830377dbebf8bf806f13215eae10796d7a7d24e51cad2f31c92ef4d8ba6773a6

Analysis

max time kernel
150s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tauri-app.exe
Size 12.4MB
Sample260810-vpsqdsdp4x
SHA256 830377dbebf8bf806f13215eae10796d7a7d24e51cad2f31c92ef4d8ba6773a6
MD5 579f80ed9ea7200f540001f112b2ead5
SHA1 aaf6b9a70200aec6faac95000a9739d32bc6f1ec
SHA512 6b48c7a42f09aa7e8b4de6747b9fb61b6020d7555d2f3840f56ec6051ad420f457a476de9b7f36db58b2c14596e75790e1448ed063422014578a896af05a42f3
SSDEEP 196608:PAUG/wFNw9g3b7YoeI2QjGVz3Epa1mZWTIu8Hac:5NwK3b7YW2QiVeasZW0uMac
TLSH
T1E5D6AE07F39181E9C0ADC4B8835BA637EB32BC894525B29F5BE44B112F26F506F1D74A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tauri-app.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_645133083\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1535470633\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1535470633\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_645133083\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_645133083\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_645133083\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\manifest.fingerprint	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	tauri-app.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	tauri-app.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	tauri-app.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2360	msedgewebview2.exe
2360	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4760	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	tauri-app.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4760	2476	tauri-app.exe	89
PID 4760 wrote to memory of 4724	4760	msedgewebview2.exe	90
PID 4760 wrote to memory of 5628	4760	msedgewebview2.exe	91
PID 4760 wrote to memory of 5628	4760	msedgewebview2.exe	91
PID 4760 wrote to memory of 5628	4760	msedgewebview2.exe	91
PID 4760 wrote to memory of 5628	4760	msedgewebview2.exe	91
PID 4760 wrote to memory of 3216	4760	msedgewebview2.exe	92
PID 4760 wrote to memory of 2952	4760	msedgewebview2.exe	93
PID 4760 wrote to memory of 2952	4760	msedgewebview2.exe	93
PID 4760 wrote to memory of 2952	4760	msedgewebview2.exe	93
PID 4760 wrote to memory of 5864	4760	msedgewebview2.exe	94
PID 4760 wrote to memory of 5864	4760	msedgewebview2.exe	94
PID 4760 wrote to memory of 5864	4760	msedgewebview2.exe	94
PID 4760 wrote to memory of 5864	4760	msedgewebview2.exe	94
PID 4760 wrote to memory of 5864	4760	msedgewebview2.exe	94
PID 2476 wrote to memory of 3092	2476	tauri-app.exe	95
PID 4760 wrote to memory of 1848	4760	msedgewebview2.exe	100
PID 4760 wrote to memory of 1848	4760	msedgewebview2.exe	100
PID 4760 wrote to memory of 1848	4760	msedgewebview2.exe	100
PID 4760 wrote to memory of 2328	4760	msedgewebview2.exe	101
PID 4760 wrote to memory of 2328	4760	msedgewebview2.exe	101
PID 4760 wrote to memory of 2328	4760	msedgewebview2.exe	101
PID 4760 wrote to memory of 4456	4760	msedgewebview2.exe	102
PID 4760 wrote to memory of 4456	4760	msedgewebview2.exe	102
PID 4760 wrote to memory of 4456	4760	msedgewebview2.exe	102
PID 4760 wrote to memory of 2360	4760	msedgewebview2.exe	103

C:\Users\Admin\AppData\Local\Temp\tauri-app.exe
"C:\Users\Admin\AppData\Local\Temp\tauri-app.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.6 --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=fr-FR --accept-lang=fr-FR --mojo-named-platform-channel-pipe=2476.5796.3807586190617703983 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView /prefetch:4 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x194,0x7ffd4caf5fd8,0x7ffd4caf5fe4,0x7ffd4caf5ff0
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,16509552656314462996,9958388598105431065,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2252 --field-trial-handle=1776,i,16509552656314462996,9958388598105431065,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2440 --field-trial-handle=1776,i,16509552656314462996,9958388598105431065,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --mojo-platform-channel-handle=3336 --field-trial-handle=1776,i,16509552656314462996,9958388598105431065,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684 /prefetch:1
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=348 --field-trial-handle=1776,i,16509552656314462996,9958388598105431065,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4604 --field-trial-handle=1776,i,16509552656314462996,9958388598105431065,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4632 --field-trial-handle=1776,i,16509552656314462996,9958388598105431065,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4572 --field-trial-handle=1776,i,16509552656314462996,9958388598105431065,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2360
- C:\Users\Admin\AppData\Local\Temp\lsp\lsp-ws-proxy.exe
  "\\?\C:\Users\Admin\AppData\Local\Temp\lsp\lsp-ws-proxy.exe" --listen 127.0.0.1:30000 -- \\?\C:\Users\Admin\AppData\Local\Temp\lsp\luau-lsp.exe lsp --docs=\\?\C:\Users\Admin\AppData\Local\Temp\lsp\en-us.json --definitions=\\?\C:\Users\Admin\AppData\Local\Temp\lsp\globalTypes.d.lua --base-luaurc=\\?\C:\Users\Admin\AppData\Local\Temp\lsp\.luaurc
  2⤵
  PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6fd329f02bdb1ccc9fd552869b346611fd5b12140498d6ef276e1698825c16ed
MD5 6c5a1d454470d653974dc0e5dde5b361
SHA1 a74a666710b0680f916a32f64bd7a0f2088c7e1a
SHA512 d9cc88652521eae632df77229c5b24dd34eef0a4e6132009dec0f570492c8c5bd8abd560e6433ac8dee8bcbbcb2bdb7db462683d9301db2838578e871bd0e784
TLSH
T17BD0121A32210178C13022370463A54C0440D54B811541875829C62E2B080540A02441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c08c1dc225613b6cba932cfd5ebd5a21475e48ee6f2e51825b2d321a2b42c04f
MD5 1c0f7118b28cf9d77b3bdd47566db8a9
SHA1 ad3349dbb04aea057fea6100a5d9838a2f2b1ad3
SHA512 9d78df60cdf33fc727573a19ea0d346178812939a86005b0e8b0badd9efd585ae1b25edcf6e6264a9437a351bcd2da80f7c4bf0388325f9cd1c542ea5d785acc
TLSH
T1C9D0041C51340044D331133D0471C5540154DCC1453103D70451411515441040141100
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

3be99f5a-5af2-4779-aeeb-5f75d37be337.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\3be99f5a-5af2-4779-aeeb-5f75d37be337.tmp
Size 6KB
SHA256 6d7f6234ad6fb2e4cbcca54a5a7ef1b595ab64e2bcc247349b0edc1586d69bf0
MD5 346d9c85bda275c87b13345f69107077
SHA1 ccc92e8d22a1b447c3b24216c07849987f8e0048
SHA512 32779149d6b6c0eafed94246db7e1422f02924ed3503067d805d12f3381071ab677c1966d4b66b5ea2b5c7faad8259caa9df98f62c970957deac50ca2c7e1555
SSDEEP 96:st6/d2e+b9BkNv5h16Z0Cs7/x+6MhmuecJOd1eje20K+gv28XM3WC7K:stiS2vnCsV+FdOdQjbJGTK
TLSH
T13EC196025E3479FB4CCBE509BA39BA13E2F9607164D51D58EBF8952C04EA6CC6317D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ff13aa8131eaf62567296a25b0cd530320b64637f5581e46f78ca39e7c3dbd1d
MD5 0a0e574c675efe0fd3760a6d04aedf41
SHA1 b5c550d5a9652ed2af90b523f7a2c8c55da7ead7
SHA512 1e632c1aaab1754cad3fba442d1df4bc102a67e3d623fa993e6d07258f2e484e05867fc08524eec425969550b22bd645ea85b2e90636ea133ae8e391e6b73bd0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 9f1601dca15f1035a380df2b4ae14773572b9c93fd204b51cebea0bdb7537b74
MD5 2cff9aa89a1d105c5eb846073910a174
SHA1 a911dca968606caee043162193565a55e88b686b
SHA512 d3de5cee63b26b67bb6fc1b20a699df5e6d14126f5c56643e080092f6d106b31c4581d035cafd563362f1e1f371dd0e525cb871e0c598653aff9bb48057bb0ef
TLSH
T194A002144151545BF15847B094C133603A305C341607462747D10E64D8907E2431B890
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\Network Persistent State
Size 238B
SHA256 34dd883fe277abe25eef74a672a2abcd9b8d2838135c5692e5f5b2121949ec60
MD5 3b7f46940155d3bf9281de1acb42d9c6
SHA1 84973bcf9c00642dcb06c437b3ffe2003e57a3e8
SHA512 76701183367dfc3b030c8d16edff8f9bfa4e6a3233e7bf6f0f16f6bef82a9254d2b7d90f05d57b8ab96de10e677a145bc9a3b7e87bbe706d7edbcb518d19079c
TLSH
T1C7D0956181709CFF474083D015246503CD7E0002531C4D76C9E477F54662079E020803
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a9caf.TMP

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\Network Persistent State~RFe5a9caf.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Preferences
Size 6KB
SHA256 d09c97a04b98236f31a21ff8f4d1ca91f2dd3e5586019a1c6776b0d747d09d00
MD5 31ad0263e5cdf41bf4ef0b5bf4826c3c
SHA1 0e99ba2cd3558d0423cd0627a2713783937f2cad
SHA512 0634b1fdbf975d2ad47cf9e84b1d29c09ce5395ca692f5b51e78e3995d886ea58b32f67b8698242542e26e28162883646d913fbdcc0fd9b1b12e31c289480a83
SSDEEP 96:st6/d2FG+b9BkNv5h16Z0Cs7/x+6MhmuecJOd1eje20K+ge28XM3WC7K:stik2vnCsV+FdOdQjb0GTK
TLSH
T1BFD1A6025E3479BB8CCBE519BA39BA13E2F9607160D51E58EBF8552C04EA6CC2317D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\shared_proto_db\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\shared_proto_db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 2KB
SHA256 604920b09fea0663b6936f586f0486cf436e66f6b0f5ffdc77981fd64550ef68
MD5 dc297e07bca9a5dd4b02cdf03f7b2489
SHA1 21992b375ab557830f342f5d7938d861939b7689
SHA512 12e37bc963b7f0da480e9f8a7ecbf9d81e2601913c3d4ab898253f1ba78822c83ef355698932f8779bd3bac42646d940a9f66f8c5d1c210c2db3173672c8888b
TLSH
T1C251A5336D20ABB78AE34A45794A3F23EE7950659A912F20DBDE0B2C00D721D5301C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 3KB
SHA256 81c8346c623bc7bdb8e9b2aade09104c1e97f514e820a8b97266d0869e610c46
MD5 3df6953bb1d01d763d6a2cba4189bd3e
SHA1 83a90974baae9d73ba41266314c7e4f6946b521f
SHA512 211c34d0650b0327a4680d09829172f7c76a17ebc86d1aea633cb7565081fd15e73b82097f7bcf55dc826760f17ccf123b506894837b39da4419b94ec02b4b33
TLSH
T1D56174376970AA778EE39A05B9863F22BBA95027E5C13FA4DAED0F1C01D728C1341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 15KB
SHA256 2fdf2149d8699674fad2d48d15eb39983a0fb1e8069d6bd1705dca57ddef4cdd
MD5 ead0e9db0ff6ed0e95591136faf6aaf9
SHA1 dd1e0221f4c007e56905b65d0b8018145fa31dd5
SHA512 ca3e6bb0d709b5757da769f6a77b256b7c7f0ea155ff47281c8eb41ba05c6a274596176c2cbd55ebc819b6b87e285a5943fc306717f8390b1ddbc730cc887e6f
SSDEEP 384:g+aQikB+z/xvxjg/qhEwNBS5kkysAVdpy+G9zY://UxvxjgC+e/sUVGFY
TLSH
T17572BE2B95793E6396F7EA057D5D1B8BCAB8847290C16EB84EFD6F0D02D72D80302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe598320.TMP

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State~RFe598320.TMP
Size 1KB
SHA256 585d5e77e2715a8b4155fa26074f79e18bafe242126f29031ad7ce18a961f7ca
MD5 63e753f7b587f6bcbce4b617b1a6998f
SHA1 61242977401320b64e07ff9545b1c1f9bfd5d3c7
SHA512 635f4c66739f525c50cace8df4e071bb2ac46d8c8bbba608d022c3f4b862d1885eabe3863f35f1b354a39febb3e7927e20636b51efcc091719c5f3cc33c2fdd1
TLSH
T136218773A6B06BB2ED86655731127F637E65207AC1804E00E6DF4B3C12E714EC525C32
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_1308301302\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1848-234-0x00007FFD6E130000-0x00007FFD6E131000-memory.dmp

Download

memory/1848-233-0x00007FFD6DB80000-0x00007FFD6DB81000-memory.dmp

Download

memory/2360-451-0x0000029F079E0000-0x0000029F079E1000-memory.dmp

Download

memory/2360-453-0x0000029F079E0000-0x0000029F079E1000-memory.dmp

Download

memory/2360-457-0x0000029F079E0000-0x0000029F079E1000-memory.dmp

Download

memory/2360-461-0x0000029F079E0000-0x0000029F079E1000-memory.dmp

Download

memory/2360-462-0x0000029F079E0000-0x0000029F079E1000-memory.dmp

Download

memory/2360-460-0x0000029F079E0000-0x0000029F079E1000-memory.dmp

Download

memory/2360-459-0x0000029F079E0000-0x0000029F079E1000-memory.dmp

Download

memory/2360-458-0x0000029F079E0000-0x0000029F079E1000-memory.dmp

Download

memory/5628-179-0x0000020BD6550000-0x0000020BD657A000-memory.dmp

Download

memory/5628-21-0x00007FFD6E100000-0x00007FFD6E101000-memory.dmp

Download

memory/5864-56-0x00007FFD6E100000-0x00007FFD6E101000-memory.dmp

Download