3d74cdf29ec23b1b14eeb1dd6719e6f737c1e4dcb7f5f8a56ce3c5c468295dd1

Analysis

user interaction
yes
max time kernel
74s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
volt.exe
Size 11.2MB
Sample260511-lfb7lses4s
SHA256 3d74cdf29ec23b1b14eeb1dd6719e6f737c1e4dcb7f5f8a56ce3c5c468295dd1
MD5 41727dfb7523bf6cd4a78af7cde837c6
SHA1 c91f668100f67f4ce54aa5c6c170442f6312d4e6
SHA512 35683d88cb595c39c8f433294b13ae52ed0d56b37c09967a696d369f084bde5ea2e05dd45a68b05133aa467ed68d8bbf38387065e5cfc58e427739c5b6ea7374
SSDEEP 196608:tq76bQLBsMhX5P9CNhjNCyX17i9DgAUhxLpRtJiqXCwlpEE1xICKqDTZfS:tG6UL2MhWhjNCyXRiHUbvtxCQhnJxS
TLSH
T10FC633497B0513D2F2B0B632E75D605225BAC91D4234E0FD77AAC7ABE01ED3C895B532
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1124 created 3264	1124	volt.exe	56

Executes dropped EXE 2 IoCs

pid	Process
1444	tauri-app.exe
4868	lsp-ws-proxy.exe

Loads dropped DLL 16 IoCs

pid	Process
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tauri-app.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	volt.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229653534095352"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe
1124	volt.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2240	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1444	tauri-app.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1444	1124	volt.exe	91
PID 1444 wrote to memory of 2240	1444	tauri-app.exe	92
PID 2240 wrote to memory of 3756	2240	msedgewebview2.exe	93
PID 2240 wrote to memory of 4240	2240	msedgewebview2.exe	95
PID 2240 wrote to memory of 4240	2240	msedgewebview2.exe	95
PID 2240 wrote to memory of 4240	2240	msedgewebview2.exe	95
PID 2240 wrote to memory of 2272	2240	msedgewebview2.exe	96
PID 2240 wrote to memory of 3860	2240	msedgewebview2.exe	97
PID 2240 wrote to memory of 3860	2240	msedgewebview2.exe	97
PID 2240 wrote to memory of 4120	2240	msedgewebview2.exe	99
PID 2240 wrote to memory of 4120	2240	msedgewebview2.exe	99
PID 2240 wrote to memory of 4120	2240	msedgewebview2.exe	99
PID 1444 wrote to memory of 4868	1444	tauri-app.exe	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3264
- C:\Users\Admin\AppData\Local\Temp\volt.exe
  "C:\Users\Admin\AppData\Local\Temp\volt.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1124
- C:\Users\Admin\AppData\Local\Volt\tauri-app.exe
  "C:\Users\Admin\AppData\Local\Volt\tauri-app.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=tauri-app.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1444.4728.6311857838314927729
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffd898cb078,0x7ffd898cb084,0x7ffd898cb090
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,1009407970168371982,9713472039324952503,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,1009407970168371982,9713472039324952503,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:3
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2352,i,1009407970168371982,9713472039324952503,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3576,i,1009407970168371982,9713472039324952503,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:4120
- - C:\Users\Admin\AppData\Local\Volt\lsp\lsp-ws-proxy.exe
    "\\?\C:\Users\Admin\AppData\Local\Volt\lsp\lsp-ws-proxy.exe" --listen 127.0.0.1:30000 -- \\?\C:\Users\Admin\AppData\Local\Volt\lsp\luau-lsp.exe lsp --docs=\\?\C:\Users\Admin\AppData\Local\Volt\lsp\en-us.json --definitions=\\?\C:\Users\Admin\AppData\Local\Volt\lsp\globalTypes.d.lua --base-luaurc=\\?\C:\Users\Admin\AppData\Local\Volt\lsp\.luaurc
    3⤵
    - Executes dropped EXE
    PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd1AA9.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsd1AA9.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd1AA9.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd1AA9.tmp\nsis_tauri_utils.dll
Size 32KB
SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
MD5 6ebdde247cad8468575f1f2a4d7ae2a2
SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
TLSH
T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsp-ws-proxy.exe

Path C:\Users\Admin\AppData\Local\Volt\lsp\lsp-ws-proxy.exe
Size 6.0MB
SHA256 486738c935d418254e43acdc8962f62cefcb97ee41c4586c070973ad23d3036e
MD5 7bc0212746818664f04a1f03c03fa3c5
SHA1 fbf39d56c8f005fab1cb77c97a0ef10948f46cb4
SHA512 aca3532bc6b7eaa9fd3aa60f4697ac74fbca35f8490b0529256165b3297cbb4221f2aeb5bb844334a6042e08312354516a5c0bc16de126a3553a8e9111f55be2
SSDEEP 49152:0qkaooYXxnagJe0/aqbE9d9YpPZtSFi1l4erIPXHsxgBYn7Ev+zVwAHhUG0IDj49:AdVJeP8y1HWeXt
TLSH
T1CD5605157B8E68AED169C8B4C34A4B621A3234DB1B36BAFF00C454353F6A7B45F2D349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tauri-app.exe

Path C:\Users\Admin\AppData\Local\Volt\tauri-app.exe
Size 11.4MB
SHA256 bd5f3b97b599342fc77674ffa9e00df4e821e8017e128fa503b9c26006f88d35
MD5 dc0d786392ffe04cc8ef7f990ead2b15
SHA1 97c9e338fd997ba05e66d9c0e9c6732e789920e7
SHA512 d423a34bfdd7b1ab2f104d1102eebdabf2fac586f056345e37df151a5cdd98bee39e8a8443f36a975fad0b931c51a7b2b82b306558bc4dad01f00b700688cab5
SSDEEP 98304:tMC8+uIhgK3cBIwMxBN64kuRDj8CwgK6QY00MIwdkCRh/zadQnBYVvGXNKujg+gQ:gZj3uPAY00C7R1zaOBY0Np9g56i99SA
TLSH
T1B6C6BE07F29181E9C0ADC078835B9637EB32BC8D4624B65F2BE44B212F66F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a9160cd42f874e9600a583f1bf398f10373459e5673084b75c5fa60bf5d3f24a
MD5 4a0a0ae3f7b24a3b62422b89f5248161
SHA1 884e027fb06b0334715505ee0727035e8753cb6f
SHA512 2c36cf36c6c974fff50953f40bf8b25917553b48024d080da8ab30fea3a5e825cdfc5c018d88a0b86e6c5391c899b6aeb77342ba3c6d8e3b2b66bcca817ce536
TLSH
T1DFD01232B381013CC05030334042620C0A40D10B41454004D428855D7A1C0A02973481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 83b79def7762916536b642943290508d53d3cc459c6925b6db76df36eedd9dc3
MD5 fc813d41d2ebc65c4906ec5f17003157
SHA1 81f45958b792e9d613f9887a434f9c20e4370774
SHA512 4e8cf9b6086d8ca1373cd47e7e479f4cdc4b536744841a6effe723edc415ec951951d8d80a8bbee4a09c77f037e1549b105cfe5072bd04862f0a68323e608091
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 27ef597c9ca363a044e51bd6877d2ca8d04b805099edb7b3e87852fd62d1364b
MD5 9337ca59065927fafbdf3756494b0093
SHA1 80b11a81fe945b75a415875263bcdd338bb73577
SHA512 5736a0cc49f8d5eb394d518410b34c5680c6496663ab91e48a5ab2be1d433a5d6d52c972908b6025a74d8ed4ee370d8a15e02c269f7a75c046be756c8351f218
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 40d755968d481d11308a855fea5b0f6156bd42e26a0b3bccff03760f64581347
MD5 288d9cf2323b874952b1dcf177c65667
SHA1 d5f9091febcfd02536e86b8e20067705b8d1fb90
SHA512 7036631593023aecac7e0a052344ba6f2521e256ceb6c215bb7fa293fed1a18d4501b3bd65b2a0d4f4b3a55e1b381b85a5d2390f0e391576746a55598ad0c9a7
TLSH
T108A00231D6D14963DB1443F010C1114837754A1CE713475589B51064AD593849242015
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Preferences
Size 6KB
SHA256 8a71428848ff8ed3aaf386cf2bd7b042a4f59b658382d3f248362fffc9674e42
MD5 a0460e5fe393744b5d6b86bf4fc713bd
SHA1 be1254dae990d9c231ec04fe8f2633a54d2ebb9a
SHA512 b05c3d2d79460c0010c5011df4bed52336f54c8b83f1cafe75a5c404943a08eaf612064edfecff9cb97ff5e26f90d5da151577b5c7f6b801025d109bf9e3892c
SSDEEP 96:stP05NKd9b9MffPZ8i0vhEItktMm/7qx+WVHMSm+uecJJOjMdQjzP+gwlMOB:stP0TPfHZ8paIMV/S+WiTJOod4POlMC
TLSH
T18CD1B7026E2869B78CC7F6197A35FB12E6F6106266D50E58EBFC870C04E66CD7207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5939d3.TMP

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Preferences~RFe5939d3.TMP
Size 6KB
SHA256 d56a2affc00d1b28ac1794aaf12a89c374c008029e4af99383f82ac221a777db
MD5 425e31c6dc5ae0c2b8279ef01f7c8906
SHA1 1d4e3b7c351d9041fadc4cf16df6e7b1672b278a
SHA512 a9427c149d33125177a203e3116fd03c7c88053a3100718b7350f43281ae6dce0cc13ccc38a46718547bd7ec0864ffb313b8263e09409d6955ad35f467fc4a66
SSDEEP 96:stP05NKd9b9cffPZ8i0vhEItktMm/7qx+WVHMSm+uecJ5m1idQjzP+gYlMEB:stP0TbfHZ8paIMV/S+WiT5mwd4P2lM8
TLSH
T112D1B7036E2869774CC7E2197A35FB16E6F6106166D40E58EBFD861C08E66CD720790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 1KB
SHA256 574a2a7cba5ec4e1a734c93d88c0472fdf6025d4fb957c65201cbe598ff5ea6d
MD5 9d7e8037a6ab8515505921cde78c72b8
SHA1 29d6386e74cfd0b0c1f5f3666e5c500631f6606b
SHA512 c701b0694248d149cd78454d931f721b99b866db96a7654f2bf341d14394731b12f8a8c8fb3fd9ca7a847d903c57a0c28c14e09a5ae24dabcb9518345ac4ddb5
TLSH
T10B313573A4581BF67CC156C67742BB9F2E61506A83618E58D1EE0B0802E768DE62BD33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 2KB
SHA256 cf84e3064bb18f02eec1dc66894eac7d5556e3bb4ac99e7352e033f9865e4c2e
MD5 566685f838845941e10260c788abec19
SHA1 ca5aa6f98cfc8be6212337119dc18ef7fd7ccab7
SHA512 e5803c2ad2116247707a6d525f8781c0fc05232a95163cf17b25fc20d50cd648478f71470704feb1ac8cb4d505a57792b8e95d284d8dd17cecb6c22cdb94b4cd
TLSH
T16A51D773B808AFB79DE28AC57A467F276E3150698B611F64D5ED0B0801D769C7303C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 4KB
SHA256 4ca36e489e1d630d1eb72de6b636d54a6ec99df8aeec0a70657042f315879e65
MD5 b4224c16383ef012b74379db1cbf4e60
SHA1 8d17ebc9400adba3ebaacb288820612ac7d3336e
SHA512 5b2498e23ba070dcbf073a710ffb83bcc7af9e79feb4494f96e3e5cc77943be13391614f554e5d57c575d9573656664cc309fd0803ac25c547b72abbd54296bf
SSDEEP 96:zuGMbNkCufyFL6w0uqgf8Frh/cInURoDoto+5i6D4BErV69aZsZRTx6Sla:zHMbNb9FLOuPgooDUhJMErEtx8
TLSH
T19E81A822A464AB775DF2D985BA463B077AA15077D6A57FA8C9EC0F0C01D73C82352C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 3KB
SHA256 b7d594ddd1a40db6bb9a7c9319f5c8bb1e98561038b8125c08544e97aed869e6
MD5 e0eb2287825fd29e97083829c587f734
SHA1 54210e371a6340b47d3af653cec69c902b3a750b
SHA512 d4805006e9ed4d6c981e8a6db1f8c9ff68dc834b2349500e86c2ff065a3a27888e911abbbae2a7041989bd26ddd4afbbec308d0a23c171269c93581dd323fda7
TLSH
T14071C6376964AB7B4DE29A85B9822B1A7AA15037D6E03FA8C5FC0F0C01D73C82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 14KB
SHA256 6f19d052922afa1138b3d674083f02e4af4fa3f8e96a91fd16c3e23d34374387
MD5 d790037719085688da01fba965519e58
SHA1 8605e629e8898ef78d1b5fda444cb4981d5c88c2
SHA512 3d74a0d225e70bfd68acec028063f4452c5cb7dc5265138a520d2602f35fdf0bf715097aef1da21330162b4ea59e4608b34b7bf1747d0adc75af22514b13b813
SSDEEP 384:zHuvsrvyOiyp4+IWA1eUVWGfvvLhNbujJL5PehuS2h:ju0raxyp4sQe6WGfvujJL5POjI
TLSH
T13E62BE711B745A779CE6AD87BC8B3B1B7E81542ACED02F88E4E46B0E004B6CC1706C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe589ad4.TMP

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State~RFe589ad4.TMP
Size 1KB
SHA256 10a098b8223289432e588b7be124f7216cfa1921bf4cb254e84fa0751ac9df40
MD5 114857d62317ae05411d685d28d20780
SHA1 0aa27d6deadf0a8e5cccb97e930570d71b223e29
SHA512 ac478558069b9086a755dc437294dd649f686982b3a554e76c20a71824573f3e0b3e47e924a295b70f47b2627888c40e0fb4f5f800407fee49753953b4aa0876
TLSH
T14B211073D4582BF67C8146C67742BB8F2EA0506A82248E08D1DE070802E7A9DE62BC73
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1124-71-0x00000000005F0000-0x000000000064F000-memory.dmp

Download

memory/1124-89-0x00000000005F0000-0x000000000064F000-memory.dmp

Download

memory/1444-298-0x0000025069900000-0x0000025069955000-memory.dmp

Download

memory/2240-302-0x000001BB74C60000-0x000001BB74C87000-memory.dmp

Download

memory/2240-303-0x000001BB75630000-0x000001BB7566B000-memory.dmp

Download

memory/2240-300-0x000001BB6D2D0000-0x000001BB6D2FC000-memory.dmp

Download

memory/2240-301-0x000001BB6D310000-0x000001BB6D31C000-memory.dmp

Download

memory/2240-299-0x000001BB6B210000-0x000001BB6B265000-memory.dmp

Download

memory/3860-157-0x00007FFDA5FE0000-0x00007FFDA5FE1000-memory.dmp

Download

memory/3860-158-0x00007FFDA6320000-0x00007FFDA6321000-memory.dmp

Download

memory/4120-218-0x00007FFDA4B80000-0x00007FFDA4B81000-memory.dmp

Download

memory/4240-320-0x000002372D950000-0x000002372D9FD000-memory.dmp

Download

memory/4240-115-0x00007FFDA4B80000-0x00007FFDA4B81000-memory.dmp

Download