hxxps://gofile[.]io/d/oZq3pXMa

Analysis

user interaction
yes
max time kernel
139s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/oZq3pXMa
Sample260930-ec649avekc

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1768	VolkWardogsDMARelease.exe

Loads dropped DLL 8 IoCs

pid	Process
1768	VolkWardogsDMARelease.exe
1768	VolkWardogsDMARelease.exe
1768	VolkWardogsDMARelease.exe
1768	VolkWardogsDMARelease.exe
1768	VolkWardogsDMARelease.exe
1768	VolkWardogsDMARelease.exe
1768	VolkWardogsDMARelease.exe
1768	VolkWardogsDMARelease.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
28	api.gofile.io
29	api.gofile.io
31	api.gofile.io
35	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3288	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{C9D6B8E4-CB3C-45D0-8922-8822C106287C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1768	VolkWardogsDMARelease.exe
1768	VolkWardogsDMARelease.exe
1464	msedge.exe
1464	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2436	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2436	7zFM.exe
Token: 35	2436	7zFM.exe
Token: SeSecurityPrivilege	2436	7zFM.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
2436	7zFM.exe
2436	7zFM.exe
2436	7zFM.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5456	OpenWith.exe
4632	OpenWith.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 5108	3936	msedge.exe	87
PID 3936 wrote to memory of 3288	3936	msedge.exe	88
PID 3936 wrote to memory of 4788	3936	msedge.exe	89
PID 3936 wrote to memory of 4788	3936	msedge.exe	89
PID 3936 wrote to memory of 4788	3936	msedge.exe	89
PID 3936 wrote to memory of 2380	3936	msedge.exe	91
PID 3936 wrote to memory of 2380	3936	msedge.exe	91
PID 3936 wrote to memory of 1636	3936	msedge.exe	92
PID 3936 wrote to memory of 1636	3936	msedge.exe	92
PID 3936 wrote to memory of 688	3936	msedge.exe	93
PID 3936 wrote to memory of 1636	3936	msedge.exe	92
PID 3936 wrote to memory of 688	3936	msedge.exe	93
PID 3936 wrote to memory of 688	3936	msedge.exe	93
PID 3936 wrote to memory of 3660	3936	msedge.exe	94
PID 3936 wrote to memory of 5032	3936	msedge.exe	95
PID 3936 wrote to memory of 5032	3936	msedge.exe	95
PID 3936 wrote to memory of 5032	3936	msedge.exe	95
PID 3936 wrote to memory of 3660	3936	msedge.exe	94
PID 3936 wrote to memory of 3660	3936	msedge.exe	94
PID 3936 wrote to memory of 4828	3936	msedge.exe	100
PID 3936 wrote to memory of 4828	3936	msedge.exe	100
PID 3936 wrote to memory of 4348	3936	msedge.exe	101
PID 3936 wrote to memory of 4348	3936	msedge.exe	101
PID 3936 wrote to memory of 4376	3936	msedge.exe	103
PID 3936 wrote to memory of 2260	3936	msedge.exe	110
PID 3936 wrote to memory of 2260	3936	msedge.exe	110
PID 3936 wrote to memory of 3496	3936	msedge.exe	111
PID 3936 wrote to memory of 3496	3936	msedge.exe	111
PID 3936 wrote to memory of 3496	3936	msedge.exe	111
PID 3936 wrote to memory of 5156	3936	msedge.exe	113
PID 3936 wrote to memory of 5156	3936	msedge.exe	113
PID 3936 wrote to memory of 5156	3936	msedge.exe	113
PID 3936 wrote to memory of 5176	3936	msedge.exe	114
PID 3936 wrote to memory of 5728	3936	msedge.exe	115
PID 3936 wrote to memory of 5728	3936	msedge.exe	115
PID 3936 wrote to memory of 6028	3936	msedge.exe	118
PID 3936 wrote to memory of 6028	3936	msedge.exe	118
PID 3936 wrote to memory of 6028	3936	msedge.exe	118
PID 3936 wrote to memory of 5324	3936	msedge.exe	123
PID 3936 wrote to memory of 5204	3936	msedge.exe	124
PID 3936 wrote to memory of 5288	3936	msedge.exe	125
PID 3936 wrote to memory of 5452	3936	msedge.exe	128
PID 3936 wrote to memory of 5452	3936	msedge.exe	128
PID 3936 wrote to memory of 5588	3936	msedge.exe	137
PID 3936 wrote to memory of 5588	3936	msedge.exe	137
PID 3936 wrote to memory of 1464	3936	msedge.exe	146

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/oZq3pXMa
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa7632c188,0x7ffa7632c194,0x7ffa7632c1a0
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,3539886621974130396,15676965967421122568,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,2989937801589105491,5478973578585956381,262144 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,10634971188769763555,1745209548279112228,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10249312227155829330,5221232194662596101,2097152 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,4988076651723584664,11793792908789669010,2097152 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,13462708326226898356,7749824440955525782,2097152 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,10388413573752302374,8722515068686310417,2097152 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:2
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,8049210009676081254,9094165048826058792,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,209317387672941213,15511316435913613339,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,178399717318774159,11088042653156182257,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,178399717318774159,11088042653156182257,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,8126634862715411831,10868933807035107747,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6352,i,2938771628505651218,11593325064095704191,2097152 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6860,i,10473578469664501548,14593835508245975410,2097152 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,13306360050973820211,1411851892792251112,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,1963774449855915581,10306228168559862560,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7108,i,5942368173749568712,993324947886477171,2097152 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7496,i,13212997090396362464,11106918705591771571,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,10067214795240805585,15021410634448641695,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,16420636962098584764,2628588881556114102,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3144,i,11150410093774758906,5219279036970250678,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,1760078562189545227,1667325385636192244,524288 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,9188616008949480776,9710217015846766140,262144 --field-trial-handle=2312,i,9816730291458259116,7803262583426621874,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5488

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Release.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2436

C:\Users\Admin\Desktop\New folder\VolkWardogsDMARelease.exe
"C:\Users\Admin\Desktop\New folder\VolkWardogsDMARelease.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1768

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\VolkWardogsDMA.log
1⤵
PID:5508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 740e3ef8395762886b0b05c7b56b7eb9dc2cc08a2bf0687ecb462e46c4f3eb39
MD5 6b3cea8fcb1fd3724bc612fe33381119
SHA1 8fe427a32a1fa756830198e7c9c0c17b98ba2a65
SHA512 76e44e7828c6a9e677683a0671fb4d03e51f66f5c74dd221b4d97104107280b829f89fdc3b96fe46fbeb62fa8ff6ef8390f9d1888463d28e2539b1599ae22bf0
SSDEEP 96:S/p+IkvK8iF04d6HgMsj3KcM7qgaPr26vitAiQmMHQOv:op+IkyhGs+pOXq6vdmSd
TLSH
T135B1FD50B1913655FF19B7F264E8DC9E3B34A9F116431F9A0034C47ABEABFB101D1268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe592457.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592457.TMP
Size 3KB
SHA256 8baef81b53a11311fee4803a92787a4793218614a2fd4ec9481ab73bf154881e
MD5 3d82bfbdd5a37c236b42bce5cb28e1e2
SHA1 a05ba6e949e00596581c0e83b22f9099345f6a05
SHA512 96c342f5d2ec7660aa3a607b6fb10badf07035ab42f7557db4cf319e17cbd9b1ada2eb44141bee17e9f715a72c88b70b32cdfbc5af6d9bd5b1bce454d68a597c
TLSH
T11D61934465A07B9CFF68873398D42D8B7F344DF319835F6A0868D87A6ACB37550E03A8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f31bc00fc016ad66f6fed201c011cf3d8b9f2fb47721f06c195aa3f0b0ec1e73
MD5 83e04ea66b8f20ffc6d9af61f61f3582
SHA1 619a76ad158920fd668ce203b9603b094821c18f
SHA512 14bb2530b5b5369e27c93aeaf2d7f47897ffb39ba4f41130f8e89d32efe99fcbbf16d0de8cb8d00fd9c9489697b49922f65531dd309d995518571a0556b774a4
TLSH
T15871A8F3C3A6826DDA1196F09E14AF1BCE1C0456436C3D5989E4AF17A3F24B1E151B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7c1e6d986bbfa2a2d19f858296012b41c52bc853bef4171f3a4cfd122e3518d8
MD5 127bbf4eca3bcf2de780ec9c709b281f
SHA1 efa0515d1384dfd9886ded04223e12a91d1d5478
SHA512 cf9f1d29a13a82c49cff3c3530e038b3a97db6f9e543e55eb09b4a665c927303a9fec61917488221599882249d4e46d0f7a71368cbd3c9f4bbbf93315bc6c44e
SSDEEP 192:sxZ/RdMP0/fBsITudpjlrHW6+WNeJV/YRPQt1IgrJ:sxZ/MP0/fBsIyNHbS/mI9
TLSH
T1342297526E28A97B8CCBE31DBA15BF53D6F9503291D11E58AAFC861C04E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 be81cb7a5285c270f1c02ec772bc3d785aa4168e9d276602d6414d3b23199755
MD5 9969a1bc2d31340d00f7d385dda68515
SHA1 97f6e7b5905324883765def7841ba69f7407aae0
SHA512 18c32c769f62b271525ed0450a1a7f8f1eb2a6559784b8c83f4e3c89df7cf5b84c0dd08deac23c0a767f03952d538e8e119b5f92b5bcf97a1d6323992ae01969
SSDEEP 192:sxZDRdMP0/fBsqdDbQGdpmzlrHW6+WNeJVq7r/YRPCt1Ig5xJ:sxZDMP0/fBsqeG+HbS+/mat
TLSH
T1BA42E8066A24A97B4CCBD259BE15BF53E6F95032A5D40E8CE6FC851C08F67CD2217C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 141d60243adfd7b16069675c241417e88e0d3856eb037713a871515a980380c8
MD5 a6c1ef26b15726c9ce02705937a28c89
SHA1 6ebe0783308928b7eca26123247636153f14c3f6
SHA512 80d929c04b73c5d08f27ed470cb70b16620c1c58f883400a4da678059013caa6eaf2f0263d8a41acabca8697a86e0b559732bd985dcdb2e80fb4a6408a3bb50b
SSDEEP 192:sxZDRdM0/fBsFj1bQedpm6lrHW6+WNeJVq7r/YRPA0t1Ig5rJ:sxZDM0/fBsFjmuXHbS+/mZj
TLSH
T1C842E8166A24687B8CCBD259BE15BF63E6F95032A4D40E4CE6FCC60C08F67DD221784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a5cf0d7719b7f58d308eeb1d5a9395f7d95704ad46260ec2457fa79e2fe46d0f
MD5 7a25057f30d584a8467f9b34aa8497c9
SHA1 86cb86da33b8dbf3fafa9496d4dfaf240c07dfec
SHA512 14754a8253237016cc4aadf47c44717a3af7e0552112deaaf190c37627c243292c369d68604172f0cf8b8ad8956c6d205c0b44bb16b3f526965b46d9aaf677c4
SSDEEP 192:sxZDRdMP0/fBsFj1bQedpm6lrHW6+WNeJVq7r/YRPA0t1Ig5rJ:sxZDMP0/fBsFjmuXHbS+/mZj
TLSH
T1FA42D8166A24597B8CCBD259BE15BF63E6F95032A4D40E4CE6FCC60C08F67DD221784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 15b4f7c3b9c8239ab7463ed71e83a47e5ba6141e3c5ff8a75c10b6484af38966
MD5 20ed7497f866e5755a97d6f988b1cc25
SHA1 8abe71011f371318ed3f8cb22b88198d2de012d5
SHA512 07ab58cff1e211c56d731a77324c223bc0cc28f02b2c16a5f58aec94c3574d96d8ac812e8cff65e4299dc6ef15f34b076454b0be4cd6bbb0db6e6e29f08f7241
SSDEEP 768:QKK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3Hrod++N:QKK9uzYWvcQWsu1ja0HL7Q3Ud++N
TLSH
T1B4C20A3F640CCB7E5FC01A9DDC5A6F973E9802D7A6588D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1a368cb2-655e-4505-85d0-20300a913369\index-dir\the-real-index
Size 72B
SHA256 b4e6f455bc87a2a7b178e6c542f0fe7a73144145259cd6aba9ad493300ab0d7a
MD5 3a5666c5d3b662300311ed8f03c4e6e5
SHA1 aa2b7e9628bb3ad14a0380481141b170252f9b5b
SHA512 4a5f1f1891537fe3f78a045e921f6186f09a172dd0701c778908b59dca773e7e52cc9d20241a1eeab2680cbde03aa5073b72d7daef7a1c43ed2bd9b931d5cffe
TLSH
T1B7A0021C03882816C14233F829965249A320CA944605575B73912258DC909674ED100E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1a368cb2-655e-4505-85d0-20300a913369\index-dir\the-real-index
Size 72B
SHA256 0805fc555db70ae60901ab606e6323eb8be100e28236043d13530263f6fd1a1e
MD5 d07e3c7932ac3c22a3338375f19f0f1f
SHA1 2a802294f839de179b856c3163ad6d6482bc1176
SHA512 3e3a801c9c6870e1a104434d15a960250fc1dd08954b9c3604819b0b7c2fc60377a8cc9db27071118d35dc605c0665d8663ebc072e0c13827fabcfc589391781
TLSH
T198A002104BD24045E01311B1195233611320C8121620130748935848CC724415D450AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\568da5b2-7611-4c39-a336-da0d40f37a75\index-dir\the-real-index
Size 72B
SHA256 34911b2963687d4013148647d9f132d9d4636458ea4ea96f732b83153c36baba
MD5 b8a785e08d1939ce3ab3e26f03fb1e7f
SHA1 b7cb9672a80d5ccd096fd9c6a62a9281b90bff92
SHA512 4ac08df338cbef72e718c7f409a8e71321717c143c4b9098068face538e885f86a604cb66ac2090f6f290a548385366b184a62e2515647cf98faa60d29d5d6be
TLSH
T1B6A0022141544095E1002FF06B4243D2A316DE5B1301871744A24495BC622ADC931250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\57cb5f6b-986c-435e-8a8e-1f285a276f4f\index-dir\the-real-index
Size 72B
SHA256 1b3c89ffc605347b7e023183e1f7981ad18dc97eeaad1bcb0d70d10d1c23c851
MD5 3e2cc28db17475e75f18bf32816b6428
SHA1 b0745283c7d62326faeb703992a6149430e45d4f
SHA512 d89a5f8306a1f5292119029c79149681568219f6d84bad28976829f958138b56bef1e03c81aa63cf1e23ca168503c3248a19dd72841ee2d3a812519e560221e0
TLSH
T15EA0022933902415D10056F1E1C3876167E84ED40102626E52D2F5BD9C925B852C30E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59169b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\57cb5f6b-986c-435e-8a8e-1f285a276f4f\index-dir\the-real-index~RFe59169b.TMP
Size 48B
SHA256 ff812d2d5b1c3c554983069584df5badc90ed66b7d90f935e9fe5c770b99dba4
MD5 04c1e104e35a96d05813498515b1d7ba
SHA1 e084e16442e7c9ae07ac0157f7a25882e5ecd9b5
SHA512 adeebf207784e46b4e7e73ce2b97d61f57a4050533902c673cbef528a439322f1576ee201259ee9e531cdedebd276f0d817d9ffc07e6beb73f5fda55221beba8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5b8a626f-7a8e-47ed-bf42-9a2d1cd7f9c1\index-dir\the-real-index
Size 96B
SHA256 b8880ea0ed93af35cae3cccf88816282b3278ec87cdfb64490c1350988a488f9
MD5 01f67dc4a007c0bb21c5c32a8f25c500
SHA1 18167679d956ec85040b31cd05974c7871d19196
SHA512 1341b1fe7b5129671ea94a8a9510e565c763bfe5740566b4398bdbdf31ba850b673137d902838604a62f2e3733b4bbabe8ff494c20d46c5ba9d8b9deb247f783
TLSH
T164B01216B2050101E27252B115920C5161504810021666222450A0B5EA006510561002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59169b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5b8a626f-7a8e-47ed-bf42-9a2d1cd7f9c1\index-dir\the-real-index~RFe59169b.TMP
Size 48B
SHA256 6696432b446b8b297dedf25e37ba475f17d456ed7f30057ce1472ed95f229408
MD5 013de0c1e0119632f4372407fcf04831
SHA1 25b170e78a78164295fd046d13470010f2b6039d
SHA512 4ee25455533d2f86a3747f654b44d3b33e47abb6a0505b9106613e69f8347391ea71510808bb0b5fbad47bcf7400213b2e6a28b71a385d6f16a991a71641139f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c25285b0-0820-4373-b90c-b7da29e72a5d\index-dir\the-real-index
Size 1KB
SHA256 f857c265b28b7f90efe0ba578efdae8b9746035d8ea0df377ade521c4a3d34e5
MD5 bb055d21fe9624325de50134205584a0
SHA1 9eac5d3d8c0d3133285ba98e40ab56009c367d4e
SHA512 d7003ad17f2100a2c4e563ebc55ce47f1504d42cdccc100522de31c0bc27e049b637cdfe0d22a805f951934077f60a4bcc716dab1c515c2ebfdd49969fbdde48
TLSH
T1742150820E934F97FD94633810392896B33192CC03547E1FA2FDE136CC96780BD89998
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c25285b0-0820-4373-b90c-b7da29e72a5d\index-dir\the-real-index
Size 3KB
SHA256 8bee91d112d08be8ab23ba0c5611e0fff3f0b80febca931b9f8eac22d5fb2887
MD5 bfc46fa667c9c5c2d01bf36a6977ed41
SHA1 65d61d2a5a803f8e603ba6d02f6688c165c549dd
SHA512 5169c60df6df24dca15b96e8b92941a1f613a63924216140e665dfc2eec6feaa5c96704ca8e616116d2094d037c6fd5d8a59c4aef06ac5a91c0161ff9b006918
TLSH
T1BB51E70F1D562F27FCA8A3B205B604563BB066CC2B444E1BA4FD9034F8C376D2CA9215
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587153.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c25285b0-0820-4373-b90c-b7da29e72a5d\index-dir\the-real-index~RFe587153.TMP
Size 1KB
SHA256 1b024c624d418943b37d31b85a407cbb712cdfdb1f5af14c296c19ceb7142227
MD5 b20aa8b9e3a08a92d31642d1cac0c167
SHA1 b282191148fed1ca44679d151006fbd9829ca272
SHA512 b562d059b93bf23f7283ada4d63ccdf07f847ef6cfa9b969f424bb28e535792b429626657003d613f5c9cf0ba4068e97deb3e24227d0a262f085514e9e85f283
TLSH
T1FD2163A201630B7BFC542336496D64E77335D54853543B0FA3E7E03ADC81B80ACC6AE4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 dd91c99a407fb4928e21c237f261efaac38b1be8f7c5725ef71917714876772c
MD5 c1bb701ccd92c619b3a3df3cc4fc3fde
SHA1 4ecd06e4049d4ef88acf5075436c1078505ba8e9
SHA512 5069c3a0a85a4b1fc9756888caeddd72c12d30bb1136ec1687ce4a1409dcea011e358f4857e5f547a16a75e502c87cd7d966cb5a187a38d9a2fbfac6c6d582e8
TLSH
T1E1F022F73FF32910BDAEC3EA243105A40425BC44C959AD9F806AB29B91B3B396158D72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 bca0209e766f34c73d54b8f937dc520363cd87653396944f8dcb748f8c345715
MD5 a4b6ef853136af4c5c9636e286f4b18a
SHA1 344043685cb08d75b49bd511124065555322c5a7
SHA512 7bf417bb0deac546e0282c3ecbf1274e84dd397e206e5cae7ab0306ac046e3a6c167906996213d9571eabd939643b68cd1bd7c35e8fc5be671d6fae7ac886382
TLSH
T1F0F046F73FF31910BDAEC3D5283105B40425B844CA5CAD8F4466A2DB91B3B357058DB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 f439997ec97118d22d9587fe60ec8360d43343f5e0383b00051f57485d6cec88
MD5 a484192fd97e1c8d22472a35d70209b3
SHA1 ef63a5c0f27ff6164e9c0042a669ff3e5241d2ea
SHA512 852b4027a570ded417ac139a8c0c88996dc5975e18f4e402db3269186d93996f0d55834d4f0b298e03555ecf795436b32e0057f82e0e826e7fec8a131cbbbace
TLSH
T146F097F73FF32A00BC6EC3E2243549E44025BC04CA0CAD8F406AA39761B3B267419E72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 dbde2727f81f8866cbb16e606c91854be7b9c81bc136437641c44b7bc799eac4
MD5 ec3ef26905553837caaaa6c1dbc86600
SHA1 4c4b63b8c860692af6bff88af496033562008a92
SHA512 dba75e64b3e84b14a2cf7ebe8286bd429f4d6ec0b0c79c6159be49d8ecb7e107ff5ebc928ce6ce127c0dd928edb2c650371944a4c76e5c95f809e01896025527
TLSH
T1B5A0021289549042CD2013F4D0B566C4A324CCD82A4527E980EDF2B49A931628193905
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c87b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c87b.TMP
Size 48B
SHA256 95061d972c0e2aae643b580b4fd8c95fda4596a694f7d7a0e5271c86183d7906
MD5 f95ceba092584f924c592b8164078c21
SHA1 b5240f4103922f8e67f6b74d5b31ca2cfd6344c5
SHA512 4ab332d88b72be2fa96433ea3913ffd034d316828005dace855a1e2fc9046562cfa40cc2237e82e13a4425dccbc459b834fd7b598cfc157aca44461178fc56c5
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8d07ed1a622a66d2455180dc5fc9e5756c1facb4bbc4102a2137a0a697446674
MD5 127661a346f6bc462e839c3c8538b51e
SHA1 e2a7f7e2c6f6d0ae2ce51ef6d8c9f1787900386a
SHA512 cc2dd49c93e6f48e26a404c908245adad96e1b268a915e93517147c78176cd030daa2c7f0a26703b2b8c64647eaa9308b70076e855109ee3260288e25f6e9f21
SSDEEP 96:K0m5owKVmK3/yR1/hBx8VssaNxKC4afxeXvkN4GcKrq/:hr3/yR1/hBeVsRND4afUXvkNps
TLSH
T1E291FB5176BB160079BD691884B58B2E528271733018EB6F3FBD84A24E67F0C4EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46d84869-819c-4ab7-9bc8-21114302736d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\46d84869-819c-4ab7-9bc8-21114302736d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 220124adf0a4fa43f17ad0b8e5d056b6112c01811954c0e6ab8405548c1308b3
MD5 fdedc7eb3d0a494abfa2b1d954a2eab6
SHA1 cf28fe9be16de1f80ea82b31b36c45ee4dbf5707
SHA512 f58168aeea13c68581c97dae17ccff378b139770bf7281a399ea4d3b2ae550d740c85fb107cb59714787bf790491f1647eb32ed78d4439ba37a26c70aeead0da
SSDEEP 384:DZcI7sN9FTDB/nxhn2OjTVY9di9r/D5tgOIwZOyyLCoe:b7qPnNnS25Xs1e5
TLSH
T1A0828E329C782DB75DEBA241F18672038FB8D467E6D96F54A4FD8B0D00D66A8231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8c2829d1afd7a8f505de433deed08e3aa56ab0a831c8be9ca8dd32c458422c05
MD5 4c2e3ab10eafefa028ff5a115dc31050
SHA1 cb68fb12e7611f5e258b56251630c8d7a40d21d1
SHA512 3e3f86901bd883ccc7bade5d668711bbe232487f8f59eeec228715efb1343c8ec2ecd742aa0394728aa7e1c0cf53b5f9174ecf78fa7cf93e9e7badeeacf4ec76
SSDEEP 384:fZcIAsN9MTDB/n9hn2OjTVY9di9r/D5tgOIwZOyyLCoe:3AvLnNnS25Xs1e5
TLSH
T163828E329C782CB75DEBA240F18672038FB8D467E6D56B54A4FD9B0C00D96A8231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5cbd6060038a10fc12b01ceb015197df3edcdfe31b33793c9a74743b7cb68ad9
MD5 82e62e32ce15ed8fcb015201116f642a
SHA1 64ab0b71216e8ab93a6a3085b018c3e1238f04c0
SHA512 0c3c2e231a4b9c76ce4a6abdad05c4cd6401c3c82bb942ace8681cf1f5a73e9532cc5401ba0975b3c50cf579d017b28fe46670d9df073d85c581cc1ffccbd072
SSDEEP 384:ZZcISsN9FTDB/njUn2OjTVY9di9r75tgOIwZOyyLCoe:xSq4nNnSG5Xs1e5
TLSH
T1A3828D329C782DB75DEBA141F18673038FB8D467E6DA6F54A4FD8B0D00D66A8231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6db0b0e135324b035b81403e7de2b6da2d30b93cc1219b3d0c4443ec8d5ab5e2
MD5 eb96d7f06513dc4036d028e75263df96
SHA1 8cf41c469f126c12decd24667e6e3765f00f1d25
SHA512 3f9e6509399822ef82c51abcd9e832582450fbef5c650882e7a23bec91f35bb15f02612b3e26b363d44c442a041935be00e427037e9c1ce798fd482bfb8bcd10
SSDEEP 384:LiF8ZcIaqgsNH8TUNTUlIlFTDB/njun2OjTVY9di9rd5tgOIwZOyyLCoe:mFq6WwgNqnNnSa5Xs1e5
TLSH
T19EC23BF248E7597AD9AE5743A37D2E028EBCC067F585A650B3D98A0CCC961BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 993237834ec34d314603f50b36bd11040f97259bf4e218ff1fa25293834b79e9
MD5 d4cdb508bffa826a505ced6883ad57a3
SHA1 53d91821d6ad9825dfe2edf16cd8cac192770a78
SHA512 835a14578f17689c0965141a0a24c36d248408e0a44f60890b288ce9e4de61698dd44ec0d575b05308d2d0ff7fed1eb730c13ea0032149e81c8b120463664ef5
SSDEEP 384:lZcI7sN9FTDB/nxyn2OjTVY9di9r/D5tgOIwZOyyLCoe:d7qwnNnS25Xs1e5
TLSH
T16F828D329C782DB75DEBA240F18673038FB8D467E6D96F54A4FD8B0D00D66A8231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3fed5f6c99e6555d818846e5a78f63e02f20de331d3370435b43fcc364aee956
MD5 d212698a289136a219021ba0cdfdaa44
SHA1 b2906f990e4b64300a37db87b09c2625ab8aa339
SHA512 a79e618598a4eecc5209c5ff897e4a8e3c9ea9b607e52796315f4b2e0f9bd70a81cf3875518bd01dc25e75c43498011b098c6e73bdd1de4a91fade41b78a33e3
SSDEEP 192:SON06ygpQmiUyfMtOCTVgLi+FdVsLzPjVU6:SON06lH9tOCTVY9diP5U6
TLSH
T14D02C735AC782CB78EB2AE45F48737179FA4117BEA562B84D9E84E0C00D766C2306D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5da296c0616c85fd752ef94bbefc3eaff9bfd89e50d20dfd3771a72918dee629
MD5 6ffe6f2c87c865e6d45064c4f84c00ac
SHA1 88ac52e441ee3935f0dc68b5cd7edc2bcf94410f
SHA512 02f95b21b71b89d240a3d2e549744b188b3021065c0797fbaae0a5b53532af11b777d90e4f0eb3d7c68aa4579e155960aa1ceebe26449456fe71aac788ddd295
SSDEEP 192:SONQ6ypQmiUyDMyOCTVgLi+FdVs9mQN43UVqMU6:SONQ6MTyOCTVY9di9rd5U6
TLSH
T159120935A8686CB75EA36541F08732139FA48267EE867F90E5EC5F0C01DB6AC2307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b328fbebf5b2a222153ebbb4931848cffdfa1a2165ee243747c1d260445e37e4
MD5 eecd86336db683c20b03643b02d7336b
SHA1 0df661f7dd95436623c1d6b13ee8c70c116cd3e8
SHA512 f384792a6c38fd1385537ed63295bca57e67188b1030efcfe12e92b451167e907d708dc2304ec55507b5a234d7be5b9f42b43766945fc6eacf2c1629c514a77b
SSDEEP 384:fZcIhsN9MwB/n4hn2OjTVY9di9r/D5tgOIwZOyyLCoe:3hSOnNnS25Xs1e5
TLSH
T1C3828D329C781CB75DFBA240F18632038FB8D577E6D66B54A4FD9B0D00DA6A8231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c8dd3650bfb2ed13b46a8920c53b3318254b0110c1cca0c5e7fd783613b0ac6c
MD5 7f7da917865b3825b78e2b09eed00f65
SHA1 bb4f08eb1af25b24ead64f7f0844b0963ad574a7
SHA512 5509198f08ff597b89c5092f5827db3b11f9808e3ce7f49b19cce5327c40d9fb23c7ae5ee36f60f2aadad9196f93c280e4262526fab0fb7ebea4f68debce2fdd
TLSH
T134411858F6E90144B3776E56AFF7B86E487EB9372E0AD59D00110E4E0626E40CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download

FTD3XX.dll

Path C:\Users\Admin\Desktop\New folder\FTD3XX.dll
Size 501KB
SHA256 3c0fc158fd4aa604c526d58ed8274ae830d53e69e01210cc5b5fa54ec5a9b7c0
MD5 f7a94af3b5f2f815866f97e8e0e393de
SHA1 b9bcaad236c9ce5e938c7477e79e13e621c962af
SHA512 7877f2a3d78a7a3cf72d117b4111a83f67f9e193c7c1f6daa29cd08e3d0833533aebc34c1e3cbdb17f0b243c963443790880e6ad9ced2a7c3171ef6f2fe6d1b8
SSDEEP 6144:wOJfCxZ2hUellRG5MJV8SAzLk5MKOE3LwEDHYG4LWNE7W5oP8E:dC/2LzG4leI5MKf3LtrCWCig
TLSH
T1C4B48D1673A503B5E0B7D139CA568E85FAB2BC550720E74B03F496B62F237A0563F326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FTD3XXWU.dll

Path C:\Users\Admin\Desktop\New folder\FTD3XXWU.dll
Size 141KB
SHA256 c507cb40f188740c4a7ba3aae4f848a305192b9b7c9e8e9264b1d66335824bfa
MD5 3a17442511d8ff7477a97f4bd252d3e5
SHA1 79f359d2678564a879eab9afb2320485de031c30
SHA512 e6a499cb81c91dfdab63086ae1394bb4fcbd06512caa1150fa27749a368ecc2f014954d0249ab12095b0fac52375ac5b91cb49be80472212f111fb0600b0251c
SSDEEP 3072:lzQhnH47pas7zlEzdj1I7HPRW5kxQUWBd/f6b0Wn13c:J7UsCdjOw1LLr
TLSH
T1B1E36B5773A500BBE4A7C238C5934A12E772B86107619FEF43A4476A1F237D09E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VolkWardogsDMA.log

Path C:\Users\Admin\Desktop\New folder\VolkWardogsDMA.log
Size 2KB
SHA256 9965a851a878337a2ad3ad04b78149acaecd3588aac72c1fd6d683b59c4eaa25
MD5 e81ef48c2380621e315dcf7a94417d25
SHA1 1d61b376c62fc29acaf2e45db5b3049fb839971f
SHA512 00279e6fc93496a32af827865dd38b15d1d94459f1a862a2fbc58b198310f7b1c14d3aa5a289a848851a8be47283d593365e374411360fbf2200980107584a5c
TLSH
T135518420F37B703075F94F01F1A5B0B56A4EAE2AAF45BD2815A8111EDB9AC153E7A027
MD5 SHA1 SHA512 TLSH

Submit Download

VolkWardogsDMARelease.exe

Path C:\Users\Admin\Desktop\New folder\VolkWardogsDMARelease.exe
Size 12.3MB
SHA256 68de5a326f79cfc61f286e60c3ae36a2e5ce66d4144d07d692fdbe3aba40da0d
MD5 5bcfce7bc0470754dc17fc17be5777f1
SHA1 260688f51a3a70e8b6947b141fc9e3fb1578c5dd
SHA512 3f167441a8f44804f2f7fbbc14a3dcd44de979f7946347cbf6b90de02344fe1ce65608152704933e9200e9c862f7ff1f7ba8385c3d55fb6b1c98cee0594de1ce
SSDEEP 196608:wib6Snsg3HWj8d4uHMq0HRTjKjCAU91ktLUEHudPBh1m2WtMhJMzwvrao:fscWjsMFHpj5AGktLInhY2W5kDP
TLSH
T168D612D964E012ECC492C270E38A17FDF195745D4EB9482EBFD61D012B32C2AD8E5E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

leechcore.dll

Path C:\Users\Admin\Desktop\New folder\leechcore.dll
Size 135KB
SHA256 6935224b6a43c2141d713bf867658da2392582474aba43d84e101711dc5f3d36
MD5 08747950e18e665cb5adc71f51c51c66
SHA1 8be2e655134828d9b586a4248cd7df3fdcea6128
SHA512 a282b9ce48378f5456e8e3dbfa1d3f2c3329f7634df10ccb85cbea5a01c4dc28df0d552795743947101e2be59dc67746521951b6c41cdae486cc4df361b543a3
SSDEEP 1536:ZqR7BVDfY2CW0VqIsz4ozIovpUEH+P07YCgD7gt+jdBJ46rcJqnnrR:41V7gWFasUEHW07YCgD7i+jdBJKJqrR
TLSH
T150D35C4AB79520BDC927D139DA66932BFB72B40823102FEF0664C9752F53AA07E3D351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

leechcore_driver.dll

Path C:\Users\Admin\Desktop\New folder\leechcore_driver.dll
Size 23KB
SHA256 18a0125f71ac1a37127207c364024739f134f9bdedc77c68db9e51dcb0736c70
MD5 926353b79769c5675eeb6a3aac57cd9a
SHA1 bd40fe13f84574f11a5de7372d668904aa7c8a70
SHA512 96052020e0b32bbc12f7cac45570cbe497dd68f251a1ffb6aba2a1592fe1e6ee364fdf07659df16fa6e242c2643b124602d1f5a25e76e4f931272173b3d7dce2
SSDEEP 384:cBjoM+NOLHY9iRUL8mPnsjaFm/VitWg86PlpUHiH90Iqa5mLYLlU5cNLyrn0au7U:cBo1OLEI6s5/+T8GlpUHiH90ta5mUhUx
TLSH
T153B22B19F7E014BAD4E7D27D85630707E7B0B91E57228BCF1360856A2E736C2993E326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmm.dll

Path C:\Users\Admin\Desktop\New folder\vmm.dll
Size 2.4MB
SHA256 64ac6a7a8cb21f50bd74502928486c325768fa8dfe2cf7f2648d09c286c9f8df
MD5 444fff5480590360677d537ac8d6c07c
SHA1 914fe86a5d2ca1754046ad866535ae1b411e5983
SHA512 0dfebd94937a2dfd67f2d1eedba46fa1491ee19c2aa5be338f1453b02335377db520b983e598b8ea59aaeffef9bc35ebdd88bcfbb803e415c04e3dbf737c38c4
SSDEEP 49152:Wi5jiQVo8pOM023cqE4mXChtHZxZCA4Jl9RK+s7Cb8OSfpPrZu:nxo8pOM023cqhuChf14Jl9EOd
TLSH
T182C58E47B7A800BDC46BC138C91A5B07E7B174052364AADF769CC9A92F63FE2127E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Release.rar

Path C:\Users\Admin\Downloads\Release.rar
Size 25.2MB
SHA256 0c014e7cb122d04fab26326459e169ccccda82a557dadb009c5bdc03b023699e
MD5 0f01d1030d64ae16c70a4ac858a5e952
SHA1 148c63b1f9a4197846d527d1f1ebb6523af062b0
SHA512 280a30e05027636cbbe6e485a6c793ac0f0546dbf243c421570ba88e65fae0b2bac8f51656d15c8265501a9bed38e500624f090a559ae65fd415fd31cf6a49ea
SSDEEP 786432:IUbuJdYQbdaXa/xKZWQfo7wCuFY8I4L7zuphLX:9uNb+SafoJuFY8I4L7GFX
TLSH
T17C473334B682E2C06DF9587F6A2CD136055D26831BEFF7D71286C19560F0FE4B52A0BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1768-1200-0x00007FFA923D0000-0x00007FFA923D2000-memory.dmp

Download

memory/1768-1201-0x00007FF79D130000-0x00007FF79E610000-memory.dmp

Download