs lchown lcong48 ldexp ldexpf ldexpl ldiv lfind lgamma lgamma_r lgammaf lgammaf_r lgammal lgammal_r lgetxattr link linkat lio_listio listen listxattr llabs lldiv llistxattr llrint llrintf llrintl llround llroundf llroundl localeconv localtime localtime_r lockf log log10 log10f log10l log1p log1pf log1pl log2 log2f log2l logb logbf logbl logf login login_tty logl logout logwtmp longjmp lrand48 lremovexattr lrint lrintf lrintl lround lroundf lroundl lsearch lseek lsetxattr lstat lutimes madvise makecontext mallinfo malloc malloc_stats malloc_trim malloc_usable_size mallopt mblen mbrlen mbrtowc mbsinit mbsnrtowcs mbsrtowcs mbstowcs mbtowc memalign memccpy memchr memcmp memcpy memmem memmove mempcpy memrchr memset mkdir mkdirat mkdtemp mkfifo mkfifoat mknod mknodat mkostemp mkostemps mkstemp mkstemps mktemp mktime mlock mmap modf modff modfl mount mprotect mq_close mq_getattr mq_notify mq_open mq_receive mq_send mq_setattr mq_timedreceive mq_timedsend mq_unlink mrand48 msgctl msgget msgrcv msgsnd msync mtx_destroy mtx_init mtx_lock mtx_timedlock mtx_trylock mtx_unlock munlock munmap nan nanf nanl nanosleep nearbyint nearbyintf nearbyintl newlocale nextafter nextafterf nextafterl nexttoward nexttowardf nexttowardl nftw nice nl_langinfo nl_langinfo_l nrand48 ntohl ntohs on_exit open open_memstream open_wmemstream openat opendir openlog openpty optarg opterr optind optopt optreset pathconf pause pclose perror pipe pipe2 poll popen posix_fadvise posix_fallocate posix_madvise posix_memalign posix_openpt posix_spawn posix_spawn_file_actions_addclose posix_spawn_file_actions_adddup2 posix_spawn_file_actions_addopen posix_spawn_file_actions_destroy posix_spawn_file_actions_init posix_spawnattr_destroy posix_spawnattr_getflags posix_spawnattr_getpgroup posix_spawnattr_getschedparam posix_spawnattr_getschedpolicy posix_spawnattr_getsigdefault posix_spawnattr_getsigmask posix_spawnattr_init posix_spawnattr_setflags posix_spawnattr_setpgroup posix_spawnattr_setschedparam posix_spawnattr_setschedpolicy posix_spawnattr_setsigdefault posix_spawnattr_setsigmask posix_spawnp pow pow10 pow10f pow10l powf powl ppoll pread printf program_invocation_name program_invocation_short_name pselect psiginfo psignal pthread_atfork pthread_attr_destroy pthread_attr_getdetachstate pthread_attr_getguardsize pthread_attr_getinheritsched pthread_attr_getschedparam pthread_attr_getschedpolicy pthread_attr_getscope pthread_attr_getstack pthread_attr_getstackaddr pthread_attr_getstacksize pthread_attr_init pthread_attr_setdetachstate pthread_attr_setguardsize pthread_attr_setinheritsched pthread_attr_setschedparam pthread_attr_setschedpolicy pthread_attr_setscope pthread_attr_setstack pthread_attr_setstackaddr pthread_attr_setstacksize pthread_barrier_destroy pthread_barrier_init pthread_barrier_wait pthread_barrierattr_destroy pthread_barrierattr_getpshared pthread_barrierattr_init pthread_barrierattr_setpshared pthread_cancel pthread_cond_broadcast pthread_cond_clockwait pthread_cond_destroy pthread_cond_init pthread_cond_signal pthread_cond_timedwait pthread_cond_wait pthread_condattr_destroy pthread_condattr_getclock pthread_condattr_getpshared pthread_condattr_init pthread_condattr_setclock pthread_condattr_setpshared pthread_continue pthread_create pthread_detach pthread_equal pthread_exit pthread_getaffinity_np pthread_getattr_np pthread_getconcurrency pthread_getcpuclockid pthread_getname_np pthread_getschedparam pthread_getsequence_np pthread_getspecific pthread_join pthread_key_create pthread_key_delete pthread_kill pthread_mutex_clocklock pthread_mutex_destroy pthread_mutex_getprioceiling pthread_mutex_init pthread_mutex_lock pthread_mutex_setprioceiling pthread_mutex_timedlock pthread_mutex_trylock pthread_mutex_unlock pthread_mutexattr_destroy pthread_mutexattr_getprioceiling pthread_mutexattr_getprotocol pthread_mutexattr_getpshared pthread_mutexattr_gettype pthread_mutexattr_init pthread_mutexattr_setprioceiling pthread_mutexattr_setprotocol pthread_mutexattr_setpshared pthread_mutexattr_settype pthread_once pthread_rwlock_clockrdlock pthread_rwlock_clockwrlock pthread_rwlock_destroy pthread_rwlock_init pthread_rwlock_rdlock pthread_rwlock_timedrdlock pthread_rwlock_timedwrlock pthread_rwlock_tryrdlock pthread_rwlock_trywrlock pthread_rwlock_unlock pthread_rwlock_wrlock pthread_rwlockattr_destroy pthread_rwlockattr_getpshared pthread_rwlockattr_init pthread_rwlockattr_setpshared pthread_self pthread_setaffinity_np pthread_setcancelstate pthread_setcanceltype pthread_setconcurrency pthread_setname_np pthread_setschedparam pthread_setschedprio pthread_setspecific pthread_sigmask pthread_sigqueue pthread_spin_destroy pthread_spin_init pthread_spin_lock pthread_spin_trylock pthread_spin_unlock pthread_suspend pthread_testcancel pthread_timedjoin_np pthread_tryjoin_np pthread_yield ptsname ptsname_r putc putc_unlocked putchar putchar_unlocked putenv puts pututline pututxline putw putwc putwc_unlocked putwchar putwchar_unlocked pwrite qsort qsort_r quick_exit quotactl raise rand rand_r random rawmemchr rcmd rcmd_af read readdir readdir_r readlink readlinkat readv realloc reallocarray reallocf realpath recv recvfrom recvmsg reent_data regcomp regerror regexec regfree remainder remainderf remainderl remove removexattr remque remquo remquof remquol rename renameat renameat2 res_close res_init res_mkquery res_nclose res_ninit res_nmkquery res_nquery res_nquerydomain res_nsearch res_nsend res_query res_querydomain res_search res_send revoke rewind rewinddir rexec rindex rint rintf rintl rmdir round roundf roundl rpmatch rresvport rresvport_af ruserok sbrk scalb scalbf scalbl scalbln scalblnf scalblnl scalbn scalbnf scalbnl scandir scandirat scanf sched_get_priority_max sched_get_priority_min sched_getaffinity sched_getcpu sched_getparam sched_getscheduler sched_rr_get_interval sched_setaffinity sched_setparam sched_setscheduler sched_yield secure_getenv seed48 seekdir select sem_clockwait sem_close sem_destroy sem_getvalue sem_init sem_open sem_post sem_timedwait sem_trywait sem_unlink sem_wait semctl semget semop send sendmsg sendto setbuf setbuffer setcontext setdtablesize setegid setenv seteuid setgid setgrent setgroups sethostent sethostname setitimer setjmp setlinebuf setlocale setlogmask setmntent setpassent setpgid setpgrp setpriority setprogname setprotoent setpwent setregid setreuid setrlimit setservent setsid setsockopt setstate settimeofday setuid setusershell setutent setutxent setvbuf setxattr shm_open shm_unlink shmat shmctl shmdt shmget shutdown sig2str sigaction sigaddset sigaltstack sigdelset sigemptyset sigfillset sighold sigignore siginterrupt sigismember siglongjmp signal signalfd significand significandf sigpause sigpending sigprocmask sigqueue sigrelse sigset sigsetjmp sigsuspend sigtimedwait sigwait sigwaitinfo sin sincos sincosf sincosl sinf sinh sinhf sinhl sinl siprintf sleep snprintf sockatmark socket socketpair spawnl spawnle spawnlp spawnlpe spawnv spawnve spawnvp spawnvpe sprintf sqrt sqrtf sqrtl srand srand48 srandom sscanf stat statfs statvfs stime stpcpy stpncpy str2sig strcasecmp strcasecmp_l strcasestr strcat strchr strchrnul strcmp strcoll strcoll_l strcpy strcspn strdup strerror strerror_l strerror_r strfmon strfmon_l strftime strftime_l strlcat strlcpy strlen strlwr strncasecmp strncasecmp_l strncat strncmp strncpy strndup strnlen strnstr strpbrk strptime strptime_l strrchr strsep strsignal strspn strstr strtod strtod_l strtof strtof_l strtoimax strtok strtok_r strtol strtol_l strtold strtold_l strtoll strtoll_l strtosigno strtoul strtoul_l strtoull strtoull_l strtoumax strupr strverscmp strxfrm strxfrm_l swab swapcontext swprintf swscanf symlink symlinkat sync sys_errlist sys_nerr sys_sigabbrev sys_siglist sysconf sysinfo syslog system tan tanf tanh tanhf tanhl tanl tcdrain tcflow tcflush tcgetattr tcgetpgrp tcgetsid tcsendbreak tcsetattr tcsetpgrp tdelete tdestroy telldir tempnam tfind tgamma tgammaf tgammal thrd_create thrd_current thrd_detach thrd_equal thrd_exit thrd_join thrd_sleep thrd_yield time timegm timelocal timer_create timer_delete timer_getoverrun timer_gettime timer_settime timerfd_create timerfd_gettime timerfd_settime times timezone timingsafe_bcmp timingsafe_memcmp tmpfile tmpnam toascii toascii_l tolower tolower_l toupper toupper_l towctrans towctrans_l towlower towlower_l towupper towupper_l trunc truncate truncf truncl tsearch tss_create tss_delete tss_get tss_set ttyname ttyname_r ttyslot twalk tzset ualarm umask umount uname uname_x ungetc ungetwc unlink unlinkat unlockpt unsetenv updwtmp updwtmpx uselocale usleep utime utimensat utimes utmpname utmpxname valloc vasnprintf vasprintf vdprintf verr verrx versionsort vfiprintf vfork vfprintf vfscanf vfwprintf vfwscanf vhangup vprintf vscanf vsnprintf vsprintf vsscanf vswprintf vswscanf vsyslog vwarn vwarnx vwprintf vwscanf wait wait3 wait4 waitpid warn warnx wcpcpy wcpncpy wcrtomb wcscasecmp wcscasecmp_l wcscat wcschr wcscmp wcscoll wcscoll_l wcscpy wcscspn wcsdup wcsftime wcsftime_l wcslcat wcslcpy wcslen wcsncasecmp wcsncasecmp_l wcsncat wcsncmp wcsncpy wcsnlen wcsnrtombs wcspbrk wcsrchr wcsrtombs wcsspn wcsstr wcstod wcstod_l wcstof wcstof_l wcstoimax wcstok wcstol wcstol_l wcstold wcstold_l wcstoll wcstoll_l wcstombs wcstoul wcstoul_l wcstoull wcstoull_l wcstoumax wcswidth wcsxfrm wcsxfrm_l wctob wctomb wctrans wctrans_l wctype wctype_l wcwidth wmemchr wmemcmp wmemcpy wmemmove wmempcpy wmemset wordexp wordfree wprintf write writev wscanf xdr_array xdr_bool xdr_bytes xdr_char xdr_double xdr_enum xdr_float xdr_free xdr_hyper xdr_int xdr_int16_t xdr_int32_t xdr_int64_t xdr_int8_t xdr_long xdr_longlong_t xdr_netobj xdr_opaque xdr_pointer xdr_reference xdr_short xdr_sizeof xdr_string xdr_u_char xdr_u_hyper xdr_u_int xdr_u_int16_t xdr_u_int32_t xdr_u_int64_t xdr_u_int8_t xdr_u_long xdr_u_longlong_t xdr_u_short xdr_uint16_t xdr_uint32_t xdr_uint64_t xdr_uint8_t xdr_union xdr_vector xdr_void xdr_wrapstring xdrmem_create xdrrec_create xdrrec_endofrecord xdrrec_eof xdrrec_skiprecord xdrstdio_create y0 y0f y1 y1f yn ynf

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

/4

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

274KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

400KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/38

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

zapret-discord-youtube-1.9.9c/bin/defender_guard.cmd

SHA256 197ce86f9c1067a7ce07a50cb582befb861b4e187bc9818b88175651e9f91932
MD5 93543e0e49904c2c3cb729b203ea475e
SHA1 7e561d30fb2568d06ad2249e77850593ad9764d4
SHA512 0434e8e5c5f57f6180d15fcd5ba8371e1399682d815aa433d1499e33349b74aedecf2a00254ebf428a2c3d17eaba5fcaf500c2d63cb9264eb9ec8f5a66a77bbd
TLSH
T16731464A921016FDC3F9064415C353A8F78B4099E67DD7C11897822BE53944B8EFDF2A
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/extract_guard.cmd

SHA256 fb4030fdab4f882d1600036287381826411386dac9d4a126fca074cda0c13dbf
MD5 74fd49efb7855253f318c689d4819dd6
SHA1 e1a1785761043b47adac84df5af2012c1fb1dc25
SHA512 e447d04c358c232576327796238f5682432efd2523fc7c99093bdb16c009a733ab51c350ff66fd34cc3caeb6e541f1e9308e3f4f82d1b3bd9076f36d862834a8
TLSH
T19FE068A9B2637C26202816D02F71205C6CC302F757CAADC1A8F3151834AA2B877860B0
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/gbzap_lists.cmd

SHA256 9821d5236f7025adca57195a1d5069554e1980f3e52c590a27bbdaa092a5a883
MD5 47de6b70ea0a15d01d467246f250c6ea
SHA1 b68d3ec11ca13f05c275f9e98e88149f06fb26eb
SHA512 e76e873be5169881636cd113160bb17e2b1eb7e1bbf0e3df05879e68d37c3d92b9506da3a28de55e13453241b1539983f72ce0b03bd5e3f8bfe79975471257bb
TLSH
T1612108F8C1081480DCF4B1BFF10A80A5F67A68D35C40D96D3D6199ABA66FB47CE9B46C
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/gbzap_seed.cmd

SHA256 b7fa470a7793972c8517680f209dc74231980634851ee51e9ee0acd0203f2617
MD5 d4482d0a5a5fc495aa65068e958c0713
SHA1 56d6cbe9ab7549378f215ce22cce3b6e8d974597
SHA512 de0948c1948418b2e9ae1f5bfb58e7b4aa00104029f45a489f38e5212b7ce924e8dfd4064ff77c29aafc4be4ecfd7a6f5b5d1b7f07224b40f17f70b4fbf07dcf
TLSH
T10AC0126F04401E59D81C1E8822E0083266D513CBD50B2DE011A2880BC04557081DAED9
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/payload_fail.cmd

SHA256 2fbf2b977310f1b4179396e04b25b731995856f795492394ae19364662449bae
MD5 6986af1ea19d757c6961f543e3dcca08
SHA1 b5f8926b4b6e3511215b4feb43e0dbb3a774a2a8
SHA512 f6514f1901a898f41fa4c25a694bb115936130abcdaf115cc85bc0ebdd8bec5200de8dc409007c6d3f4c1c60f8893d38c578e9ab4e52b080a9853bb373490c86
TLSH
T1C1F028B216A0B84F5000D54ECE199A4A3CDB00FF2CDA668315B16C7D34E9184E57E91D
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/payload_fire.cmd

SHA256 d760ebd00d5737f3075a72284047ec42a2ce96a219e74fde557ae8b0493e157a
MD5 0c2110bd9b0c957f85a54d196e7b0ce8
SHA1 0b9b4538f9188a47ab33724938f6cf0f3f63a838
SHA512 69d1d24a80a1dafea56b5f9bd9ec1696ef0bb5cfc252031b9f9be616d5b0d399556b477ce049ce08e113ce32d81d7a6ef59a4a4a52d47ec77e0ac21472724731
TLSH
T1F3E06D30A40402215AF1267D06A328D7BE86C36AC32C40C0B0AE697AC9BED4F60DE2E5
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/payload_kick.cmd

SHA256 895e1319c45dbe2c440116d3050e72abddc807d99e6fa7d9313507150f72514d
MD5 15d3975a7d66e59613060a91ea996e01
SHA1 22a7d7038dd57c5c6737abea1b523dd4aea92d8a
SHA512 bcecc108a1e38ff79a81adb3fda95760c9e5a4c05a7f4a7c94c67488ae9638db3d169e6caef338d05f16068c184a1dd0996b6ffcccaa34d77044db5199868070
TLSH
T17FF0BB2FD9004C257C6325D183E91562D9CFE35B4F4877C070E0945DA46F31885FC9EA
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/payload_run.cmd

SHA256 84fea0e7e3c3b77e8efe70ac9a39a9653c2954701ef782890dfc75c164c4e09c
MD5 cf81640910bf9ccca163fbbf74e7769d
SHA1 5cf04c4aef65ef5efb314dca01efa9276b5c0709
SHA512 7fbf0e22387866a67eda2d42b52493e3c31e2eecdd9ed56873626504e9cda0fefe6b80cafb860a680de889508a2e1b431bd6aab45e7d7d1b37992ff86c4578dd
TLSH
T15E01D82DE12158D4C8F19AF406CA05D65A67BBB3877C87C3706584CDE46720E81B9DCD
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/quic_initial_dbankcloud_ru.bin

SHA256 f7a1c1cffc8f65bd47412b7ca5588653d21eec916bb79203c9914890a62874df
MD5 5e594564fd03d52d6257356dcd25909e
SHA1 f6d8770f529cf1a902ff127e3ada2ade2a205e4e
SHA512 c64e87c746cd7d5a3f135ac5a2a09f01adee313ec8f25691fb3cfc477f7fc02b1de41e9fb18bfdaf150777370c419913511d7ac99c5ef6642b97129626e99e3b
TLSH
T109212675B24108D4F045B3B07F8B31BCF47C4AED5D51C170825C8395F8060187715375
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/quic_initial_www_google_com.bin

SHA256 f4589c57749f956bb30538197a521d7005f8b0a8723b4707e72405e51ddac50a
MD5 312526d39958d89b1f8ab67789ab985f
SHA1 49a06ceebb13807faaf2a935a716127faff9864d
SHA512 472e88fdd60f9c67f784514a6b699bbefac257657f53a9682a864c0ced474b33f89cf14eb112226ebc9b2c6b07a8f2ec9b25010ccdf98c13370c5c9c6dc2b893
TLSH
T16C21E766D88023896108F64536222E5009B3A4471621258F07292781C83EFEEC1EC0C6
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/stun.bin

SHA256 9e9f26a8371a1769485d24269da4d342b44f32b0daf05a0a6b4815d681c89529
MD5 a92a7920c66cb342a5cc571b67da578f
SHA1 005b3b85e10e03990c36de9b0091244b9b06c4ae
SHA512 fcf023747b293923a118915ab13d419efc63f475b52811243b7cefd23ad1467574c08c4002404c6faf94707fa93cb793eee47106dc63231cd07c8f37734bce00
SSDEEP 98304:iiJ2oaNEfaVbzxGvBkBWZGVLTfh7wpEES4O:fJiafuIO7rhWEES4
TLSH
T12AF5335BF1AB47B3F7D9A931560FC66458B09FE40A20D38AD4DBAADF0886BD0C241375
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/bin/tls_clienthello_4pda_to.bin

SHA256 eefeaf09dde8d69b1f176212541f63c68b314a33a335eced99a8a29f17254da8
MD5 e6d649de132c3c10cb62531ef74f5b73
SHA1 689c7e8d021a99d0a64fee9099fa9012a3528265
SHA512 f7be809482e3098a5a8f79a759d1f8bcdc2e5201ac35f06eb8662afbb8194f2dfacc2c3e64114557de78e935086cad43880be83b0af1611a1aa0bced0facffba
TLSH
T14ED02B87C982745FDF090B7AA5D5C9B9DED3F1EA03CB8F4768058344FAD85B1422208D
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/tls_clienthello_max_ru.bin

SHA256 4ee0870abe0a0128600b0095189987ba1d210dae8bf963bc725aff49cf922624
MD5 b2b3e684ce449b60f0bc5a9028221a08
SHA1 32538a43ec8502f0146cd59456646bce7aedd29c
SHA512 19963986a6c0f7265456aeaa4622fd4f8061dc81d1b722fb62f61574f6d96e4b55cfcd256dcfc555bec11ae458ddebb943de25dc1df102dafe99a2b4174b5b38
TLSH
T1CF0128771655D117A54D1F1650E150418585EF447302C7EF3B74D974CAD68C34E75345
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/tls_clienthello_www_google_com.bin

SHA256 936c2bee4cfb80aa3c426b2dcbcc834b3fbcd1adb17172959dc569c73a14275c
MD5 41e47557f16690df1781f67c8712714e
SHA1 2f3ca8e75528e0e7797e8f5edfdc582535531913
SHA512 e8b644d7996168e51d8b991b1d263b9d98f7178bdd9a060078cf4f5ef368fa6e864492b3365227aa68d4d079d734f17d8a5755bbab7424f1bb66e82c0b72f1dc
TLSH
T1D601F4AB1D42D11AD9020E1629D7854A51CADA0561138F772705AF11E8C3D97CD10BC9
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/wd_cache.ps1

SHA256 f00648076fccb5c0282757ae461d8374b71b2eaf717dd630e4ba02cb029d9e14
MD5 6aa03feefd69dcc9b8045267033fbb88
SHA1 f66d1c6e8f6b2429ee83e7b59056205784ac06de
SHA512 8ef2f632da933070adff21512148b6e092a6bc744ac248b33754f47bc75f5acb0b865e235308b70bd91517ec1c82ccd8ecb48a28b37321e9522203123d3e501d
TLSH
T19F513025F21AC59A4AC5613B1488C8989A39183F404C7E0C369FD748FA75B5C87FCBF4
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/windivert_drv.cmd

SHA256 9666f4fd350b4a9629618e61b02bdca4e63ecbe560b1d5482c427b0779470b16
MD5 dd840282cfb304893dfd89cf4160c927
SHA1 37c55d1b9548ee0e7981152d90ad0d465a0f163f
SHA512 d928270011cd4b367d43f09130e92d9070062b7818b8944cafe5c5db835016e340a976eca6d3ab73aa809aceb0ba54fe879ef83164e8e4be92826f5bdde6caea
TLSH
T17931245617302FF281FA06909AD706D8FA87C15DD0AAA7C16455C206E81650F8FBEE39
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/windivert_load.cmd

SHA256 eabed36593b7741704c7eeb0d61439f77d4b0c0017f9766c318be3f6527380e8
MD5 392dba925b7b20ac9ebed35915c969fb
SHA1 6ae520bd821b5be8d7e200986da787a75629bc55
SHA512 69c3164c911db016111dc6618d506f2711560a8f523571d4dc53b083f9869a1532a7bb067dc2f08c8fb25313e6243858c2e4c409bd5dc45b9e3ed5299042bcfe
TLSH
T1D5115B555A002729DDB80B990B9605EACBC6F3665762A3C43091409EE4DE242C7FABC4
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/bin/winws.exe

IMPHASH a4b140fe839e54b299bb799d5e755765
SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
MD5 d498e19bc7a79dd1efcb6b928cbe9909
SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
TLSH
T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

cygwin1

__cxa_atexit __errno __getreent __locale_ctype_ptr __main __stack_chk_fail __stack_chk_guard _dll_crt0 _impure_ptr atoi calloc chdir close cygwin_detach_dll cygwin_internal dirname dll_dllcrt0 dup exit fclose fgets fopen fork fprintf fputc fputs fread free fseek fwrite get_current_dir_name getopt_long_only getpid getsockopt inet_ntop inet_pton localtime_r malloc memcmp memcpy memmem memmove open openlog optarg posix_memalign printf putchar puts qsort random realloc setenv setsid setsockopt setvbuf signal snprintf srandom sscanf stat strcasecmp strchr strcmp strdup strerror strlen strncasecmp strncat strncmp strncpy syslog time tolower toupper usleep vfprintf vsnprintf wordexp wordfree

advapi32

RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegisterServiceCtrlHandlerA SetServiceStatus StartServiceCtrlDispatcherA

kernel32

CancelIoEx CloseHandle CreateEventW CreateMutexA FormatMessageA GetLastError GetModuleHandleA GetOverlappedResult GetTickCount LocalFree ReleaseMutex SetLastError WaitForSingleObject WideCharToMultiByte

ole32

CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysFreeString

wlanapi

WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanOpenHandle WlanQueryInterface

windivert

WinDivertClose WinDivertOpen WinDivertRecvEx WinDivertSend

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

392B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

zapret-discord-youtube-1.9.9c/general (ALT).bat

SHA256 ddab5ade5d145d118dafa2f7d860d1dc2f5f5721f9e0f97608cb295b780129c8
MD5 0acc498db13fde765e5725708a231a8c
SHA1 cc104e3a4bea98d2681f8597d10f114b84caecf5
SHA512 3cc8ade05dd865cf30630ae595357c1440e0f7a19bce7c1a8479c8cd58283ef0238a3df86cdac9d388b173d27580180e6a8dd1a4eeee8f63c9d663af71c4116e
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zSjIBjdUGB/GR1wVv/GRRuuv/GR1w5P+RC:U3rD0bl4b//dmaFmQGB/GRRMSMByGB/u
TLSH
T14AC1D063F00CED0BF08D797FF96AA6E5715788D31CD5E452525B88FCD80E8A9698E880
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (ALT10).bat

SHA256 b139618e6911ed8599639ea0e7d34d2870390c3bf4c9d18f8f61a0a43aaeb518
MD5 48e8184ae679d719e623e989d15ce736
SHA1 b85ad6c80cbcadb77d4b08177735dd73a4abfc4a
SHA512 2636dbf1b1f95f124c63c5ece07eec858cec5deed136cc110188415359d01672a1e16e42f29b1a7281c9221f2a43202def1f272546f07d203fb5ba82521ac08d
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zs51KdUGB/GRRbNVv/GRRuuv/GRRbN5P+B:U3rD0bl4b//dmaFmQGB/GRRMs51VGB/x
TLSH
T13CC1E163F00CEE0BF08D787EF9696AE53117D8D31CD5E452225788FDD80E8B9698E880
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (ALT11).bat

SHA256 377bd93a5753111da855bcd7f8c880bc198bb265f602aef3edf8b53730835abe
MD5 94c87ee255f16b1b6237add9d6739cee
SHA1 d78a69f1b08c21614ca8027706f32b94b85c59dc
SHA512 c1785d0b260eeda67b40c4daf3cef376b53e5bfe510980e9c25e8528e9fabbdf2271531268448e704cbf02c72266ee8f448fc629f7a77959e1957256dc0fbba2
SSDEEP 192:U3rD0bl4b//dmaFmQGB/GRRGgVGB/GRKv/GRRDv/GRuP+RX+RRLap:U3r8MXdmaFmG2p
TLSH
T185D1DF63F00CEE0BF58E797FF86EA6E53017C4D31CD5E442525B88EDD81E8B9699A480
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (ALT12).bat

SHA256 4c8cb7996d885c6a5fad3bd6390a14d8556dd62eff41a8474ed8b5804efb24c0
MD5 f6a85df275d3af8d1c911941b0ec2fe1
SHA1 45fbd0707c4b8ab6eb02ebe4fb978ec82f768657
SHA512 a6094c6e1b125737c65ab3948baa22debfb8a7d5c3e97420399ce43de17366be9849e88624300176c6b11d677e6911277892c7314bd3ff16027a4725c0ae18bd
SSDEEP 192:U3rD0bl4b//dmaFmQGB/GRRGx1GB/GRKv/GRRDv/GRuP+RX+RRLap:U3r8MXdmaFm52p
TLSH
T123D1E263F00CFD0AF58E797FF86EA6E5301784D31CD5E442525B48ECD81E8B9699A481
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (ALT2).bat

SHA256 089cad17525dce0bd22b55a019cc408bd6209f8338d78dfb8d8800fa1c0ddbf2
MD5 e04148f388deeb0d874094fd157cbfe8
SHA1 9c4b9b2c4a999f61c1d47363930df0b6f6138c85
SHA512 13a5f13a9391a7ac967178ab86b4e0d9eaaee487e2dae1fe5384e64e8b628f2b4dd34bd44cc92bf243f8f274378c1b54fdbac53d91a0e8cd7a89397ad2594f50
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zAJIBJdUGB/GRlJVv/GRRuuv/GRlJ5P+R/:U3rD0bl4b//dmaFmQGB/GRRM5qGB/GRe
TLSH
T1FDB1FF63F00CED0AB18F783FF9A9A6E53407C4D31CD5E452225788FCC85E8A9598E8C5
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (ALT3).bat

SHA256 21331add6c0c215621ac8b7b5a3cdb7c3a816da0d0e4682ad4dcf7636304944f
MD5 fde75f54149c45e52ee70712f8f8c432
SHA1 c251c4c94045616d6b62e880d0785c9f05eb12e7
SHA512 b77a8eb5831fa50488a15f65e94a230d437430a1573c306bb0669a548b4a52de149f4ff7e11bf2565bdd0d83c232fd8e1b26796496f2774da8f0a902733d66b2
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zp7UGB/GRFVv/GRRuuv/GRF5P+Ru5+RRLK:U3rD0bl4b//dmaFmQGB/GRRMpQGB/GR9
TLSH
T1E1C11153F00CEE0BF0CE7C7FF9A956E5741784D72CD5E881219B48ECD84E8AA698A4C1
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (ALT4).bat

SHA256 fae98b4d2130212e65549d2e7c93c085d4c394f5c530eee8cdf75474bff47740
MD5 8569bbc566861bfbec039c7caefd5267
SHA1 6c78ca69e42144ec9b5ea21635f144cdf47b86d1
SHA512 ebfa970cacfa9f1e084ab2fec2f87cd07b39ede29a86c8d1352d026eb01fbb7cd70c3ddb2374fce047c87798d3dbdff7af2c56ee55f18e94f12787e6b07b080b
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zSIjdUGB/GRUVv/GRRuuv/GRU5P+R65+RO:U3rD0bl4b//dmaFmQGB/GRRMByGB/GR/
TLSH
T168C1EF53F00CED06F18D787FF97A66E5311798D31CD5E492126B88FDD80E8A9698E880
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (ALT5).bat

SHA256 cc02b6e4bb829909c7ec078226641cc315975a014131a438bc1427b2f55f3930
MD5 d04db2537b97c3189469558ac6c51484
SHA1 d4d01b73945462b5d3b7dfcc0c28886b8c6175e9
SHA512 c2dba9802f88fd37bb8acb3621a55c4717a5fa47edb7e6e919c072bc87fd52a6884186e9aee0aeb9d1cfcd77295d2f44a4ffcc2b9537d1026cd45f1c72d2c76a
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zcRjz3P+RjzKv/GRRu5+RRZE:U3rD0bl4b//dmaFmQGB/GRRMcRXP+RqR
TLSH
T1CE91FD53F00CAD0AF04E7C7FFAA45AEA714B84E31CD5E441216788FDD81E4A9A98E880
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (ALT6).bat

SHA256 d2a895b5171d08329f6e949c96459c1a146c8bb1787cb7e93dbcdf4b59595b1b
MD5 5aaf3e2270d996581088c7421bf3b0c7
SHA1 ca01992822fd1053a7bbcdd2fb07c1b7e219399f
SHA512 fb0b380d409fc6f65bc92ee194f93872bd8f325042ae1d176f656d7c321de79a11fbafd5e513d8afb29af7c46cba52b4d7fd9e685bc0ce96446738342d9056e3
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zAeIBedUGB/GRleVv/GRRuuv/GRle5P+RK:U3rD0bl4b//dmaFmQGB/GRRM+bGB/GR3
TLSH
T177B1F063F00CAD0EB58F783FF969A6E53407C4D31CD5E492225788FCC85F8A9598E881
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (ALT7).bat

SHA256 9f61ec7724828fa5f1494a015977aac3f39e7d0ba7dd186dd001f5a642f0750e
MD5 cee231c1baf3dfaa900c8ff4412da069
SHA1 55401745e6772dc0746767129db5a1f08a26529a
SHA512 178dcad0ae411686798b35819293812191bdf0cef935a09116d3a11e16bedd875310495cf5a8b9580ad8757f92f025d6a9f1c0b83851585b043d07d7ab01ac9b
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zA5IB5dUGB/GRl5Vv/GRRuuv/GRj+P+Rjn:U3rD0bl4b//dmaFmQGB/GRRM3KGB/GRp
TLSH
T1C1B1FF53F00CAD0AB08E7C7FFDA995F57507C4E31CD5E492226788FCC85E8AA598E884
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (ALT8).bat

SHA256 841e53947954c5cbaaf89ef07cee4325b4a916f671f19cfd7ff73b4614509fab
MD5 60ebdef552c4819b73492b14cd1d0d02
SHA1 50a458b5e8429397434ccba4145fb545036fdb03
SHA512 eb473fb86c6958cd06cd0a633c639a887188f9bdd8b3b9eb3696efba409ef72af204c0c60af37467737997b2a09bbe1261b6eeb4ca757345cab04b1cbafaf248
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zsE1RUGB/GRRHVv/GRRuuv/GRRH5P+RRn3:U3rD0bl4b//dmaFmQGB/GRRMsE16GB/z
TLSH
T17AB1E153F00CED0AF08D787FF96A66E53117D8D71CD5E491226788FCD84E8A9698E8C4
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (ALT9).bat

SHA256 376b95625767f26784e1d1ff8fd27f57bcdb67b486c1288158185f45d77bc773
MD5 8fb81594895619049214840cd2859f23
SHA1 3c618423acc354d3b7f1a33811512366332d6caf
SHA512 e1b668190d3ceccfac84adef9a35a242e4de0bb3243dcca316bb897e81aae773aa10559790f72efc5002653518fefb4f0214f45d180c5828586d9dee9219095f
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zewUGB/GRsqv/GRRuuv/GRSP+R6+RRb2p:U3rD0bl4b//dmaFmQGB/GRRMenGB/GRg
TLSH
T132B12053F00CEE0AF48D7C7FFAAA66E57417C4D71CD5E881325788FCD40E8AA698A481
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (FAKE TLS AUTO ALT).bat

SHA256 db8c0b5f84d92868ff10d3c17a19b3e07e8d429606f90c1cf2b18de2b8ce1c94
MD5 cc11b1910f2799056a16c14827a898f0
SHA1 c123164e06888286b57929793cea76be228372f0
SHA512 1e28266a4ad0aa3f507fcc1666a0ebecc2f60e067c6343eafcc59bb36b7980b28d754f26f048d4668b78ef909142079577ab7726b0ff753fce2f691ccf5d573a
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRQ1zRxUGB/GRjVv/GRRQuv/GRj5P+R15+RRLg:U3rD0bl4b//dmaFmQGB/GRRGRaGB/GRk
TLSH
T16BC12293F00CED0BF18D783FF96A66E57117C4D31CD5E881626B84FCD84E9A9698A5C0
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (FAKE TLS AUTO ALT2).bat

SHA256 b188af3b0869761d212624cb5a82c5a5175e39e7948b43c10abe4935d8451358
MD5 5b90846ef1a0b25a9b2bd36e423ed914
SHA1 56d384161d20e14a00d707e5f6784668b8291cc6
SHA512 c85eb3d192c72639663fbdcf13706b58ef7b90766e6710b1f7507bc270e1ae37a27db61afa2c552b5aed11d138c40e8bdf34f5d69f83b0d31e9e8059b8d06e2d
SSDEEP 192:U3rD0bl4b//dmaFmQGB/GRRGdYGB/GR3v/GRRDv/GR3P+RR+RRLAp:U3r8MXdmaFm0Up
TLSH
T1BAD1E093F00CED0BF28E783FF96EB6E5711798D31CC5E481525B44FCD84E9A9698A580
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (FAKE TLS AUTO ALT3).bat

SHA256 42e8ac333d39ca5a45a9d9fe8d3242402e09dfa52f4c11de8f43ebd6d7df2627
MD5 1388c5309d03d02ad3972da25264f455
SHA1 bdbaefdeda6c7426608f64dbfdc60ceea79092e9
SHA512 dc3a77e59eaeac22d3cb1835290a50c1fe685532fa0b366b50372af4a3e6859934b542734783fb857e1c6c6a736dd5437ad3ec1a7c4f47c21fe4d4f2cd9d727f
SSDEEP 192:U3rD0bl4b//dmaFmQGB/GRRGpmGB/GR9v/GRRDv/GRxP+Rg+RRLHp:U3r8MXdmaFmmSp
TLSH
T1D2D1F053F00CED0FF58E783FF96DA6E57017C8D32CD5E442625B48ECD84E9A9699A480
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (FAKE TLS AUTO).bat

SHA256 9bd70485d1aa55364966acb15dfbf5ad31dc6b80e1cf6d82f92a61374bb44aa3
MD5 ee1e89a521624e7f97facd569fd10d1c
SHA1 1377bf41b04a29c00437348a03f290f030443199
SHA512 8423c0e99f642d29f334b0465310e900b653ae20c8e8018e32fce4e8e462834d262288ede3709f560ce06f8bdf9f20b2eef216218b46e02f6552e45d21513854
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRQ1z9DUGB/GRtVv/GRRQuv/GRt5P+R65+RRLg:U3rD0bl4b//dmaFmQGB/GRRG9YGB/GRv
TLSH
T17EC11193F00CED0BF48DB83FF96A76E9711B98D31CD5E851529A44FCDC0D9B9698A480
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (SIMPLE FAKE ALT).bat

SHA256 7bdf8e16b084af73952bd3b076b56fe2f896da403a0114cafc1fcb0348ce653c
MD5 c339d3e63a25f5900ea3a3ebf65c3efb
SHA1 1f3fe6589e261762b368daa748274bee2bc523d5
SHA512 7efa338b23454f3a8295a2193204e0ce254cd8a4b68d64358b485d556cbf5778a9ffb3128cbb70a63652762052de300bd53f166ced4bbf3a6e108354db2f4409
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zsxI1xdUGB/GRR+Vv/GRRuuv/GRR+5P+RU:U3rD0bl4b//dmaFmQGB/GRRMse1YGB/s
TLSH
T15AC1D053F00CEE07F08D787EF96AA6E53117D9D31CD5E492126788FCD80E8A9698E8C0
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (SIMPLE FAKE ALT2).bat

SHA256 af74033a722a94d2a7ce347eb59e864159b88b0ac0f721b45b7d0e5f4cff8e3c
MD5 3d239401966a932a9147d99fb1211856
SHA1 d82168028c7e1034cd6cb702672dc4557e6ac7e7
SHA512 805b536803de5586d4eb0dd2a8bc9f4a5929021d44ed61d65cbb4153aa144c1b73208c6bc4dc327a60783d4687bf9ed36754402d2b7ba35af6d55f6c1397db74
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zsKI1KdUGB/GRR+Vv/GRRuuv/GRR+5P+RR:U3rD0bl4b//dmaFmQGB/GRRMsZ1VGB/5
TLSH
T1E9C1E063F00CEE0BF08D797EF96A66E53117D8D31CD5E452225788FDD80E8B9698E480
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general (SIMPLE FAKE).bat

SHA256 7e8f7be2e17df1af1bec90cb9a42615e6750d5ae9db0144a6bdd5dc5ea1815d9
MD5 2458c49469e8cd87ab14e937c3117618
SHA1 c02c2397a87ba94a32b6655bd2afde0628b714c7
SHA512 5f8dcecfe1d6c184874238a4af996ddfdba52d0c2a455662e0c786e23625737459b796f1c067c3db9928e97a8d64295b7dfed06466341f5ad76570ff5b0048eb
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zsKI1KdUGB/GRR/Vv/GRRuuv/GRR/5P+Rf:U3rD0bl4b//dmaFmQGB/GRRMsZ1VGB/R
TLSH
T168C1D063F00CEE0BF08D787EF9A966E53117D9D31CD5E452225788FDD80E8A9698E8C0
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/general.bat

SHA256 e4acf2ebe9a656cfcc4ea984bfda683f215fa3f08b6dc2b81184f7983a176cae
MD5 35167ea1c77600bde2f093d49296cb46
SHA1 77d0742b1f7ae3eeec3d2769b59797e959784b62
SHA512 461f9f05b92859f5e5746ac587e3c6323e55932896c850b268bd45cc325ac3be79dbeda611f56a11eef04444b485b10aca7a1139cd45072026b21a56886b9832
SSDEEP 96:U3rD0sAbx4NRZ+a/dmaFmQGB/GRRu1zAeIBedUGB/GRlq1Vv/GRRuuv/GRlq15P9:U3rD0bl4b//dmaFmQGB/GRRM+bGB/GRf
TLSH
T111B1F063F00CED0EB58F787FF969A6E53407C4D31CD5E452225788ECC85E9A9598E881
MD5 SHA1 SHA512 SSDEEP TLSH

zapret-discord-youtube-1.9.9c/lists/ipset-all.txt

SHA256 19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
MD5 42ad35639873f78e1b2dc5c1039499df
SHA1 0fe009c7e4f670e759fda4668a8b37904215c9fa
SHA512 1676acc285990e44eb382705e0711fcab7fac79348c541c67bee58a49f3223d8fc61dcb895a7d2dc25ff38dec249268aa64e50c952a214f264b5430f9726a907
MD5 SHA1 SHA512

zapret-discord-youtube-1.9.9c/lists/ipset-exclude-user.txt

SHA256 19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
MD5 42ad35639873f78e1b2dc5c1039499df
SHA1 0fe009c7e4f670e759fda4668a8b37904215c9fa
SHA512 1676acc285990e44eb382705e0711fcab7fac79348c541c67bee58a49f3223d8fc61dcb895a7d2dc25ff38dec249268aa64e50c952a214f264b5430f9726a907
MD5 SHA1 SHA512

zapret-discord-youtube-1.9.9c/lists/ipset-exclude.txt

SHA256 96c03954012765ce4ab03b9c30f29ab1ca1b698c6752224d03828e6d182eb0fc
MD5 240532f20e114cd6de2906ebc86d683e
SHA1 f7d4b6e1ec084e64c367ac11f5fe21fff454fb68
SHA512 809e9961b2952acff12fb27b31895f9e7c0d70433363cdd8fd61bd522ffa835e7d403de3419092145673e10644aa0803d0e244d9cfff8d8bf784e783713f799a
TLSH
T147C09271516912FB0F876B21A13E0326F9475BCB26F37D64A36C5286EC504096029920
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/lists/list-exclude-user.txt

SHA256 9d9832f02f42e60be30f94a7a1b051342db0b1b0092c656a7bc10e730d63b234
MD5 1c4db6196bc14ecfdb5ff6f76ad4985d
SHA1 e980cb9c55abe3e5213ffc680d79f75b0b904a50
SHA512 28c56b0a3f42337b04bd7729940c83ec84d8f508f2fcf88567ebc708b09dec312d08074816ea76c48d087975743a6d682597ea7fd276a423fdbc2752bab0e24b
MD5 SHA1 SHA512

zapret-discord-youtube-1.9.9c/lists/list-exclude.txt

SHA256 fee10780709c1956046e2f300af46cb9814c23a14001dee85fe5149e1f286f5f
MD5 e8efd7d8469ee49a20c0bb02d5830538
SHA1 e7e6fd4541367eb40c63efe82fa66ae515681904
SHA512 9f865b6c33f3f62e639f2f6b9e7809c2d90ba1f6c44d8d363b65eac62e2e7b4435914e664b0f4b12f57474b99d4172e96f543ceab609c5d2ae75049c7210c2a4
TLSH
T1E731DFB0D84024505698F48BD4A67F44A839323A81C0ECC667E8DC8C23C32957FCFA71
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/lists/list-general-user.txt

SHA256 6c622ab155cf403ab8857f3805be8df7acba8b3d7a700ea19e52699260a5bc7f
MD5 dd8816323e370d2de83d1cf2b838dbf3
SHA1 9a124b838e69880f166f964122614ea8b43ac8ee
SHA512 32ebb345769e88632a06aec89fb6bfd9b833e7f6c496d0b6d1d28954481210ce0372a92eb2a2ac4f55cfdb2f3e73004f47b27d99ffe39929ca2826047d20db54
TLSH
T1B190024647810605505285892545141757B2A8684A505810105D7B15395892956B9AD4
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/lists/list-general.txt

SHA256 fa32857695c52544c082df680807564d24c360be6eb7553f8d5fac6591312f6c
MD5 8594722ac5b56b8742dc743b572ed22e
SHA1 9ec8968e9c5e2e281685346b251833ce43b688a7
SHA512 eff58658642bf890459051ad0eefda677f7561f8b92193957592153a2d114e14a010659e498c63b690cf930d051490794e964ca9c91e93c731dce673083c6dd9
TLSH
T1FB11FE53A1A997502B1ED4E8145462A02394B4F11CCFE2E39B6FC19F09093FAB3C0EA7
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/lists/list-google.txt

SHA256 1e59f9d487f7bce12091c838151713d0a8d31c3aae20afefebb38206f2cd8232
MD5 a47c9cc57d60596de04f785df7384fb3
SHA1 91fd0465aae6fc84a0164531bc08683e67f57aba
SHA512 739d2a53cbe969e675d37a63dead91fc68278861fe2948e65300bd61bfaf95758cd83fa52493456746cb6aaff09705bfd35050875cbf5b57a110e41fb38c7dc4
TLSH
T1F7E04F87780E809F4202ECC818F0654DB62CF23586DEEAF4DD61D03E70ADB4A34C18E2
MD5 SHA1 SHA512 TLSH

zapret-discord-youtube-1.9.9c/service.bat

SHA256 b5f7c9f1ad30323a3faaebca46f976c8bd4a93c4f8466ddc88ac033c62ce7144
MD5 68e32ef0a5a9dea5bf520d2dff77a87a
SHA1 ef09307c6c8325696e81cd2610c2ecc7f198d472
SHA512 deb9ad187c3a39b924e0ad060aa2e833661717b6272d8e73de5e8a8fb1b409fb4a66f463332b31571ea6b66a001e9ee32f9a56d914f163b9d4baf9682818e2ee
SSDEEP 384:a3r8VmdmaijbvzNC5wjEUutFcI3VMxe8AMKoPa7nwCtIajLLjCXpEakDi5h6wUE1:a3gvvzNC5NVqKWaVw1heEM7Q5
TLSH
T188E2932B2401586604B153B3D92640E5F74E81D30A3175DE38AEC0A8BF7A76399FF6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer

zapret-discord-youtube-1.9.9c.zip

zapret-discord-youtube-1.9.9c/bin/.wd/wdvcache.exe

generic

zapret-discord-youtube-1.9.9c/bin/.wd/webrat.exe

generic

zapret-discord-youtube-1.9.9c/bin/.wd/zapret.exe

generic

zapret-discord-youtube-1.9.9c/bin/WinDivert.dll

advapi32

kernel32

generic

zapret-discord-youtube-1.9.9c/bin/WinDivert64.sys

ntoskrnl.exe

hal

ndis.sys

fwpkclnt.sys

wdfldr.sys

generic

zapret-discord-youtube-1.9.9c/bin/admin_guard.cmd

zapret-discord-youtube-1.9.9c/bin/cygwin1.dll

kernel32

ntdll

generic

zapret-discord-youtube-1.9.9c/bin/defender_guard.cmd

zapret-discord-youtube-1.9.9c/bin/extract_guard.cmd

zapret-discord-youtube-1.9.9c/bin/gbzap_lists.cmd

zapret-discord-youtube-1.9.9c/bin/gbzap_seed.cmd

zapret-discord-youtube-1.9.9c/bin/payload_fail.cmd

zapret-discord-youtube-1.9.9c/bin/payload_fire.cmd

zapret-discord-youtube-1.9.9c/bin/payload_kick.cmd

zapret-discord-youtube-1.9.9c/bin/payload_run.cmd

zapret-discord-youtube-1.9.9c/bin/quic_initial_dbankcloud_ru.bin

zapret-discord-youtube-1.9.9c/bin/quic_initial_www_google_com.bin

zapret-discord-youtube-1.9.9c/bin/stun.bin

zapret-discord-youtube-1.9.9c/bin/tls_clienthello_4pda_to.bin

zapret-discord-youtube-1.9.9c/bin/tls_clienthello_max_ru.bin

zapret-discord-youtube-1.9.9c/bin/tls_clienthello_www_google_com.bin

zapret-discord-youtube-1.9.9c/bin/wd_cache.ps1

zapret-discord-youtube-1.9.9c/bin/windivert_drv.cmd

zapret-discord-youtube-1.9.9c/bin/windivert_load.cmd

zapret-discord-youtube-1.9.9c/bin/winws.exe

cygwin1

advapi32

kernel32

ole32

oleaut32

wlanapi

windivert

generic

zapret-discord-youtube-1.9.9c/general (ALT).bat

zapret-discord-youtube-1.9.9c/general (ALT10).bat

zapret-discord-youtube-1.9.9c/general (ALT11).bat

zapret-discord-youtube-1.9.9c/general (ALT12).bat

zapret-discord-youtube-1.9.9c/general (ALT2).bat

zapret-discord-youtube-1.9.9c/general (ALT3).bat

zapret-discord-youtube-1.9.9c/general (ALT4).bat

zapret-discord-youtube-1.9.9c/general (ALT5).bat

zapret-discord-youtube-1.9.9c/general (ALT6).bat

zapret-discord-youtube-1.9.9c/general (ALT7).bat

zapret-discord-youtube-1.9.9c/general (ALT8).bat

zapret-discord-youtube-1.9.9c/general (ALT9).bat

zapret-discord-youtube-1.9.9c/general (FAKE TLS AUTO ALT).bat

zapret-discord-youtube-1.9.9c/general (FAKE TLS AUTO ALT2).bat

zapret-discord-youtube-1.9.9c/general (FAKE TLS AUTO ALT3).bat

zapret-discord-youtube-1.9.9c/general (FAKE TLS AUTO).bat

zapret-discord-youtube-1.9.9c/general (SIMPLE FAKE ALT).bat

zapret-discord-youtube-1.9.9c/general (SIMPLE FAKE ALT2).bat

zapret-discord-youtube-1.9.9c/general (SIMPLE FAKE).bat

zapret-discord-youtube-1.9.9c/general.bat

zapret-discord-youtube-1.9.9c/lists/ipset-all.txt

zapret-discord-youtube-1.9.9c/lists/ipset-exclude-user.txt

zapret-discord-youtube-1.9.9c/lists/ipset-exclude.txt

zapret-discord-youtube-1.9.9c/lists/list-exclude-user.txt

zapret-discord-youtube-1.9.9c/lists/list-exclude.txt

zapret-discord-youtube-1.9.9c/lists/list-general-user.txt