6b41d2813aefd7e9328ed42dad7de18ab8bb1bb72c3ed3a9221a9de34e2eb6db

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zapret-discord-youtube-1.10.3/general (ALT10).bat
Size 3KB
Sample261027-payefatwhx
SHA256 6b41d2813aefd7e9328ed42dad7de18ab8bb1bb72c3ed3a9221a9de34e2eb6db
MD5 c8b5ab05d87ba654d4b60905d826ac42
SHA1 ab426209e125921ff9dae3d4e534f4b9eeaacb6b
SHA512 3dedc3bc7046dd710979ae6cdd44a762290d50aab34d3a8c585c97df0ae8dacf102a99137009db32f85faa29c4965f4ad47abd1869a12665a277d8f86c49bbbc
TLSH
T154712BA7E00CDE47F58C697DF85FA5B42127DC8328D6D456439B89E8CC0ECBE584E484
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	2760	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2760	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
11	raw.githubusercontent.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3272	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1348	cmd.exe
1856	cmd.exe
4672	cmd.exe
3888	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1304	netsh.exe
4964	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{F8CDB50A-09D5-4B22-AE9D-450E7CD93EF0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2760	powershell.exe
2760	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeRestorePrivilege	3344	winws.exe
Token: SeBackupPrivilege	3344	winws.exe
Token: SeDebugPrivilege	3344	winws.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 904	1856	cmd.exe	89
PID 1856 wrote to memory of 4672	1856	cmd.exe	90
PID 4672 wrote to memory of 3272	4672	cmd.exe	91
PID 4672 wrote to memory of 1712	4672	cmd.exe	92
PID 1856 wrote to memory of 4512	1856	cmd.exe	93
PID 1856 wrote to memory of 2748	1856	cmd.exe	94
PID 1856 wrote to memory of 2144	1856	cmd.exe	95
PID 1856 wrote to memory of 5116	1856	cmd.exe	96
PID 1856 wrote to memory of 1304	1856	cmd.exe	97
PID 1856 wrote to memory of 3888	1856	cmd.exe	98
PID 1856 wrote to memory of 4384	1856	cmd.exe	99
PID 3888 wrote to memory of 860	3888	cmd.exe	100
PID 3888 wrote to memory of 1348	3888	cmd.exe	101
PID 1348 wrote to memory of 2760	1348	cmd.exe	102
PID 1856 wrote to memory of 3344	1856	cmd.exe	103
PID 3888 wrote to memory of 3976	3888	cmd.exe	107
PID 3976 wrote to memory of 2136	3976	msedge.exe	109
PID 2136 wrote to memory of 4800	2136	msedge.exe	110
PID 2136 wrote to memory of 4964	2136	msedge.exe	111
PID 2136 wrote to memory of 1668	2136	msedge.exe	112
PID 2136 wrote to memory of 1668	2136	msedge.exe	112
PID 2136 wrote to memory of 1668	2136	msedge.exe	112
PID 2136 wrote to memory of 4812	2136	msedge.exe	113
PID 2136 wrote to memory of 4812	2136	msedge.exe	113
PID 2136 wrote to memory of 2052	2136	msedge.exe	114
PID 2136 wrote to memory of 3372	2136	msedge.exe	115
PID 2136 wrote to memory of 2052	2136	msedge.exe	114
PID 2136 wrote to memory of 2052	2136	msedge.exe	114
PID 2136 wrote to memory of 3372	2136	msedge.exe	115
PID 2136 wrote to memory of 3372	2136	msedge.exe	115
PID 2136 wrote to memory of 2160	2136	msedge.exe	117
PID 2136 wrote to memory of 2712	2136	msedge.exe	118
PID 2136 wrote to memory of 2160	2136	msedge.exe	117
PID 2136 wrote to memory of 2160	2136	msedge.exe	117
PID 2136 wrote to memory of 2712	2136	msedge.exe	118
PID 2136 wrote to memory of 2712	2136	msedge.exe	118
PID 2136 wrote to memory of 1776	2136	msedge.exe	120
PID 2136 wrote to memory of 1776	2136	msedge.exe	120
PID 2136 wrote to memory of 4156	2136	msedge.exe	121
PID 2136 wrote to memory of 4156	2136	msedge.exe	121
PID 2136 wrote to memory of 1904	2136	msedge.exe	123
PID 2136 wrote to memory of 3080	2136	msedge.exe	124
PID 2136 wrote to memory of 1904	2136	msedge.exe	123
PID 2136 wrote to memory of 3080	2136	msedge.exe	124
PID 2136 wrote to memory of 1956	2136	msedge.exe	128
PID 2136 wrote to memory of 4520	2136	msedge.exe	129
PID 2136 wrote to memory of 4520	2136	msedge.exe	129
PID 2136 wrote to memory of 3776	2136	msedge.exe	130
PID 2136 wrote to memory of 3776	2136	msedge.exe	130
PID 2136 wrote to memory of 5032	2136	msedge.exe	133
PID 2136 wrote to memory of 5032	2136	msedge.exe	133
PID 2136 wrote to memory of 3800	2136	msedge.exe	134
PID 2136 wrote to memory of 3800	2136	msedge.exe	134
PID 2136 wrote to memory of 4972	2136	msedge.exe	135
PID 2136 wrote to memory of 4972	2136	msedge.exe	135
PID 2136 wrote to memory of 212	2136	msedge.exe	143
PID 2136 wrote to memory of 3028	2136	msedge.exe	144
PID 2136 wrote to memory of 3904	2136	msedge.exe	145
PID 2136 wrote to memory of 2448	2136	msedge.exe	146
PID 2136 wrote to memory of 2448	2136	msedge.exe	146
PID 2136 wrote to memory of 4700	2136	msedge.exe	155
PID 2136 wrote to memory of 4700	2136	msedge.exe	155
PID 2136 wrote to memory of 4080	2136	msedge.exe	156
PID 2136 wrote to memory of 4080	2136	msedge.exe	156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\general (ALT10).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc query "zapret" | findstr /i "STATE"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\system32\sc.exe
    sc query "zapret"
    3⤵
    - Launches sc.exe
    PID:3272
- - C:\Windows\system32\findstr.exe
    findstr /i "STATE"
    3⤵
    PID:1712
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:4512
- C:\Windows\system32\netsh.exe
  netsh interface tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2748
- C:\Windows\system32\findstr.exe
  findstr /i "timestamps"
  2⤵
  PID:2144
- C:\Windows\system32\findstr.exe
  findstr /i "enabled"
  2⤵
  PID:5116
- C:\Windows\system32\netsh.exe
  netsh interface tcp set global timestamps=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K service check_updates soft
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "(Invoke-WebRequest -Uri \"https://raw.githubusercontent.com/Flowseal/zapret-discord-youtube/main/.service/version.txt\" -Headers @{\"Cache-Control\"=\"no-cache\"} -UseBasicParsing -TimeoutSec 5).Content.Trim()" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Invoke-WebRequest -Uri \"https://raw.githubusercontent.com/Flowseal/zapret-discord-youtube/main/.service/version.txt\" -Headers @{\"Cache-Control\"=\"no-cache\"} -UseBasicParsing -TimeoutSec 5).Content.Trim()"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Flowseal/zapret-discord-youtube/releases/latest
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://github.com/Flowseal/zapret-discord-youtube/releases/latest
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x16c,0x7ffe9aacc188,0x7ffe9aacc194,0x7ffe9aacc1a0
        5⤵
        
        PID:4800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,6547369869269557113,9153205974903569723,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,10376562225269426848,7054440117632776030,262144 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
        5⤵
        
        PID:1668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,5559433365604122037,8806176074868329379,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
        5⤵
        
        PID:4812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,2426656473576941878,10281020673059047309,2097152 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        5⤵
        
        PID:2052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14053694877251923618,11323018139828592538,2097152 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        5⤵
        
        PID:3372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,18069775880767825875,6444557395904607925,2097152 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
        5⤵
        
        PID:2160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,1490948563601657216,9149468931816032714,2097152 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:2
        5⤵
        
        PID:2712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,11170679337161282012,10614029508980870582,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
        5⤵
        
        PID:1776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,15621493923578463620,13915539495602953764,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
        5⤵
        
        PID:4156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,15083861781530580752,533416273493781152,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
        5⤵
        
        PID:1904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,901778346890997389,18094092050186546607,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
        5⤵
        
        PID:3080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,12440302798562245357,5027719709752655110,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
        5⤵
        
        PID:3384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,12440302798562245357,5027719709752655110,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
        5⤵
        
        PID:1956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,2234463568271957930,9107512195662367388,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
        5⤵
        
        PID:4520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,2351195579594945605,17860279679760087193,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
        5⤵
        
        PID:3776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,12522915364040059569,13729973443832154967,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
        5⤵
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,14217632020016158288,8173358031616481546,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
        5⤵
        
        PID:3800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,9546775163281725521,10933061055040935696,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
        5⤵
        
        PID:4972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,17353917443697701175,9438538408823583362,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
        5⤵
        
        PID:212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,14761602684240306743,2942355331423890323,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
        5⤵
        
        PID:3028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,2441497640917261501,6997326313853296796,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
        5⤵
        
        PID:3904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,10121771758747444186,4805645621095733209,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
        5⤵
        
        PID:2448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,12446983583265719325,17481784084341591685,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
        5⤵
        
        PID:4700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,5580289881694010082,12242363119719150172,524288 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
        5⤵
        
        PID:4080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6316,i,11572560427505749172,11934548533380600199,262144 --field-trial-handle=1984,i,1184317324917555923,401395366945763303,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
        5⤵
        
        PID:2948
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:4384
- C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\winws.exe
  "C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-tls-mod=none --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_max_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_4pda_to.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_max_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\tls_clienthello_4pda_to.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3344

C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\bin\WinDivert64.sys
1⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

17b9ea10-4588-4ae0-b675-58fce462f0f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\17b9ea10-4588-4ae0-b675-58fce462f0f7.tmp
Size 8KB
SHA256 1787af47cea33146f8aa7842d05a6810dbe25a42caca4d2b6e61bfb400cb1430
MD5 c860114a01915a5a193ff59d24f1b7b1
SHA1 9ecccb482f045432d20b6dd4b7916cf5910eff7c
SHA512 a72728e34710a667497b43cd2dbac96730fbc949c909b53b27dc203a4aeae18be0a320fb2ec377d4df9bb13be874cd67b8b756267a1656922e098df5840c51a6
SSDEEP 192:1ON46wlDgQmiUyS6W4X58gZDOKaFbAIDlmQUU6:1ON46kgAW4X58EDOJbAs0U6
TLSH
T16C02E835B9787C7B8EF2AE09F58B36139FA5102BE6512F80C6E81A2D00D775C2347926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b21a030-4153-4f08-b269-8c3bb0d6ac99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8b21a030-4153-4f08-b269-8c3bb0d6ac99.tmp
Size 18KB
SHA256 f9a7d8a4aae0c4f05a5d384c7b5d54b005b58a30d91090c3d778d8c8c0e14f70
MD5 bdac97126337aa29312726ffd6be697c
SHA1 d3eef962d1d8bbdcd0841dc9132d0151563edfc7
SHA512 45d103430641c35a98c7899d7f92cb93a1e7c6ec33d5eaeca1883be33964aa7a0698bfa8b213c0eb8d3e547268208404122d7717309d76085e52db1341df9140
SSDEEP 384:noQkUSv0sNLL6fU3ZACwHX58EDOJbAWWa8fvaTZcQHfIIlv:g0amU3pOa4OdUfvaTZcQHfLh
TLSH
T113828D32A879AD374EF6A151F24A3603DFB89167D6846F90C5CCAB2C01DE29C334BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

16e7a63f-84aa-4f35-99fb-24a708c24be6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16e7a63f-84aa-4f35-99fb-24a708c24be6.tmp
Size 32KB
SHA256 3b9be1d302341340fcca0c1367cd5956528323f79cb5075291a5b9d2b4963c98
MD5 7ba8ba03e4c34182ed8a880b3509dc02
SHA1 3f4199bcff2e7cc92af7bd3c6b876b965a2040d7
SHA512 199b85bd136e0552f3a6d52c0024f4236c502d802795e590b04c7631ac77afae92f411730debd7559c352572545a9177d6ab530f7d559cd904da8c2beec8142d
SSDEEP 768:TeUGy4JLE7pLuLj/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoqjiLlc2TbUC:TeUGy4JLIEj/DWvbtBhu1jaxqjiLm0bN
TLSH
T121E2E93B780CCA7E4FC00A9DED1E7F9B6EA8028B96D8C95047F9945C02D77EA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21e96e85-1da9-4e4e-bc8a-9207e19779a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21e96e85-1da9-4e4e-bc8a-9207e19779a8.tmp
Size 11KB
SHA256 827aa30f23277aff2f48107f64af607e18467ab1152b9769c752390e26a1b7e4
MD5 0036e756c9cf3ab247aa49793cbc5614
SHA1 eb9f1c526ab7b7ad17640fd411bd3948c7409232
SHA512 8ddb63675413e3571df8bdf58bc6dc005a954b44a898ca69c52fb848e3017361f16721f1e31da66340068bb24dd50066cc0923472e7f51bb364b5390da0801aa
SSDEEP 192:sxZrR0sD/fnsbQYMEEIdp9mKHW6+WNYWg/Yrl/l3eOIg50J:sxZrvD/fnsb4EdLHbe/WpV6
TLSH
T19432D852AD38E97B8CCBE319BA197B13E3F9503291C51E44AAFC861C05E76DD224781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 dbcb2700ecd6a9869faee2606087796791116b731acab0c8b6a5d162ce6e6e19
MD5 ab1e6e9a7d2598bff3ba1ed731c34f81
SHA1 20e120038ac5d2c15a251daf081115f2e63c8102
SHA512 625477e00860529994e44e4eb5300e56a3b2cdcd27c43e4ef5f7f1e356b41417334e0504a168a8301baa5b20acc7c68814b4d7634d3ca6612a7fe67adaddead0
SSDEEP 96:AhSCa5dE+i+ow1/uD6VEmz3w8/b/eUN3aD/KcqKeHvK7G8O7A3aV38I0OM2vTn8d:igv/aujrSP7Mt9/r+fgiEo5T/
TLSH
T1A1B1627A45BA48D0FF4400B99FC589973AF8A7781093BF0A367CF876A4027757C40887
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 eef36cea21815289154f60a0e58f514fc95ece9126bc282c4eb4e87a6c70db7f
MD5 8e0e77948a51dcb0a4d695d3ef56b593
SHA1 dae25189e52920854e67853f00be043cfc82c163
SHA512 9f4b1a8b6f510cdea9718d5371f3e4d69ca28bf86303dd9fb8cb95c8e88ea767bcb02d657fc10b3330fa6f381eecbf5d8c13249eff4c11792ac5842b3c135227
TLSH
T1D4514FBA454A48D0FF5850F0DEE985873DB8A97D55C3DE0A37B4DCB6A9427797804C80
MD5 SHA1 SHA512 TLSH

Submit Download

dc382145-dfb3-4849-9f3b-079dc4fcd914.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\dc382145-dfb3-4849-9f3b-079dc4fcd914.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

00c6ab78-7fb2-4432-909f-d86626aa702b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\00c6ab78-7fb2-4432-909f-d86626aa702b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

79ff00fe-cab5-4f81-b5d4-6560d29443b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\79ff00fe-cab5-4f81-b5d4-6560d29443b1.tmp
Size 2KB
SHA256 44a55c90a0e1f8359e9ba186f6d20a4f28c72d9d055c68627a1202132df2623d
MD5 3861c89fee7bc53d0995b51a08b92aa7
SHA1 61b3b07a6543f6e189c34808bda3c97573a4a0a1
SHA512 681192be9847594b13a4a9e7e0f55a132e6654740a9f2aecf7607dd81c760f3c7a88504157ba13f04880a04f9cda2d91b8d1a31e5422508d6354a035db3da54e
TLSH
T17E518DF787F5856D8A0255F0AA18AE2BCF2D0514831C3D6AC4E4AE57E3E3871E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

aab8904a-7d9c-4d47-aff6-dc1aee82c7d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aab8904a-7d9c-4d47-aff6-dc1aee82c7d5.tmp
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

a5acd806-1bfe-49ab-8abc-5171a544cd32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a5acd806-1bfe-49ab-8abc-5171a544cd32.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b748a3f8-a42f-4b5d-97db-792ce8e08931.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b748a3f8-a42f-4b5d-97db-792ce8e08931.tmp
Size 10KB
SHA256 0ae83fe11a44bd2ebe214b08193bf27b5b1bdd054f7f5cd07cb9b41bdd489736
MD5 d2f481bbcad4ff22c936f5984f117bb9
SHA1 cab0c22b0b1383500d88492978d69f74ad3c60c1
SHA512 04d91017cec7d7b6135ede93cf5613b5c6c13dc88e86da446f27aa96c66f0b0fcfb6ade159798f2a1336eeaab044821f481cb5559507fe3c90e14d17c6f5004b
SSDEEP 192:sxZrR0sD/fnswQYMEEIdp9mKHW6+WNYWg/Yr7v3eOIg4J:sxZrvD/fnsw4EdLHbe/OVc
TLSH
T16C32E9526E38E97B8CCBE319BA197B13D7F9503291D51D44AAFC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bda8ddd0-541d-46ec-b7dd-6ec250d09190.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bda8ddd0-541d-46ec-b7dd-6ec250d09190.tmp
Size 10KB
SHA256 cb33743f290b3315cc97517a803e14bb33ba3c4d13b0095892671c7f129b922e
MD5 771dcdf314b3ed10e3fa4bd40566d850
SHA1 d9bf8fb692caa2adc4af0a483426b9f082a95017
SHA512 57e78d581765088792dd4f0fc3c26843efa563707f583f9d67a12ceb01aca130cb4aaee93aa13d930a86bdd66a8505e55cbd12014af90ecb78ce635d51de3bfa
SSDEEP 192:sxZrR0sD/fns0QYMEEIdp9mKHW6+WNYWg/Yr7v3eOIg5CJ:sxZrvD/fns04EdLHbe/OVc
TLSH
T15532E952AE38E87B8CCBD319BA197B13D3F9503291D51D48AAFC961C04E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06f5ffe9-86ba-4bf5-b564-8486db3db7ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\06f5ffe9-86ba-4bf5-b564-8486db3db7ad.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd90098c-70f9-4dc6-b72a-f3cfdd74703d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\dd90098c-70f9-4dc6-b72a-f3cfdd74703d.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e62b2884-6f15-4184-95f7-f32d346ea742.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e62b2884-6f15-4184-95f7-f32d346ea742.tmp
Size 18KB
SHA256 e76dc550ef5f4ddd1374762d7c4a8cac7b8374fcc245bb2a92f3fcdc82eeca46
MD5 58fb2c9505d4dc5e30273c18df32a1df
SHA1 eb70642fdfe229a2d59e99a107fcd31183b3cb9f
SHA512 19fce59244fba0a64ceb67baa18a13c670a98dfd133f8667127b67421f4776900c7dcc10afcdffc48124433f21cfad71df4ed53ed4bf93a03a4fdbbc72831461
SSDEEP 384:ngQkUSv0sNLLDfU3ZACwHX58EDOJbAWWa8fvaTZcQHfIIlv:I0aHU3pOa4OdUfvaTZcQHfLh
TLSH
T15C827C71A879AD374EF6A151F24A3503DFB89167D6886F90C5CCAB2C00DE29C334BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca3ada57-05c3-49e7-9240-4654c737bad4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ca3ada57-05c3-49e7-9240-4654c737bad4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f757025e-7508-4b47-abef-46900f5b220e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f757025e-7508-4b47-abef-46900f5b220e.tmp
Size 8KB
SHA256 eb9d18cbb1e13b902f30b7fd0fac53681b7855b0840defcf5d484819ab51d740
MD5 6ce57ca1bdd58ee7b706f1d3746a4ca6
SHA1 593c6be0cfea9e4e146ba1e6f2f4df1b0685d5d3
SHA512 d391d0e6e35703eb54aa30df1e981004ca80e28c0880a682613c544335eb65e4dda0534bab282338bfd6ccb008950cf95407ad95f5a923a5f70f738d5dc526b9
SSDEEP 192:OON/a6wlD3QmiUyX6w4X58gZDOKaFbAWWaxvepqqU6:OON/a6kZbw4X58EDOJbAWWaAfU6
TLSH
T167121831B478EC371EE2A595F4873503DFA99167EA497F90C2DC2A1C01EE6AC234ED16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa3d08af-fa72-4d8c-877a-cff5e8211aa0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fa3d08af-fa72-4d8c-877a-cff5e8211aa0.tmp
Size 28KB
SHA256 bcb8d3cc833a82038eef439476a5668a4152b59963dba13f9a6f20daeb56b570
MD5 abdfaaf49ae4999de33ba4ac935b83e7
SHA1 36c76f837ea9ec46b946eda0f00f96721567dfd9
SHA512 09f900e125982289504854d4817322a45b5d5a26273e0611a355c1aac46364f1b919f52c6c2dd3539bf2c25cc12af8381b36bf170a543624d7f1a18265eadbeb
SSDEEP 384:nRiFzQkUSvuzsNLV8TUNTUlIlDfU3ZA3wXDf4VX58EDOJbAWWadfvaTZcQHfIIlv:4FduaVwgdU34L1a4Od1fvaTZcQHfLh
TLSH
T1DBD293F198E79937D9AE8783A73E3D429EBCC153B5885980B7885D5CCC861BFD30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 938b0280ec385fbd8c967d15ebeb2120ef3c27b03494f45f1fe5872c9949a16b
MD5 6b648b6208a41146fc5dc7ea14deafaa
SHA1 8ca9c7423007dc9c7b52664e2ee3bdf7b87cf0d8
SHA512 0c66127bbf5ccbe2ee1397a87797011f5681a1e037a56bb5dda58b8f76ee7abdafaa511066ac9084f9a9611b8bf01f06f20d05bd7e00f52ce5adab3ae232268d
TLSH
T16841EB68AAF91148B3B76F5AAFF6A86D447EBD772F06D45D00020D4E0627A44C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

43db5bd8-73ca-4c2e-a30b-4b8837475a2c.tmp

Path C:\Users\Admin\AppData\Local\Temp\43db5bd8-73ca-4c2e-a30b-4b8837475a2c.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67448512-5ff4-4f17-81a0-c8a127334968.tmp

Path C:\Users\Admin\AppData\Local\Temp\67448512-5ff4-4f17-81a0-c8a127334968.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_sicrjwro.0aj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sicrjwro.0aj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2136_1219066789\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0ac37cf-11f7-4cea-b632-a38c998726d8.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2136_1219066789\d0ac37cf-11f7-4cea-b632-a38c998726d8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2136_954857683\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

ipset-exclude-user.txt

Path C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\ipset-exclude-user.txt
Size 18B
SHA256 19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
MD5 42ad35639873f78e1b2dc5c1039499df
SHA1 0fe009c7e4f670e759fda4668a8b37904215c9fa
SHA512 1676acc285990e44eb382705e0711fcab7fac79348c541c67bee58a49f3223d8fc61dcb895a7d2dc25ff38dec249268aa64e50c952a214f264b5430f9726a907
MD5 SHA1 SHA512

Submit Download

list-exclude-user.txt

Path C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-exclude-user.txt
Size 20B
SHA256 9d9832f02f42e60be30f94a7a1b051342db0b1b0092c656a7bc10e730d63b234
MD5 1c4db6196bc14ecfdb5ff6f76ad4985d
SHA1 e980cb9c55abe3e5213ffc680d79f75b0b904a50
SHA512 28c56b0a3f42337b04bd7729940c83ec84d8f508f2fcf88567ebc708b09dec312d08074816ea76c48d087975743a6d682597ea7fd276a423fdbc2752bab0e24b
MD5 SHA1 SHA512

Submit Download

list-general-user.txt

Path C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-1.10.3\lists\list-general-user.txt
Size 51B
SHA256 6c622ab155cf403ab8857f3805be8df7acba8b3d7a700ea19e52699260a5bc7f
MD5 dd8816323e370d2de83d1cf2b838dbf3
SHA1 9a124b838e69880f166f964122614ea8b43ac8ee
SHA512 32ebb345769e88632a06aec89fb6bfd9b833e7f6c496d0b6d1d28954481210ce0372a92eb2a2ac4f55cfdb2f3e73004f47b27d99ffe39929ca2826047d20db54
TLSH
T1B190024647810605505285892545141757B2A8684A505810105D7B15395892956B9AD4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2760-4-0x0000025E51400000-0x0000025E51422000-memory.dmp

Download

memory/3344-19-0x00007FFE90E40000-0x00007FFE91142000-memory.dmp

Download

memory/3344-12-0x00007FFE90E40000-0x00007FFE91142000-memory.dmp

Download

memory/3344-16-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/3344-18-0x0000000062800000-0x0000000062813000-memory.dmp

Download