hxxps://share[.]google/gzKqtYtjvrEM0Kcgg

Analysis

user interaction
yes
max time kernel
264s
max time network
266s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/07/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://share.google/gzKqtYtjvrEM0Kcgg
Sample260701-xtqspsey2v

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
177	3220	msedge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
4508	7z2602-x64.exe
1092	7zG.exe
4644	Vоltix.exe
4452	Vоltix.exe

Loads dropped DLL 3 IoCs

pid	Process
3184	Process not Found
3184	Process not Found
1092	7zG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2602-x64.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\7z2602-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3220	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274065526189734"	msedge.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{B2221CA5-C99C-4AF1-A98F-5A534CB742DD}	Vоltix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{CCB30D80-B249-4562-B2A3-BCA06C793B7A}	Vоltix.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{1FD6C475-D426-4683-95A5-6A9869BB9EA0}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2602-x64.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Vоltiх.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Vоltiх (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2602-x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
4644	Vоltix.exe
4644	Vоltix.exe
4452	Vоltix.exe
4452	Vоltix.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1092	7zG.exe
Token: 35	1092	7zG.exe
Token: SeSecurityPrivilege	1092	7zG.exe
Token: SeSecurityPrivilege	1092	7zG.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
1092	7zG.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2340	2876	msedge.exe	80
PID 2876 wrote to memory of 3532	2876	msedge.exe	82
PID 2876 wrote to memory of 3220	2876	msedge.exe	81
PID 2876 wrote to memory of 3532	2876	msedge.exe	82
PID 2876 wrote to memory of 3532	2876	msedge.exe	82
PID 2876 wrote to memory of 3968	2876	msedge.exe	83
PID 2876 wrote to memory of 3968	2876	msedge.exe	83
PID 2876 wrote to memory of 1604	2876	msedge.exe	85
PID 2876 wrote to memory of 1604	2876	msedge.exe	85
PID 2876 wrote to memory of 1604	2876	msedge.exe	85
PID 2876 wrote to memory of 3204	2876	msedge.exe	86
PID 2876 wrote to memory of 3204	2876	msedge.exe	86
PID 2876 wrote to memory of 3204	2876	msedge.exe	86
PID 2876 wrote to memory of 2964	2876	msedge.exe	88
PID 2876 wrote to memory of 2968	2876	msedge.exe	89
PID 2876 wrote to memory of 2964	2876	msedge.exe	88
PID 2876 wrote to memory of 2964	2876	msedge.exe	88
PID 2876 wrote to memory of 4592	2876	msedge.exe	90
PID 2876 wrote to memory of 2968	2876	msedge.exe	89
PID 2876 wrote to memory of 2968	2876	msedge.exe	89
PID 2876 wrote to memory of 2044	2876	msedge.exe	91
PID 2876 wrote to memory of 4592	2876	msedge.exe	90
PID 2876 wrote to memory of 4592	2876	msedge.exe	90
PID 2876 wrote to memory of 2044	2876	msedge.exe	91
PID 2876 wrote to memory of 2044	2876	msedge.exe	91
PID 2876 wrote to memory of 5096	2876	msedge.exe	93
PID 2876 wrote to memory of 5096	2876	msedge.exe	93
PID 2876 wrote to memory of 5096	2876	msedge.exe	93
PID 2876 wrote to memory of 3140	2876	msedge.exe	95
PID 2876 wrote to memory of 4872	2876	msedge.exe	94
PID 2876 wrote to memory of 3140	2876	msedge.exe	95
PID 2876 wrote to memory of 4872	2876	msedge.exe	94
PID 2876 wrote to memory of 1740	2876	msedge.exe	96
PID 2876 wrote to memory of 1740	2876	msedge.exe	96
PID 2876 wrote to memory of 1740	2876	msedge.exe	96
PID 2876 wrote to memory of 3376	2876	msedge.exe	97
PID 2876 wrote to memory of 3376	2876	msedge.exe	97
PID 2876 wrote to memory of 3376	2876	msedge.exe	97
PID 2876 wrote to memory of 2784	2876	msedge.exe	98
PID 2876 wrote to memory of 3828	2876	msedge.exe	100
PID 2784 wrote to memory of 1924	2784	msedge.exe	101
PID 2876 wrote to memory of 4468	2876	msedge.exe	102
PID 2876 wrote to memory of 4468	2876	msedge.exe	102
PID 2876 wrote to memory of 4468	2876	msedge.exe	102
PID 2876 wrote to memory of 2040	2876	msedge.exe	103
PID 2876 wrote to memory of 4936	2876	msedge.exe	104
PID 2876 wrote to memory of 4948	2876	msedge.exe	105
PID 2876 wrote to memory of 4780	2876	msedge.exe	106
PID 2876 wrote to memory of 4780	2876	msedge.exe	106
PID 2876 wrote to memory of 3812	2876	msedge.exe	108
PID 2876 wrote to memory of 1684	2876	msedge.exe	109
PID 2876 wrote to memory of 1684	2876	msedge.exe	109
PID 2876 wrote to memory of 1712	2876	msedge.exe	110
PID 2876 wrote to memory of 1712	2876	msedge.exe	110
PID 2876 wrote to memory of 2724	2876	msedge.exe	111
PID 2876 wrote to memory of 2724	2876	msedge.exe	111
PID 2876 wrote to memory of 4380	2876	msedge.exe	112
PID 2876 wrote to memory of 4380	2876	msedge.exe	112
PID 2876 wrote to memory of 4500	2876	msedge.exe	113
PID 2876 wrote to memory of 4500	2876	msedge.exe	113
PID 2876 wrote to memory of 4500	2876	msedge.exe	113
PID 2876 wrote to memory of 3388	2876	msedge.exe	114
PID 2876 wrote to memory of 1028	2876	msedge.exe	115
PID 2876 wrote to memory of 1028	2876	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://share.google/gzKqtYtjvrEM0Kcgg
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x214,0x24c,0x7fffb4e7c188,0x7fffb4e7c194,0x7fffb4e7c1a0
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1676,i,7844489747763946138,13210186349194555796,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,9970925053683152703,4042769675516640799,262144 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,7629942000852796509,3023302579551928144,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,6148173346880455181,13755883218163440515,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,14700003556512135455,5780005579387536312,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,2349870825583197181,9005796946440691778,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,17502503573589234987,17483245061984837322,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4320,i,2135509900026015762,14474745115103827836,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4360,i,18046578177621137733,13610715598389552269,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5400,i,4483084704764140992,11938906377645743314,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,18016018678040427624,8063478788321765835,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,14586575014431292784,11854820622790748139,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5932,i,10965865500304403285,16730430570807210041,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6076,i,4312241702652679004,6342173117926805982,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,17954228314456661539,1200899181080761680,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,13983038597247240960,8734219356470385330,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,13983038597247240960,8734219356470385330,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7076,i,18111581693419490687,13136360444279424879,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,16273919729667172451,14487402489990698643,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,2895216291245148137,3168149166045782785,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,9227933710098538071,14441853621137452026,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,512076628419734841,10370225388387524070,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6484,i,3393163201547701207,6952412805579173472,262144 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,16406854085790036297,16252683623505873713,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,3879875752584290440,11616590006717275700,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,101208571502931314,13443850999314604046,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,823621035929686395,8834626207869532828,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4808,i,1743381319426572152,18167813388355879669,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7292,i,12276600934374971367,6236913901733230013,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7372,i,2973336127901823804,10195012165257026504,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,1233852821134638140,3582284545834031058,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7384,i,14270980222098277403,6715210671202285596,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3716,i,1220102157771469702,13845578947858761546,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7348,i,15844109042941562050,2854198887252610427,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=4404,i,12128553531597665940,3139137518702163941,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7632,i,565682827970600136,8464692462145937186,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7612,i,3332872900387264313,12844422867026400102,2097152 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7792,i,14219975852138497051,12891500199506067564,524288 --field-trial-handle=2064,i,14360772497338972124,12777278479718011418,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3324
- C:\Users\Admin\Downloads\7z2602-x64.exe
  "C:\Users\Admin\Downloads\7z2602-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4444

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Vоltiх\" -spe -an -ai#7zMap18218:74:7zEvent25878
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1092

C:\Users\Admin\Downloads\Vоltiх\Vоltix.exe
"C:\Users\Admin\Downloads\Vоltiх\Vоltix.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4644

C:\Users\Admin\Downloads\Vоltiх\Vоltix.exe
"C:\Users\Admin\Downloads\Vоltiх\Vоltix.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.dll

Path C:\Program Files\7-Zip\7-zip.dll
Size 99KB
SHA256 fc46083ab31a20bacc8135766c063b6cc72e16abbed0294f4d9c630b05e8b8f5
MD5 2e11356db5a1e6c52f685ea90007024a
SHA1 7630f3236068201be55c00ba92e34d9a241e080c
SHA512 d826c15458ad1da562618ec6d38682e0e176e4e11e88ba0c4e574b60de24b2187d8436d4e8d30e9eb9d197d170009ea79d50e172c82aaf220b0cef13ecfdd30b
SSDEEP 1536:dG2eoxbHFxG0ms0/WvbuKedUiQgKnlK/rjJX3dss8Vg4vQ8JAUI3C7+:kOxBx4N/IvnlK/rjhNeg1UI3C+
TLSH
T13FA3D825B2A48331D073D0B9C9D2AA99EA7278419F3047CF2246A75D1E37BDACD35732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Program Files\7-Zip\7z.dll
Size 1.8MB
SHA256 69fd4df057985c40e510e2fac182881c7f85e90aa13ec703f763a8fdb2ce61f8
MD5 58c9628787bce8db529dd668e1825630
SHA1 f59f722a9a0064fdc2c762100383d7babb0a57b6
SHA512 da68b7bc3281bb0f7dc1ed7dcd234dddbbb1f5992bb156f6a844f8c8bea42fecee93f953d6f4a1c7d324b456e2fe56246601f334b13badc3c21e307958117327
SSDEEP 24576:h8yTPwShrEtNwWdhpmBi/33fR8x4cWNFhzNXuzrMnM:hzTPwZ/wUhwucOrbn
TLSH
T14E954C1BF6748270D0B6C075C5E2AB9AEE7134869B30A6C712859B3D2F17EF5863D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 706KB
SHA256 307a306fd3c2e1beab674d0b60fc8b6a74f0d0d7cf9db02201f03328bf1a25f0
MD5 c8d0d6ba5a081676e091e0aee0bc1f1d
SHA1 ee542ada94412fb58dc61968efb7cc866383fece
SHA512 7cc24312b023c37a20a3ff09f769ee1000be6dcb367e8d648c19a5e83a8d9e284c6dc87cf46316d1270af08b221cd895fcbcea46de27ab908273f5ade39f46bd
SSDEEP 12288:YtWiROD0RFpHlziZZqevq6U4KxaHm/0bu6oGMxxE65Be+Z:kBID6FDchG/0a/GMD5ZZ
TLSH
T138F40966F5748331D073C0BAC5D3AA9AEE7234425B308ACB5245D76C2E27BE68736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fec5f4682b770d11d7da63a7e01b69ae4d4e477ab9d62341b60ac445072c86e4
MD5 1718e39566ebb9e8d445a1cf9b96ffae
SHA1 8ed635f4d70654fdfa1549e6bc326dfa48cf8707
SHA512 8e66122bf3751e33a71d7255840d1f14e959915c25b9a4073cf77d5310539f89a94554d7b914e9a9d5a5257cb777cdf0e34d93edbe4028aac7d55bbd0f67af71
TLSH
T1C671D865B0AA0761F3A50D32B4D373457C30A2B94A937E0640E499B6D9FDFEA8C6C4DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 17b6bd9aea35e681a8b5c7489b6dadefbe5c7acd7c3847a638db7f9023f8d9c4
MD5 36079fac1fab8ec1d3d46cb616d65e85
SHA1 3786c307332f4dd5db42adf9a74da44d8560dd13
SHA512 870bb15b1e8d8dcea125ae3f59a2a9688964c2125aefaa3d2fd42dc3e24e5f7e93704985eac6cb77914e2c2e4473ad792a43e0aced8dd0a61055fa1c54ed61f5
SSDEEP 48:1jk82mN3xuaQN7LyrzseDfHpKMgWBAeL5c2AS04d5Rc4U56oVuJoPNHzCWU4lFb:C82iutNqXA+BAy5cM04dE4OdumVTvlFb
TLSH
T144C17E17629906F1F7650832BCD22730793373F405876E7200F079FA98AABDA8C584DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5918ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5918ce.TMP
Size 3KB
SHA256 1fbaf862565ae523d1881593980d6172cd010a10094dad0e39f909688d5c064c
MD5 eb123b6eedbd8dac3be15eb9e9411817
SHA1 76ba90531a351d61c6d899735791829a30907cb4
SHA512 c3a1b73bc2c89131c585350de4c4c87479d1e40d6adadbad93835175e00b8ffdb8b1a3a4070d898f6b7f396a9b182ade771e5a10716f0e8784455d2de2e407c3
TLSH
T13271A365B4AA0762F3650D32B4D373453C7062B94A837E0280D4997699FEFEA8C6C4DC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4d750133986b647637025d019bfd5ec4d7f28c6fc4d3f0b7c3573a778272f8d7
MD5 afe1292049037550b10830be0f5f21ee
SHA1 345aaef6a94b7312c874fc2190b6b1a67e6f8e99
SHA512 441283641e9ac25fab727468fc67b30adf12c09d7757904058bab34dc8aa0446ae0459a23ee270add25c34c1f34125fa2ecda2e167ff4868723ded9d9f6297b9
SSDEEP 48:YALlNqyOhDORCOlOPPBOZOjsTzEs855sd4sHbfWsL/wEseVCKsTXs9nzsImsWfx8:DTOl/c8Z0Pzw5iH7d/wCVckl0fxhMd
TLSH
T15DA16EE3D6E4861DC91156F06B146D1ECF2B0A2487383D6AC9DDEF9B63E24B2E10164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 4bd6a1ab34aaab863969e8adb5671157e56a7e4d878488433a42e04acba81f6b
MD5 35127d43b02c921f9e4157d8482604a8
SHA1 8dc2dbe38615719d8f912012ac0416af99254eb3
SHA512 b295997d7e793319cde12a1f4324a6b1a97d52891b8f1b807babc36ca56ae1c5247d36609cc12489572fa85888c35a711949c114432b89409cea9b068502c94a
SSDEEP 192:Dq+/c8Z0RfQ2k5ibRkl0fne/kj6uMezgmtnZx:Dq+/c8Z0RfQ2k4bRkl0fne/kGuMezgm5
TLSH
T1FAD181F7C7E4861DD91156F0AB146D1FCE2E0A6483383D5AC9D8EF5BA3E24B1E101A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 57f2e83953cb3ab4fb8890945c7f8ec9fd616258a2bbf5d9bd38f239df8966f9
MD5 d276a894f5232d0f667a50a479773e0f
SHA1 12ca47be8d8f67565220be9f6529793bdb1b702b
SHA512 ff3532ee340f18cb5e4fb48ae0996ba9cef0639e4ca8b577fd87b696da81d1c721030ae15159c1d3b9cff40bf0779afe4890a46c98a82138b20771d2bf141337
TLSH
T158D022232A4070B6ABAC3EC5406EFC8FC32B00204912EED561F4D9AD293286E060F2C8
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5beb18.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5beb18.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 96f9156c3fc3d31d15303aacf62b992d4703df153f823bb05f530d081c6b6fab
MD5 508e307feb2896f74c6826f7bc74ff6a
SHA1 2f846398443992ce4659c3336dd8d8425d37824b
SHA512 68e5b2725a3001bb016943be70f23268f66c4a0b1a5ef55ea87cc628ce3ea1aba31d766120e8c74da3d618fb1651adaea5d7d052662afa073fbb243d06c10f73
SSDEEP 192:sxZvRgyM/jK1Ml8UQ2Fv/fas7vo1Idpxab/W6+WN1tqXY0sEG5LIg58J:sxZvGqEv/fas7AGq/byX54u
TLSH
T1EB520A12A6346977CCDBD209F955BF53D6F5047292901E48AAFCDA0C06E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 46337b90e85f410543d336bdd1c3f9357249cd36c723020d1803586be75e4b25
MD5 7340e4008b0ef41aa8e59ea6856dfcbb
SHA1 fe768e5a95ea0de2fdf2ead6d2cf334f8ef84cb9
SHA512 6dc2d0065343f264c8232448e33b2e4ee5ec4f4f72741a7a4d7e80cf391eaac1dacf59aeab3fa28cd4c3f49809fd516ec6e4195c5b23eb17a150fc1ea64d5ae4
SSDEEP 192:sxZvRgyM/jK1Ml8MFv/fassvdpIdpTaY/W6+WN1ZG/Y0sCD/LIgrJ:sxZvGdv/fassFij/b+/539
TLSH
T1A3520A12AA346977CCDBD209F915BF53D6F9147292901E48AAFCDA0C05E6BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4c5dceaa758183456280173fdf69a850bb325d471da008bdff514524b498855a
MD5 b0c7b9311b715b130b3d4d7184fee0e5
SHA1 a97381c10ace1892a8f2e61ee605ce266a3c0a2c
SHA512 9402eaab3e16ba295f9ca0bba9911a4aa98fd566189fd2d1d2ea1a14e66d98b2aa315ff124c10473f8e6a3aa1f0bc4f20310831240760bf5e4021ff7176217af
SSDEEP 192:sxZvRgyM/jK1Ml8UQ25cB4v/fas7vo6dpxrCekb/W6+WN8yxV7AwdL/Y0sYG5LIU:sxZvGqUm4v/fas7AKU/blAe/5IAu
TLSH
T19672EA526634A9778CDFD209B925BF13D6F50472DA501E4CAAFCDA0C01EBAED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8a0e2b2f52337bbc70ca0b5c66afccf0e13c1dfba44c61e7ccb3a6d6e4860132
MD5 3a974e6f208fa419faf09a0b684a82a1
SHA1 bd285c0a1359b7b3925d68e657526a8a8c5e76bd
SHA512 71f565c324df60cf201b35faf189cfd11d4dfc090027065059b3e0d66dd3d1907d6d1585cd4b050731ee2ff704f54d468e5de057ac34958116c7ea3cd8726a9e
SSDEEP 192:sxZvRgyM/jK1Ml8UQ2ov/fas7vo1Idpxab/W6+WN1V7ZY0s8G5LIg58J:sxZvGqdv/fas7AGq/bHZ54u
TLSH
T1A262F812AA346977CCDBD209F955BF53D6F5047292901E48AAFCDA0C06E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 f39de55cb5740cb803b71d11fb6009d99dd78019c47cbdaa951dce1596352efa
MD5 617180c7d8cdca2cfbadfc2a71ce2c42
SHA1 0be52a388c1e087dc94be7fcc719a4b8db565bc4
SHA512 0fb869b2c1a23614bf4bcf50ba6ff8ffa705a4f2fa5a2db1c9b6c76a0200ad39758f057b164b6283fb94567f66c15e41a7fbac09e9fe8c83e2500ea83bc945a3
SSDEEP 768:IT/Xh8dF27kWRmwcQZw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mjLl/k601vDrodb:IT/Xh8dF27kWRmwcQZwu1jaKmjLpkD18
TLSH
T17BE21A3F280CC77E4F844E5DEC26AF966EE802CBA6588D5447FA494C03C77EB511A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 985067342e58938076d941a6348942b76680e7d04cd7a30a337cc8b58c78ec19
MD5 e5c370b1fc451d9fbe0ff2aafd88b49f
SHA1 3cfc1caeff20bfa3db280d9efa3587f975a71a5d
SHA512 86bf8ff8e9f9f85f76c61f212071ed4e8f29da7ba190687378d5ee111928ca5129f13ea3ad9537704d6629f8890ff14d5e110c22c0303ce5a92520b912c63d62
SSDEEP 96:Kop+K6MyKsgKZS7/oNJ/9dRWpGMgxRK4YgfRcHPuxdyHMN4cWa7:clvK/oNJ/9d8pGNxbYgf+HPuxdyHMN4Y
TLSH
T1E791A151327A02413D7D3918A276BB578681F5633618EC3B3BAA01A94E66F124DFC5CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596d47.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596d47.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 62d6cb08bfff07d2cd8d1c511f164a0dcdcffd53dc2dfa3a6c0533219f127c1d
MD5 971b0218460239aebaa1c28c69bcedd2
SHA1 fca3c16bbda8ca277b309b2dea844ff0ddef6fcc
SHA512 1804fd6c2455e8dcc6eeb05cd40a78d7e5ce0b43dc3c9a8e3b906125fdf5e22198dc6a46d8a6f02d8a5625b4101786d8b9220a0f9701d00704c04f20c411cc1d
SSDEEP 384:ttNn/s3n9Su8N3ntWXivYbur/E5D+NacJueQsUk0:tj+95yWo/Et1cJRUk0
TLSH
T1D7927C316479AE6B5CA28650F50B36179FB851BB97C52F98D5EC7B0D03DF2EC1302922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6c6a7aca82e890bd5bfd5a49858e8be8ffbd5544fb7b201d0e2801d0d51818e8
MD5 49c97e343cd23fd6522492fc0d64eee8
SHA1 3f91dbd2665e880828351f260c0e365a8830c102
SHA512 b974ddc5adf87f6015d74283e891f22ae3efe3c39b198ff41f3cab8488940181a9d76b89a983b33702bfc40bf39b42d7400b2a27018442daffff149c6255b25b
SSDEEP 384:FiF1tNn/s3n9SN8NJ8TUNTUlIl0tWXiyvbur/E5D+NBcJueQsUk0:MF1j+94Mwge8o/Et8cJRUk0
TLSH
T1E3C22BF214D7993ADC5E4B53B73E2E128EBCC067B5801A94B3D85A0DCE9A1BFD202911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 29e93a32ac6bfcf9a02a4afda58ca09070eed60395403ef146c22a1ce280ee84
MD5 48d2fe866739d93d5fbfa176e201ca1d
SHA1 4947e2b8963fd738334edb90b983c2ceb0753062
SHA512 19f64aed8dfcf59d18f9449538132a91af5ab4f3344feb48cb1e2ceaa97afbb17c1d368bdb3716e70bb5792e1a12f4f72f406fb533c15d4454a574995610deca
SSDEEP 384:ZtNn/s3n9Su8N30tWXiyYbur/E5D+NacJueQsUk0:Zj+95dDo/Et1cJRUk0
TLSH
T1D1926C316465AD6B5CA28650F50B36179FB851BB97C52F98D5EC7F0D03DF2EC1302922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f9fd7174bacf87675149d4931c0cde11098fa1ebaa4b147c8c610d1cc0c5d1ca
MD5 abd943f992da604e3047561a54b51528
SHA1 d096b8fcd8d1e16c8982e0962dd2b82f69117d02
SHA512 d60529684ccc503987191811ca661afd3478dc98b6a48191d88c8078427d585c87ad55a3430ab9ac38c3d69908f442446904399e46087d051ce518c759a275b4
SSDEEP 192:1GNs6t6H3BQmiUyzHBHn2Qq/rUH5mO+PD9MclhU6:1GNs6MXfA12Qq/E5D+qcDU6
TLSH
T12102D93578A8ACBB9DA36F41B48777239F94216FEA955F88D5E81B1C01DB68C1306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 271e483572d6773ae7082a7748c47e3f48f49caa52d2340844e66703b7050bf3
MD5 7220993a417e7e13661845efc0f59005
SHA1 7fa64c2373c3c95e5e91089b1a74cea3b534e687
SHA512 a814daad267378eeee097184fb59102ef4784c11926221ab8d71594f3c7756324db6e2a8b3585b2de852ffecdffa4a00210822239f567777c09c16bc04c4c5ba
SSDEEP 192:XGNy6t6H30QmiUym0n2Oq/rUH5mO+N//9ncVnqMU6:XGNy6MXEe2Oq/E5D+NNcJU6
TLSH
T16B121A3178A8EC6B5D939A51F44736238E64516BEBC86F98D4EC2B1C06DF6DC530A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 88b6f0a1901c2ab2240e23af81c94c61ee8f3d0f1d48e84975006cafe6bb64ea
MD5 1ac824517559a2dd57c56fa96ce7f823
SHA1 77e881258beff12356c2b38675c7a091851292a1
SHA512 b1dc0107f70a2919dafb5ecbc8146ad13913ad7d2167d46be575d66f17ef8a0675bbe98f7539c65d074c4fd1f87d29edb33ef06519065172c2e32a977a83ba81
SSDEEP 384:FiF1tNn/s3n9SH8Nb8TUNTUlIRA6WXig3bP2r/E5D+NWcJueQsUk0:MF1j+9iSwg7uzM/EtFcJRUk0
TLSH
T126D22AF254D7993ADC5E4B43B73E3E128EBCC067B5801A94B3D85A0DCE9A1BFD206911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f903a974-092c-476e-bb73-413496754d43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f903a974-092c-476e-bb73-413496754d43.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7z2602-x64.exe.crdownload

Path C:\Users\Admin\Downloads\7z2602-x64.exe.crdownload
Size 1.6MB
SHA256 6745fa76dc2ea031596d8678f6f6b99c3c1b435b4164a63485adbbc7b8d82ef0
MD5 0617e5373e5e311fcb4bee506e046359
SHA1 b563e139acab81cc7ddf358bec6cee1e6b8b2b17
SHA512 85389eaef377aa9fef3155d2e3375c1fff77fc10e39d9312cab229f202f3aff78f6e807460cf6b04bc2a32f72f7853afbf475cf0dce6232a40c0a6f8ddcbe4da
SSDEEP 49152:L6Cx0Yr+pwKQtSzhTnSwIC4xQlMIUoks8KkE3XB1:L6ChSwbm4wIvxQlPkN76XB1
TLSH
T10D753302D1A0817DCDCBC871D6EC9E23E132B10DDB605E6BD266CCCEBA21A119EDDD59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z2602-x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\7z2602-x64.exe:Zone.Identifier
Size 984B
SHA256 e3ad90fd6da4c064e8a9290d3adc2efb1bedcb24768c118b7c04936f4320b2fe
MD5 837ff2434370b8e1ec1a201b5e3780b8
SHA1 243c3623e9b002bc07253b382409193cb4676aac
SHA512 ca7a891b74e6efbcbd210e2bba8ea81ef5b7d53e781a509d5e75e596e1d78e021ac0750cef4fb72e84554e54d727d36c33d6c478c1a96a1e98f7993c4a4008da
TLSH
T1B21154F7C0159D4B2B06E2F1495C6D8ED077F4E74BC646490661D29DC7C00B660C683F
MD5 SHA1 SHA512 TLSH

Submit Download

Vоltiх.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Vоltiх.zip:Zone.Identifier
Size 242B
SHA256 199e0a11c0ebd3a97e7128d51437e78438e592e9b657a84723aa88c1ee7ae11a
MD5 71ae743568ecb3380512925231da2852
SHA1 bab5656bf9dce547b21b8d680c0f12a46c7c8c69
SHA512 0f00a8d3ce4a25f1c33e42a191acca2996550accb15ceeaaa6c07c3740d1ecd469b4c736828038113dd46085071da4de17e7ef16bc3eec142c901d723b070999
TLSH
T1E4D09783E60400210B8130C0899DE108D20F7618BDFF229C9C10C19A9DCCC3896A095F
MD5 SHA1 SHA512 TLSH

Submit Download

Vоltix.exe

Path C:\Users\Admin\Downloads\Vоltiх\Vоltix.exe
Size 6.3MB
SHA256 670246d34a9711da2d454b42ccebef655b1bcc1739d604981a25e90feb619a63
MD5 04ccf39cfdd3789a506e457adcc98fc2
SHA1 92a67dcfce08c002182f68d105eb3fb4b4c8819e
SHA512 e4c8b0f09fbcc13d038bb7d3ca6732eebc31f4f9f118835bdc065fdb02fbc743bce1aab20704610c098f9002827b39dddbc8fab50b2f395e83a7433939e73894
SSDEEP 49152:6EGlwRN+b5lQGwxykpVVRrKSH1bAjGAW7dkp6FSSU/1Q/+:F5+6FSSU1Q2
TLSH
T18D66B3EFA256896FC1CA833AC4928A04FBF3E07507A39EDB919057654E4D7C44E3F264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bannerv1.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\gamesresources\Game-12\Bannerv1.png
Size 25KB
SHA256 a84d6f953587d87252901a3fde1cc69bcc039640662b1527fe92b1d955325f2f
MD5 ac0f8d0f489df56d46b8dd88bd09f981
SHA1 173f1954b21d518e21ab81fe695c3ce99184ff76
SHA512 06d2953ccabd1efe8993623b6b6958afe16a75bad31f467a0734348d41bafdae74559752e2f828e175eac8e361e4b22cbd6152132cf017bd4956fac4d06f6ee3
SSDEEP 384:HKvQQ+XAftsjRwlg8S+fRu0iOkCKUkW/onyhww6GptvAiQLbsSjAYC1GLy7:qN+XAftgul7dRC+myFLvVQLbsePSx7
TLSH
T122C2E134BFD0F92B49A134D624E522E34679D7638F199386DC8189A72CC97EF301C9D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FilterStatus.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\gamesresources\Game-12\FilterStatus.txt
Size 4B
SHA256 140bedbf9c3f6d56a9846d2ba7088798683f4da0c248231336e6a05679e4fdfe
MD5 334c4a4c42fdb79d7ebc3e73b517e6f8
SHA1 71f8e7976e4cbc4561c9d62fb283e7f788202acb
SHA512 ab93a9e95d70edb06025511cea4e2b8047fb7e1deaf7244fc0d3edf5e7cb57d8fb7b951bdeb3c6b552714878749eb19b9103e64a83635e8885c7d3e1d0fc5649
MD5 SHA1 SHA512

Submit Download

Status.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\gamesresources\Game-12\Status.txt
Size 37B
SHA256 601df91c1b25aef8fd1828080f4eda4fba775d072dc53b1f6fe64c68546ee201
MD5 94a7a0ee1386c19fe770151614d2b438
SHA1 89ae792b4eb8ad6c4352386e32a16101429c1671
SHA512 d4a96d27cc4985e7e5f4d25c7d99052fb29e3b3cd57a96b317e09b8870e26e619c047fb576e999e9058d72cf56ec8ac2eaf8e95e8cd3101b6f7544addb138337
MD5 SHA1 SHA512

Submit Download

Image1.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\gamesresources\Game-18\Image1.png
Size 406KB
SHA256 7c2cf681bcc6e3d6cbda2ea638b461984dbcadd4c446ad4b8ca75a8982467bbc
MD5 8e4e730c6b184aa6a72216fbd764b8b0
SHA1 165402cf69414e220c0c3735d37bd3ca3274295e
SHA512 508183a58d6042f42d5a64ad6ed62beb4e153f3be648261c8a9c9b5677faef0242422e307fb7dd4f137e0b0be7f64487850af6da06e2407c767db59c862b4e46
SSDEEP 12288:fHUfZBnxJD3GZmonrKE4dEnk/PnMFfbKNW8pa:vItDcfRnwMFfga
TLSH
T16E941393C34394E41DFB043DD0A8EB7A52A5992CF9A27B118E1DCF372366798CB14A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Image2.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\gamesresources\Game-18\Image2.png
Size 521KB
SHA256 44ae28d5d37e92764162db1150a65a53e517835272de9f21849adac6bc399df8
MD5 b387a06e20e6906f8a565965f9e102af
SHA1 55a3ecd60181e930e0c4caa6e3543ddbb4af16f6
SHA512 5b66bd6e7882f406463d2677daf8a71acdeddb0894aae1aa496d235519cd17dca352e2851549bba496bd1c2b77e6b6ecb32c3f18c8f79bc520c0894d1ee01e42
SSDEEP 12288:QWdWr6bmELKtK+tn5T0/RukPo/UPdM2zuUuhXEtC2t0908WkiXI:QWdWW6CPo8PdgtNmxt09PSI
TLSH
T1DDB423E6918B26C9848BE92887247D688AF17817EB754CD14C3DFF70160225FF6B836D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Image3.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\gamesresources\Game-18\Image3.png
Size 491KB
SHA256 5c138969e47f2618ab6aa67d9f05582e4c9746885a2967b9084462bc69187732
MD5 14df0a602d2d06744cc51bb1123e9acf
SHA1 3938fa8961a862edf074915e13a3247de49275d7
SHA512 6e5aa8bc24c278f86f4e5c593a3dfcbdecf30253bddff9100aa206cf186c5ad6096435dcdc88ab9d77c5d7fc274ba9bf705105b1566fbb38d6853b2c21b88993
SSDEEP 12288:l7tqqQNCt7BIhafcdAuajjrN4MIvQHtvmSso6aPU0M:lxqqsC8hIcAjjrGIHtcTGM
TLSH
T1FBB423DAF1F143A1FD9426231C448BE97084648A1BEDF929827892445E395EFFAC5F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Status.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\gamesresources\Game-20\Status.txt
Size 36B
SHA256 9cc2b87cf9721a147929d61bc775c1c9a4bfa0f9b19b6ddce793c9ccf9aa84ea
MD5 bf3af32f04ee511bcca7de2d77f30ea7
SHA1 ea8b7d6ef777fd299111d7a8ca6f09c035a4fde8
SHA512 e56de19abdd16095e865f84f0de7ca0ef9e14cb04b7ddd207abb6dfa3fe010fc3d183b1bed117b2a4c2c16aa2ef44d61f69083a3951eaf37d5f66f7e84236453
MD5 SHA1 SHA512

Submit Download

FilterStatus.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\gamesresources\Game-2\FilterStatus.txt
Size 3B
SHA256 11507a0e2f5e69d5dfa40a62a1bd7b6ee57e6bcd85c67c9b8431b36fff21c437
MD5 22af645d1859cb5ca6da0c484f1f37ea
SHA1 c2a6b03f190dfb2b4aa91f8af8d477a9bc3401dc
SHA512 aa54def9e0bb11c1ebbfc97a9ee63af9e95c4fdf1d032b1ddcc0f21661f748651d2b2b8fb94e9ae041780554db29815daa1c0fe991ddae54eff0c4c28cd9d20c
MD5 SHA1 SHA512

Submit Download

showfiltersgames.cfg

Path C:\Users\Admin\Downloads\Vоltiх\bin\modificator\showfiltersgames.cfg
Size 19B
SHA256 c5b3cf05ed6e2a79e8d7305b3af7ccb5ed02918ddc7624b330ed97f41e066f02
MD5 a88082a7664be4f56db07c5e5112d163
SHA1 2271f7061d8e3c3f7b5f4b25b8eb09b4f92b7657
SHA512 f2be5ddf15d61348f71da98148f2f4739d0d7025db8c3e596d502d4e9dd8427adb776554607b31365202949ac6d39c87df82d8074f1f2b2adf4d053854adb5ed
MD5 SHA1 SHA512

Submit Download

BonusModification1.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\ABI\mod2\BonusModification1.txt
Size 3B
SHA256 8a798890fe93817163b10b5f7bd2ca4d25d84c52739a645a889c173eee7d9d3d
MD5 a6105c0a611b41b08f1209506350279e
SHA1 fb360f9c09ac8c5edb2f18be5de4e80ea4c430d0
SHA512 81e92f5d90684db6638344869c82e784b5270b513811080bdba905820be1b0331be8fb7329e4c7a6f97846c1b211572042a0c5bfc7d487a74cab0221c19685c5
MD5 SHA1 SHA512

Submit Download

Developer.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\ABI\mod3\Developer.txt
Size 5B
SHA256 8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
MD5 21232f297a57a5a743894a0e4a801fc3
SHA1 d033e22ae348aeb5660fc2140aec35850c4da997
SHA512 c7ad44cbad762a5da0a452f9e854fdc1e0e7a52a38015f23f3eab1d80b931dd472634dfac71cd34ebc35d16ab7fb8a90c81f975113d6c7538dc69dd8de9077ec
MD5 SHA1 SHA512

Submit Download

DownloadWait.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\ABI\mod3\DownloadWait.txt
Size 8B
SHA256 68ff63fb82e0e5dfec2a8496bf9afef608ad639ed552e740268eb537fa52067f
MD5 fd456406745d816a45cae554c788e754
SHA1 817248fb77fb5c2cef3f2c732ad257cb1fb9c5e4
SHA512 2da33b9f5b0781675bea57d971386b4be20fdf25a2f748d94106adfd12a0f173fd2b1b18c5784f9b8b054ba820298838fe0b4aee5f221360b66a7bf203f2e79b
MD5 SHA1 SHA512

Submit Download

FilterStatus.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\ABI\mod3\FilterStatus.txt
Size 6B
SHA256 1eaa2baef4a4375ac2455e8ab2dec7b18b2eebdab82422b4f2e734fbbbc9f5e0
MD5 b3795f8a261b95481f5e98fc3b83e953
SHA1 cba11cf3f0757efdd201932612fa022d8a19a1a1
SHA512 1fd89a44dbf2b28cde55d5beff67247fcc68f226085ed2b7faaf26a5e2d45836883a3fc2a1c1733da8f0292b704cbccf986207bf040ffbef1435f30d0af39795
MD5 SHA1 SHA512

Submit Download

HideKeyboard.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\ABI\mod3\HideKeyboard.txt
Size 2B
SHA256 9390298f3fb0c5b160498935d79cb139aef28e1c47358b4bbba61862b9c26e59
MD5 7fa3b767c460b54a2be4d49030b349c7
SHA1 fd1286353570c5703799ba76999323b7c7447b06
SHA512 22494af556a0782623729d0b5a9878f80aa6c21a6f51d346771842d613f51073c3b02fab211baff42fb1998f38b77250dc7a1c71dd98b4b00cae9620a6102ad7
MD5 SHA1 SHA512

Submit Download

ModificationType.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\ABI\mod3\ModificationType.txt
Size 9B
SHA256 b23b6b4d061476fd5593e7a314839fbe6e8039fcd59f2f31686b872625d900c8
MD5 7641e5f4e7e8517bd0477fd81e3de1b8
SHA1 d02603176f8822a40aaa5b4270e49934a7f83824
SHA512 7f958029ad599c86e5a0605ae6b913bb169774d84cd6e16eb7943674401f950b50263806a743541cf9a41778d4b937472e06e1ea16efc10f4a2d7f6c04a58b3f
MD5 SHA1 SHA512

Submit Download

Status.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\ABI\mod3\Status.txt
Size 4B
SHA256 c34045c1a1db8d1b3fca8a692198466952daae07eaf6104b4c87ed3b55b6af1b
MD5 b1f4f9a523e36fd969f4573e25af4540
SHA1 85d8d76ba15bde3ef1602f477f32fd64e32fea5a
SHA512 03a144604e0a3ce0c3d21e6e003e56957a200b8389cf1160d886732076c9041208a7176c4015f7b26cc560024580047725060c234afbfb7fcd13bff802a36c54
MD5 SHA1 SHA512

Submit Download

UpdateDate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\ABI\mod3\UpdateDate.txt
Size 5B
SHA256 2b065c7c9ce466e5ebcad757987d5d660ee4c9ea708bc62c43444b53334738ba
MD5 1dd1c5fb7f25cd41b291d43a89e3aefd
SHA1 24345a14377fd821d3932f4e82f6431640955b0b
SHA512 cd681b1a08d4520b935fbe1553ef9b993299bc3dfb60132cc917de2d055ec149c843aa9a7a09d62344a9573464fc61b32ed369251eab31648e96766300cd3fdc
MD5 SHA1 SHA512

Submit Download

YourMark.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\ABI\mod3\YourMark.txt
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

UpdateDate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\ApexLegends\mod4\UpdateDate.txt
Size 15B
SHA256 c3f394d5a071e3178243933442f37f91b5842e9961a1e7f6ee625ceca80fa4ba
MD5 1319cf96efed21236e8b414530c52d9d
SHA1 48c9763254eab05bd3e6a86b0d9ca7ca265d4f7b
SHA512 67caae4a08bf6e940658d663ea7b7d0f4e3153b358a6c9a7fc92d966a10964392f3c98483311c713e0ff7e1f41832470eba7d741a54441c0a6c8b03778605035
MD5 SHA1 SHA512

Submit Download

Image2.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Counter Strike 2\mod7\Image2.png
Size 683B
SHA256 c441299dd8d0fcb74a1f5909d46db4d9b071e2e61e377233706d2ffaa3401fc2
MD5 349fc15af70e4bb605c14e19985db79c
SHA1 1e9e69964e0e03f499551580bffe775ac825a85b
SHA512 711a2698b28cebb7d660fd7cd38b35096d38cf2a7b3b562c76be3019ffcddc67389a413d78e2281c1c8d9c3539c7e2f0dc50c3b002fc75fc946f1f91a566f2e8
TLSH
T1B60192D2FF44CB98850E4817117243D01D5D3DB62447170B5978C5D0F074548FDD564F
MD5 SHA1 SHA512 TLSH

Submit Download

Rate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\DBD\mod1\Rate.txt
Size 2B
SHA256 ad48ff99415b2f007dc35b7eb553fd1eb35ebfa2f2f308acd9488eeb86f71fa8
MD5 812b4ba287f5ee0bc9d43bbf5bbe87fb
SHA1 8e63fd3e77796b102589b1ba1e4441c7982e4132
SHA512 053697fde5b417fe1b134c29ad411e4acb153b4d157acf88d45781ee1122cb7f7465e0f0d3e3abca78ff9cfd6b0534b39a3cc80cf3222baeb5c340c0fa2afecf
MD5 SHA1 SHA512

Submit Download

Rate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\DBD\mod3\Rate.txt
Size 2B
SHA256 a46e37632fa6ca51a13fe39a567b3c23b28c2f47d8af6be9bd63e030e214ba38
MD5 9778d5d219c5080b9a6a17bef029331c
SHA1 76546f9a641ede2beab506b96df1688d889e629a
SHA512 ef52db28b01e9632cd5969f3ccf502e9e43c33fa30cfa8a0227a07d0dc4be590388da493e42257af4c45fe42a7b702fcd649885eeb92f53c3c115dc661aaecab
MD5 SHA1 SHA512

Submit Download

FilterStatus.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Forza\mod1\FilterStatus.txt
Size 7B
SHA256 2c810fd03484ce327b8424680058543822cd88b577809c73529104583a936627
MD5 5fa3852b08951fcdc4d2e60f89a85bfe
SHA1 99d637374f51ab8f607c22b55440ea3666d3fc47
SHA512 6468ecf62fdf35c2e73669f0e143a8def7fc85adca2e375fb6f754451df863f9bddbd3cf90da13f887cfa30068f9618749449a6fcc0623250c989fddbf35ad5d
MD5 SHA1 SHA512

Submit Download

Rate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Forza\mod1\Rate.txt
Size 2B
SHA256 d6d824abba4afde81129c71dea75b8100e96338da5f416d2f69088f1960cb091
MD5 e2ef524fbf3d9fe611d5a8e90fefdc9c
SHA1 812ed4562d3211363a7b813aa9cd2cf042b63bb2
SHA512 73ce1b4371978a11dfcfd913a24fffab97c1d4d5c4407a7ee5520b46dc50614c17d4ed1622be4e9c078c96c7bf80ee1d2817a196ca49695d279805f72dba0237
MD5 SHA1 SHA512

Submit Download

UpdateDate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Forza\mod2\UpdateDate.txt
Size 15B
SHA256 1c91a19ffb7cbd94ede3b45332e7714cdb9732379a37e877d9f10e81fd2bab60
MD5 fed9a11d70a9e5f544913ee340cffe35
SHA1 80c0b82b95ec408ad5f3a5442dd28740ded24f83
SHA512 a96638d55c5f56b7b149176a58b8c96e61d6c96f620e401bf28c83184462aae29b4abfa11cf253287569847076c7c1147194d5c8a18fb94dd108a99d3981e7f3
MD5 SHA1 SHA512

Submit Download

Views.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Forza\mod2\Views.txt
Size 2B
SHA256 6f4b6612125fb3a0daecd2799dfd6c9c299424fd920f9b308110a2c1fbd8f443
MD5 3c59dc048e8850243be8079a5c74d079
SHA1 472b07b9fcf2c2451e8781e944bf5f77cd8457c8
SHA512 198dabf4bac21cf35cddb48db0f8b67c56b2bdf63767242aea7342fe68c0b9df8d37f3e47a134648e19f1640e158f2e527e636db122a9143307cf309efcb85d9
MD5 SHA1 SHA512

Submit Download

UpdateDate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\GTA5\mod1\UpdateDate.txt
Size 16B
SHA256 be29f3e7182c2ab16d041055e01b99c77b6f7e7c6a764ad6c0fac61ce95e31f2
MD5 d02978f5418350c78caad40c693aa002
SHA1 59199d5b9ba5b2f6e29f66a2e3ca6148d9d0bc7d
SHA512 a95d47bc67044e8dac3a626353ee191da66c993d0f8df9cb43d31337d996d76cd5bbb34fad9ca020c23f58623378b3bd7139fd2e951533516b698e517aa69957
MD5 SHA1 SHA512

Submit Download

UpdateDate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\GTA5\mod2\UpdateDate.txt
Size 15B
SHA256 1d00a68af8f85d2b6a9a456dae414a3db42956821045490874e4477441f4eed6
MD5 4ef586a3b9a5b2137f85c1024b473ffa
SHA1 7bb689aa0dac87bdee47527d647ed5483c201701
SHA512 ec051d1cbfaac97677b9d7b3eb1a07dea9cad5c59850d47632398b3f07461bdcf04e45aa4df4de68a51f1c282067dc7ef082dfa15f80d967995d31600cbd4d85
MD5 SHA1 SHA512

Submit Download

FilterStatus.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Hoyoverse\mod1\FilterStatus.txt
Size 7B
SHA256 870dc23d21836b97b58a7753922edc8512764e83c02586f3d8f14c11f760550b
MD5 a288195832f8717bca4671416014a464
SHA1 5c0a4fc7c32f26dec6ff80e80471b4a93152d252
SHA512 627471d914bfed7a06e040dab245d3429aecce0027729c340f117103d23db2ced23271c8d0f65a433b09cf7f2f6325533df680da2639130974d6330fc706adec
MD5 SHA1 SHA512

Submit Download

Rate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Hoyoverse\mod1\Rate.txt
Size 2B
SHA256 29db0c6782dbd5000559ef4d9e953e300e2b479eed26d887ef3f92b921c06a67
MD5 ed3d2c21991e3bef5e069713af9fa6ca
SHA1 31bd9b9f5f7b338e41b56183a2f3008b541d7c84
SHA512 0dcff5a44cd72c19f94f7b72a5a7766ba5674afb9c13a9085a0ae03848d6a09c2bc0a0ca9660c0aa124b179ec6e84fb9af1121e7f0441705e052d6a6b2f87a7e
MD5 SHA1 SHA512

Submit Download

Description.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Hoyoverse\mod4\Description.txt
Size 91B
SHA256 dd4c0f010600a2695507d60c0760048aa4996ae69128472fb5bc084ad1c724fd
MD5 35536cb70f5d9595013937052afb0675
SHA1 25dc3cd5f7c85833b4b6bf1e271a2225a60fa3f6
SHA512 79b77115e5233049d4a4835b59341f3e1f31bbf760278fc9d16200bfecbde64142f1b4fb4065dbf4523c5d8af99eefa5fb730f44b85a34175114e2f1c8f72d53
TLSH
T199B012A080CD010183174430EA4889E175ED141D3F0A0403CBE0801941E429C133C652
MD5 SHA1 SHA512 TLSH

Submit Download

Image1.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Hoyoverse\mod4\Image1.png
Size 59KB
SHA256 218fc9a456e394476aceaf146432022c50fb7e93a70d273049a2662bcc54ab65
MD5 72cd8f289a9cc2c1c6aaa22b1c2db7ff
SHA1 423a848ae7f8b2980de8caf051bcc40f3931587c
SHA512 b747d473647628922ad153f3bd3d4d7ba5d7d55231489b6d79fabe5ad76bf70f688591d799ed41f0fa06251ef1049f6c8c469c22fe253d0fc70826794c7d5e4e
SSDEEP 1536:aFUTwtA54gX5DPCkJQaQ5rUkeRyoCpF0IcXE:NTz5pXBqakeMzaXE
TLSH
T1F6430286688EEE871506892797A098E27964C04DB570BF3FF36C5E0B78D3489772EDC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Image2.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Hoyoverse\mod4\Image2.png
Size 21KB
SHA256 fb88189815ceee079bdd5b536f93789c4f9f82d0a94ba2124082b3d219002c80
MD5 8c14f389ee4f6195ba8b00e48d6a5331
SHA1 0eaea86a810970d19e769838dd7dfe3cf48aa07e
SHA512 ae4fe63c3f5e9272c401f5386c10cd28f22621a6fc1d08af372bfc817883c619de8550d1beef7d6b01f258e383223925643ed28142911a3111d17611c3521c53
SSDEEP 384:i/rF+8tVnJ6QVRVM/hNRn7CjBua42xrBLXbc/EWCNvlK0MnJa3WL5:kVt5VRVM/hTn7CjBuNk1Xbc/r7AU5
TLSH
T18EA2E171F8DDE5A68E2CBC4B86CC99DA02AD2241FAFD49E9CCB493210359C4ED0404FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Image3.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Hoyoverse\mod4\Image3.png
Size 19KB
SHA256 09812b2ef03239a9709f9c516ee9eac68645e793cc81ae6d26653ed4461e9812
MD5 5b16477f15d577500413207292bc442c
SHA1 97c20ff67487c3791bc87ae6f409298aa98909f0
SHA512 02e5ed6783ecbebf021792e2a0843aa38aaefa5d002bc783d58ba507c240d9649addd370b9320a20812d205613273b4d651da6eec6732eccfb28482e5be492ed
SSDEEP 384:SbDyNV1KtkGdhYd4jIxyFQv9IJEFR4mSufT2CFHEN6k6N:SAU260E/EFR4mSurtN
TLSH
T1A792E0907727F44CABCBE100BFE08653082D85763E83EEAD663F842211BE51CE565EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\LiarsBar\mod1\Rate.txt
Size 2B
SHA256 69f59c273b6e669ac32a6dd5e1b2cb63333d8b004f9696447aee2d422ce63763
MD5 8613985ec49eb8f757ae6439e879bb2a
SHA1 2d0c8af807ef45ac17cafb2973d866ba8f38caa9
SHA512 62b09abf6d9f2846c1785343a14449c125b8955c2445171a8bd76af58c874fdf1552070145ead76e36da2869c740b98a5ee900d87403ece014ca438fbdabaac5
MD5 SHA1 SHA512

Submit Download

UpdateDate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Minecraft\mod1\UpdateDate.txt
Size 15B
SHA256 60e1684e902f0821ba65e3fce942969ff6273ffc4f987c996d67fe7fe3f1088f
MD5 f66c63cf0ff76c19209f85ca687a2fb4
SHA1 a6c3a7f8bfd832eacd4b27e3303d051d620554b3
SHA512 05b77de2790acbda6cfe8c4cb59902d0b084f3566ef6f618abf332bc0e0a78efd01cd8e8aaac75aff27fd73272ce7b8a09361532d1d7cdec8b67da1c9cbfad85
MD5 SHA1 SHA512

Submit Download

Rate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Minecraft\mod2\Rate.txt
Size 2B
SHA256 bdd2d3af3a5a1213497d4f1f7bfcda898274fe9cb5401bbc0190885664708fc2
MD5 c7e1249ffc03eb9ded908c236bd1996d
SHA1 e62d7f1eb43d87c202d2f164ba61297e71be80f4
SHA512 838eb538a86499c61ee2f47a4d94114a03a623c8f70b95dd0d74e552c8448de53aa3a53b3682cff76022a3edb8f08dd2fd48a2c3614e7fb3b8a3ce1d1e5662bc
MD5 SHA1 SHA512

Submit Download

Date.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\OSU\mod1\comments\comment3\Date.txt
Size 29B
SHA256 6c5a80d5264f0e542486ef5a9ed9c650871ea2730850c1a3914cc0fa1e2c6c6a
MD5 b9e0793e22f6f0d39d04581b97a9b852
SHA1 22e9aa9775886f595b69b46449b194185fa1e672
SHA512 9b573ef81698eacaf7e2259798b6b043d3392d5b6398d9ee7c63a2bf72f0a32f87bd42c93f3f5371f8fd0c8fae3672165fc05476ed2ed1920b36ad7e847754f8
MD5 SHA1 SHA512

Submit Download

Rate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\OSU\mod2\Rate.txt
Size 3B
SHA256 ad57366865126e55649ecb23ae1d48887544976efea46a48eb5d85a6eeb4d306
MD5 f899139df5e1059396431415e770c6dd
SHA1 310b86e0b62b828562fc91c7be5380a992b2786a
SHA512 643c30f73a3017050b287794fc8c5bb9ab06b9ce38a1fc58df402a8b66ff58f69bf0a606ae17585352a0306f0e9752de8c5c064aed7003f52808b43ff992a603
MD5 SHA1 SHA512

Submit Download

NameText.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\PUBG\mod2\NameText.txt
Size 3B
SHA256 f7abc869526cf7f2d70622bdc0eedc496cec64d3bf9d53f5a0eb5a253f7b7db5
MD5 6acf5841c41ad6e7f0d0e91b2ad1f3d6
SHA1 44a509a28388dd58d56af8581724422899ab5640
SHA512 ba86059a29007535def13f9c09b691a29f8b20e1aa59b5a4efa6236cfe57de70d016b4cc10b732d7d8d2eddde0309295d3320ed83b2bfcd6ee4646bda0e2e44a
MD5 SHA1 SHA512

Submit Download

UpdateDate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\PUBG\mod3\UpdateDate.txt
Size 16B
SHA256 d0f0d40bc289836bb6a8122685ad3def633b284d476f317bfe314e1ff09a035d
MD5 c38a1b936e30f7420938a4cf9cd7385d
SHA1 c81e79fadb9ffff21f9f5ccdca0cb10850f40043
SHA512 6f68a60bbebce50a71c7d59a40abe5bf1679271e289cb40a8ccca1c7b182c8f6cac6782798b180a48b154a0720d87f4a776376b60fe45b75677df70eb11ccc08
MD5 SHA1 SHA512

Submit Download

Views.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\PUBG\mod3\Views.txt
Size 2B
SHA256 f74efabef12ea619e30b79bddef89cffa9dda494761681ca862cff2871a85980
MD5 fbd7939d674997cdb4692d34de8633c4
SHA1 d54ad009d179ae346683cfc3603979bc99339ef7
SHA512 bc7dea130d219f9d1097a174eb56df348da86f1080c5e5c1ff9e9ef4c4204640ba01b946f3a2fa8ea8adcf2a099e76ccb58d8632c7c51b1d42c5d4f72ce09413
MD5 SHA1 SHA512

Submit Download

Rate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\PUBG\mod4\Rate.txt
Size 2B
SHA256 8241649609f88ccd2a0a5b233a07a538ec313ff6adf695aa44a969dbca39f67d
MD5 92cc227532d17e56e07902b254dfad10
SHA1 8ee51caaa2c2f4ee2e5b4b7ef5a89db7df1068d7
SHA512 7820561264baf306e62430accddb1e07cc3129eab1ad131040c36f84b7bda8e283116fcba7582f53f8521b8ad70789c34cb82781cc48e028e646a12c004de63a
MD5 SHA1 SHA512

Submit Download

FilterStatus.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Roblox\mod11\FilterStatus.txt
Size 3B
SHA256 e55cffc81a5ad8cfe85239d944a3ae9513645a9eed79bc884f51b80b2760fc46
MD5 ad148a3ca8bd0ef3b48c52454c493ec5
SHA1 7dd30f0a95d522bfc058be4e75847f8b6df9f76b
SHA512 fd2d1f62aab380a798f7a2daf73e8aca617ddbe13da858609939d7420769d3398000e5463a9ab995ff8d0c48c2a1b64bb71db0528cc5adea40abb5bf9cd1a62a
MD5 SHA1 SHA512

Submit Download

Rate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Roblox\mod1\Rate.txt
Size 2B
SHA256 8c1f1046219ddd216a023f792356ddf127fce372a72ec9b4cdac989ee5b0b455
MD5 ac627ab1ccbdb62ec96e702f07f6425b
SHA1 9a79be611e0267e1d943da0737c6c51be67865a0
SHA512 6781a9e05f5e327a138f3d09ce0211ce4f166d940a14b46373e44402a3f3754cab4109f62c50777cbc1e3c4f1b8e6234e8d0b41281571bf0e1bd480c12149830
MD5 SHA1 SHA512

Submit Download

UpdateDate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Roblox\mod3\UpdateDate.txt
Size 15B
SHA256 492f98cb9752bc0a603dbd27dfc2e23d62ff6f40bd2024022c33a6d8a1681bd1
MD5 1b8b5642a1e9aaf4a3bc12cc489b2fad
SHA1 00c86ae34d12ae3754c9e9c49116ee055a27b93a
SHA512 582092ea11b666e2bf16b9467aa4e87f86c3425f0822f8ca81eecaa73fd6f3e23812d6744a629f1bd00d8d943ab2575a3cdc1c126914d57bc935819f48d15da8
MD5 SHA1 SHA512

Submit Download

Views.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Rust\mod2\Views.txt
Size 3B
SHA256 6566230e3a3ce3774c1bbc7c18b590ae0f457bbcd511e90e3e7dca2a02e7addc
MD5 d1f491a404d6854880943e5c3cd9ca25
SHA1 8b7471f4ae0bf59f5f0a425068c05d96f4801b9e
SHA512 4f593caa3b94b9892eaa62ebb1e737e0b93f63c57c6303ddc49ee76800b0bd7af49dae671591befca11ef0af8e91e45d5954aa1ba0d4b64fd477283729c3aa11
MD5 SHA1 SHA512

Submit Download

UpdateDate.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Valorant\mod1\UpdateDate.txt
Size 15B
SHA256 cecdb54237bc11921ddefc8d93cf83b8f1799a786af00138534d25456d0830b6
MD5 dd6a36e60f4ebe3ce70e7a8639e62b45
SHA1 d995969cca20b85508012597e2d986ee552241b6
SHA512 8b366e43efcbc80d162b6faea7b7fc48b56e8a4785c4704371b2d5ea90c8a8eacdf17af2727362c8a28e62eeebf3e243b065d539f7d6db56b1652c719d830e42
MD5 SHA1 SHA512

Submit Download

Banner.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Valorant\mod4\Banner.png
Size 41KB
SHA256 182e5b41e1ec9c043f6bf411c5f8be49c3f76c9fbd8c6105055e366a7cf79c44
MD5 9e9f5f301ed7773371f1f0779d755e08
SHA1 b12bd0aae4a5315329132efcbb870fa71f852064
SHA512 c3afbcb9c850c436686c45b8bf43495f62c736a9fca0210ac64e91e3e6aebab681dbe9a4a7112b5a9b97f74bb4a064f094b5fb21bc2b6e092eab978335103a73
SSDEEP 768:TmISH64pQPcTAoVBC8gsITbOdQc5VihJ+1U9WaRWtna3:SHPpQPcTBBnITbTc5plaRkq
TLSH
T1D213F1EF81119088BB199CBEDF71A348816B135513C5BAC513F9CE5E3D8AEC4BDE2816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Description.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Valorant\mod4\Description.txt
Size 204B
SHA256 c39486ba091411dfd88b64e6e83a1eb872730f7b3de2c94940978597fcfee52a
MD5 46d7a58920d78fc84eedff8edc320329
SHA1 1ba91726838ec259f2ea04b334667a3ad801ada7
SHA512 c41223c58e753c29eda315eea4e8ce84bf350da0e6d685caa98c8f118b19193e360ea28919106cc4946d72a4827b224877c2e83aa78ab6b2881acf3fdea24f81
TLSH
T15CD0237DF004117750252404324ED597C392DE5DD5101511C85CA17077A1F442974416
MD5 SHA1 SHA512 TLSH

Submit Download

Image1.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Valorant\mod4\Image1.png
Size 226KB
SHA256 5a66b8f54e8a3c8cfa996694a10958558b3e0d941c2d48c19dc41cc9ed48abec
MD5 ba061e40908412313b9a044f568c9295
SHA1 5b98f12ad7851c69f0ba63ed17483837cdb9df4a
SHA512 f3ea1dc9f0cdf75b3cff9b5d39ecbed8404f4f4b3be5104f9a8aa23958bb85bff743792f268bf87aa1a76c52da4946f33dd58c330ab22a37e9e91938a64edfb5
SSDEEP 6144:Ye41Nwp+Hyvse7tYIDw4ZtzNSZQLTM8sw9:Ys+ratYqwvQLTM8sw9
TLSH
T12E3423870A31FB1092A54B7E3A2E46772EF7C0785A5F56368839C258B873DDDE671032
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Image2.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Valorant\mod4\Image2.png
Size 370KB
SHA256 57a70970a81946c1ee47797bf1e969a861e6014ed7a7b4e82f2caa1bf9e6fc74
MD5 0fc9d8aa9f4431e69373bfc76b49bbf7
SHA1 65e51a4d4ef500e41477dd142236e9a22215bbf9
SHA512 0a95f47971fa0fc537d4934afc364a9865d61918144969ef0de30e2e3ff40a6a0d900be97136cb4acba701cd9e72d6f26fb2dfec3dcffec6d5c435489e5b3e1e
SSDEEP 6144:qutjkTbuOEnoQCN2UcvL3OJaB0RvHp79mQWXafPtQfLBFBIW7W+NB:NAu3ne2tjOEB0RvJ5mYtQfLjBIsD
TLSH
T151842374AE0FA6D2678835807BD65C2857D3770100F3CBD2FBB1F0355A232979EA6962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Image3.png

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Valorant\mod4\Image3.png
Size 304KB
SHA256 8a8c7ed1275bfccdf7d87292014d220725154f8c58a7e87722eb1335d31b3f25
MD5 3d40bac3233d35561a9513b773d645d9
SHA1 23acdf78ca632bae2c9c13235636aa37ed608b60
SHA512 34d3e0882b1bd6db263257e4cca0d6163eb8422741efc97e0abab4df8c71a1cd7fd0cd5af21ee21645867eae09fbc7bca23bd3d7144124575d2b38224807c9a8
SSDEEP 6144:vTaK+zb76tOB4EZzbj7WIjVl/9It22eMHz1M+Gl2h2SmycB5SJ8yJRsc5HjO8r:2Kg6O+Gj7W2/StJeYhj8ycB5DeDO8r
TLSH
T16A6422AE656EE454736723A80C82D9145D00D2F003CF9A43012A6D7A88F98FDCF58BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launches.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Valorant\mod4\Launches.txt
Size 6B
SHA256 e83c354d5ec4d039a0d133a058691b8312027960040e03217794f16926e2ad7e
MD5 bfbc1ad4f46a620cc54c9f70d9a03127
SHA1 d811631276182c42c6cc616ec38603f2c63433e5
SHA512 8553be28cd941b8fe9429bb3989d8233ed6e2c359bf5a8f7bc5af97d6634ea73bb702a336777925f21b8ba5794274cf6ceea3704c07cb0f554d199fac845cda7
MD5 SHA1 SHA512

Submit Download

NameText.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Valorant\mod4\NameText.txt
Size 7B
SHA256 c97f1306f711404877ed68ebadc8c380c99d78dff9b75c9e7969065efda5ce6d
MD5 3273dfdaeffa894f1a2cb32819fe271d
SHA1 7d59a8cdc6cad668b50ba033b5b44a5f9ff00a58
SHA512 d8cd46bb47c4efc0002b1412f550fa6b552ad2a42132e91661bb52b2a6de0896656c742387165b2e00b79ce3b1fb063064fb878b12c828a76f78e32b275f2fa8
MD5 SHA1 SHA512

Submit Download

Views.txt

Path C:\Users\Admin\Downloads\Vоltiх\bin\modssresources\Valorant\mod4\Views.txt
Size 2B
SHA256 7f2253d7e228b22a08bda1f09c516f6fead81df6536eb02fa991a34bb38d9be8
MD5 e2c420d928d4bf8ce0ff2ec19b371514
SHA1 d02560dd9d7db4467627745bd6701e809ffca6e3
SHA512 a8abec0b2fac3f9c8d08c0b2b06e75e591b67a5cba47cc0f0c66468f1db6b5ddb75461b57ea1e17f1eb90b62e6ca9e1cd2491e43829709288e1f1f592bcae1a1
MD5 SHA1 SHA512

Submit Download

memory/4452-4263-0x0000000000400000-0x0000000000A65000-memory.dmp

Download

memory/4644-4246-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4644-4250-0x0000000000400000-0x0000000000A65000-memory.dmp

Download