hxxps://voltexecutor[.]xyz/

Resubmissions

16/09/2026, 15:49

260916-s9ctkaw13k8

16/09/2026, 15:48

260916-s8stdscr8w8

Analysis

user interaction
yes
max time kernel
117s
max time network
113s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/09/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://voltexecutor.xyz/
Sample260916-s8stdscr8w

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
100	1648	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4952	volt.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\volt.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1648	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340472979554262"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4077919521-2131189092-3796306753-1000\{F951296F-96A5-440C-B080-30505EE42EFD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\volt.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	taskmgr.exe
Token: SeSystemProfilePrivilege	4420	taskmgr.exe
Token: SeCreateGlobalPrivilege	4420	taskmgr.exe
Token: 33	4420	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4420	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe
4420	taskmgr.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2864	2068	msedge.exe	80
PID 2068 wrote to memory of 1648	2068	msedge.exe	81
PID 2068 wrote to memory of 2416	2068	msedge.exe	82
PID 2068 wrote to memory of 2416	2068	msedge.exe	82
PID 2068 wrote to memory of 2416	2068	msedge.exe	82
PID 2068 wrote to memory of 2800	2068	msedge.exe	84
PID 2068 wrote to memory of 2800	2068	msedge.exe	84
PID 2068 wrote to memory of 4456	2068	msedge.exe	85
PID 2068 wrote to memory of 1276	2068	msedge.exe	86
PID 2068 wrote to memory of 4456	2068	msedge.exe	85
PID 2068 wrote to memory of 4456	2068	msedge.exe	85
PID 2068 wrote to memory of 1276	2068	msedge.exe	86
PID 2068 wrote to memory of 1276	2068	msedge.exe	86
PID 2068 wrote to memory of 3996	2068	msedge.exe	88
PID 2068 wrote to memory of 3996	2068	msedge.exe	88
PID 2068 wrote to memory of 3996	2068	msedge.exe	88
PID 2068 wrote to memory of 4204	2068	msedge.exe	89
PID 2068 wrote to memory of 5092	2068	msedge.exe	90
PID 2068 wrote to memory of 4204	2068	msedge.exe	89
PID 2068 wrote to memory of 4204	2068	msedge.exe	89
PID 2068 wrote to memory of 1080	2068	msedge.exe	91
PID 2068 wrote to memory of 5092	2068	msedge.exe	90
PID 2068 wrote to memory of 5092	2068	msedge.exe	90
PID 2068 wrote to memory of 1080	2068	msedge.exe	91
PID 2068 wrote to memory of 1080	2068	msedge.exe	91
PID 2068 wrote to memory of 2172	2068	msedge.exe	93
PID 2068 wrote to memory of 804	2068	msedge.exe	94
PID 2068 wrote to memory of 2172	2068	msedge.exe	93
PID 2068 wrote to memory of 804	2068	msedge.exe	94
PID 2068 wrote to memory of 4044	2068	msedge.exe	96
PID 2068 wrote to memory of 3248	2068	msedge.exe	97
PID 3248 wrote to memory of 580	3248	msedge.exe	98
PID 2068 wrote to memory of 3320	2068	msedge.exe	101
PID 2068 wrote to memory of 3320	2068	msedge.exe	101
PID 2068 wrote to memory of 3320	2068	msedge.exe	101
PID 2068 wrote to memory of 1740	2068	msedge.exe	102
PID 2068 wrote to memory of 1548	2068	msedge.exe	103
PID 2068 wrote to memory of 3976	2068	msedge.exe	104
PID 2068 wrote to memory of 2420	2068	msedge.exe	105
PID 2068 wrote to memory of 2420	2068	msedge.exe	105
PID 2068 wrote to memory of 3844	2068	msedge.exe	107
PID 2068 wrote to memory of 3844	2068	msedge.exe	107
PID 2068 wrote to memory of 3844	2068	msedge.exe	107
PID 2068 wrote to memory of 3820	2068	msedge.exe	108
PID 2068 wrote to memory of 948	2068	msedge.exe	109
PID 2068 wrote to memory of 3820	2068	msedge.exe	108
PID 2068 wrote to memory of 948	2068	msedge.exe	109
PID 2068 wrote to memory of 948	2068	msedge.exe	109
PID 2068 wrote to memory of 956	2068	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://voltexecutor.xyz/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7fff49f6c188,0x7fff49f6c194,0x7fff49f6c1a0
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,15998710471805678179,2736049980054441428,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,8162341353695506765,13535940482616196548,262144 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,14804182731342599963,4126654532842680375,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,9811211295362468305,5606012150991992159,2097152 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,1585910047647981281,5463116568919195241,2097152 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,16270248488627654135,4529362026215567955,2097152 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,16876813770859945703,1194924435107811647,2097152 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:9
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4308,i,14420638989358646887,1474067811509580362,2097152 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4344,i,10564241181206999210,10071590651011260177,2097152 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:9
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,1925442933126559323,13642287959428307980,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,14827405053315887581,3430004733391072293,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,13326809542468807267,9849345699426822469,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,13326809542468807267,9849345699426822469,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,9919016543178007558,16538425473571001742,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1124
    3⤵
    PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4360,i,3871210723570640361,9533693290112441890,2097152 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,9637571020884783492,2826944287834078561,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,10974722088531061619,12502948481904434286,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,11590893910741823082,11743631084453380439,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,5700431609789302070,8990360821603258791,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6588,i,2372588319354206524,16478169434440264551,2097152 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,18163152414450631058,387710075483492461,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4292,i,18177676771581876398,6922914095594155524,2097152 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,489983392341544451,4791689576143386836,524288 --field-trial-handle=2056,i,6382374062214788269,7335824455052048789,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4260

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5036

C:\Users\Admin\Downloads\volt.exe
"C:\Users\Admin\Downloads\volt.exe"
1⤵
- Executes dropped EXE
PID:4952

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48ff4460fd06c20ad400cc57a94de8c221ccbfa21edec3a46f2c49ac2dc47f1f
MD5 fbaa312c71fa74dbad82d379926144ac
SHA1 6e0bf96548f833cd7614c6765856fafe71e03430
SHA512 2d2ebdac18f3a47bc8e1e57d915d4c68ef660758f3bb190bf31ed052c9ec0f3596e027f16d0a68538ff77ea830cf92d80514892ef27ebd35e8f39a74547351b6
TLSH
T1CED02B74C1C85D80C451343C1733416330C4F810C407150088D0125C0CCC7C30274120
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd94736ea2245d6ade3fbffcc7b96a4e02aa9006ed4e41a5043255d439ea58f9
MD5 e53ea538d9037e80c26dbca906c95c2a
SHA1 3cc7813658c79810edbc35fe6a3ca8c395b7624e
SHA512 8174d6db3c0d382d910834f9b1d7abc302dee09d5d2d11a936ba3569bc7c8b1cbe1b2607b445af84029edc933a7a9ebfe5db06ab4e68c6976dce45bb6e680fff
TLSH
T184D02B7481C85D80C851343C1732416330C4F810C407160188D0125C0CCD7C30274120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8567602acfbebc9174ee53aa4074b8f350a5ab30a73acf56294d31955927a155
MD5 6e85ed5b082242f6dc7143be59482d15
SHA1 bd05a5508a3e0983f3de26e333da5fc5702e6101
SHA512 3ce2880e767354e82513abcad815c3ab7279417f75e883c9be509c7417a8c48a3287cf9155635c556aa1952bee485aa248b1cbf547001d6ddaba1fa59a92026f
TLSH
T160611CC15D90C063DBA451B49BF3654B3936FDCEBA932ED108E4D8BB7C1AB6492160E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2f2cee55bde6eae1add54229857458e1541345bbcd288d233a89d10154eb9722
MD5 3d90e9a1a0c0d56f3b94a2715b81b796
SHA1 ce7eeb4820301edae3d88bc72091ea3a558b201c
SHA512 acbe46bde354d82d5b4f32ed917d00481fe98c6f23cff8cabac70b095e5484cb1f42e393d38068eb0b9e79e7b2c56ff5330a7cf82e70a8e88087950b638efd6b
TLSH
T172610CC15D90C063DBA461B89BF769473936FCCEB9932ED208E4D87B7C0AF6492560E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bb4c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bb4c.TMP
Size 3KB
SHA256 5e6d573f99b9e425622f060abf2932c7d81e325f50cd5252a2d366f820be4964
MD5 849085061200900cd9bb8f9568356605
SHA1 d3ac1ade92609d08f157fc7e65684ee0fd184846
SHA512 84f4abfbcd9950d1044f935876178a7153fd79c16a5f1f858a25ab9daac42fd0e45d3ed367bbbaa240bd47bba717fb9adb1147160100e875a053f659fb708d6c
TLSH
T1BB611CC15D80C063CBA491B49BF366473936FCCEB9936ED108E4D8BB7C0AB7492560E1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3b017de6ffe14f191b663500ad0e9aab5ee5fbf20c07049b55ae8c14ac8e81ab
MD5 ba0a29686bdf6e6447e32c9a1242c2e0
SHA1 806684b98389c2b9e0351548c857a37e38946cab
SHA512 d50829a8245453f5defa1fed4c5d677fc3e5d46217b7c29546cbeb3995971fcbeb1bde7e5fe4d5fd7c3dca51713016ba83aa55a6ea09b2617f7d0b5d97393d43
SSDEEP 96:DhO7VRrgFEedEDzunip5uESH1r4FFOwlbR:DUxRrnedEDCnip5bM1r4FkwbR
TLSH
T1F691AFE3C6D58A6F982111F09A542E27CE6D0D35822E3C19C9E9FF9FA7E1071E20254E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5710e462ce0d678e79d818029371f6aaadc8c80b6d8c10c32cd9391f19ec427c
MD5 708d38e92a336c485451f3a5c4aeb781
SHA1 ba8ca4bbcb3d89ead243956b26036dff65ad5b4d
SHA512 2cf6053e0f83834b6eb8e68564f97855113a149f63313e496c35fc36757c6da3ab482bd0036225257858791c70be04116cf4b79d06f37a201ec31a62aa9de0de
SSDEEP 192:sxZlR4bc/fps/FIdpM/W6+WNGY0tfK8IgrJ:sxZlcc/fps/2M/bG5f9
TLSH
T13212B6526E28697B8CCBE20DBB25BF53D6F9503291D51E48EAFC861C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 190f6fa7767d073a84ab058c7242f8283f215e000fa115ea11ff4484cb75fac2
MD5 cef3a831bf812ecc941f482aacbc2f06
SHA1 0789daa81583ece7d85af3f89dc824f7ed26e106
SHA512 c9dc2808f561be7a2a2ae1d070c143a0c59afe1efd88c735c65be0ad2d29bf5d6d781ae06bfd2d914357611445b049f5b911b5c21512a86f16c7cfb4746863ec
SSDEEP 192:sxZlR4bc/fpsKFtIdpts/W6+WNHBW/Y0t/K8Ig5TJ:sxZlcc/fpsKUG/bg/5zH
TLSH
T14822A7567E38697B8CCBE209BB15BF53E6F9503291951E48EAFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e158749afe40c0eb449c71cc6ad3a5711feb662ddfcf32c1ded6b43796aa758b
MD5 ad04a13a50842c75d04e7072dfe91d4c
SHA1 fc24cf6d701482f9f0eee070e5ef655b68a7cbee
SHA512 7f7483fe673bb666c032f50a8858bf3f291acc7c99391bdd745b1f1fc5d2cef2ad8cbf4064af7601b9de74ec6d3f045733da95ba3268bdab6854fa6e844e4aa3
SSDEEP 192:sxZlR4Oc/fpsKFtIdp7s/W6+WNHxHXY0thK8Ig5TJ:sxZllc/fpsKU4/bRX5xH
TLSH
T17A22A8567A38697B8CCBE209BB15BF53E6F9503291911E48A6FC861C05E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c9fb49eb0d64edd063ce02888328c7e0ae948237d80cf0a30b3665213ddb5bb9
MD5 e0ab3abb6c8c91e624ba207e644c9aa6
SHA1 afbba4e0d68893722026b3f3ac759068126b3142
SHA512 90ec5bceb266748f0a136b30bd46f0aece56a082902ea0e70147cc71ba2e722e172e972687d609d9815411218a42a249449973b6f7ffdfb3c65a5b98cbad5992
SSDEEP 192:sxZlR4bc/fpsHFIdpM/W6+WNGY0tfK8Ig5pJ:sxZlcc/fpsH2M/bG5fh
TLSH
T16912B6527E28697B8CCBD21DBB19BF53D6F9503291D51E48EAFC861C05E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 6fa663ed3b2bb86bad6bdbf4016818c941ce8d111acfee6365b7b7d83c9ae7b3
MD5 e676a088122a54dc5b9bbc87175edcc0
SHA1 d32c6ab35c13f52319d9fff5aa45863bc16ba25c
SHA512 bce49e7eeb40d244dd4e20cec826ff1b295bb7311c9c9e007b94ebd03a325613e5f16f6e32b558373941a32a29b66de4efe3d75702d3294131539d021adc02f3
SSDEEP 768:oWbN98wh2cYWRmYQQOs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mHLl/eA0Zw8rojo:oWbN98wh2cYWRmYQQOsu1jaKmHLpehZZ
TLSH
T1E5D21A3B240CCB7E4FC05AADDD166F976A9C02D7A6648D4087FE894C02C77EE91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 23c7ae73354968a551c5468b5441443aebe4239ae2dd4c90efcbb1bc18f06d4e
MD5 a8abd4c0f704befa28d63f73b0d6665c
SHA1 66487f0b13f494d852a45f7a50446654c60cd328
SHA512 41bad6ec3eaa8d6984b60b9a04fe24686363844c8838d9cd05475641d4abf16899024b7445c84f1298294e10811f1688c6b419dc1fe69c459c643ae04d78e4c2
SSDEEP 96:K4hKK6Iy/Uh4E62Ski2XPYckKgBYykMkE36bU/K+Uaqpludk/2pKHg/Epj8E1GKu:YZ9dRz
TLSH
T1B091525671BA165039FD691C80A88B1F524231B3310DF63B3FBD20A68E7AE446CFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\5b2f987d-af2a-41ca-8291-639044ef43aa\index-dir\the-real-index
Size 72B
SHA256 4e70ea4e3cb85b9ecfd280af4e25e09b035038b0e0d58a88198ea38144a4e5ad
MD5 c80e522a7a90c3231d439e18f54f2379
SHA1 910bea2fd2b9182b99997ac2887dca6df86b1126
SHA512 18ef6f419d55bbba8e9420ac254eccb683195f27ea3398349ab4e4211eeeb5959070aad2c0ec823048c9fee4f2c6dad3fec0087e3443edbf180b2db7be33a38c
TLSH
T1B7A0023802E00653C40042B0254741A132715D58FD06074685D122C9C8912D99147138
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b9d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\5b2f987d-af2a-41ca-8291-639044ef43aa\index-dir\the-real-index~RFe59b9d0.TMP
Size 48B
SHA256 de54b45b169a4f36eb96a36a1f36322a399e1a4b07eb051a1123cbfc10d245f2
MD5 bc8892c024f1a9892d5b07b2411e8f54
SHA1 7bcd4e7f8eb16198e8f0ec1597380d5172845744
SHA512 334a300a1d708c664d4d0bfab3870eb125de58b34b3c7977a9b05349b454e309393830ef1177bb4401e07f95452fadb448e1991c169ce5ce1977d7132c2190b4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 156B
SHA256 339a6ff5300e200225ff02b140c4b5c44f692b6a6bd49ed0a07e691f4e98b074
MD5 390d7ef28ae799aa0add946eb3f1a81b
SHA1 2d34c0f3ae5b65f0be308bc298df853a73c298b8
SHA512 fda9d60c6424d92d05756807a04bfcdf1f8d921c2849865765cf1221e2b5a1e96980494fd0f4169e4eee33c6bbaa4f4f1444e6089787a57ee8ceba777757a746
TLSH
T147C08CEB2100468F07B49EE87022751FC60B820CC9C0C9E8E4584202613E9234802E24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 240B
SHA256 5b7bf39cee060af6ff76466b22ed2e9d648fdad9998106c93d6aa877442dc786
MD5 062971f4cf206402c9a59571cd3fe1b8
SHA1 49e25de44ea3d3303d7cbf7a0e8e32e48adb1294
SHA512 a73a3d2ddf022773c4d06ea36e2165654855113ae59c7c922116364df47678f188117ee51e7d0481f0db54f3fd9113b941f8420dabeae1167b76063ea5d5fa6a
TLSH
T131D0A7EB65714E6B47B099D4B126745F951B8909D9C0D9E4E8A47247607E623C401E24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 157B
SHA256 08be487668031c2dec8307b502c193122b6256609a11257972c572b74ea8bb73
MD5 9f5d27010e19725213eda12e31c0bc79
SHA1 971d43dbdbbe19f7226b03b0f0762926345ee81a
SHA512 b8e0958a1d86f74cc57ff6146cc6dae749bc73c803895ccdf769947273b79c07d5221355a67ddaf1595ab2a271a0ba3d375fdc8b1e8ee390f4b0faef6cd551a0
TLSH
T143C08CEB6100468F0AB09AD87026711FC60B820CCDC0C9E8E4584102613A9634812E24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5912f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5912f2.TMP
Size 163B
SHA256 b90bde09b0897f62a1c9855647da92d18238ef8f4b8c5af30e71ec8b89195a4e
MD5 a9ac3306cf8f6f183de8c9f97330d516
SHA1 6ba8a0c7a153ba5d96d29a6d3f62fcfa0f7c1c7a
SHA512 bff178379ccc99d5a126f5f848178cca79ef2038f34a07073574dcc1f098d67e806af018bccec1471a6e51d8c1cc159950a65bac30fd78affedd8b6d27e51feb
TLSH
T171C08CEB2110468B07F099D57032710FC60B8C1CCDC0C9E8E4587142613A9238811E25
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

1e4e4aa8-48a1-4cf7-a403-f608e20d4db1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1e4e4aa8-48a1-4cf7-a403-f608e20d4db1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bf363cc99d9e4f55c1392ae3f9c36a265ca572f753a50cfdb65fd0308fc6e2e6
MD5 fb2273ff395460ce18016f96cda044b0
SHA1 661d4c9d2ed40dd3319258347e48878a525d553a
SHA512 84b084f306df9b1b994da2968d97f6204f24a49de39446d3de1eba010546ae750a00ca9f844dd784252039b6bc0db8a0ea4e9640df142a07828deea92964e0bf
SSDEEP 192:uDf8Ny2Q3T9VILehLSvPQmiU1Gfv14IZ/5P1r+VV78gRK8/0U8:s8Ny22T9VILaLSJYiIZ/5tr+niNU8
TLSH
T198422A7578786C374EE39550B54B3A239FA0406B9AC82F94D5EC1B2D06EB39C131B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ac13aca7852a9d1377c8fd4787074fb92216aab2ee292743497b4c721636dbbd
MD5 e5eb17b968e3ab5a03842f288a5b4e33
SHA1 92b0569660195a0734e8d4d0650b427f181bd748
SHA512 adae4bcc6c4b52ad173bca2329a82059157c8a75c7d840ac976cf84dcb4a3f646a2771c31b23244c3e313744daf1170849704cc9f84012c2d42382a6ef4b6300
SSDEEP 192:uhQf8NymQ3T9VILehLSvPQmiU1Gfv14IZ/5P1r+VV78gRK8/0LqyaR:Y+8Nym2T9VILaLSJYiIZ/5tr+niNXaR
TLSH
T191523B7578786C374AE39581B54B3A139FF05067CBC82F9499EC6F2E06DB29C2307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 704dc26105aafdc1a21de754f213030be06c4e28399cfe6f978c8499c9fbb7a1
MD5 e18b8c6ab899b6af1f27dfa0841de32e
SHA1 0e427bcbf0514f23b0d3c7d3c5748750b7e05414
SHA512 0efe4b4799d0ce52e7082cb79c20f207edac59b68e8d9b324ef337dcd402780de3fd3aa366bb08d58c7c1c6540111b61a94f7c3e3433d20d03ceedb7350d05fc
SSDEEP 384:YTZcIx8Ny+2T9VILaLSJYiIZ/5tr+niN7O6R2FeoJh7UnoU:SxtTDVxDZ/5NFN7TRkaX
TLSH
T1AD82ADB268B86C3B59F7D541B54B3A138EF490679BC96F80D8EC6F2E05DA7981307813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bb2f2babde3c7c4c8d39675a276d1df3771a4a48825e84a8975cd18fea702a5d
MD5 c3ef0fc5f5c006ef95ea9e75e4ce1cab
SHA1 a13d2a180337fad418be71d8befd4f4ee1e75253
SHA512 692d2a6bc14049d1c729ad2b5ed8d3f92c07aadc7d1fde143814ba8b7c84040424d6e736e897e3616cea9356e0b892b5aabc8aa1c5c3c0bd39e4815497f65891
SSDEEP 192:VGNV6QhLFQmiUyE36zVZ/5P1r+VVLOE3zU6:VGNV68LjbKzVZ/5tr+pDU6
TLSH
T1F002D838A8A86C7B8EF3AE45B4473B239FE5116BD9952F94C9E81F1D01D725C1306522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e8461e7e6e973737c53304663da1e78e3ffd152fd90995274b89f92cf407dbf0
MD5 92ed0d900ddd28b00c434aca798b8ab5
SHA1 2f9b28f7f4532b5f787835b9a8f75c58c780d83c
SHA512 015579b0d3acf48dfdef691140548e5912909f3e5e6e07f44b6147d48d5a57b074c68bc6e6ec5bed5a1c2bb4a11ca1bd5f05a50f3be21e1e6d427006f69aeaed
SSDEEP 384:QFXiFiZcI68NK8TUNTUlIl+2T9VILaLSJw+kiIZ/5tr+nyw+N7O6R2FeoJh7UnoU:jFQ6zwgpTDV5+kDZ/5NI+N7TRkaX
TLSH
T1A6C23BF258D7983AD9AE8743B73E2D138EBCC063B5855950B7C85A1DCD961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 284e275f44a4fea6c6332421fe5dc33186ad6b119c5d4981a07237b24ae5a1aa
MD5 f0471d5f4e7c0704c72be5a94ac34090
SHA1 858752c46b28ad73465b2b5a9ff514bffe28cc69
SHA512 a12a4f214e99f8e33ec5dbe8b446e1bfd07cf78fd49c106eeb0ee0dd9d3b0e160cf7302e8346b7470f070dccb363714f8d02cd50c3254321462ad8691c9aea39
SSDEEP 192:uDf8Ny2Q3T9VILehLSvKQmiU1Gfv14IZ/5P1r+VV78gRK8/0U8:s8Ny22T9VILaLS+YiIZ/5tr+niNU8
TLSH
T198421A7578786C374EE39550B54B3A239FA0406B9AC86F94D5EC1B2D06EB39C131B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d47f9640b4869bda701d36639ad3fcf2511fe223f5791713552056ce7bf1618a
MD5 e72d6739c79871c9b45b57f156dcdd1d
SHA1 bc18cf90ed62f1f9ebba87f8006e6c4679400c44
SHA512 54069a445d98f2560da80d286729a960c5c36df425235ab0883ad6a4c99a4f37c622732961b05e5118b22c920f8501b86c8cb22bc7c48ba75287d8f63d2f1c34
SSDEEP 384:QFXiFqZcIK8NN8TUNTUlIlC2T9VILaLSPw+kiIZ/5tr+n4N7O6R2FeoJh7UnoU:jFIKywg5TDVL+kDZ/5NJN7TRkaX
TLSH
T199C23BF258D7983AD9AE8743A73E2E138EFCC063B5855A50B7C85A1DCD961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2c681c64ed875b2e3d049c0c63dc0d6343d6ca86f7ea58a34f59c04212691abe
MD5 95b7bf03a437377020ab76ecbde38267
SHA1 82e1d8b34e61bfb1122e1a0d1bb56fa75fe6d01b
SHA512 753b6d7e1e62978cfa075098eb85973dfeddaab621cea04a62f0d1cfcc5bd208891dc621bda081fb65e26ef4e17760960a88278986c6f09d327a49af549c40b6
SSDEEP 192:VGND6QhL1QmiUyO6v2VZ/5P1r+VV7816/8/0U6:VGND68LTM+VZ/5tr+n3NU6
TLSH
T18B122C75B8A87C3B4DA3A591B4873A239EA14127DB897F90D5DC2F2D05EF35C130A913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

volt.exe

Path C:\Users\Admin\Downloads\volt.exe
Size 4.7MB
SHA256 50d19ad606705d3b26201829d1026258254a2eb2656f42c6b1db995b4ec2e4c7
MD5 b8c84ceab2add4f72051c95576df59ba
SHA1 19b0ce63c778ecede2a2a0b1b05b06686e2d5f86
SHA512 f32f186963170cc38d386d01af20a0c3eff40128a7cf0e4af49f0c3b18007fdaf367a049fc841af1e397b91588d7bc2728321953ea3a94e0788d490f1f434fd1
SSDEEP 49152:YvIfamKkUPOaOZ4tHTTy+oyz0cr46UpL/TdghRjNWnObm:Mzm6wLbdYJkn
TLSH
T1BE363A073BA154E8D199DA34C1B38252BBB57C4C873177E76E90A6742F727C06DBAB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volt.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\volt.exe:Zone.Identifier
Size 115B
SHA256 52e0c6842a1a36a3363d183a4be06e710af4fe785e61ffed1d516f20590c8be0
MD5 ff04d156b874b10814013c8f5cb9eb65
SHA1 ce59cb04229ec29abdbbe0fc2913f00bf835b9e1
SHA512 8bcc37c1e2b8c12b0291c3e0d6d002d4b6e04047728f1bc60d445895e17fe0ccb85745c4e1cafd62d274684b06049859351c49bfa05d6f5cba3eba2462891fb1
TLSH
T12DB012BB9D02E330077529C4A1AFD51FA24F30288DF9C18CFC8050C2B8404ACD6D06DB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4420-395-0x000002616C2B0000-0x000002616C2B1000-memory.dmp

Download

memory/4420-397-0x000002616C2B0000-0x000002616C2B1000-memory.dmp

Download

memory/4420-396-0x000002616C2B0000-0x000002616C2B1000-memory.dmp

Download

memory/4420-404-0x000002616C2B0000-0x000002616C2B1000-memory.dmp

Download

memory/4420-407-0x000002616C2B0000-0x000002616C2B1000-memory.dmp

Download

memory/4420-406-0x000002616C2B0000-0x000002616C2B1000-memory.dmp

Download

memory/4420-405-0x000002616C2B0000-0x000002616C2B1000-memory.dmp

Download

memory/4420-403-0x000002616C2B0000-0x000002616C2B1000-memory.dmp

Download

memory/4420-402-0x000002616C2B0000-0x000002616C2B1000-memory.dmp

Download

memory/4420-401-0x000002616C2B0000-0x000002616C2B1000-memory.dmp

Download

memory/4420-408-0x0000026164FA0000-0x0000026164FEF000-memory.dmp

Download

memory/4420-411-0x0000026164FA0000-0x0000026164FEF000-memory.dmp

Download