57cb714ea0e385ab3cea37543fd9ac7d591142571192217b39a6ce7c04f85f15

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.10.3/general (ALT7).bat
Size 3KB
Sample261027-pawkva1v7m
SHA256 57cb714ea0e385ab3cea37543fd9ac7d591142571192217b39a6ce7c04f85f15
MD5 96e72a33cf63c887ef194cedd6ee22db
SHA1 0e5a8595f435fc4d01be203da895f5117fe585ba
SHA512 83c853db87e8e37ba5dbb02ce35d88833d5a11dcb6c8bc3e4ab21506878385d38de720fd5ac022ab85eb1e2f473daf14aef4fee5fcd11f83f66fd79c923b0f86
TLSH
T13751F797E00DDE46B68EA83EFC9AA5F52017C8C31CD6D462539789E8C84EDEE4C4E485
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	1796	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1796	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1521918563\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1521918563\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1521918563\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_110491166\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1900367809\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1807196631\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1807196631\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1521918563\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1900367809\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2416_171729503\_locales\si\messages.json	msedge.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4568	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4380	cmd.exe
4580	cmd.exe
1792	cmd.exe
644	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2108	netsh.exe
5532	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{1DA7D5AE-B8E5-4760-957D-7F2B71962F89}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1796	powershell.exe
1796	powershell.exe
4584	msedge.exe
4584	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeRestorePrivilege	3568	winws.exe
Token: SeBackupPrivilege	3568	winws.exe
Token: SeDebugPrivilege	3568	winws.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4548	4380	cmd.exe	87
PID 4380 wrote to memory of 4580	4380	cmd.exe	88
PID 4580 wrote to memory of 4568	4580	cmd.exe	89
PID 4580 wrote to memory of 396	4580	cmd.exe	90
PID 4380 wrote to memory of 3508	4380	cmd.exe	91
PID 4380 wrote to memory of 4900	4380	cmd.exe	92
PID 4380 wrote to memory of 6044	4380	cmd.exe	93
PID 4380 wrote to memory of 6056	4380	cmd.exe	94
PID 4380 wrote to memory of 2108	4380	cmd.exe	95
PID 4380 wrote to memory of 1792	4380	cmd.exe	97
PID 4380 wrote to memory of 5296	4380	cmd.exe	98
PID 1792 wrote to memory of 1928	1792	cmd.exe	99
PID 1792 wrote to memory of 644	1792	cmd.exe	100
PID 644 wrote to memory of 1796	644	cmd.exe	101
PID 4380 wrote to memory of 3568	4380	cmd.exe	102
PID 1792 wrote to memory of 2652	1792	cmd.exe	107
PID 2652 wrote to memory of 2416	2652	msedge.exe	109
PID 2416 wrote to memory of 1612	2416	msedge.exe	110
PID 2416 wrote to memory of 5532	2416	msedge.exe	112
PID 2416 wrote to memory of 2184	2416	msedge.exe	113
PID 2416 wrote to memory of 2864	2416	msedge.exe	114
PID 2416 wrote to memory of 2184	2416	msedge.exe	113
PID 2416 wrote to memory of 2184	2416	msedge.exe	113
PID 2416 wrote to memory of 2864	2416	msedge.exe	114
PID 2416 wrote to memory of 6076	2416	msedge.exe	115
PID 2416 wrote to memory of 6080	2416	msedge.exe	116
PID 2416 wrote to memory of 6076	2416	msedge.exe	115
PID 2416 wrote to memory of 6076	2416	msedge.exe	115
PID 2416 wrote to memory of 6080	2416	msedge.exe	116
PID 2416 wrote to memory of 6080	2416	msedge.exe	116
PID 2416 wrote to memory of 736	2416	msedge.exe	124
PID 2416 wrote to memory of 1944	2416	msedge.exe	125
PID 2416 wrote to memory of 736	2416	msedge.exe	124
PID 2416 wrote to memory of 1944	2416	msedge.exe	125
PID 2416 wrote to memory of 2144	2416	msedge.exe	127
PID 2416 wrote to memory of 2236	2416	msedge.exe	137
PID 2416 wrote to memory of 3960	2416	msedge.exe	138
PID 2416 wrote to memory of 408	2416	msedge.exe	139
PID 2416 wrote to memory of 1492	2416	msedge.exe	140
PID 2416 wrote to memory of 1492	2416	msedge.exe	140
PID 2416 wrote to memory of 1264	2416	msedge.exe	141
PID 2416 wrote to memory of 1264	2416	msedge.exe	141
PID 2416 wrote to memory of 4220	2416	msedge.exe	142
PID 2416 wrote to memory of 4220	2416	msedge.exe	142
PID 2416 wrote to memory of 3940	2416	msedge.exe	145
PID 2416 wrote to memory of 3940	2416	msedge.exe	145
PID 2416 wrote to memory of 4272	2416	msedge.exe	146
PID 2416 wrote to memory of 4272	2416	msedge.exe	146
PID 2416 wrote to memory of 4676	2416	msedge.exe	147
PID 2416 wrote to memory of 4676	2416	msedge.exe	147
PID 2416 wrote to memory of 4584	2416	msedge.exe	148
PID 2416 wrote to memory of 3992	2416	msedge.exe	149
PID 2416 wrote to memory of 3992	2416	msedge.exe	149

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\general (ALT7).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc query "zapret" | findstr /i "STATE"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\system32\sc.exe
    sc query "zapret"
    3⤵
    - Launches sc.exe
    PID:4568
- - C:\Windows\system32\findstr.exe
    findstr /i "STATE"
    3⤵
    PID:396
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:3508
- C:\Windows\system32\netsh.exe
  netsh interface tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4900
- C:\Windows\system32\findstr.exe
  findstr /i "timestamps"
  2⤵
  PID:6044
- C:\Windows\system32\findstr.exe
  findstr /i "enabled"
  2⤵
  PID:6056
- C:\Windows\system32\netsh.exe
  netsh interface tcp set global timestamps=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:2108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K service check_updates soft
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "(Invoke-WebRequest -Uri \"https://raw.githubusercontent.com/Flowseal/zapret-discord-youtube/main/.service/version.txt\" -Headers @{\"Cache-Control\"=\"no-cache\"} -UseBasicParsing -TimeoutSec 5).Content.Trim()" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Invoke-WebRequest -Uri \"https://raw.githubusercontent.com/Flowseal/zapret-discord-youtube/main/.service/version.txt\" -Headers @{\"Cache-Control\"=\"no-cache\"} -UseBasicParsing -TimeoutSec 5).Content.Trim()"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Flowseal/zapret-discord-youtube/releases/latest
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://github.com/Flowseal/zapret-discord-youtube/releases/latest
      4⤵
      Loads dropped DLL
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x21c,0x7ffca742c188,0x7ffca742c194,0x7ffca742c1a0
        5⤵
        
        PID:1612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,8649576537967684309,17102183610655068651,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,17907898036933574702,948215844002758161,262144 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:2
        5⤵
        
        PID:2184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,17792813328058122954,14497630192729792257,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:8
        5⤵
        
        PID:2864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,8094815860558269813,9329643638848655271,2097152 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
        5⤵
        
        PID:6076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,2938930763102542443,2915276508927097920,2097152 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
        5⤵
        
        PID:6080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,13741395767431933267,8175867634814910836,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
        5⤵
        
        PID:736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,4727356096313210249,13958959050656968275,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
        5⤵
        
        PID:1944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,4843540302937698390,12838435562961932260,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
        5⤵
        
        PID:4524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,4843540302937698390,12838435562961932260,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
        5⤵
        
        PID:2144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,2904686539363880826,1384731304270937224,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
        5⤵
        
        PID:2236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,13903302089850452818,8572143895888453791,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
        5⤵
        
        PID:3960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,16514557712051448739,15733404212034996852,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
        5⤵
        
        PID:408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,12060852172931068047,3589170883462859968,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
        5⤵
        
        PID:1492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,4448595104130688087,12258951002843930169,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
        5⤵
        
        PID:1264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,9228598759304725508,37616369921811358,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
        5⤵
        
        PID:4220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,17703077876993997319,5301878978427286375,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
        5⤵
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,2481205967852701569,1722783489922053032,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
        5⤵
        
        PID:4272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,15134443985587569819,4152353080627578106,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
        5⤵
        
        PID:4676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,16095882554111394100,4327958030534663304,262144 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,11554146655605925770,4093361286937091609,524288 --field-trial-handle=2816,i,13356694244262410555,11626082342405227979,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
        5⤵
        
        PID:3992
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:5296
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-pos=2,sniext+1 --dpi-desync-split-seqovl=679 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=syndata --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=syndata --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3568

C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\WinDivert64.sys
1⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_110491166\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1521918563\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1521918563\deny_etld1_domains.list
Size 7KB
SHA256 1c999530d7fed6e4346d8cfb3933a044055544eea970efc00b114505b9cd3a86
MD5 f3249a6b4b36c4907803ec372e4d2b14
SHA1 c8ef9da8682dc8bba70ffebee0ab4d47fcd89136
SHA512 4b7860cf50fb58c32f136e578d284f9a66dc48c9335e2e45de323f8b1429ff70115032d5c7d0555f46db2ab349f8bfd8b9e24e60d9a867055518a5f4cd7ec360
SSDEEP 192:E9KyU8bqzeC/m4XqLWPgETdT/n+DEDYZHNnd:EQy8eC/m4pzpmDZZH5d
TLSH
T19FE1B0D537C7E2D2C03580B32203ABDEAA51BD40A78A3FE5FF461AC15F55AC7511E118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1521918563\deny_full_domains.list
Size 12KB
SHA256 19e871f69e774c847717469957dd18f342712e702d2c54c5efb8542907bcbabd
MD5 85a2a44606d0d937cb7c3cb97549d1dc
SHA1 27081c556bfa37eef2ac2b0bfafecf90dfa8662d
SHA512 3f564a6b0b71ff54e3cf0e7addd91fb63a2e0d477cacaf73409fcd4c29cfa2076e76d0ca0e330c4fd0fba6cdaec8f118401bb2ce0f83af9e334cd603adb61d24
SSDEEP 192:3zjGRPX/DE6OGcrMHNK17dYuybxV3SOZTAnbtIBzkJkW9ELtW74zPJ1vRbmZM0ED:PAPYmhKh8RvOkWYtW74zBI1F71WqEgOR
TLSH
T16D42D04EF5E8A884C70E0AE50B8C759EDE0A514087A22BD53FB57B5F6988CB9FB11601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1807196631\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1807196631\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

well_known_domains.dll

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1900367809\well_known_domains.dll
Size 86KB
SHA256 f63a806e2b89ed1db25687026abff5df4675a82a13882cdb2a47d1b08d2c996e
MD5 94e3e395b95eed4fe8857e0258d62491
SHA1 0e9bb0173cb2df4be5eea77cef5a09bb5b3116b3
SHA512 b680ece7a8b72a6f78a1643ee52a606fe7a094fe058bac041c25b775dd472834a1df349d45594a11fe6eb4c41d083bdb9809e944d9ff254d795f04e177ac19d7
SSDEEP 1536:HJxEzwtlOEMkVXvopF0BYDfBny/nXi7IruMPzEVWHxgeBz4:HA2DMggpuusPXBuEuaxgEc
TLSH
T17583F14A7AAC149BE9EB8674E2645E17BB72775B071893EF1342D0040DF73C1AE35A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c14dd2a-7fb7-4ad0-ad5b-d06f66a0be16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3c14dd2a-7fb7-4ad0-ad5b-d06f66a0be16.tmp
Size 26KB
SHA256 31d9ff2d1a711092a35aebdc92895b92116de6dc623454f072f5a67684f02600
MD5 9cbf311082673b3cd13a48c904f0af7d
SHA1 c280435daa268cdb7392beb24d9a7aa3820d61a9
SHA512 992dbf04ddafce9e59fb3ba9be243fda03789f8ebeda2d760fc3af0e61aee28aa7cfc2d62692e5d0af0ae8e8fdb08092453c7ebe251bdebf3a95f1849e5e41e4
SSDEEP 384:nliFzQkUSvq3sNN8TUNTUlI4INaKMxbs0w2fLBCNfunKUnigvaTZc2HUgL/7Iz5s:sFdq3owg/MQkBCRPUnigvaTZc2H6LA
TLSH
T11FC24A32E8A9DA6BEDEA4BD5A70A3643DFE04113C88C5AD4D9CD5D6C00DB2DD530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40fdc712-6fa4-43b0-a535-1714fc598232.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\40fdc712-6fa4-43b0-a535-1714fc598232.tmp
Size 26KB
SHA256 f59d7ef8affeac4e9cf808d084e8d20efa536e2c824719afc6438906f136b550
MD5 0b124dcfd4c98ba93634e2076b2939cd
SHA1 71788c8558f3218ea6a185f52a83e5b350833037
SHA512 ca1390fb321c24ec1cf4ef172e58f742e38ebad3b2c376c848f8a7225eaffdfaa24089f03d922b930c8ef116b73ba39fe4c96a9de8b9393af0d576effb17619c
SSDEEP 384:npiFzQkUSvq3sNN8TUNTUlI4INaKMAs0w2fLBCNfunKUnigvaTZc2HUgL/7Iz5Ij:AFdq3owg/MFkBCRPUnigvaTZc2H6LA
TLSH
T1CDC24A32E8A9DA6BEDEA4BD0A70A3643DFE04113C48C5AD4D9CD5D6C00DB2DD530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

1882106e-087b-4eba-b233-62d88f7eaa81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1882106e-087b-4eba-b233-62d88f7eaa81.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

762ab40d-3a51-4e06-a28e-0130a9aa7f60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\762ab40d-3a51-4e06-a28e-0130a9aa7f60.tmp
Size 13KB
SHA256 f7012379b8e3153c4bcbd52e0fe6ea8e9398d8afa7ccf09ce3a86231fd2c01af
MD5 f01a639d9aa1ef709df615f1f4c94831
SHA1 f7ed480ec31218fb11f2a97b2caa62e365b1c233
SHA512 3a9a522ed6ed44c624e437825dbc95b14656ae3183ed68cf10a3623ae451be87b23083c650274ee65e38e8176a664aa3759695b6c9d4bc33b6663dda916da4d6
SSDEEP 192:sxZ9ARYjl/fKswQZLjG8/zodpv2NxEHW6+WNYFp/YoV6OjSe1+NIg5HuNt4J:sxZSGl/fKswOPtUzHbg/rjSe16YNtc
TLSH
T1D052D655AD28E97F8CCBD619BB55BF52E3FD503290850E44AAFC8A2C04E7ADD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89a27afc-f179-468a-878f-14e0036506b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89a27afc-f179-468a-878f-14e0036506b0.tmp
Size 13KB
SHA256 85aedc9552bb1555659239de091ce1196896e6bc27ce00889299794f03373f34
MD5 e903a418cae607fd4a4b6f580fd9444c
SHA1 008ed68333532213d8ab23d59108841d0c718e85
SHA512 d854f1498b892b5273ccc3e5bdf2711cb503d19ce1d242fc2941c27bb545701d1ebda811f575b7263a9f7d0591389fcfe355712c5d2cb3da5422d631f77088ef
SSDEEP 192:sxZ9ARYjl/fKsVaQZLjG8/zodpv2NxEHW6+WNYFp/Yow6OjSe1+NIg5VttJ:sxZSGl/fKsIOPtUzHbg/6jSe16Xt3
TLSH
T11052D6556D28E97F8CCBD21AFB55BF52E3F9503294850E44AAFC8A2C04E7ADD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 52d7dd756ad05e24e801233ceab7a2fb71604a5455ebab7a588f00faff03586a
MD5 f6a25378d5c1bd8a7cab679574618ae9
SHA1 fb3b97a3352ab1def3ad46fc82ca63b527669800
SHA512 4e58e29b250fe02a36bb9593d54a775262d0a581ea3508794a3aefc6d2f311110c50274ad5a6d98ff9d6f41eab3045d192d201336e2240f2064be9d370f0acf1
TLSH
T10B617E848C89B0D0F3AE50F4E9FA508336B46B7409A39D1315D2DC7CE4673B4931230A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 97e393156795eea70416384bdb879d99a7a3c32ac63bf0f54b3a37eaf1e75a9a
MD5 d0b876d934d5f47c74f35b597423bca4
SHA1 9157c6cf2a5fa35ecd1dccee5449bc10c4f74912
SHA512 348ea14442939d047b451b5775e2e2760fd958662870b3b58ff1b9cf5937acd24af03241cc011a6e52f95c6195bbff22d61e57fe81e642e399932be12b030f96
SSDEEP 96:h0JiqlK3zH9bUSiHbuwTNVZyXiu28z8h1OfaXJ556FoDGe7zfvnU+iib5ik5NfXL:FqMb94y2fnUOG2v8iJfLmhxmNl
TLSH
T14AB13E444C95B5A8FB5A10B8A9E5448736F46F7400A79FBB859ECC3CA862FB4D362207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e58ad37-79c7-4999-9194-77b240479239.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5e58ad37-79c7-4999-9194-77b240479239.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

0c7e82db-b9d2-4e63-bce4-0ced6ca4b6f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0c7e82db-b9d2-4e63-bce4-0ced6ca4b6f6.tmp
Size 2KB
SHA256 4ff15d23643d2610009895437d96ce7b964ae2901bca84bc56a4fa754e017282
MD5 a4a9e63906e05a44c8dd91f7cc6c234c
SHA1 29fef2e514e7db3a2f6891cf6047bb8ab8888148
SHA512 2a568ac4fac0dab494973ece3d80ba99c36b96fb656de385034d05157a45617fd2a2e792803bb69aaf3ffad6b2edeca7d48fa6575df19f02b8288e85e43d407f
TLSH
T1DE519CF787F5856D8A0195F0EA18AE1BCF2C0514832C7DAA88E4AE5BD3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

2020ebe7-4f7b-4550-a90e-2a1a4b6275f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2020ebe7-4f7b-4550-a90e-2a1a4b6275f6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4e89cc63-ad4e-46f1-938f-84fd6cebf274.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4e89cc63-ad4e-46f1-938f-84fd6cebf274.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

6050f615-faf1-46a1-a356-934d17e2fa4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6050f615-faf1-46a1-a356-934d17e2fa4b.tmp
Size 1KB
SHA256 ce4043574da71be16df3e9760945fbc211a657edb8093bf889cd5aa97acc8db1
MD5 d8dc7167f8c7447e3a39d69b2cd15b73
SHA1 37f48f2d898c60af824cc9143c152af54f0a868a
SHA512 ebae0aeeddc837448afa32eb768f7ff4d7c26dc154cf337c51c7c76d2e4ceffb1b00e4b7f567ff17cab1b1a96ed4f8e47c9ffc0d2b7fb3ce3d94aa51fcbe68ba
TLSH
T1FC318EF3C3E4C66E8A0096F0A618BE2BDE2D0554432C3D9AC9E4AF2BD3E3471D14165B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3f590d0cd836f22569971ea557921d4e1bcef507320efe758686cbed642d687b
MD5 6ea7dd454399c6338538002334564e37
SHA1 3eb1edced8dbd860876c1f59f976db8e24047d84
SHA512 d85bdbf129cf24865e0651568773b71a2f29b9d48975872a00a4087629aa69f589d5104f506e94990ce39566b63bffd501a4f73c99300fc1abb3ddfe2ca8fd18
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgL:ST/2dXOJhJlpfnpp3tNXVrN3m9v0
TLSH
T1CFB2235571BB421039FE391891B59B2E064232733119EA6B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8c61e6a-8f86-4a28-84ef-a92738fd0b35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8c61e6a-8f86-4a28-84ef-a92738fd0b35.tmp
Size 13KB
SHA256 330729ed44b4985f6b72edd7a5e466cb7e21478a51ff45323293c27963a552f8
MD5 f2d59e55971179f8a6bf2fc9bad9ff43
SHA1 c91fd80dc8ea8396fb4a3177346900245f0cddc6
SHA512 3d85342ef6c5ec56bea83d0e7cac0c272b0df3a31d397465588cbca96ba02ed4e4f669019984040a8cc5708f568c123855ce7a5c2a7b90d75fd14c09075fbef9
SSDEEP 192:sxZ9ARYjl/fKslaQZLjG8/zodpv2NxEHW6+WNYFp/Yow6OjSe1+NIgjttJ:sxZSGl/fKsYOPtUzHbg/6jSe16jt3
TLSH
T14452E7556D28A97F8CCBD21AFB55BF53E3F9503294850E44AAFC8A2C04E7ADD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee5db744-a07c-435d-93a9-1ad71fcb6b45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ee5db744-a07c-435d-93a9-1ad71fcb6b45.tmp
Size 32KB
SHA256 4c11653f5e25933d6f6943222c3b00b1c7f2d878062033659f40d6fd7657202b
MD5 d8861be1a0a8824eeceb7b66b23fa490
SHA1 807453177e9e260df8765e8372f9091c6960ec49
SHA512 2198ee1a5ecfe77a7c6e3ee757e71a8225ce955f743ee8784498ab80b50f25c1144fec10ec301ff0933087de58f8dca99c4fcf89adb8111c988e03230a81cd48
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVw1qpLlvVajYroJ:Px6r8s2EbG+WviyUKu1jaN1qpLd4jjoI
TLSH
T18CE2E97B780CCB7E4FC04A9DDD1A7F8B6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f76bee4c-93c3-42b0-b594-f9ef35b5991c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f76bee4c-93c3-42b0-b594-f9ef35b5991c.tmp
Size 414B
SHA256 f7914cb35e0e051bd8cf030d3b3e580f844d3d97f1303f0d6b1788c05b5fe64c
MD5 b34a132972e072862a912019ac176724
SHA1 e6643c7cc89c606109ded2ff8f425c6fd475d871
SHA512 ca7889c0243775131bef722dcab17d6171483d6f2b09d709cc8773c4e0185c8b561beef34be8bbc1b89f3bae61efabc6baa07d02a49f829792c0d1a3f1f41ce2
TLSH
T175E02BAAC821EC3B18FD0B7960A44245F75513672B409C4B3F3D81088FB157795C596C
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.158\manifest.json
Size 177B
SHA256 976e13362933c4e9d37530c32a043728f47136ff030f249ade8210d4d1300df6
MD5 27f9a23b87cd0575e13bfd00ea13e3e1
SHA1 998b5c16a3c10772059819448dca88be1af7b84a
SHA512 3a1517e7d3f68d944fa540d52885c2e16d679358c8683997a407720cd6b4b194829017d07b451e58a78879e68cef66ac9e5a1cca3582034a70699709c6ad7f88
TLSH
T144C012DFDC509DB115EB4332156D43C4D733CF0B1546450935F766082E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.3\manifest.json
Size 141B
SHA256 fe8c5046a79693a9b7f32bfc3ed7c8fdf84c5d186f5326a527ac508345a44009
MD5 3a5a48cc06d7f5cf2ec6e467e34915dd
SHA1 b6c3679e8961f0af7b5a56704992d5561ebaf6c1
SHA512 ae2de2b1827831eaeae6c9d00d081aa7be570fb050368eabc6b549469b14d7409b55e3726d4ac8ceb6cf75e48b3a88604345cb56a53f0686dd84cf8cb262125a
TLSH
T130C04C5585005D71509D87781D6C97054B12CF5618946509DDC68309EC1DCCB64B234F
MD5 SHA1 SHA512 TLSH

Submit Download

2034272b-1a66-49bb-b7db-e48c7514ecc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2034272b-1a66-49bb-b7db-e48c7514ecc6.tmp
Size 2KB
SHA256 92ca19c30144330d848b07b3979e62ee6d768e438ba29598a9d0a449791c7749
MD5 fbd990c6d0ad83fcfe0fa8dcd56998ff
SHA1 607eb5aba93290f91149d39bdca58c3fe6a85a32
SHA512 18fb20220c7b74a3d3213f7fe93bafeb56916618e12618bd44504edf7159a83245ac0422dd745d4da43e29f9e38880d495eac6f8871f359a06c6a16597903bd0
TLSH
T11C5121D04C3D5AD1D1FC0E7EB49B35EC91E89622B590383A3864D998497EA2D308483F
MD5 SHA1 SHA512 TLSH

Submit Download

371b211a-7ad1-4b7b-9542-ac99f107faa5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\371b211a-7ad1-4b7b-9542-ac99f107faa5.tmp
Size 2KB
SHA256 772dcf43b8091e2f5976a221e26447379b7b173bd07d54a6d5b2b7fa06041919
MD5 3aad83ca557983b2b4d674060da7b3c3
SHA1 03c4cded2d5a4710ecfe33bf83562192aa7001fa
SHA512 393af2b40b8a02c32c8f55306d6fa8921fe727a5519420b1b9f45c95ddf4a355fbd6801a005a43c7436a90a2ba1c99af23c689925e41f219a672d1b435c05812
TLSH
T1BF5121D04C3D5AD1D5BD0E7EB09B39EC91E8D661B490343A7858D99C497E61D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

7d3bcf00-f9fe-40b4-991e-2e638f2ee009.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7d3bcf00-f9fe-40b4-991e-2e638f2ee009.tmp
Size 2KB
SHA256 5952982a8efe7dbe2e79a7bab9936874087d18400fa29d9c58ae4e008b68aabb
MD5 418b05271a24648e2ef3afa036685651
SHA1 e3ff351b9a8284d38d3d9eaaa67867cfccb63b21
SHA512 6921da1130855150d54a5f10f2ce38474dbd469bcc5a38a187302bf113e4be5cc47fd272f971b6e2e9863fb1e1aa91390c693fcbe1e046846d1d9e7409bd1688
TLSH
T10C51FEE0583C5AD1D4BD0E7EE49B39EC90EC8621B494387E7858ED985A7A61D7084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

e762ee39-aa2d-4c8f-83e1-7685e3442fc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e762ee39-aa2d-4c8f-83e1-7685e3442fc4.tmp
Size 2KB
SHA256 300a365f8a3216feb41574f17cbe53ed6cc6fec36e536687a20a0eb48e0916a7
MD5 31c3419806b41a8160fd0af8990c0f57
SHA1 6783095dc5fbf6e2551aa45da97b111978552387
SHA512 93eb7b7cfd7afb7e2f8258378bb390bcf96601c6c2c6efe38a3d70a185f628ea3c7f0a1a9afc42a2eaf44677e429870888a7054b8c8b196df834d8f93ad6e64e
TLSH
T167511ED04C3C5AD1D5BD0E7EB49B39EC90E8D661B490383A7858E9984A7E61D7184C3F
MD5 SHA1 SHA512 TLSH

Submit Download

dedadc6e-90b7-4b32-9d88-13e109182754.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dedadc6e-90b7-4b32-9d88-13e109182754.tmp
Size 32KB
SHA256 c488784552046cf8fe60dfd605d85a335169931cde96622e691677b0c7ac795a
MD5 6e279a90d1b63052736633a5df9dc5b2
SHA1 7a6164b3c02343cf4827e5b3ae6f6c8beca2bf0e
SHA512 5cfe3a515a999a50613f5e3325e57014778999e7b0ffaa017aa87b9dd2daaace9bfa72f46871ba7971414520fd9c6d5e05bbb3a8707981986b2e448ec07435b8
SSDEEP 384:nhjiFzQkUSvoX3sNN8TUNTUlI4INaKMxbf0w2fLBCNfunKU9mgvaTZc2HUgL/7Iu:hOFdK3owg/MrkBCRPU9mgvaTZc2H6LA
TLSH
T192E2A1F298E79977D9EE4B93A73D2D429ABCC113B4885994B7C80D1CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e893fc5-46c1-4bb4-a344-fb3c4debe2b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3e893fc5-46c1-4bb4-a344-fb3c4debe2b4.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

fa62bfa4-2378-4085-aeb7-57e76fd178fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fa62bfa4-2378-4085-aeb7-57e76fd178fd.tmp
Size 25KB
SHA256 421818bcc98e3ecc555976a703903e1731b090213bcb7a5fcae5a1a60970a197
MD5 3af8765b55fe56c5ca200765b01df91b
SHA1 577698ce8b6bf991fecc42c6d58bbd37949581f4
SHA512 eea20f932cdf9d3aca305a3c2bca0eb2c181a7fd3d3e42c5b356af8b75ddc0a660471d9d295c2820527fb0a7ef9c04317e5eeb1c7cd4597aa72467517246d0ca
SSDEEP 384:npiFiZcI63sNU8TUNTUlIm2aKMiP4w2fLBCN7Fp7O6R2FeoEgL/7Izzo9:AFQ63pwgcCoBCBFp7TRNS
TLSH
T1FEC24B36ECA8DABBEDFA8FD5AB4A7A03DEE00163948C45D4D9D81D1D00976DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff10b97d-a2c0-4343-bca0-cc4634898372.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff10b97d-a2c0-4343-bca0-cc4634898372.tmp
Size 26KB
SHA256 e62157579a8bf9731cf20efd10dff321cd9de7d66e714d3a4469ff001b41339a
MD5 2fd3601d5e3f0bfac7cc29f1d12c9639
SHA1 15f2566e8b07faead1581c44f39bc43cdcf9637b
SHA512 21bd5f585f8df70cabfcdb4b1974c266b4e604aad515dd7497747062e07b828e98e993b771264d1e51ba972972844f5f8121266f55a0542de510fd479d997f4d
SSDEEP 384:nAiFiZcI63sNJ8TUNTUlIm2aKMXZBw2fLBCNfunKU2ig7O6R2FeoEgL/7Izzo9:bFQ634wgcr/BCRPU2ig7TRNS
TLSH
T120C24B72EC98DA6BFDEA8BD5AB4A3A03DEE44123858C99D0D9DC1D1D00D75ED430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6d6f8ab3a8a3ebe0b7e0eafa858133259081081c10997b548fb11b855e81fd25
MD5 819e7c20085b8fe888e5e46232f7ceee
SHA1 70e65d0ee38fc59788b4c232ec8db91bdd90ab72
SHA512 784e2dc4e45729110dd8330889ec91eb8d2807e71c606c52d1b1b5c03cd0e6f81370bc6e09b26f1acea0f21d9302832265f78269bfe92c004f483e6a1d0c68ff
TLSH
T16E410559AAF91148B3B77F5A9FF6A86D487ABC772E06D05E00110E4F0667A40CC72B37
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jdta1kn0.rtu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jdta1kn0.rtu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f2e011a7-4b71-4d50-a811-ccdd87e1811f.tmp

Path C:\Users\Admin\AppData\Local\Temp\f2e011a7-4b71-4d50-a811-ccdd87e1811f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2416_1347692518\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

ipset-exclude-user.txt

Path C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt
Size 18B
SHA256 19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
MD5 42ad35639873f78e1b2dc5c1039499df
SHA1 0fe009c7e4f670e759fda4668a8b37904215c9fa
SHA512 1676acc285990e44eb382705e0711fcab7fac79348c541c67bee58a49f3223d8fc61dcb895a7d2dc25ff38dec249268aa64e50c952a214f264b5430f9726a907
MD5 SHA1 SHA512

Submit Download

list-exclude-user.txt

Path C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude-user.txt
Size 20B
SHA256 9d9832f02f42e60be30f94a7a1b051342db0b1b0092c656a7bc10e730d63b234
MD5 1c4db6196bc14ecfdb5ff6f76ad4985d
SHA1 e980cb9c55abe3e5213ffc680d79f75b0b904a50
SHA512 28c56b0a3f42337b04bd7729940c83ec84d8f508f2fcf88567ebc708b09dec312d08074816ea76c48d087975743a6d682597ea7fd276a423fdbc2752bab0e24b
MD5 SHA1 SHA512

Submit Download

list-general-user.txt

Path C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-general-user.txt
Size 51B
SHA256 6c622ab155cf403ab8857f3805be8df7acba8b3d7a700ea19e52699260a5bc7f
MD5 dd8816323e370d2de83d1cf2b838dbf3
SHA1 9a124b838e69880f166f964122614ea8b43ac8ee
SHA512 32ebb345769e88632a06aec89fb6bfd9b833e7f6c496d0b6d1d28954481210ce0372a92eb2a2ac4f55cfdb2f3e73004f47b27d99ffe39929ca2826047d20db54
TLSH
T1B190024647810605505285892545141757B2A8684A505810105D7B15395892956B9AD4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1796-4-0x0000028AFFD90000-0x0000028AFFDB2000-memory.dmp

Download

memory/2144-333-0x0000023FEC200000-0x0000023FED200000-memory.dmp

Download

memory/3568-17-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/3568-19-0x00007FFC9F460000-0x00007FFC9F762000-memory.dmp

Download

memory/3568-16-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3568-12-0x00007FFC9F460000-0x00007FFC9F762000-memory.dmp

Download