e2701101e7c2be2979419a2e4ca22f1ec1c41bd82dcd7513bbdb2ca7fd6c33f7

Resubmissions

05/07/2026, 17:35

260705-v6c19sev7y10

05/07/2026, 16:06

260705-tkegjaht9p10

Analysis

user interaction
yes
max time kernel
509s
max time network
512s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/07/2026, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EMULATOR.exe
Size 25.9MB
Sample260705-v6c19sev7y
SHA256 e2701101e7c2be2979419a2e4ca22f1ec1c41bd82dcd7513bbdb2ca7fd6c33f7
MD5 d26a7270ddaa1b2308f9fa22a0ec89b2
SHA1 8429c9758f26c754435a7cdd5885c231b746d2a1
SHA512 e7bd0d3f839dd1275c886db0772eb85cffa5084a668e7085dfa3a338a701c5b0d22bf47425708c9cd8f11d131065187a7ac8ab52ff5b464533a020903045add1
SSDEEP 786432:SfQ7WlCSDebWhn8Ef89v9wMpQnuYahjqw:SfMWlUCxNw0hw
TLSH
T15D57234B79E593E4D7C38A009A8F12DA53C2728AC5DA591E15C65C033930EBBCF4AE77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3984 created 3404	3984	volt.exe	57

Downloads MZ/PE file 1 IoCs

flow	pid	Process
55	468	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
3984	volt.exe
5852	tauri-app.exe
4560	lsp-ws-proxy.exe

Loads dropped DLL 16 IoCs

pid	Process
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tauri-app.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs

pid	Process
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
4780	EMULATOR.exe
4780	EMULATOR.exe
4780	EMULATOR.exe
4780	EMULATOR.exe
4780	EMULATOR.exe
4780	EMULATOR.exe
4780	EMULATOR.exe
4780	EMULATOR.exe
4780	EMULATOR.exe
4780	EMULATOR.exe
3596	EMULATOR.exe
3596	EMULATOR.exe
3596	EMULATOR.exe
3596	EMULATOR.exe
3596	EMULATOR.exe
3596	EMULATOR.exe
3596	EMULATOR.exe
3596	EMULATOR.exe
3596	EMULATOR.exe
3596	EMULATOR.exe
3596	EMULATOR.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	volt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
468	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277465951173631"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5304	chrome.exe
5304	chrome.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
3984	volt.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5936	EMULATOR.exe
5304	chrome.exe
5304	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5936	EMULATOR.exe
4780	EMULATOR.exe
3596	EMULATOR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
2068	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5852	tauri-app.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5936	EMULATOR.exe
4780	EMULATOR.exe
3596	EMULATOR.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 5088	5304	chrome.exe	88
PID 5304 wrote to memory of 468	5304	chrome.exe	90
PID 5304 wrote to memory of 2292	5304	chrome.exe	89
PID 5304 wrote to memory of 2292	5304	chrome.exe	89
PID 5304 wrote to memory of 968	5304	chrome.exe	91
PID 5304 wrote to memory of 968	5304	chrome.exe	91
PID 5304 wrote to memory of 564	5304	chrome.exe	93
PID 5304 wrote to memory of 1076	5304	chrome.exe	94
PID 5304 wrote to memory of 564	5304	chrome.exe	93
PID 5304 wrote to memory of 1076	5304	chrome.exe	94
PID 5304 wrote to memory of 376	5304	chrome.exe	95
PID 5304 wrote to memory of 376	5304	chrome.exe	95
PID 5304 wrote to memory of 3816	5304	chrome.exe	96
PID 5304 wrote to memory of 3816	5304	chrome.exe	96
PID 5304 wrote to memory of 4968	5304	chrome.exe	97
PID 5304 wrote to memory of 4968	5304	chrome.exe	97
PID 5304 wrote to memory of 4100	5304	chrome.exe	98
PID 5304 wrote to memory of 4100	5304	chrome.exe	98
PID 5304 wrote to memory of 2680	5304	chrome.exe	99
PID 5304 wrote to memory of 5000	5304	chrome.exe	104
PID 5304 wrote to memory of 5000	5304	chrome.exe	104
PID 5304 wrote to memory of 3224	5304	chrome.exe	106
PID 5304 wrote to memory of 3224	5304	chrome.exe	106
PID 5304 wrote to memory of 1124	5304	chrome.exe	110
PID 5304 wrote to memory of 3984	5304	chrome.exe	111
PID 5304 wrote to memory of 100	5304	chrome.exe	114
PID 5304 wrote to memory of 228	5304	chrome.exe	115
PID 5304 wrote to memory of 220	5304	chrome.exe	116
PID 3984 wrote to memory of 5852	3984	volt.exe	117
PID 5852 wrote to memory of 2068	5852	tauri-app.exe	118
PID 2068 wrote to memory of 5276	2068	msedgewebview2.exe	120
PID 2068 wrote to memory of 5200	2068	msedgewebview2.exe	121
PID 2068 wrote to memory of 5200	2068	msedgewebview2.exe	121
PID 2068 wrote to memory of 5200	2068	msedgewebview2.exe	121
PID 2068 wrote to memory of 1560	2068	msedgewebview2.exe	122
PID 2068 wrote to memory of 1860	2068	msedgewebview2.exe	123
PID 2068 wrote to memory of 1860	2068	msedgewebview2.exe	123
PID 2068 wrote to memory of 760	2068	msedgewebview2.exe	124
PID 2068 wrote to memory of 760	2068	msedgewebview2.exe	124
PID 2068 wrote to memory of 760	2068	msedgewebview2.exe	124
PID 5852 wrote to memory of 4560	5852	tauri-app.exe	125
PID 5304 wrote to memory of 5932	5304	chrome.exe	136
PID 5304 wrote to memory of 4920	5304	chrome.exe	138
PID 5304 wrote to memory of 4920	5304	chrome.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3404
- C:\Users\Admin\AppData\Local\Temp\EMULATOR.exe
  "C:\Users\Admin\AppData\Local\Temp\EMULATOR.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffb7ca9c728,0x7ffb7ca9c734,0x7ffb7ca9c740
    3⤵
    PID:5088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,868075605126116570,14499388259104800410,262144 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:2292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,5239321755191795718,10025392590627499704,524288 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,6070790832177128499,12571255649056234091,524288 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2412 /prefetch:8
    3⤵
    PID:968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,15173575276276758938,11281563153398014271,2097152 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,18069340443265713347,11204370422958722952,2097152 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:1076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,2189893444056431504,4625000351516175654,2097152 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:2
    3⤵
    PID:376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,4179849227031556217,11233209087682293432,2097152 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:1
    3⤵
    PID:3816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,5841623289202609714,9215619117983058358,524288 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:8
    3⤵
    PID:4968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4440,i,8820972662566620074,5068499138565699127,524288 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5024 /prefetch:8
    3⤵
    PID:4100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,9465429710718424,4928921732241640868,524288 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    PID:2680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5728,i,17447098454074915376,9728245836211510996,2097152 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5696,i,5842707170385228943,11132773016969145807,2097152 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3908,i,2025149868591935669,14350610539270473404,524288 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:8
    3⤵
    PID:1124
- - C:\Users\Admin\Downloads\volt.exe
    "C:\Users\Admin\Downloads\volt.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,10327325608611659147,16711628661638848732,524288 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4864 /prefetch:8
    3⤵
    PID:100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,15126677967099420419,8214434803738718868,524288 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    PID:228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,4726219287570283586,15671073367303390542,524288 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3368,i,12938629051706855060,11456912204671895106,262144 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:8
    3⤵
    PID:5932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3544,i,9544699314194193172,776851384540464862,524288 --field-trial-handle=2028,i,7182923424160381764,1930771819614123366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:8
    3⤵
    PID:4920
- C:\Users\Admin\AppData\Local\Volt\tauri-app.exe
  "C:\Users\Admin\AppData\Local\Volt\tauri-app.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=tauri-app.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5852.2404.7949814729523854844
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a0,0x1a4,0x1a8,0xa0,0x1b0,0x7ffb5b03b078,0x7ffb5b03b084,0x7ffb5b03b090
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1808,i,10892231403749787477,16049810063933762880,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,10892231403749787477,16049810063933762880,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2300,i,10892231403749787477,16049810063933762880,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3580,i,10892231403749787477,16049810063933762880,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:760
- - C:\Users\Admin\AppData\Local\Volt\lsp\lsp-ws-proxy.exe
    "\\?\C:\Users\Admin\AppData\Local\Volt\lsp\lsp-ws-proxy.exe" --listen 127.0.0.1:30000 -- \\?\C:\Users\Admin\AppData\Local\Volt\lsp\luau-lsp.exe lsp --docs=\\?\C:\Users\Admin\AppData\Local\Volt\lsp\en-us.json --definitions=\\?\C:\Users\Admin\AppData\Local\Volt\lsp\globalTypes.d.lua --base-luaurc=\\?\C:\Users\Admin\AppData\Local\Volt\lsp\.luaurc
    3⤵
    - Executes dropped EXE
    PID:4560
- C:\Users\Admin\AppData\Local\Volt\EMULATOR.exe
  "C:\Users\Admin\AppData\Local\Volt\EMULATOR.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4780
- C:\Users\Admin\AppData\Local\Volt\EMULATOR.exe
  "C:\Users\Admin\AppData\Local\Volt\EMULATOR.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6b8a87ec692b1191578312e037ec1e37a50dd0ae3e315a0d94fec07c5084259a
MD5 b9d8758790425fc42274a8dc3a705231
SHA1 dd2ffaa9d8ba9f6804129abac9139457090fc786
SHA512 c1a0c48a1d9c03c8f5eb0e9e4aa986ad005a93eb9bfa055d9febf78598ac883192b7692e66056c9799ab6a17fcf615dab31589ac563189f4a023861479a69c61
TLSH
T180E09B66C8619D2B0CFD47186161478AE74013673750CD1B3F3D860C8F7057A958591C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 2a3211099fc622b8c169f0208fe820a5d054c8ba42aa2edb45ba27a241f0742e
MD5 55d44fa6049959a2c42f6b4c50d4fe04
SHA1 f3abead4278102b288117a5346d8a71c1077f221
SHA512 a33cc6fc6ef6fe87ee2e92a5fe5767386a361f556c40c7977ac91142e4c12acea2e2f711706ff62c6fbe53d38883f523351dc54e6d6323d46a231e889894f65d
TLSH
T133F0228CB7C9228ECFDD0370A8810D1921379800C0421BF762A4813E732BAC2430F050
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 edb1895e23ab258d8121bc2f04906cfc8f633f5b2e797d8bfcac352e848bf55f
MD5 fba295e923465760d71dd4656a1a844e
SHA1 ad516aaed071a582724b3f2ea8a5667c270bf28a
SHA512 f2b8774241ed2e3680c5f7fce8021ead1a9ae360008e437a3292de6769b53a813d612d29f057bf6c00f28644c1dab38fce4f81aa2b995d3f717b97fc5c16e297
TLSH
T1AB515CF7C3E4856DCA1196F49A156E1FCD6E0A24132C3C66C9E4AE5B53E2872D20178F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6d07408cda4508d7d09bb4d7ce819af61be3079ceaf1f86ede2c7bb901d226c6
MD5 92decb126c044dca320869b61bff4b59
SHA1 eaf9fece45c10fe6c7e949a8116d98221dc2b0e4
SHA512 b39df95f3710813d9b006a7e8c024ac8fec550093139ebf93c254bac33a82b88d69ffc61c18cb822528804ba225592226fa58984b8ecb8fccc77a43baf0911f2
TLSH
T19A4147B3C7D889AD8A0156F4B6152E6BCE6E0E54536D3C5BC8D4AF0B93E2971D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 39518073293223c821bd16a93ae8bcec6cfca139be932db31959dfac9a79bd87
MD5 619ac71df59e531e596dfba3e630603e
SHA1 64f145573df17accbaf7aad44f5535f045f5b111
SHA512 9cecddeadf198da3ae912b277f73cb484201ad84cfd28241cd6cc9eeee5091ea1efe7187ee75086927e0d0b56120fc7cccd82f8c180275c39a6adf27001618fe
SSDEEP 192:4RjTbOfr9sJKv7apAPRp24GH9FHsb+WNn62JzH2cEakwpVyIsnAUgtaJ:4RjTbgrwGmUXozwbR2Nav8
TLSH
T1CB52B42EEE58293B9CDBC229F9217757D7F6103221941E44EAFC8A1C05F76CD212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 51b00436f7a46106f09a746e511c7c1f3aef1b3b8f9d063e9f16b1f171580086
MD5 1abcc3cfcaba9a1dfa53264fc73f7c61
SHA1 34c8c20095b599fb3468a90aedd62eb14bdb9a9a
SHA512 1fc586854e1e38b077b4e79f2fa236e2d5d1d2fc7b2599fd9e511959da23541d4ebc0d89d73aefda1f1d02fc05811a4de1054284c251be3b730e2c23c181af2e
SSDEEP 192:4ROTbEfr9sJKv7apAPRp24GH9FHsb+WNn62JzH2WEakw6VyIsnAUgraJ:4ROTbWrwGmUXozwbR2jaae
TLSH
T1D152C42EFA18693B9CDBD229F9227757D7F6103221901E44D6FC8A1C16F7ACD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 28d839bcfb204efc07b4fd905c67b665b7ac963845fbb1076a952430e84c9580
MD5 623df45ab32f98fe9333da65db20fa6a
SHA1 3aca3990ec7e9c1a4e8ee01676e4e78ff050d667
SHA512 9d9f6980470a8d4379ef5581e62ff9365b414f4ab44aecf1494a184ca90b2d36d560d251cec4e66f08d691dc5901d526c1e9510e08775f0ff1ff876d77a77b50
SSDEEP 384:vNjzO7KxkXqKf/pUZNCgVLH2Hfgsl457pLuLcSjZkXODzq+ErU3p8L+HGyN423w3:vNzO7KxkXqKf/pUZNCgVLH2HfgsS57pz
TLSH
T1FE721A677C4C9A770F94C68CD8167F4FADB5025B61E9886443FA882903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 69503326c1ed496cb89f41abb78b530e725e96ef3639e35c6377a956c71dd23c
MD5 d7e52b2c58c58b9d3bc87fc11dca15dd
SHA1 df09f72d24e02c97a340755305ca2648e3476afd
SHA512 0d709bf52e92bd418707232bd9d8ab6bcabc5dc4feb819bff04231c385428b4c95baf75e82379e3ddf8928f77ea03926e0d930cda853a40f91b94ad8fb40e7a2
TLSH
T14AB0124090025645C04242F016922588B1145F19960A170153F07A62C8252618118060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591a83.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591a83.TMP
Size 96B
SHA256 a50f1bbc9a38840f8a1b7eab74973b1c11487d59171fe82ecaac5bf07959b647
MD5 ab6b50b7520fa82153dde512780398df
SHA1 9693fa402b4b2a3475ea0e6a69d9df4d4b6a816b
SHA512 66ee5a3fca806d69b47b652c81b1a509d25613c356f3f98940d71fcee71db1afac918a643bc35444268a5b7be1d0f2d5ba50d3fceb53f9713a3b7bc647cbabd0
TLSH
T16AB02200C0022302C00203B022A8C3C8B220CF20C203020282E00F2BCC302308320020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 38036eabbf3c0b2954d77588bf4a5bc9166b8d032f91c859635fc70c5b8e4451
MD5 981dded906617920e8c9b53cff4e9524
SHA1 acdb3e977a642a4b4e266e6c0af0289c8239a495
SHA512 2e567e796c07ac2f8cab7a58344470a85049e266c2ef4a4ad2db8fa817681b63b17b5f0cde262abb90d2233b9f1a24eff456ed57194f68b58b1f438ef2a35d73
SSDEEP 6144:vwP8pYw80nubFS/sBNxYm7Rkm1tYpBeh2BAo8:IENBUDZ79oBGcAo8
TLSH
T1123423363C515E7BEDA8BF1DB4022A1F0EF14D66C920EE96DCC89F4872AD20D5D489B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ca0d37a00db8aed9d4504f585f6682baf9c009e8f7ac98d1accad0df5f5fb940
MD5 36dd6fd77240682fb9cf29e54e2095e4
SHA1 ff83ed51362456d8f4cf80821a2aa14adc05b669
SHA512 7c24b486419dcf4047e02fb22e736be27dd0e3ee844994e76f7c6fd9b12668dd2a2154b37f76688d2c32e18a701e6903dfbf4a18d4803aecbf2571dd82c8428c
SSDEEP 3072:TNGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:om7Rkm1tYpBeh2BAon
TLSH
T1ECC312275E71A97B58B9BB4EB08E0B1F1EF149A2C930DA52C8D85B0437F97C81A48D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 729ebd87a3e478dbe1ae4e6451789d41233f9479d224cd020b71f0fb83e2ba04
MD5 19a9fa44ea4d29fabd42c378132627dc
SHA1 cdb3b992703c9bdd1f889cb46774b4bb48e89f46
SHA512 bd8dfd80b3dc591f7090ab4dadf7efe1220df42b97c7e7288d9cbabdcc3fecc974729dd0d9ceab33e73f35535a498ed98b93e3327c706fe7c54c79612833eae0
SSDEEP 6144:pP8pYw80nubFS/sBNxYm7Rkm1tYpBeh2BAo8:pENBUDZ79oBGcAo8
TLSH
T17A3413167C919E7BE9A8BF1DB8031B1F4EB14C66C920EB97CDC49F4872B434D1A489B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9c7a0a4aa8ba81e29385f15af21896d7e62da805568f8b66acfd72f68236f70c
MD5 1339e9b8d4fc777640714d696561ea53
SHA1 e438c27ec6b743a9cc5aab8992b6b65590d323eb
SHA512 f934bff2907e1e5e45426f732bcee19284d7a627b4a7983207079ab13ee08f96127e43ed7af4679965e92155e43c88c7d7274cd3945e2e6d5a38f8e87f9e8dc2
SSDEEP 6144:aP8pYw80nubFS/sBNxYm7Rkm1tYpBeh2BAo8:aENBUDZ79oBGcAo8
TLSH
T1383413167C919E7BE9A8BF1DB8031B1F4EB14C66C920EB97CDC49F4872B434D1A489B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 303074df673d8fa529dcfc9a57f25553e5fd90a14c7b9d57e14e33c3d039c397
MD5 05a8d272c800665c20674cbdd41c45ef
SHA1 15c228e323b04b8fac2fe47176b2b62cd9d30062
SHA512 8ced000ae4b50a3e1a3a80becf24d65cf1fa8538e393d26bb967f3cf2296f5c8f8b54cd013546cad6017a7417582eeb6107010de46741d8c31d91c4bf94352ed
SSDEEP 6144:jwP8pYw80nubFS/sBNxYm7Rkm1tYpBeh2BAo8:EENBUDZ79oBGcAo8
TLSH
T1FA3423363C515E7BEDA8BF1DB4022A1F0EF14D66C920EE96DCC89F4872A920D5D489B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiAC6.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsiAC6.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiAC6.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiAC6.tmp\nsis_tauri_utils.dll
Size 32KB
SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
MD5 6ebdde247cad8468575f1f2a4d7ae2a2
SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
TLSH
T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsp-ws-proxy.exe

Path C:\Users\Admin\AppData\Local\Volt\lsp\lsp-ws-proxy.exe
Size 6.0MB
SHA256 486738c935d418254e43acdc8962f62cefcb97ee41c4586c070973ad23d3036e
MD5 7bc0212746818664f04a1f03c03fa3c5
SHA1 fbf39d56c8f005fab1cb77c97a0ef10948f46cb4
SHA512 aca3532bc6b7eaa9fd3aa60f4697ac74fbca35f8490b0529256165b3297cbb4221f2aeb5bb844334a6042e08312354516a5c0bc16de126a3553a8e9111f55be2
SSDEEP 49152:0qkaooYXxnagJe0/aqbE9d9YpPZtSFi1l4erIPXHsxgBYn7Ev+zVwAHhUG0IDj49:AdVJeP8y1HWeXt
TLSH
T1CD5605157B8E68AED169C8B4C34A4B621A3234DB1B36BAFF00C454353F6A7B45F2D349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tauri-app.exe

Path C:\Users\Admin\AppData\Local\Volt\tauri-app.exe
Size 11.6MB
SHA256 0cab8dce3b62bc3702fa1479bd8e1fabef1a6ac579114a1d44840a67eda51e84
MD5 e55294fad8688f68a73f8d2b799a568c
SHA1 2b42175a9143d784b8c6b265807f49dc72b4610b
SHA512 3c160f5029c034f8e8e78d7b6e154bbd31a4a50e533a616d2b836524dfedb3bef9a17ef1e19b713197262e39c68541dbc2695314457a00df9a59e0137addf269
SSDEEP 196608:zqr72hNvg9SU9giN/qS5HUInWkp2X0l21OT2:7NvVUKiN/R0IWkp2X0A17
TLSH
T16EC6BE07F29181E9C0ADC1B8835B9633EB72BC8D4525B25F5BE44B212F2AF906F1C759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2838889a-ddea-4255-94c0-ea71b9fef142.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\2838889a-ddea-4255-94c0-ea71b9fef142.tmp
Size 2KB
SHA256 fab1f0c86fc5a71f210e573337657300b2473db8fd3de82435afacd29644b7a0
MD5 6ebb5c43a60c27565894ba8f26fed3a1
SHA1 7536ac405ed022cb7b683c92706f430b1e1c4f5a
SHA512 58d92cf8b2a2ef18c88e645beaf01a14f839edc4b69517fd814f04ef536c135bac4d1339c5ee5da46ce3ae23f34cb14b225f61fb5909b52673cfd37c2c0cccaf
TLSH
T1B55174736C185A378BD2AA4479593F139B325166CB922F90D5DD0F0C02D779C2356C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7f3bb714d990c71d7cfdf7372935f7c4b95b5bd666116d05df9736a2063820bc
MD5 470d534daca34466483f091a51518415
SHA1 889f144fc97cb67042c58edc1f992e97dbb6dbe2
SHA512 a92c9fb6d1ee326cff34c70dd145203c76688cf09a802295d58b296719aae587a036ef4da9669b00253f2200ae95931224f47408878fe7b8d99ff4ae952cb6f7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ca0cc6ed6a5219b69b17191bf4d3868231ae7c954f4ae7edc58cf4f3d7297763
MD5 44afc3c888bba9e315f3989873c46f62
SHA1 0bb21d3ca7013422a4d9cd1a370c71973d753978
SHA512 446a21055269e21c8608f83cf147eff3c50772f1732fddb7bb7612444c0ac895730e57aff02b775bcc974beae748b7cac9690bab6227579b45e1f24fac626564
TLSH
T11DD01233B2064174C02030330103A6082420C61B8045C344542CC62F1B240500B03441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1928f41dc4139d5c069196f34a058ebde81644d4d0336dcb3ddc40b3b34c91e4
MD5 0825a8361dc1cff8cae51a224f152270
SHA1 7e108fe600fb453704480cf255a4b83320cace10
SHA512 f4d6e6460b8bbb2066d00a56062f4a8a30ea154c38d46fb79977f9aff73e52af24e8a85162aac67a09a388857c83892924ef3b2ad8621d666740ac2cbcd4c353
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3eebedb2309935a33ff3a8b907b99512db9a516a2d23e7380e2bdfc15d1f009c
MD5 cebcec5d6a75a1794e61937253f5ec37
SHA1 f255827cc1e67bda3852cecd7ff6627debf0c24c
SHA512 9d34772c74b4d31e8aa27b1cfb8bfc7946173629b4764f7fde6bd7bc188a0299c1b79cee307130778ed24a257cd6a83406d1ef049b926bd19c5cbebc4ca9c21d
TLSH
T175A0022007580191C188D6707DC2D595F7209A5441F3A7D240904077D8BC3904B5A240
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\DIPS
Size 36KB
SHA256 f2b080407eed091cd9a16f5368fbd02204b2e25fdee7aed7cbcb2bf8ced925e6
MD5 50ebd288a638635eefb91ab2c42f9681
SHA1 b8ad928e6ed45a80add7f5a42a79253dfd3c72b5
SHA512 3c0a245d511296fd3971efca3cf0685d28dc4f7fb2d766c46b3e74bb550e3416735e70f65f8b637a1230a1ebd9f84a3ae482c2f62f011c8125b44dce81bb8e64
SSDEEP 48:TyQq3qhmr/O439Y2LNW9WjWbfl4pwU1cuBU:+Emrm439VLNW9WjWbfltuU
TLSH
T159F212474F253C51D4CA863A8AC18FEA0F79471C965F5EA849B804514ED2A4C80FB0FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\ExtensionActivityEdge
Size 32KB
SHA256 aefb267ca50676ff14f1d504549d8a0a838339d3eae353c1366dd693a6d0ebc2
MD5 045d83499804e4725dbb720cd0a98b63
SHA1 b0f459d9e7ee2b6925fc1a09ea1ca099d928288f
SHA512 2e147102da4144eac91f9010da93dfdb2e648b7481e7f48d99438c745adde13fbb9495493158bd85848a474459648ee03f270bae8ccde6cf60058c430da00a7b
SSDEEP 24:TLcJhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/5eQQ:TAm+BE9ZW9v/3WOT/
TLSH
T130E23A2A5E3C7121CD66713A7C61A42658B910DA977336F23EE000796F8268BC474CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Favicons
Size 24KB
SHA256 e69a35a901490a50c3c314ef9417264d0abd897cb823e6b3f6bf3bc1085affec
MD5 1422a2151cc0bc7a81374373aaa1d3b3
SHA1 15c1be6bd189c726cecaf287bff762ec1472d34e
SHA512 04014a940b834ea71a8fca7c17e951f9b151b926e45aef6c983663b9a3ece8668b310d93189a356aa57c6e0d8b275d9278b7564f30cc34fc15509ff6660ab7a3
SSDEEP 48:uBmw6fU1zBuz5R9q8pj8ZUHaRDmSo0C8dtupPzjv0PcrRmlBSTkikUe51nbC:uBCyuz5imdahmSoJeGzz0SRNTtMo
TLSH
T16EB2E80F5F387006CBD15EBE2AAA5C3A8D3FD36CAEA50C287C2884705CB558685355BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\History
Size 184KB
SHA256 1d92a331f66340b443a5ce7c25fbf73362781a9fb71e4dc16c09ad7aafd02dda
MD5 df47d4f29bff5ef7c64225f0b0213a1d
SHA1 f899a33c23fdc9a4465c46f6442f39450d632a56
SHA512 812f046f56354975d3f544fc6ede455bacfc13c8ab0c50dcc4782c5a752cb79dbfdc88b93228611e16f75b4c5bb1417319e6dfaa674ef82ec9ec6037f3f5c3b0
SSDEEP 192:HBTQlPH+bF+UI3iWGVGWN3qL/3VgZQW3/V:h+PIkUI3ijVGWN3qL/fWvV
TLSH
T1B004FD5E5F243612CDBD913668E645B3597DF03F8B236AC62C6108B1CEE2652B02C5BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Login Data
Size 42KB
SHA256 a5c1d3aad1ea6dfa8484d39b4b6239529889661a0a4d9643175df4d5915c7afa
MD5 cf0d378139d518ac262a5cb0979f238d
SHA1 94a24d2046879c9b26347909eb02cae09d40fabf
SHA512 d856b2d705188592828b2f277967f269ed46e5154d9e20b955b0e131d8de964b400672d167043be454104429be2bb5f285a3c084cd578aff2ffeb5363099bb4f
SSDEEP 96:ALlpeymwACn8MouB6w9f/FlXqiEqUvJKLuyn:ALlrAG7Iw9ftFqidn
TLSH
T17613350F2B682401C8AD8636ACB114B66E7CA13F4B639FD52CB144259D75C63B12D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network Action Predictor
Size 52KB
SHA256 2f80b3d97ed21bb40f2fb613ed996eb9735ce6993034397ccfecf1f37a1abe98
MD5 414d2be764f0ef6dda6a4d6485d06999
SHA1 b680a168a9c18abf2ead15f01c68242d125ad452
SHA512 c96459835a11700e1551e085a24f1bdb597abb7210ba93138b20ca6991aa0547146c08744677d35699a853d0e6c6f194a96ed33fd7cdd15ac05e59402beb1806
SSDEEP 48:T+dHYzydB+M9n+8dv/qALihje9kqy2WOT/9F:mHCydB+M9n+8d3qAuhjspFWOv
TLSH
T182334EB375176133F816E67CBEA8199008663AC58DE1CAE4DAF00C302FD6650E71F9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\Network Persistent State
Size 238B
SHA256 34dd883fe277abe25eef74a672a2abcd9b8d2838135c5692e5f5b2121949ec60
MD5 3b7f46940155d3bf9281de1acb42d9c6
SHA1 84973bcf9c00642dcb06c437b3ffe2003e57a3e8
SHA512 76701183367dfc3b030c8d16edff8f9bfa4e6a3233e7bf6f0f16f6bef82a9254d2b7d90f05d57b8ab96de10e677a145bc9a3b7e87bbe706d7edbcb518d19079c
TLSH
T1C7D0956181709CFF474083D015246503CD7E0002531C4D76C9E477F54662079E020803
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe597f67.TMP

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\Network Persistent State~RFe597f67.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

PreferredApps

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\PreferredApps
Size 33B
SHA256 42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de
MD5 2b432fef211c69c745aca86de4f8e4ab
SHA1 4b92da8d4c0188cf2409500adcd2200444a82fcc
SHA512 948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\README
Size 182B
SHA256 a0c9abae18599f0a65fc654ad36251f6330794bea66b718a09d8b297f3e38e87
MD5 643e00b0186aa80523f8a6bed550a925
SHA1 ec4056125d6f1a8890ffe01bffc973c2f6abd115
SHA512 d91a934eaf7d9d669b8ad4452234de6b23d15237cb4d251f2c78c8339cee7b4f9ba6b8597e35fe8c81b3d6f64ae707c68ff492903c0edc3e4baf2c6b747e247d
TLSH
T15BC0123585C365A5521A02F2694152826606E923A82ADD6097DD804C1703BF1F2112DB
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 e1b7955c31f5e9f71e4d0bc4b173e7867d7040264acb49b0f6a537bf492e5349
MD5 18aeda8d5174c1a224ae795091dfeef7
SHA1 0bff454495650f1465cde121b5144180bbaa2341
SHA512 741fd4917797100ba076a53047ed7984bfd261f51b07f7c164c1f66fc9534183d38a8132e68ce7764b0d0504a5d0e0e8934ce0ac464ba5df2864b4fe0c302440
SSDEEP 96:HlyjitMPlf/ROoKOpkF5d1yjit57sMaTEv9V5h5pg5+eeHMcxVrVZ5ts8Uj:HR+WGOD9lJNxFVraj
TLSH
T130D1C5A7096DC535AF848AEADD387ECF89AA009F98D54C0997E2C54C07C2EFC11DE8C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b24db4d6-21f8-42a2-9a4d-d576d4cf7a2b.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\b24db4d6-21f8-42a2-9a4d-d576d4cf7a2b.tmp
Size 6KB
SHA256 04430f47709a751584b1365f2a1296e98fd412af4e05976f9422e5c3221f458d
MD5 2792d4f39ec9cf15134df7c7674f6df9
SHA1 702949febdab08f817d89af5abdf4a424dcba03a
SHA512 bc899b1b312d5782a00c0d3d785cd4908dd852751da1aea32121bb527a66aada11667471f12f748cdf571e9e2a3fdb3c9fa51b94e51d1e0b4dd830e6ebe4e6f0
SSDEEP 96:stn05Ns1wMb9XffvzZ8i0vhEVOktZjm/7qx+WVHMSm+uecJPz1idQjv+gPwoNKEB:stn0TmfTZ8panZS/S+WiTPzwd2N3NK8
TLSH
T1DAD1A7029E2869774DC7F6197E35BB02E3FA106266D40E58EBFC8A1C05D66CD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\favorites_diagnostic.log
Size 62B
SHA256 75a5957d43a35455096a6a324b6f714542d6ab21c2c715fe8ea2367e20681741
MD5 939f3327402c2f554ff5a2a8650f727f
SHA1 c080fd4c17a77857d509c4be38df7b1f748fb404
SHA512 6b48596c1814880755f44bdec71a0035c38c981fbe6f2d17b33533cefdccd948eefeaefb94d30666f8f872efae69f115bd6947355559e19f5a678d67f8268c6f
TLSH
T115A0228220283000B0088800C0002803E0CCB820330288B0030803080200008BA2FC33
MD5 SHA1 SHA512 TLSH

Submit Download

heavy_ad_intervention_opt_out.db

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\heavy_ad_intervention_opt_out.db
Size 16KB
SHA256 85c7910f5ff38bb2fdbf88d2d072e50c6edda1e774c04b21d19dcdec158b3da3
MD5 023fd485a16aeb668e5426a8060153a8
SHA1 d58b9f186592eacee051dba8f85537957b98c05d
SHA512 2edba94f17ff5673f78d7e847a84403ecdc57876c600cbf8484449633d95fef4fdc21c71cd338d219fb07f887353f96fe7fcf3fdb4fbab43c3fc6310c1e9dcba
SSDEEP 12:TLCOwaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TL/dBgtBgJBgQjiZS53uQFE27MCgGZsR
TLSH
T18C72246D4D14B201C4BB9AB5ACC0C0D23A2C712B0757B6A1A74023BF486E032A5368A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 1KB
SHA256 ea6878f4b946b5a0249661eb7784d4ea45e611dfdc5993b3ab965c67bccffb4c
MD5 2d256c3c8ebca8a16e3a9ce072a51f73
SHA1 faf7feab5f037827388a210b705f0ba006dae21a
SHA512 049e4a3d1e770a77674e47d7e8bf6d86caba5a8e4bc58c3bdfdd5ea61c7b2464ca2a8f9ecc797cbfe70531f9f5ecd7a3be5ec595b59461c07f8a0b04777fe94b
TLSH
T16F3165B2A8651F355E82A64575453B976F315027C2515E84E0DE0F0C03D738CA23BC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 16KB
SHA256 305b0b4d1a38a65c3ec64ed0e06d971a6cce09d4a6bf9183b6376744acbae9ce
MD5 90521fffb035df8446ede2b8c2a9560e
SHA1 ebfdba518290b4440f451a02ca6d309dad305d46
SHA512 5f23cf866e2cdfa1328c338a9b4674a8c35291a474f4e7648708ffa5f31f9bc88897001f2c0a8d82b1b6da800424b9a040a3105658d70b8aa2e7353ba2f1d55b
SSDEEP 384:z+srv+89zHqlDNP9oidgNbtOuJuwhjA62NK:Vrv+4UNbd8/9hjAXNK
TLSH
T187729E33A83C5B379EF2E944B44A2A07BB74619795C20BA4D9D90F8D42DF1C92317E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 3KB
SHA256 867f69d3eee9b35d33d9a4e2e809be822955ee1b381f57913a2cc3c3dd149990
MD5 c262f93d09ea207dadccb59c69a56ec0
SHA1 2dfc521be8d2362fd291681f4ed4682807d64ae8
SHA512 f77cdf39fb01e06e3717154071aecbf9cbc3be43d64794f95901823404fad924739cd1cf7fd099d555eebfa8be95173fe6415ed69fbee42450cd5e7414db852a
TLSH
T1EF7184666868AA3B4EE2EA44B8852B17B7725127DAD13F94D5ED0F0C02D73D82352C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 16KB
SHA256 2dfd18e9ec39e32947c164123ddb1d8f51c2226012a0b2a44257779382162381
MD5 d07365bb1f8baef5b348d5e0a8ccfdfa
SHA1 4c1a53e7b0edad386a900e97b39426b842eb2f23
SHA512 c08b60c6ec5c6171af451f1ef6b9498e41a19b756f9d1879e61c1279cf795e07760446465a7526e3cb8b2451ebb856ea791c31e13904430e1a59a3db5701b2be
SSDEEP 384:zCsrv+89zHqlDNP9oido3NbtOrjuwdjA62NK:Zrv+4UNbdoL+9djAXNK
TLSH
T159728D33A87C6B375DF2E944B44A2A07BB74615796C20FA4D9990F8D02DF1C9231BD63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59521e.TMP

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State~RFe59521e.TMP
Size 1KB
SHA256 c72df1a568dac1ad3b05110f71058879e830fd8814a902f22e37f15640a4693d
MD5 20a9b1c12a4f46b50abb9c0008f9e8a7
SHA1 d2a17948ff9825cd10b913accdb06ae785db9734
SHA512 fac875f1cdfa9dbe627c2d855d68a0e83354b4d4a57b568b52a1d0a7b47fe9faa2493c5ccfdcda5159dce3de1ef40bd7430d2fb3d275de9ba489a6cab6fce03a
TLSH
T1342142B2D8652A359A81A94575127B872F21A167C2519E44E0DE0F0C03D729C927BC33
MD5 SHA1 SHA512 TLSH

Submit Download

volt.exe

Path C:\Users\Admin\Downloads\volt.exe
Size 11.2MB
SHA256 7c91c6c2f5aa996f919e682080f62992ff95534406eda32eecf2607d3490fa0e
MD5 d3dec7318562b04e9d26eb47fac0317b
SHA1 3e6517f74dffbb3e15fa0052721d3b11bfe3a6b8
SHA512 88020ab6914c350e3f89005fb302039f52cb7fd26c331aa05edb4c33d060d8cfeccae6b75f80c5a42122ee462fc5173dd6528d02f208693d63e904a325b524ee
SSDEEP 196608:tYQHw9ZtLC25kEaPRabCcXJehVdfeErIvTmt0G6yp7mbFtDkcemT/1Mv:tYSkt2sPaPRablwHdfeEH0wyvdemT/1Q
TLSH
T124C633F45680ECAED936093A5EBF1D10E5E473A7998D63D18310382ECFB15821B8A7F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-415-0x00007FFB8D120000-0x00007FFB8D121000-memory.dmp

Download

memory/1860-551-0x000001FD9B7B0000-0x000001FD9B7DF000-memory.dmp

Download

memory/1860-402-0x00007FFB8B5B0000-0x00007FFB8B5B1000-memory.dmp

Download

memory/1860-403-0x00007FFB8D200000-0x00007FFB8D201000-memory.dmp

Download

memory/3596-831-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-838-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-839-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-834-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-835-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-836-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-830-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-829-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-840-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-832-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-837-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-828-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-827-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-826-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-825-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-824-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/3596-819-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-804-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-814-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-778-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-779-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-780-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-781-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-782-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-816-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-791-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-793-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-794-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-795-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-796-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-797-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-798-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-800-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-801-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-802-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-803-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-815-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-813-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/4780-775-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5200-550-0x0000026DD1020000-0x0000026DD104B000-memory.dmp

Download

memory/5200-334-0x00007FFB8D120000-0x00007FFB8D121000-memory.dmp

Download

memory/5936-23-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5936-140-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5936-718-0x0000000140161000-0x0000000141102000-memory.dmp

Download

memory/5936-717-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5936-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/5936-9-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5936-1-0x00007FFB8D470000-0x00007FFB8D472000-memory.dmp

Download

memory/5936-115-0x0000000140161000-0x0000000141102000-memory.dmp

Download

memory/5936-116-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5936-7-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5936-0-0x0000000140161000-0x0000000141102000-memory.dmp

Download

memory/5936-141-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5936-3-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5936-526-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5936-197-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5936-287-0x0000000140000000-0x0000000142AF2000-memory.dmp

Download

memory/5936-2-0x00007FFB8D480000-0x00007FFB8D482000-memory.dmp

Download