c29ee051e883003fd0dfb869bfae3d9015775542c4f51487d5d9789d6ba0306e

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gui-zapret.exe
Size 10.5MB
Sample261110-yps8psaf74
SHA256 c29ee051e883003fd0dfb869bfae3d9015775542c4f51487d5d9789d6ba0306e
MD5 3c4d830c1febc82f6f1824c970c11116
SHA1 d1ce70897e8fa2e870b939c3b661800c90f1d97d
SHA512 98ac8904614d32d9fe91bcd3db642373347edffb3a48b82707b97501cda1b6a0cb092a726c6e45e02387207688cb134d39da7643509e8cc02f357e6e5a55c14d
SSDEEP 98304:3tYkvBSx1Mo2RK2jYKu9ar1IodnIsrInHE:3W1x1h2RK2UWryfk
TLSH
T12DB62A07AFA5DBE4C0AA9138B9A395127AE178441B3123C72B50B724EF727F07E75790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gui-zapret.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1259482131\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1259482131\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1032583792\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1032583792\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1032583792\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1126946784\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1126946784\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1156807351\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1032583792\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1126946784\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1126946784\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1126946784\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1156807351\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1156807351\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5552	msedgewebview2.exe
5552	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5640	msedgewebview2.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 5640	5976	gui-zapret.exe	90
PID 5640 wrote to memory of 2192	5640	msedgewebview2.exe	91
PID 5640 wrote to memory of 3388	5640	msedgewebview2.exe	92
PID 5640 wrote to memory of 3388	5640	msedgewebview2.exe	92
PID 5640 wrote to memory of 3388	5640	msedgewebview2.exe	92
PID 5640 wrote to memory of 3388	5640	msedgewebview2.exe	92
PID 5640 wrote to memory of 2536	5640	msedgewebview2.exe	93
PID 5640 wrote to memory of 1056	5640	msedgewebview2.exe	94
PID 5640 wrote to memory of 1056	5640	msedgewebview2.exe	94
PID 5640 wrote to memory of 1056	5640	msedgewebview2.exe	94
PID 5640 wrote to memory of 4692	5640	msedgewebview2.exe	95
PID 5640 wrote to memory of 4692	5640	msedgewebview2.exe	95
PID 5640 wrote to memory of 4692	5640	msedgewebview2.exe	95
PID 5640 wrote to memory of 4692	5640	msedgewebview2.exe	95
PID 5640 wrote to memory of 4692	5640	msedgewebview2.exe	95
PID 5640 wrote to memory of 3516	5640	msedgewebview2.exe	98
PID 5640 wrote to memory of 3516	5640	msedgewebview2.exe	98
PID 5640 wrote to memory of 3516	5640	msedgewebview2.exe	98
PID 5640 wrote to memory of 5076	5640	msedgewebview2.exe	99
PID 5640 wrote to memory of 5076	5640	msedgewebview2.exe	99
PID 5640 wrote to memory of 5076	5640	msedgewebview2.exe	99
PID 5640 wrote to memory of 3724	5640	msedgewebview2.exe	100
PID 5640 wrote to memory of 3724	5640	msedgewebview2.exe	100
PID 5640 wrote to memory of 3724	5640	msedgewebview2.exe	100
PID 5640 wrote to memory of 5552	5640	msedgewebview2.exe	101
PID 5640 wrote to memory of 2052	5640	msedgewebview2.exe	102
PID 5640 wrote to memory of 2052	5640	msedgewebview2.exe	102
PID 5640 wrote to memory of 2052	5640	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\gui-zapret.exe
"C:\Users\Admin\AppData\Local\Temp\gui-zapret.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=gui-zapret.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5976.4320.12688424259844756915 /pfhostedapp:80ab818019e71e378d9312b35e44dba2d0eac224
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView /prefetch:4 /pfhostedapp:80ab818019e71e378d9312b35e44dba2d0eac224 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9724b5fd8,0x7ff9724b5fe4,0x7ff9724b5ff0
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView" --webview-exe-name=gui-zapret.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1672 --field-trial-handle=1772,i,7762062842305111217,10020865511754306649,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:80ab818019e71e378d9312b35e44dba2d0eac224
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView" --webview-exe-name=gui-zapret.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1772,i,7762062842305111217,10020865511754306649,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:80ab818019e71e378d9312b35e44dba2d0eac224
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView" --webview-exe-name=gui-zapret.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1772,i,7762062842305111217,10020865511754306649,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:80ab818019e71e378d9312b35e44dba2d0eac224
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView" --webview-exe-name=gui-zapret.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1772,i,7762062842305111217,10020865511754306649,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:80ab818019e71e378d9312b35e44dba2d0eac224 /prefetch:1
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView" --webview-exe-name=gui-zapret.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4544 --field-trial-handle=1772,i,7762062842305111217,10020865511754306649,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:80ab818019e71e378d9312b35e44dba2d0eac224
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView" --webview-exe-name=gui-zapret.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4672 --field-trial-handle=1772,i,7762062842305111217,10020865511754306649,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:80ab818019e71e378d9312b35e44dba2d0eac224
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView" --webview-exe-name=gui-zapret.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1772,i,7762062842305111217,10020865511754306649,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:80ab818019e71e378d9312b35e44dba2d0eac224
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView" --webview-exe-name=gui-zapret.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4488 --field-trial-handle=1772,i,7762062842305111217,10020865511754306649,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:80ab818019e71e378d9312b35e44dba2d0eac224
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView" --webview-exe-name=gui-zapret.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4704 --field-trial-handle=1772,i,7762062842305111217,10020865511754306649,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:80ab818019e71e378d9312b35e44dba2d0eac224
    3⤵
    PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2755c458-ab8b-4582-86f3-cf042931a942.tmp

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\2755c458-ab8b-4582-86f3-cf042931a942.tmp
Size 15KB
SHA256 fe97368dbaa70fe61ef6ddb298a7a654da7258b8e48231aeaffd28997c66c38f
MD5 18bcdfa55284e6abbfb57487e771beee
SHA1 79d1814f72196090f2b78c44053858aeb5552370
SHA512 cd3e68e29c660a883b137adec6a84118e1e603d970a200671dbc5f798e4d34b681cfbb45048fae55232f3192bb2bb6820c9c4ea9d81407fb1c74335cb84d4c60
SSDEEP 384:r+OBqImmJvGBLx3NaFMJFNNBSbCCs8Xwg6rA:ScvGtlNMj+k
TLSH
T1E0729D772C256A233CFB8A49BACA274BCB655293C5D53BD4CDEC8F0E42AF4441352816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69c7de71-d78a-47c1-bd93-47c90748e03b.tmp

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\69c7de71-d78a-47c1-bd93-47c90748e03b.tmp
Size 3KB
SHA256 93cc142c57dd15c0f4e8550fadbee99283e4d71c4864994bb2dc1bf85c1adbfa
MD5 4230e5be63cf7c3532a72e36dda63b8f
SHA1 c4a2c63098a6cd045ac91d11d3f36e1274636008
SHA512 3684e2ada129614aee51de0fe1e016bc92fac97910af0b2a5352571ec46b89f96332bf0f6a55f1a604714e2450fd5b1904c40b63bf158cd68d1208cce3e1f66e
TLSH
T1AA61B8726D70A9375DF79A04B9863B1BBBB95023E6813F90C5EC0F1C01D76882382C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1924acbebbba2fc42cf50331a2c4a9a5c41b871ebbe9a3aa11b6789d8abcacc9
MD5 66be8318471f58974917cecc18dc0e9a
SHA1 92b95ec71ffa44bf5131d4abcf753843d611e84b
SHA512 f0ffed7f5a6b993f02744d3cc4b935a81e763996af974e3f3b9c345dacfa9dd1ff8e8108cad672c37f3a9d83584362624ca6af4cf2402343528a0872a115a645
TLSH
T177D01212F2818134C0103033005266491501C31B5046D050542A9A2D5A1445009038A1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 def45b4ae316139b42d7b55e2d70d38ea08d9b780abbedcafccf620ee9e52d6c
MD5 5b77f7a422f5ce49b804491826f7d851
SHA1 8a2a1353f59b5cf840a8fcf6ed83b3798e58143d
SHA512 cb96329e5012d55187f825a34722f9d443a4c7bac32e50da58068095a635fa11ed0d7af00de3ade30b5c9727817479cddf5e1517edebe995dc3b2b25648c3c8a
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0b142761-cb58-499b-bf96-f8b2d677883f.tmp

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Default\0b142761-cb58-499b-bf96-f8b2d677883f.tmp
Size 6KB
SHA256 a66a357e96be17cf8cbf87119a064b2d77e359637173ca939d72a67225491f35
MD5 bfde9358f02d9e7bc149a13f92faf3be
SHA1 cc86f6c71e4a649c898c1d7c04093e799678e3a7
SHA512 002c9eac6173df0c26fb097289980291e84d01292cc7facf54fd36861a12a2eb9868ac2c3d9fece2913b5312736a9ce04082cd5b051c565ce6ea1d51965e89ed
SSDEEP 96:stL/dA7BwGbb9LkTo5h16Z5Os7/x+6MhmuecS5W1eje+bK+grd3928XM1C7K:stT8j0oKOsV+F25WQjUVLG6K
TLSH
T1B8D1B6025E34797B5CCAE219BA69BB17E2F9603261D11E48EBFD492C04DB6DC331790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7446b61b-21aa-4003-ac22-c2e4bd1e31c8.tmp

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Default\7446b61b-21aa-4003-ac22-c2e4bd1e31c8.tmp
Size 6KB
SHA256 4a2b5176edeba5d39605c30fbe2d17f8b0e04bd9e274b848860f09d19542b552
MD5 a3dc33265bbc20e615dc5e34cb984f58
SHA1 cdc6aac757a33898119fed915f63125e49a0aa5d
SHA512 366092d1f44af623f387b3669a64a9679592d7382bcb7f3ca28cd376dc9ba2ec5fc1eb2071444b1e1dd1efdb8aedb5c979f4d60be1ffc76af4e5e91caf1e6341
SSDEEP 96:stL/dA7BZbb9LkTo5h16Z5Os7/x+6MhmuecS5W1eje+bK+grd3q28XM1C7K:stT8V0oKOsV+F25WQjUVwG6K
TLSH
T17DD1B5015E28797B5CCAE209BA35BA17E2F9603271D11E48EBFD4A2C04DB6DC331790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 afc10d830bd610fd4e4c902eade167036ed3d4b8bff61ba1f658f525948defdd
MD5 f6df9a6178545a56c74e077f8de3aed1
SHA1 b6823516d1d727fdbc359d22b40ef20921e644dc
SHA512 1699446ca6b3d9c2fffb4b32c10ad87c300bf8ed0d054556abfa8e712afacd1d671f012af559bb27f81931ce3fe868ad84542c50c19d62536608f4222a9d4aa3
TLSH
T188C01220C53E6168C328037298C9305E313D4C3C85FF0F81879001F3977CB4091302B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f044770cca83419953eb1b32eb9679db14d27135f235ffd57a407108e29ffa06
MD5 22de62aa2f9bf070f137e19ead3902ed
SHA1 57a9ab20cea54b3784fd3d28697b72fb4ccd93c8
SHA512 88a213c2b52344b0bf0693ba15e862b795beb6af19755dfff4b723ec13eb89e55229ddc0ba62a6db99737b7182d917fad87e20ba5af2f4513e6542d81708cb9e
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fd9a3c81-3b73-4139-b3be-8b1bf0f8b0b6.tmp

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Default\Network\fd9a3c81-3b73-4139-b3be-8b1bf0f8b0b6.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\Local State
Size 1KB
SHA256 ea1449781f5c8d3593d352d874812e5fda8d2ab2d9f2d8083fe7ec4f5d2fba57
MD5 a905744357afb4eef19ad99b0243c6e0
SHA1 0ee0fd717e58f8ec7eb07802f9454efae94cb4c8
SHA512 4b35462faf0ba58e15555aaff1d4863a5586cbe25ecc16cd51d30e1fb042f1479535ddc24a124c3e1a11cbd5935d8a21dc66ef0090dfe0433dd434924215dca2
TLSH
T1692162B2E8642B33BDBA660962427B6F7F351036C2514E40A5DD4F2C42D798C6A6B833
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\PKIMetadata\72.0.0.0\manifest.json
Size 102B
SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
MD5 329ad25b265a82c711c72c02a553a353
SHA1 a9a666d4182caad82edd399fdab141473670c5a7
SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
TLSH
T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\TpcdMetadata\2025.2.12.1\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

ce41c3a8-8208-4ea0-a708-1a133778f3b0.tmp

Path C:\Users\Admin\AppData\Roaming\gui-zapret.exe\EBWebView\ce41c3a8-8208-4ea0-a708-1a133778f3b0.tmp
Size 2KB
SHA256 1ea26fedea7b23f2c652e78472bbbe5c9dac0ded39e490d3aa5ba64da5b089ee
MD5 55a1c51b292f8e16316af687226cef59
SHA1 23eb43dc856fe9500a0ed929f9b842057ba0e477
SHA512 c5f5a605be8ec621d3addbadb1a433bf3f7a13459984ba9c054a033ce2064f469f3bcc51d0380470b86723f7032adecc1867c7af75b581eb0826bb5501b440be
TLSH
T11D5164727C246B77A9B65A04BA4A3F2BEE395061DB521F509ADD0F1C41DB94C2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1032583792\_metadata\verified_contents.json
Size 1KB
SHA256 2311d2d35265a39c96a5774645cbaa05e40ef60dfa6b39fbdad1e72e54901a8f
MD5 290d5fdd863fefc7947425c6c6b1f642
SHA1 1e03a96ad7ba402c88caf8e93f54e94ecf52e0a7
SHA512 a2a77f1bd30ce2acbab09b692100a0a90cc2b8742001f79134e944a88df86d88e738a53b508f6ee816dd76e32b87d011185acf8eb3fc2fde38700914e0e2feca
TLSH
T18431D887464CF49F338A7A2064B6AD52872B31FB16C2236932CCB04BD5C875941A26D7
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1032583792\manifest.fingerprint
Size 66B
SHA256 8c0739035353dabbc06e0e8167beb6151285bdc4a076cb5686bdf4d43ad544f3
MD5 c26af37e331802627691f9dc088b69e1
SHA1 8462416ffcfc26847ff3a057050939419b3982d0
SHA512 f0652883ce0091b4c5fbfa36642eff0ec2d9693877b78bfa43cfd126244d9410139d5fff44bdbc0552e10ebeeb1251964cf6e53dbd2bdea3414cb56cd2958329
TLSH
T115A022802003F303800BFE030CE08FC22A200203022B0080C38E038C8C30BF00AF0008
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1032583792\metadata.pb
Size 33KB
SHA256 628b2de57b5dde868a30e9c45ffc6ff35a820c93a90d3f4ff61a1ff5396eaf54
MD5 0f83ea8aad2d94a32037e90f2812611d
SHA1 66a2879b881176df793c94f6833441fe153e5135
SHA512 e676aa774c099e43c00ecd42d2f10ae194910d9b694629abdba763aefc1d2c541cb1133ad3bf74df08fc6f8fb32b3f3047c07375977ee8d0f8bad9eddb7bc388
SSDEEP 768:mYP/JiEqpCP593U1l2II97uqsLg0JgyCrFNT+L2fiq8I40KwYZstyKYZ9JPd+mFY:RP/JiEqpCP593U1l2II97uqsLg0JgyC9
TLSH
T1C3E267B75A544963228D1B1F8592719DB05C1B4908FBEFCFE61E18F9D99ECC82CBC281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1126946784\crs.pb
Size 284KB
SHA256 340643d368df6700a082071385780ba1d8212f35696137b0a44dd8538fa25ee1
MD5 280a97fbbf2e4b70813f616b487143d5
SHA1 804cd67da601cc1a9c248ee59ecb3585e7a0a625
SHA512 47beb2b1f2bd640d24e7793c313c38b42e3e394be9a4eb88c94ac261c5131a1585b39a2431e39326c9197aea29198fc0f60e1c737d354d71cc0f7e0a57c5cf68
SSDEEP 6144:KKqggR3NpUvYpVW+J2aKH66k8G1nT+uuBw1hhd0piFlXGq9V9t:KWsNpUvC2pIYTsTGG7
TLSH
T1C554CF960F383D12BFD2DEE466CCE93B3D79B6E06A6928162111C4F159927E07D8C42F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1126946784\ct_config.pb
Size 24KB
SHA256 a7371e9e40f287ebfd8c444633ff1eef0cc3050b015f761dd16ed5ae8fa1f35f
MD5 84a749aff1727eb9f4c907b1fb1ab051
SHA1 117b3ada2b80e5e03c560fe4b8eef5e8e6a7d760
SHA512 dfc2c3c565cfd5194be7029184db9a5cf5ee50b3a510da52e509e7e630ec963107ff57d65324aac9983f67158b6cacf8c6d03113cae79dbb37b2a413b57627d3
SSDEEP 768:8oIO1NNHA5uAbuOCri7GrZ7gl3u6ksYCjMPI:c+OuAbXGjhsYCQQ
TLSH
T142B2A7BF61159F001753D50896F52BB6E133A3D6C8F3697DB1E28008F1872E961E867B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1126946784\kp_pinslist.pb
Size 10KB
SHA256 71798e7f16d50ccfe2428fbc868f81949f592fbf7b8a64db4753e3fbba8a0d57
MD5 25b685289453d58201e61d13670b7105
SHA1 e3305c5defd136f91236ef6f06cc1536bceb4f38
SHA512 9fb8df9033e7ffb5a47b7a54b8f497a68a839976894a682d21d9d7e52ee8bd3bbc048ac2fb7a53b69d9ca807b42d1feeb17ad1e5eddacd27b46e72dc149dbeaa
SSDEEP 96:nxleRkDB0rBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gNn:3/DCrBnYQ5jlMacFwn2c9x
TLSH
T1A722F1B37904F99390E7E0BE1041F49AE937436540ADF98A528C4A7635F1F0729BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1126946784\manifest.fingerprint
Size 66B
SHA256 d6eff41b92a45577a8985604359af6d1bdbac85d6e9dfe19438e8efc1bf01f9c
MD5 f6f7a2d4983e6c4b8331d71d5a6a7acb
SHA1 b62c452a4627992b16959d022e0cee50c0a0f294
SHA512 ac5b99ca8f28cab92572bfb5a9c3f4369ce2581d450f5f39d3f16e742f291e275e110f35be78596387e8ef4ac66117d0d878b47ef813df76c5259393c869f18f
TLSH
T1D5A0228B0E20A883300C300EE888B002332B030000882A0CF0F08EC0E8B80C8032E830
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1259482131\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
TLSH
T1F8A022A0C302202228A00E0A82E20223200EA80CE880002328AC8E2A080833B00A8200
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5640_1259482131\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/3388-226-0x000001BB74000000-0x000001BB740A9000-memory.dmp

Download

memory/3388-43-0x00007FF991050000-0x00007FF991051000-memory.dmp

Download

memory/3388-195-0x000001BB74000000-0x000001BB740A9000-memory.dmp

Download

memory/3388-385-0x000001BB74000000-0x000001BB740A9000-memory.dmp

Download

memory/3516-233-0x00007FF991100000-0x00007FF991101000-memory.dmp

Download

memory/3516-234-0x00007FF9923E0000-0x00007FF9923E1000-memory.dmp

Download

memory/4692-202-0x0000019CB7000000-0x0000019CB70A9000-memory.dmp

Download

memory/4692-112-0x00007FF991050000-0x00007FF991051000-memory.dmp

Download

memory/4692-261-0x0000019CB7000000-0x0000019CB70A9000-memory.dmp

Download

memory/4692-217-0x0000019CB7000000-0x0000019CB70A9000-memory.dmp

Download

memory/5552-346-0x00000115461D0000-0x00000115461D1000-memory.dmp

Download

memory/5552-354-0x00000115461D0000-0x00000115461D1000-memory.dmp

Download

memory/5552-353-0x00000115461D0000-0x00000115461D1000-memory.dmp

Download

memory/5552-351-0x00000115461D0000-0x00000115461D1000-memory.dmp

Download

memory/5552-350-0x00000115461D0000-0x00000115461D1000-memory.dmp

Download

memory/5552-355-0x00000115461D0000-0x00000115461D1000-memory.dmp

Download

memory/5552-352-0x00000115461D0000-0x00000115461D1000-memory.dmp

Download

memory/5552-345-0x00000115461D0000-0x00000115461D1000-memory.dmp

Download