dced936739574375ff5fc0b6b21910759d6fff456d11095f289ec0aa645bd752

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
files\ZapretTray.exe
Size 276KB
Sample261107-1pgwsavyc1
SHA256 dced936739574375ff5fc0b6b21910759d6fff456d11095f289ec0aa645bd752
MD5 651cb640c0e86ce90cd7757e55e46be3
SHA1 beaac06d7d6ed6b21db8822db71fc896eef13f42
SHA512 8f5cbfbe49bd007f3c232f3096c8f031b629929f973b82e127b2064c186994f43c3b70cfef103324f06e9615e37d21f2422c5f00481e00265f9fd7030beca6d0
SSDEEP 6144:3Rlv1fAD3+6gtzkBDtc7GPgZstWgtrD5wge:3Jf8gm+VurD+
TLSH
T1C4544B0FB7B98F65FAAE8738807105C18672B307E75EEB485CCB68FC1459371A61126B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	discord.com
22	discord.com
54	discord.com
80	discord.com

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4808	sc.exe
2976	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
688	cmd.exe
4348	cmd.exe
4816	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ZapretTray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ZapretTray.exe

System Service Discovery 1 TTPs
Adversaries may try to gather information about registered local system services.
discovery

System Service Discovery
T1007

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1648	netsh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	ZapretTray.exe
Token: SeRestorePrivilege	1408	winws.exe
Token: SeBackupPrivilege	1408	winws.exe
Token: SeDebugPrivilege	1408	winws.exe
Token: SeRestorePrivilege	5636	winws.exe
Token: SeBackupPrivilege	5636	winws.exe
Token: SeDebugPrivilege	5636	winws.exe
Token: SeRestorePrivilege	5720	winws.exe
Token: SeBackupPrivilege	5720	winws.exe
Token: SeDebugPrivilege	5720	winws.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe
4752	ZapretTray.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4808	4752	ZapretTray.exe	84
PID 4752 wrote to memory of 2976	4752	ZapretTray.exe	86
PID 4752 wrote to memory of 688	4752	ZapretTray.exe	88
PID 688 wrote to memory of 4468	688	cmd.exe	90
PID 688 wrote to memory of 5144	688	cmd.exe	91
PID 688 wrote to memory of 1160	688	cmd.exe	92
PID 688 wrote to memory of 1920	688	cmd.exe	93
PID 688 wrote to memory of 5960	688	cmd.exe	94
PID 688 wrote to memory of 1648	688	cmd.exe	177
PID 688 wrote to memory of 2036	688	cmd.exe	97
PID 688 wrote to memory of 1408	688	cmd.exe	98
PID 4752 wrote to memory of 4348	4752	ZapretTray.exe	109
PID 4348 wrote to memory of 6132	4348	cmd.exe	111
PID 4348 wrote to memory of 2896	4348	cmd.exe	112
PID 4348 wrote to memory of 3860	4348	cmd.exe	113
PID 4348 wrote to memory of 5172	4348	cmd.exe	114
PID 4348 wrote to memory of 5512	4348	cmd.exe	115
PID 4348 wrote to memory of 2380	4348	cmd.exe	116
PID 4348 wrote to memory of 5636	4348	cmd.exe	117
PID 4752 wrote to memory of 2800	4752	ZapretTray.exe	118
PID 4752 wrote to memory of 1380	4752	ZapretTray.exe	119
PID 4752 wrote to memory of 2808	4752	ZapretTray.exe	120
PID 4752 wrote to memory of 2176	4752	ZapretTray.exe	121
PID 4752 wrote to memory of 2680	4752	ZapretTray.exe	124
PID 4752 wrote to memory of 3264	4752	ZapretTray.exe	125
PID 4752 wrote to memory of 3220	4752	ZapretTray.exe	126
PID 4752 wrote to memory of 560	4752	ZapretTray.exe	128
PID 4752 wrote to memory of 3484	4752	ZapretTray.exe	131
PID 4752 wrote to memory of 1272	4752	ZapretTray.exe	133
PID 4752 wrote to memory of 5272	4752	ZapretTray.exe	146
PID 4752 wrote to memory of 4844	4752	ZapretTray.exe	147
PID 4752 wrote to memory of 552	4752	ZapretTray.exe	148
PID 4752 wrote to memory of 5364	4752	ZapretTray.exe	150
PID 4752 wrote to memory of 1640	4752	ZapretTray.exe	152
PID 4752 wrote to memory of 1660	4752	ZapretTray.exe	154
PID 4752 wrote to memory of 6004	4752	ZapretTray.exe	155
PID 4752 wrote to memory of 5252	4752	ZapretTray.exe	159
PID 4752 wrote to memory of 5260	4752	ZapretTray.exe	160
PID 4752 wrote to memory of 5288	4752	ZapretTray.exe	161
PID 4752 wrote to memory of 4816	4752	ZapretTray.exe	168
PID 4816 wrote to memory of 5836	4816	cmd.exe	170
PID 4816 wrote to memory of 2840	4816	cmd.exe	171
PID 4816 wrote to memory of 4984	4816	cmd.exe	172
PID 4816 wrote to memory of 5864	4816	cmd.exe	173
PID 4816 wrote to memory of 3200	4816	cmd.exe	174
PID 4816 wrote to memory of 3732	4816	cmd.exe	175
PID 4816 wrote to memory of 5720	4816	cmd.exe	176
PID 4752 wrote to memory of 1844	4752	ZapretTray.exe	182
PID 4752 wrote to memory of 3920	4752	ZapretTray.exe	184
PID 4752 wrote to memory of 636	4752	ZapretTray.exe	247

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\files\ZapretTray.exe
"C:\Users\Admin\AppData\Local\Temp\files\ZapretTray.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query "zapret"
  2⤵
  - Launches sc.exe
  PID:4808
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query "zapret"
  2⤵
  - Launches sc.exe
  PID:2976
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT).bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4468
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5144
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1160
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:1920
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:5960
- - C:\Windows\system32\netsh.exe
    netsh interface tcp set global timestamps=enabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:1648
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_sferum_ru.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\stun.bin" --dpi-desync-fake-unknown="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n3
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1408
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT2).bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:6132
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2896
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3860
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:5172
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:5512
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5636
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:2800
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:1380
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:2808
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:2176
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:2680
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:3264
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:3220
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:560
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:3484
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:1272
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:5272
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://gateway.discord.gg"
  2⤵
  PID:4844
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://cdn.discordapp.com"
  2⤵
  PID:552
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://updates.discord.com"
  2⤵
  PID:5364
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:1640
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://i.ytimg.com"
  2⤵
  PID:1660
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.google.com"
  2⤵
  PID:6004
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://redirector.googlevideo.com"
  2⤵
  PID:5252
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://arcraiders.com"
  2⤵
  PID:5260
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://id.embark.games"
  2⤵
  PID:5288
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\files\core\general (ALT2).bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5836
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2840
- - C:\Windows\system32\netsh.exe
    netsh interface tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4984
- - C:\Windows\system32\findstr.exe
    findstr /i "timestamps"
    3⤵
    PID:5864
- - C:\Windows\system32\findstr.exe
    findstr /i "enabled"
    3⤵
    PID:3200
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe
    "C:\Users\Admin\AppData\Local\Temp\files\core\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-fake-discord="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-fake-stun="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_DISCORD_UDP.bin" --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-google.txt" --ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general.txt" --hostlist="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-general-user.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\Admin\AppData\Local\Temp\files\core\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude.txt" --hostlist-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=multisplit --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n3 --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern="C:\Users\Admin\AppData\Local\Temp\files\core\bin\tls_clienthello_www_google_com.bin" --new --filter-udp=12 --ipset="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-all.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\Admin\AppData\Local\Temp\files\core\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\Admin\AppData\Local\Temp\files\core\bin\ACTIVE_GAME_UDP.bin" --dpi-desync-cutoff=n2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5720
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://www.youtube.com"
  2⤵
  PID:1844
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL -m 8 --connect-timeout 3 -w "%{http_code} %{time_connect} %{time_appconnect} %{size_download} %{remote_ip}" "https://discord.com"
  2⤵
  PID:3920
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /tn "ZapretTray Autostart" /xml
  2⤵
  PID:636

C:\Users\Admin\AppData\Local\Temp\files\core\bin\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\files\core\bin\WinDivert64.sys
1⤵
PID:5856

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

System Service Discovery

T1007

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

best_config.txt

Path C:\Users\Admin\AppData\Local\Temp\files\core\utils\best_config.txt
Size 20B
SHA256 5ce3a69be18944c1bc3f6f874b9838607c7708dfee84332d18fa2acce227ffad
MD5 1a8b5d0e4b860e6199d37dec17b2d7ab
SHA1 c6a1032bc8f59d11d809ceb35877feaed4d19a55
SHA512 aace85e1bdeea14d6f31c7ddfebde65581923562f044e45e4fc80aea3bc6d765bcfbb246f37b604724f14042fa9db9f78b9e431719de92d3d004340737cb0549
MD5 SHA1 SHA512

Submit Download

graphs.txt

Path C:\Users\Admin\AppData\Local\Temp\files\core\utils\graphs.txt
Size 2KB
SHA256 f1eaf0511322f90719c649bb6c128de7388586835c233a973d88847c28c59b17
MD5 047a3d22881b1fe322be9cdfbc82c414
SHA1 546d57fda2bb7527bbba0cd3a4f295af794732d0
SHA512 4e6dd3517fb800713282a8ec2aec7b4a5b608ead4bb0d588d885b1b1f572fb514dd514f40f17ac71c668129783763f2acb3ce8d8101ea5fe958f110b9d425feb
TLSH
T1CB51367C1B4E849248FD75F842E47940DE370A6FCDC98A0E3A6E58A91DD3A5D93C2DC8
MD5 SHA1 SHA512 TLSH

Submit Download

graphs.txt.tmp

Path C:\Users\Admin\AppData\Local\Temp\files\core\utils\graphs.txt.tmp
Size 3KB
SHA256 54c8c761bf5ae1e2ee284fc38d1503533b1178beeec4f67e9398ce5727b64f8d
MD5 221a69fb9098e457068b55ec50d4b529
SHA1 1d33d9b334c87c481f5ad5fed7662ef25f371243
SHA512 d669f3eb03dd0990bb7bb53f664270b32cacf7f725eb4a253b1faca02d51926c83008138f5f6a4ec95658a70d4210de0d54a934c4e4db3d3c3fcb8d45b242b84
TLSH
T127614A7C0F0E489248F975F442E07964DE37466F9CC5890D3A6E58A86EC7A2E93C3DC9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1408-10-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/1408-9-0x00007FFAD22D0000-0x00007FFAD25D2000-memory.dmp

Download

memory/1408-11-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/1408-13-0x00007FFAD22D0000-0x00007FFAD25D2000-memory.dmp

Download

memory/4752-15-0x000000001C9E0000-0x000000001C9F0000-memory.dmp

Download

memory/4752-0-0x0000000000C00000-0x0000000000C4A000-memory.dmp

Download

memory/4752-14-0x000000001C9E0000-0x000000001C9F0000-memory.dmp

Download

memory/4752-21-0x000000001C9E0000-0x000000001C9F0000-memory.dmp

Download

memory/4752-4-0x000000001C9E0000-0x000000001C9F0000-memory.dmp

Download

memory/4752-3-0x000000001C9E0000-0x000000001C9F0000-memory.dmp

Download

memory/4752-1-0x000000001C9E0000-0x000000001C9F0000-memory.dmp

Download

memory/5636-16-0x00007FFAD2070000-0x00007FFAD2372000-memory.dmp

Download

memory/5636-18-0x00007FFAD2070000-0x00007FFAD2372000-memory.dmp

Download

memory/5636-17-0x0000000100400000-0x000000010043C000-memory.dmp

Download

memory/5720-28-0x00007FFAD2070000-0x00007FFAD2372000-memory.dmp

Download

memory/5720-27-0x0000000100400000-0x000000010043C000-memory.dmp

Download