hxxps://cdn[.]discordapp[.]com/attachments/1479142777324568780/1558969123092828200/volt[.]exe?ex=6acd5ea3&is=6acc0d23&hm=222ceb0a1e497b770ef4c5818109fa30036004be72e8a4df84286c1c0b50cdb0&

Analysis

user interaction
yes
max time kernel
86s
max time network
86s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/10/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1479142777324568780/1558969123092828200/volt.exe?ex=6acd5ea3&is=6acc0d23&hm=222ceb0a1e497b770ef4c5818109fa30036004be72e8a4df84286c1c0b50cdb0&
Sample261011-2gnj2axyht

Score

8^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	1824	firefox.exe

Executes dropped EXE 2 IoCs

pid	Process
1944	volt.exe
1012	tauri-app.exe

Loads dropped DLL 16 IoCs

pid	Process
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tauri-app.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\volt.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tauri-app.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tauri-app.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	volt.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\volt.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe
1944	volt.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4184	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	firefox.exe
Token: SeDebugPrivilege	1824	firefox.exe
Token: SeDebugPrivilege	1944	volt.exe
Token: SeDebugPrivilege	1944	volt.exe
Token: SeDebugPrivilege	1944	volt.exe
Token: SeDebugPrivilege	1944	volt.exe
Token: SeDebugPrivilege	1944	volt.exe
Token: SeImpersonatePrivilege	1944	volt.exe
Token: SeDebugPrivilege	1944	volt.exe
Token: SeDebugPrivilege	1944	volt.exe
Token: SeDebugPrivilege	1944	volt.exe
Token: SeDebugPrivilege	1944	volt.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
1012	tauri-app.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5832 wrote to memory of 1824	5832	firefox.exe	82
PID 5832 wrote to memory of 1824	5832	firefox.exe	82
PID 1824 wrote to memory of 2888	1824	firefox.exe	83
PID 1824 wrote to memory of 2888	1824	firefox.exe	83
PID 1824 wrote to memory of 2888	1824	firefox.exe	83
PID 1824 wrote to memory of 4148	1824	firefox.exe	84
PID 1824 wrote to memory of 4148	1824	firefox.exe	84
PID 1824 wrote to memory of 4148	1824	firefox.exe	84
PID 1824 wrote to memory of 4148	1824	firefox.exe	84
PID 1824 wrote to memory of 1556	1824	firefox.exe	86
PID 1824 wrote to memory of 1556	1824	firefox.exe	86
PID 1824 wrote to memory of 1556	1824	firefox.exe	86
PID 1824 wrote to memory of 1556	1824	firefox.exe	86
PID 1824 wrote to memory of 5240	1824	firefox.exe	87
PID 1824 wrote to memory of 5240	1824	firefox.exe	87
PID 1824 wrote to memory of 5240	1824	firefox.exe	87
PID 1824 wrote to memory of 1364	1824	firefox.exe	88
PID 1824 wrote to memory of 1364	1824	firefox.exe	88
PID 1824 wrote to memory of 1364	1824	firefox.exe	88
PID 1824 wrote to memory of 1364	1824	firefox.exe	88
PID 1824 wrote to memory of 5580	1824	firefox.exe	89
PID 1824 wrote to memory of 5580	1824	firefox.exe	89
PID 1824 wrote to memory of 5580	1824	firefox.exe	89
PID 1824 wrote to memory of 5580	1824	firefox.exe	89
PID 1824 wrote to memory of 3360	1824	firefox.exe	90
PID 1824 wrote to memory of 3360	1824	firefox.exe	90
PID 1824 wrote to memory of 3360	1824	firefox.exe	90
PID 1824 wrote to memory of 3360	1824	firefox.exe	90
PID 1824 wrote to memory of 3912	1824	firefox.exe	91
PID 1824 wrote to memory of 3912	1824	firefox.exe	91
PID 1824 wrote to memory of 3912	1824	firefox.exe	91
PID 1824 wrote to memory of 3912	1824	firefox.exe	91
PID 1824 wrote to memory of 3200	1824	firefox.exe	92
PID 1824 wrote to memory of 3200	1824	firefox.exe	92
PID 1824 wrote to memory of 3200	1824	firefox.exe	92
PID 1824 wrote to memory of 3200	1824	firefox.exe	92
PID 1824 wrote to memory of 1944	1824	firefox.exe	93
PID 1012 wrote to memory of 4184	1012	tauri-app.exe	96
PID 4184 wrote to memory of 3688	4184	msedgewebview2.exe	97
PID 4184 wrote to memory of 4996	4184	msedgewebview2.exe	98
PID 4184 wrote to memory of 4996	4184	msedgewebview2.exe	98
PID 4184 wrote to memory of 4996	4184	msedgewebview2.exe	98
PID 4184 wrote to memory of 5344	4184	msedgewebview2.exe	99
PID 4184 wrote to memory of 1448	4184	msedgewebview2.exe	100
PID 4184 wrote to memory of 1448	4184	msedgewebview2.exe	100
PID 4184 wrote to memory of 5736	4184	msedgewebview2.exe	101
PID 4184 wrote to memory of 5736	4184	msedgewebview2.exe	101
PID 4184 wrote to memory of 5736	4184	msedgewebview2.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://cdn.discordapp.com/attachments/1479142777324568780/1558969123092828200/volt.exe?ex=6acd5ea3&is=6acc0d23&hm=222ceb0a1e497b770ef4c5818109fa30036004be72e8a4df84286c1c0b50cdb0&"
1⤵
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://cdn.discordapp.com/attachments/1479142777324568780/1558969123092828200/volt.exe?ex=6acd5ea3&is=6acc0d23&hm=222ceb0a1e497b770ef4c5818109fa30036004be72e8a4df84286c1c0b50cdb0&
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27097 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {33f2a776-4708-40f9-97da-da59d86a9029} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2352 -initialChannelId {2864c3cc-8183-4b58-beda-0b3d9d4f5f22} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3720 -prefsLen 25164 -prefMapHandle 3724 -prefMapSize 270279 -jsInitHandle 3728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3736 -initialChannelId {a11778f1-fa3d-4c7b-bd11-76978b639cb2} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3884 -prefsLen 27274 -prefMapHandle 3888 -prefMapSize 270279 -ipcHandle 3956 -initialChannelId {5d7a8324-214d-4ef9-bf31-c222ed9110ab} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4420 -prefsLen 34773 -prefMapHandle 4424 -prefMapSize 270279 -jsInitHandle 4428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2756 -initialChannelId {b8a472fc-5bae-4a86-8168-96d9f1c47fac} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5052 -prefsLen 35009 -prefMapHandle 5056 -prefMapSize 270279 -ipcHandle 1536 -initialChannelId {6b770b94-51f1-4514-b32d-b2cbd914fdc2} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5552 -prefsLen 32991 -prefMapHandle 5588 -prefMapSize 270279 -jsInitHandle 5592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {f38621ca-b1dd-47d6-bccf-1ebce1da6ef4} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5772 -prefsLen 32991 -prefMapHandle 5776 -prefMapSize 270279 -jsInitHandle 5780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {b43497a2-b597-447b-82f8-a101fe613428} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5956 -prefsLen 32991 -prefMapHandle 5960 -prefMapSize 270279 -jsInitHandle 5964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5972 -initialChannelId {02d7cb74-ae07-4a52-8b99-a0a7649fa046} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3200
- - C:\Users\Admin\Downloads\volt.exe
    "C:\Users\Admin\Downloads\volt.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1944

C:\Users\Admin\AppData\Local\Volt\tauri-app.exe
"C:\Users\Admin\AppData\Local\Volt\tauri-app.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.23 --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1012.3216.4890414822441063860
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffa4fc7b078,0x7ffa4fc7b084,0x7ffa4fc7b090
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1772,i,1031746890084977166,10607532563451959639,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1656 /prefetch:2
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1996,i,1031746890084977166,10607532563451959639,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1688,i,1031746890084977166,10607532563451959639,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:13
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=tauri-app.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3552,i,1031746890084977166,10607532563451959639,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:5736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.contile.json
Size 4KB
SHA256 69afcc6ad975395e33e7404d7bea956b151491c1ef1e022ac6fb867a8ca6ac4f
MD5 6c1d197b3ce453e921cb76a553cc3b6e
SHA1 9910fc52bc98eb7b5227f72da603a0cd89963dbf
SHA512 016fe9a9396a36643a1acc9bc459dddbbf6dab8a4743f87159cb2073e1335feffdd7a613f99f98181c24a6db6a732e7896d7ebaf21895e51fb5b22a692ba8322
SSDEEP 48:YdbAIreDZvysWMaCpqAioJQNmqVKYGreDZ2ysh2XF7GemLl4DQQjnqb5reDZdys7:T9+MDGNm4KYCZj6DRjnzkxWdtlz
TLSH
T19C91C55F84B884021761AEF5FC0B3798F007B026DED5DEA8B16A8C61C16D7AD80DB985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 e69d75c20c8fe293fb7c5bb2484f9e45fa7b793dae5b6109177e08949eba743b
MD5 c5116dbb94eaa7df8434bd38f39d24bc
SHA1 e89d7f4b765831484f2466c64983c86146f28043
SHA512 709a49b15e58aec6f5498c89aef5ad60706c94e41adb572abe9e980b8fe60b974588da744b1b83d39462c0ab4edd3ac43dd4d74291b8c11c86fd3fb9603cb43b
SSDEEP 768:IyN0ztAhNB/wq0CZ+xidYgpF551gcbSe5aM7x+GtOOrGX:zNgsFD0CZ+xAYgp16FSa04Gq
TLSH
T13B73F9A3A6E9B2FB1B9137CB2C0FB95B65E20146E34505C8FCE9C91CC1CD754123A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 eb2e3a5973a18931913bef48e7029f5b52fa6fce836be729c5795bdc94ecb09e
MD5 44bbaaf423a36b963c32e7d1d0f7017f
SHA1 3ff6aaabdfa16cee83247a216ce49ae64b70b380
SHA512 4101948b8abb05058befc918184bd94ada5b6d03e665fef7b1b00f006f1ca317fdbe34867c1b7c6522cc389a77c1ec78091ca7a30b01b1058ff83f550123e594
SSDEEP 384:HGNQiO024YbWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAY:mDZYbWTToXJWTTogB7S/AmVAf+hRMj
TLSH
T1E0728E7D8F013CAD175780E8C8B583598D18B7ABDFB6C02D26983D09CA88A5A71F945F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 a56e12003eb95c151f3d4de07ec662423ec590221600155527cec5368570d76c
MD5 bed88e763504ad2d94406fe369cbe0a3
SHA1 7930afca1a7345a3d54808fa77c3cbe051beb88b
SHA512 d6e4c0cabfe106b9f0c5f9c5dfa252897827cdfc15681bf35ee03a70658b208257203a996407ea2c673bdc637236138e35d5d9276d4a7fefedc759f0bb5cec5f
SSDEEP 3072:X3lje8Bb1xHO+n8Bvv95Ssxv1LsQsCw7l8T0e:FjP198Bvv9ssxeQsbip
TLSH
T1BEB3AEF7DFA6C93C55FFD42DAA92853DFD222404B3A7300AC913335462C6BB86679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 52b08d6b6ccaa4bbc75f57a89738d4e4c1a2e7eaec9237d4f49a274f298e65bd
MD5 01b0c0b6fc2fa9ae01da6ccdaa015597
SHA1 db2f34d2ad04d168b8887e95ce7de2bb223ab500
SHA512 f1e5e36b2f15c37e4b0b4e2adcc5d5be0884068a03bca403b45c376ace7ba02033658bb09637a2f9a087984db8345d03cab7de1af465b6501f1c9cadb4293813
SSDEEP 3072:j3lje8Bbr/gdJLQvv95Ssxv1LsQsCw7l8T0m:pjPrghQvv9ssxeQsbin
TLSH
T1D8A3AEF6DFA2C93C55FFD42D9A92853EFD272804B3A73009C913731462C6BB86679609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse755C.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nse755C.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nse755C.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nse755C.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.luaurc

Path C:\Users\Admin\AppData\Local\Volt\lsp\.luaurc
Size 169B
SHA256 a4f0cf2fe24eb73815a884211257322dc2bcad03506c6c02171b3b97fd367e6b
MD5 e1698082286f891febf0ac7371d2d0e7
SHA1 6c6d7c77361d7ed51de646f9a057dd5336c32bf6
SHA512 87e6a44aca53943cb5886eb49aac67780e6db5fd05ad588d61f8d692df232090139364be8f588012e74f881caab98d70f097e0fb6d84d8ff94ec446fe5981fdf
TLSH
T1B8C08C01C88B09FD38D6C04EE8A5D152812C46EEA20C2E2EF2324229ABA983C4845FC4
MD5 SHA1 SHA512 TLSH

Submit Download

en-us.json

Path C:\Users\Admin\AppData\Local\Volt\lsp\en-us.json
Size 6.8MB
SHA256 1deaf275538c1cb05eddf3934bfb21758fa8a8bcf997ed24b610b354fe7b2aa8
MD5 b752256eb2e8de6d4fa8075af7c61540
SHA1 de9217777ef3c52aabb9c9e68397d955f36d7824
SHA512 535ff877bf47c5e241344c5d3ae592f034c938b475cebb3ab6af7a249775cd45f80920c4858fcfa5f2206e73cab9da2976cb8894313106136f52d65eb0271cbc
SSDEEP 49152:wcnn/G/6QasKN5yPkyC/T+V0g+8sH9em2Dl:q
TLSH
T13F66DD33D9901D5726B2574DF8B9435AF82802EF204D188EBABC732C6F6197B1516BCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

globalTypes.d.lua

Path C:\Users\Admin\AppData\Local\Volt\lsp\globalTypes.d.lua
Size 844KB
SHA256 844d0d3767c82140ae05327e2b92ac1f3604fc46d8356c8ab844512e2f8694f4
MD5 8065d50eebb5b7162bbd601deaf5dd11
SHA1 b0f4a81e1e8d52b8ebb1ed5bc26609bdb3bde652
SHA512 c24c758855f353db0b69dd63b058388f4645795c696abfc687c78ba865d57127412ba976bce899d28bac135edb7b754aec9243db1ef6d667693290ed95499b4b
SSDEEP 6144:6ENUApJt52uXnoQOeucwfTFCoLJpldStDMMyYmxBmz/+RxJ7MGicvvKFupgzgd+W:4uXnoQOeucwfcDMuzV+
TLSH
T1C105431DB608F1300D8F63F6AA7F8884E87592C4521850BCA1F8FB9A177F43D2656ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Volt\lsp\luau-lsp.exe
Size 6.0MB
SHA256 43dc7a51985872f83cd2f644cabf251023158b432a7cdcc795ac1b36dab3462a
MD5 e44b9ebe7211e3aa6ff3bab4f8c8451a
SHA1 4d0406042cf46fb776eea8645635d21f8cc50308
SHA512 ce57f9592ec2086a1ddad05d6e0edc4a13f243e47ccb12cab5bfe3939ce4565a8a360c55992afd3799af7bd50d992309d4ca565462bbfde6b60e10713a0a99c5
SSDEEP 49152:NsY0bbZDDDDDD7H5c7G9or26czNvOgPQqWv9UHtS3XLZvdfEfPgp1LY078qWcHGy:Pifc7GXCn+361QjvQfyom/BOa
TLSH
T112565C3B629801FCE0BBC179CB5A9953D772300A0331AAFF05E145A66F57AF45E7A312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.db

Path C:\Users\Admin\AppData\Local\Volt\state.db
Size 8KB
SHA256 36e1537d6daa4977d21290c0c39d23b18ffd8790d4c2dde1e6f2aa38d0027102
MD5 a9e5d788a23352842fbe043a134e2b58
SHA1 da7f0aa2691ce7db47c137c38c2f513477865d01
SHA512 6856cfc309de660cee97a544fb0298361afc3659914a8f7d5d526298f4425ded60e9913eac224eea8d11b9b1c80075217046cf7d90fb92074267ff0c6286e139
SSDEEP 6:l9bNFlE9Yksm/0ur9FXGLux4v/YqFOnqfUbQdr:TLiukD/TrD+4qFgq8Er
TLSH
T11AF1226A47007098C8C02CF2A8628B731E3AD70BC6232DC3311C0000EF8AD08682DE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tauri-app.exe

Path C:\Users\Admin\AppData\Local\Volt\tauri-app.exe
Size 14.5MB
SHA256 93ed1c16ff9061dac4be42ca76f3cb85c2bac792d820ebee716f768f5c69055b
MD5 6ba3f2a5a6ac3d6668da88e5f42ccaea
SHA1 5578be8c19ab97e047351fc0b6f08003db5f61ad
SHA512 b97144ed445e03cee3268df2337e3a6d57897827670379a5ee526c1fea024602a2b346219147e0f0c543df92d4a790d5387c044386d30ded119d72d4708c07bf
SSDEEP 393216:cVzFvL4xH2ihKKnbaOlYJ5URvLLjZWsE+:0pShKkaOlYJa1LLFWsE+
TLSH
T1F5E6AE03F39581E8C0AEC5B8C31AA637EB72B88D4521B29B5BE45F112F26F506F1D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09173555-54e2-41aa-b7aa-cfec29ae2489.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\09173555-54e2-41aa-b7aa-cfec29ae2489.tmp
Size 2KB
SHA256 0810680d383dc395fe71a46231a1613f25acd8144a4793a501ab84c34b822153
MD5 94d3ff94c96970c39871a9d147716c9a
SHA1 252fe93b26f3bf69298679ef53ec5c7c4b142d09
SHA512 fc942b44792e4a6f613124950582036d92693e8ac0fe9eb71207d2fab87812d05c57e873daa64c2324f10dd440998fa22379350b267043f63e817c26f672d59a
TLSH
T1B0518772B884A73785E26984B5593B53EE35A125A6923F5495DD0F0C01DB6EC2306C27
MD5 SHA1 SHA512 TLSH

Submit Download

356e0f5f-1c0c-4e43-a600-3cf21f4a7dd0.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\356e0f5f-1c0c-4e43-a600-3cf21f4a7dd0.tmp
Size 1KB
SHA256 6b7b5326d9df25068abe5d98e99dae4385f73d251cff337f38689a44a682646a
MD5 6fc91675443d640d960ae27dca14064a
SHA1 3fcf3eb56df1e50c016c12dd5581ba60ced081ec
SHA512 6e39a63d3a85ad06ec9705341c35a7c49147fc89dc36a055843c4b8cc56f34f315c82ceab537ea722349cc089321e78f7164faba42eea0048340e92660f03dd3
TLSH
T1DF31A972E4D07B3259817AC5B1567B87AD307025D291AF48A1DE0B0C02D76DCA73AC33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 82e587d037535f955f81e674db229000a0e57e5e796832175561d2f07f0bef7c
MD5 03145f099ddc77fb62a6748b8de794dd
SHA1 70bcef030257969b13588e9d6e0858119126f774
SHA512 69b0f4b3dd4c82ffb12b50464fe798a26b03f9c98099fb5f8ae5dca3c4cb16a62052041055a1e89c971967743884def68f456637ed3eba2561f949c2369429fc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6986f0cddb7dd83e8456ccadf55dd1f953ba761a03ab0ee15fa37aecc03688d5
MD5 d595bf0c887ff0d9b2cbbb113aa823ab
SHA1 0d1961bf6f7b0d904b0990073af9424ce9159102
SHA512 50df9797d5e468dbc80adcec9d8c355f6de381614fc0d2b95fb49626f6bb6671e0b9692893b31fe731784fa0e5f73c908ae327f1e7e32bc4b06ef38eda0751f8
TLSH
T163D0121633010134D0A034331002A10C0845D60F820AC0445428D61D2A444500D02491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 d4f6ce1cf56b69b730cb53e7b481c61e655db1333308edf9685760ebc00bb626
MD5 37c5b5f1f76effcf120888a12dad0536
SHA1 79da9be103f97b05f8ce4dfff09c67080d2c7b7a
SHA512 7fdc3e958e97e7376b3f17d9c37e61f863306d5ded41bfa031ac6debc5aa3e7e7f401732e1990f111aafa48db1366f07cb75c5ffa0648eafe2bbdba6961e8ad1
TLSH
T1A9A002211A472483D380237015E202907635489246AB0FE665A451ECC994391C6A540A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 edd9b73633e19f2c6c736645e468beb0a20fffc54612bdc4edb744b0b678116a
MD5 a1accdd6c38423bb1543368d6f0e6bb8
SHA1 2da8a56044dde8a75749eb9ac7cf7517de7c3a72
SHA512 02fcb94f0e44456738185e77e822304e481cc7a323c478365141331985a96921bfbcc1de70a823b2f9402de8cdbe85bfbb7bd606669af3a34a56192fe9203329
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 50ce02b63362758989a64014130e1bb603ff2f4b0e5e91092621c16517c0a6d5
MD5 d6b5e3a2efdbe8e9943bb71a2bb74715
SHA1 2630fd7a0fb029fb65f07f659d789e406c15e7c7
SHA512 a3d410c67f097b0153767e865b116cdfe3517fa09ecc666793963fa8df06378c2cbea274a44d4b729a2f0a91f8c03ecfce91f4b2b250eb214509e8a59ea3c607
SSDEEP 3:LstlNllkll/lIAql:LsX3lEtIN
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Preferences
Size 6KB
SHA256 e89d9d4b9298c9ab0dc88b4380a182fbcd73f3f512f96643f2093855879a9d61
MD5 863f1eb2be44a786a996d180c2632879
SHA1 7e32a68537c1d8ada78a3f0404af61fd9a3ea266
SHA512 4fb8092c5a3750028f1af57a545b9b9335878ec86d1479c045fb4c4d5e2379d96cbe28cd2515295d869a2dc0fdb68a5aa467835023e7447b992ca90b88bf028e
SSDEEP 96:st105N9YQb9vffMZ8i0vhEhkt0m/7qx+WVHMSm+uecJ5111idQjr+ghBQMEB:st10TTfkZ8paId/S+WiT511wdSjBQM8
TLSH
T1FDD194129E686A774CC7F61D7A3ABB52D2F9502171D51E98EAFC861C08E76CC2207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a802c00c-02e5-41bd-9897-ba73ca2c4bad.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\a802c00c-02e5-41bd-9897-ba73ca2c4bad.tmp
Size 6KB
SHA256 749393c6ae16b0f34c54ab5398d104f8a6cc6e57b48638f24ebd22fb9d0c78b3
MD5 7447f9e29dfded7fe346b263ce25e83d
SHA1 e8b94e30a68b76c6e159bfbcdce32218d9ec66f6
SHA512 4b05ef0b34a609cdc144e4243395943c8d5ed7785da415f8327ffa03dae1578ae0776a908ff8e1c953895f0ce67895812ed2fcd1c0f8ade8f014aaf9d76ce48a
SSDEEP 96:st105N9YQb9lffMZ8i0vhEhkt0m/7qx+WVHMSm+uecJBd1MFHdQjr+ghCYQMOB:st10TxfkZ8paId/S+WiTBd1qdSj5QMC
TLSH
T1F4D194125E686A774CC7F61D7A39BB52E2F9506271C51E58EBFC861C08E76CC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 1KB
SHA256 666e56fc9e16868965e0293427ec7e24bfade6af09cb838df9b1dd8269c33cce
MD5 52684c8fbd0fee9647eca708196b6b66
SHA1 bfa4e964d8e34195aba1016b5cfdd3ce26c89ee7
SHA512 1cd60142486469ea4eec388b314cd01f3b42010e53cce10f5ae1908a244e7e547deb6706c347c63507321e84f2ede8029ce3bd298a058ef8002d0f554769d9a7
TLSH
T134216273D4C57B3255816D84F2567B8BAE70A025E291AF08E0DE0A0D02DB5FD973AC33
MD5 SHA1 SHA512 TLSH

Submit Download

d1506b2a-13b3-49d6-a4ce-1589419d8314.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\d1506b2a-13b3-49d6-a4ce-1589419d8314.tmp
Size 3KB
SHA256 865e23d7a42bea1875d84a082d5ef110066389ea4b13963373dd228258b9ba90
MD5 3c6a65ab79465ddc43a09ec998818261
SHA1 21d80f6155d7fba5fa16ecd0293af9d7bb2febf0
SHA512 d607a6aa57383cc9dfe305743cbe376a8c50c97e4fb67fca82799855a240fc18041ccbc87bb16644cb0e86d75b0bea3317ad3325581bc0ad0f2acc0f7061a35b
TLSH
T125718672A9A4AB374DE2AD44B8892B17FAB56126F5D13F98D5ED0F0C01DB3D82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

f55e61c0-a76f-4bcd-a05b-35cfdd46bc6b.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\f55e61c0-a76f-4bcd-a05b-35cfdd46bc6b.tmp
Size 16KB
SHA256 1e4142a492200d32a382fd3e0b2f613ff045a75cc2cee542cd2550fd2054b03f
MD5 dfa73b2cfbaa2d5047c53bb3aba5eb1b
SHA1 003c4ee2ae62bf5b88f6a19befb86c8078e9e334
SHA512 ecc711e2e520b9f5f77f148c33580b1ca52e76ccef8fbe4a5514a2d9fcc7d7b0bed104a24d568a7dea013c13363d6a8d516a460f4fbcf1f1c0f5f1c8113b572d
SSDEEP 384:zVv+aQikB+z/xvxjg/qhE0Nbux7ll1ojFg9zR:4/UxvxjgC+jrojKFR
TLSH
T141728D2761A87F3399F7F9447A4D078BDBB494B190C16EA889ED5F0906CB3D81342D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\addonStartup.json.lz4
Size 4KB
SHA256 51174a6218ba4199ce0995c50e2e85d8a52073606ad5bde60b427cbd314293f6
MD5 ac74263ce0e8218f75aabf6435d7cfe5
SHA1 99e429952085f3a7195b8348a0ed97e583786ba3
SHA512 91a372a5403e211284da7c621f533a291711ee9f6f86d2341cf38a96fdf6b85ae9f3b5490cb9646ae6a931872ae1f9d409295a702091a301eced91418667dc22
SSDEEP 96:NbTC4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhaFs:NbZ52xxhD8rGvm6ApwnHa6
TLSH
T190A18EB5D585EFB6FD22D04348E93FB2EAD59B7424B5C8D0F1AE72290C64AB31705380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 74d4383856d27eee0746f61983c9a8435b5bfa99f39625caba9aab787e547351
MD5 87b2cf48df8f57ee48113f33eab0eaaf
SHA1 ba01e57d792679bd79af025d9345dce790cfc0d5
SHA512 b6749f81ad7d907ccdd901b0efa888b3fb5a44967ea08a3daa9acb9fbcea9b919ecda14312b599b696c06eaf4bfa422dcd5dce2d6ace0ae58ecc4ea2fb6b7868
SSDEEP 192:7Ov5zbobZOZyjsTT1d66Joz0dzgCl6mc0dz:kbobZOZyjGd66JozQzgC1jd
TLSH
T19BE11CA4F629863FD408027BCCA61B440F39389BD84E3F2935AC75482D5B2DD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 44016e357ab7001a703a19c8001cdecba1c279934401084ce8800d9ab1776f51
MD5 8157d2668ca6a1ef4b989bf051bcf2b2
SHA1 460ba887ea804634bd09cd03d63d425b38963de4
SHA512 5a7ecd793afcbb4cf7ab7fc1a590493c1ddb2c2044141f9dc270632804b45753e1dc8d7496ec810e5371b0c8a85ee39b3e3bfd86f74f9c2a85ecf966201ae889
SSDEEP 96:6FF2ROxl/dd66Joz0dzgClKtmc0d/UUhSdF95/7bkW6QXjrcEOZyUR6fWZ:m1d66Joz0dzgCl6mc0dHOv5zboobOZy6
TLSH
T114C1D768F629463FD449023BCCA61B500F32399B985E3F2935AC74492D572CEBA8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 70542bed80ea9fc2b2cd7483a9639559816fbfe7fff1df580374bdaa585fa603
MD5 2af7dbac55ab5b3b672f69ef2ebec9c6
SHA1 627428fc8a3b952ce25d5c8059edd1667341f4c3
SHA512 490c7410939d47435f8a4f8894b7f856f71f88d2b369ead5ad0132280cac25536dbf0430e7e77a40dd8c94020ede0c82827ac2a2877b4d1a214225c88ff09b7e
SSDEEP 192:POv5zboHuZOZyjsT01d66Joz0dzgCl6mc0dz:gboOZOZyjLd66JozQzgC1jd
TLSH
T1FBE12DA4F628863FD008027BCCA61B440F39389AD84E3F29359C75482D572DD7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3abc358884200b1c046510b227091a750ced1c6cf81ab518a1a1362ae031299f
MD5 44e269c9d70d4295a073a4976853ac64
SHA1 ee9197a50a0aab72316d3d2667e3b850beb60263
SHA512 66aab4492435feb06dae5164aec60ccdc8134ceef2a5a653938dd0e479045d753392c2809ee7b0d338c383141a77abf2b93b2b8f3e4d9aaa71caacb2bba8718a
SSDEEP 192:IOv5zboHROZyjsT01d66Joz0dzgCl6mc0dz:zboxOZyjLd66JozQzgC1jd
TLSH
T19FE11DA4E629863FD408027BCCA61B440F39389AD84E3F29359C75492D5B2DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 203cef8dcc57794560b08767158802416daafc527f497622954705f3cf036d73
MD5 96d27332cb134476afedc299db24738c
SHA1 fd526251ac9a8b1eac2314470b037129b5c3cdb2
SHA512 56a9c88c279ce16846dc5bd39921e70d8abf0c4fc4205aa59676ce165054fbad568363af64f01e9ae3374572bdf5429eed4c6c58ffa5ecc1059b50dea04643ff
TLSH
T11221794C3AB98E2B9E8AE65CF45102CE53958E0B148B1C474D42DF8DCD91BE932AE43D
MD5 SHA1 SHA512 TLSH

Submit Download

07e2995b-4d3f-410e-b517-db242be05d9d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\07e2995b-4d3f-410e-b517-db242be05d9d
Size 2KB
SHA256 75c73ffde143b7513dfbf788d27e62e87898fcc0e54a64229855cba2cfefccc9
MD5 9f418ea3e65a651e0aedb2ffe40baeac
SHA1 46ca6f7c22904c462d6f0d4ee3a55763c33b3de2
SHA512 15d57fca4aaf964fadbd4eee095e639fc427a190a47e430ab8ab4dacb4a4caf7e67a98e243a7844c2366e295db091d201ad86cf724a20cb18e1c64450d88bccb
TLSH
T13441536CB9B85C7A6CDAE15D84E2238E53715E0300862C836E51EF0CCD96B9D63BA527
MD5 SHA1 SHA512 TLSH

Submit Download

1aac70a3-c9f9-4ec7-a38c-4dcd05d45992

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\1aac70a3-c9f9-4ec7-a38c-4dcd05d45992
Size 235B
SHA256 028887858b427f732df20d79986da908223f52bf39dc93e0ad634ad5d82a6df6
MD5 2d63a8d3becc08395e36f945f9488db0
SHA1 5861b03c87b074caf2d99756d75aaddbdfdb4432
SHA512 2e06426859a48a5b5171e87fc8cdbdd5b1439b310bee905a69e11ea3f6af13c369af75497f8acc1297ebdff64da48739920d17536f3814437287d2d14de18977
TLSH
T161D09780E8AC337E0C080F12F0F038C630458C331075A810CAA00978DAF9EC54261C1B
MD5 SHA1 SHA512 TLSH

Submit Download

43c68d4d-3719-430d-9fff-24f6dbc98552

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\43c68d4d-3719-430d-9fff-24f6dbc98552
Size 886B
SHA256 add79f0c360f049c8e311ca3e5e31c88964662cd604c109bdc8c8da251efc1ec
MD5 51c432eeb1dbdb95ecac18b3681a7d31
SHA1 d4e6c7acd32f1d4e8bb70ee15fbf44e9f187c78f
SHA512 f87a46293fea5c20a2b425f529545c46829491862893878ea2ed990da27919d9d4170e61f137f5fe309d95aecd3bb05f0c9f4e141462aef1a415a6899270d742
TLSH
T1291144819A20B5F29C68928B85F2B78287E43033C0DE49147D95AF184CAB51DE7A2207
MD5 SHA1 SHA512 TLSH

Submit Download

46e41b8d-5125-4918-b7ea-c8ad1805df92

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\46e41b8d-5125-4918-b7ea-c8ad1805df92
Size 16KB
SHA256 dd343d2cbf79a5d7fac821aacad4184e84bd2186d91de5906d18d8a861b3ad43
MD5 f98c7d33e5bb87c0cc485f75f5c2dae7
SHA1 4ff7e2d7f942e9b6c2998ffbc4dabe714e215bfb
SHA512 b8d408d9855cb81145fdf070eaf87b07d21e1898a6bf4ffcc85c16e6ea970a5d48a7cdf0d421bb4719fef39bc4824c09f2d0e3e0277da0f0be39f50981a32412
SSDEEP 192:pudCjI9vEelpzsU+x1U3k66Bx6KtWB72gy39wVQaTqfdC/yy+0VVGgS2+TEOTRB2:puAc9v9lpQU+kx61CXIwVXTPhi2
TLSH
T14172EA5A286055BA9251E36884ECBFC3E2F538CF4C019FCE9BE47D086DEE46D512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92ea4c8b-e737-4ca4-aa5b-2462caf64d23

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\92ea4c8b-e737-4ca4-aa5b-2462caf64d23
Size 883B
SHA256 03d55edc36f53166a046f13cdba1f559f854facda04ed79c5c75f84c3ed6ccdc
MD5 c25634c3a5c464a97dcae052a69a6f8a
SHA1 e22fdd25fc7bfb30ccb3b34cee5effa5e87b3fc3
SHA512 cf1c528cd73384d1d517fed6321992fe20a20a8f9e00cac9705e1717853fba0dd3dab6a7631ab0cd89988d5476698d9f373501f90221fed7eaaa0ce6a0abc7f6
TLSH
T1711100C0A931B5F6DCA8E24B89B7774687E4752380C794143DB5AE044CBA91EE3A6607
MD5 SHA1 SHA512 TLSH

Submit Download

edde48c7-c52e-402d-ad51-73d15e549a99

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\edde48c7-c52e-402d-ad51-73d15e549a99
Size 235B
SHA256 883329304f3777b2be62dcf560ccf077fbcbfc3b58ec30f87785119dfb493961
MD5 eb4109619c37454e3551360c83f3aadb
SHA1 fdacc42bf6b37a0e06e5ef524c0375e743c44a7b
SHA512 353dbc8ca4f9a786306758457dc1eeba8239c89dd46cb589c5bdc6acc92d0411a1cb25d9accd72ce4a3433336498a7f9133e4735d959319c7df8c316fe4b98e3
TLSH
T15BD0978034987B6D08100F0BF0A069CA30488C3758A4D82095A00978CDB9AE8429190A
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\downloads.json
Size 681B
SHA256 7700320f79b22f5de851b6f523e42220c0ed9beb9004001b6a4d09d83ad7d02a
MD5 daeae07d358f31cbfcac63d094c2dbe7
SHA1 1a209e1b11247636c9b4b051e89286b47c8a4f61
SHA512 b8a132f5bac35dd6e294c010a81e4fd8f4eb62f83b7472d695f79f7a9b0d24f2b059141730b3a508c66110acd1000777e6f4fceefb226e762bdbb325861e9b47
TLSH
T1F30168B3345BCDD577813F89A96C3F434A35E80B81D4487814CCCC05519087B2531DB7
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\extension-preferences.json
Size 942B
SHA256 a56a46aa7451d640626f9adbce3ffb26ea6ab549f15af56fc2cd69f0bcfda67b
MD5 8913f98eab4828647224c9a64b706b3c
SHA1 f886a4456ee44a4e73ef32a2b138193f2fa41d37
SHA512 28869c106812bf053c732469b0f67da993e42a471c7b576e68d45fe66d2f067bab0a66c5334e88c6460e08a06285daa643f5f34771bd0d7361097307137e1630
TLSH
T16211F13A640B6EB01E8E5625FA384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\extensions.json
Size 14KB
SHA256 249172c21021abb82f894e1f021733564319f376c2f6fdae1669d5a834bcb797
MD5 9a6b68b1a6eea877beac646f859fed8a
SHA1 60b8db2fd8159ee1011b3ab2d69122710adacfc7
SHA512 d91979e69e07fbcf6406d4fd803a79bf9023c9f9e93b46923939ac4c8ff70edabbff32e643e7181eae5965423499755ed1b71f8ab87ed9ea504fe76c9b05baab
SSDEEP 384:/kI4vTUmldvRJ8dhWH94zt96ogL4HVL4PAL4HvL4HGL4H7:MI4rRfZCXy4f6V414a4T4M4b
TLSH
T1ED62431549149EB8294FA78AAA367E02C37D473B70445C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs-1.js
Size 6KB
SHA256 b6fdccb814aba22a7de38e69bef1af9c3d337217ccbbe2b3014ec1c00ff18d49
MD5 2d70d1e4c41cd26e5328c0245f7ca399
SHA1 2fa50428bb755758e82a0c7f837f6c7323971d24
SHA512 ac89ef7519d4aa7562c2f7a8874de52833f32cf90ff925a2a785acec3ff52823cabc13b2ff9dbbd4b68085b6aa3fc39ec696346df8cc5051000179090812748b
SSDEEP 96:xHAmUTUJrPqGq4fy911zSvSSlcdv9jWnIHGAvzE3KF7Bw88H8L4cnh1Vlx:h5CR4fy91USSCG/KF7Bw88mV
TLSH
T108E11F7895088F7F78B6776CAC688C715AB2013BB7BF28D650B95485050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 6KB
SHA256 a7c16b2e57805da2221739e39424b1ddd308c89c78299ea0b32afe0f574b4ee9
MD5 8a35bd1955f70b0d155c0b9ebfaf66a9
SHA1 ad6319e388b4bcb33a907b57e3937842cbd47f60
SHA512 8ed761f8294c323d369d2e475bc3acd554f87460e4c0c8fa2dd48fe87843eba0c8ac494abf4cb21879893b73726d0a7045587726eb9982029d3c6832c77d2387
SSDEEP 96:xHAmUTUJgqGq4fywj1zSLPSSlcdv9jWnIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fywjCSSCG/KF7Bw88mV
TLSH
T101E1107895088F7F78B6776C6C6888315AB2013BB7BF68D750B95485050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 6KB
SHA256 687a52ec2880d56da7becd839222feefd0d9438dc9d3830f565aaab31706d2e7
MD5 0ce5193ed28e08cf9e52a205c492f927
SHA1 3128582a27610631fbb659d9b310f6c20a57975c
SHA512 ba5b792fef81d4be400296a3b21169373755beee1fc6932a1f189e1b067a4735f67da2deecc9a003acf3d3789fcb06d02d45f84050aa2f9d4774a2c044fcf0af
SSDEEP 96:xHAmUTUJrPqGq4fy91ObzSvSSlcdv9jlnIHGAvzE3KF7Bw88H8L4cnh1Vlx:h5CR4fy91FSSlG/KF7Bw88mV
TLSH
T1E3E12E7895088F7F68B6776CAC6888715AB2013BB7BF28D750B544C5054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 7KB
SHA256 2461878c9af21849d93353fb7a28072b7ce5d56db552014238b93b21e5195fb2
MD5 6c717f63789ce4a119254aabe56e48b0
SHA1 5a6a496bc0a63db33dba05ccfeb2f7b636786ad5
SHA512 158f7ebefec8f6a475b109719eafdd140308fe0261b16c210c199690e852918686b6212dbffbd4c6c399e566cc78832d89ecc46775b37c9fc25f22019fae820b
SSDEEP 96:xHAmFTUJrPqGq4fY91ObzSvSSlcdv9jlnIHGAvzE3KFWBw88y38L4cnh1Vex:hoCR4fY91FSSlG/KFWBw88t0
TLSH
T157F11D789004CF7F69B636ADAC6449715AB2013BBBBF68D650B984C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 7KB
SHA256 cab654362694708932ed46fbe04b8d128d2feda041fa7265a977649508fd9167
MD5 e6c5e17079b2a91df555baf453735816
SHA1 3b1a8dfa6d6d089d0ef5e6ecef09d68b230d823b
SHA512 ae3d03813355c9d5c160be6c5ec341bb49f7f5b1950a928903873ff522f6cab4cb5f17e86c48d7b5457bed3f421b61d890a54abba546647b96ea7d3a0c48275a
SSDEEP 96:xHAmFTUJrPqGq4fy91ObzSvSSlcdv9jlnIHGAvzE3KF7Bw88H8L4cnh1Vex:hoCR4fy91FSSlG/KF7Bw88m0
TLSH
T1CAE11E789508CF7F78B677ACAC6848715AB2013BBBBF28D650A944C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 15920cf8ae6196d14011bf44f3101d545122999304d2c88c0d7caee1afd7bbc1
MD5 cf8478f207675d0cc2952321a75d5aab
SHA1 00f72c3b7facf93ff84c246eb16f6751f516b19f
SHA512 e5036b0add0e27cce11c0ad86723e515aceeaa9ccaac3b49dc9d36746bf4c4e16e113d452d559700a67d57d6978e5386695349ea24d694aca32a8dd95ee258f0
TLSH
T13621D713889B2FF5AB25C22BD4485FF982D83033847158A0D289CA0252ED8AAB381648
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 177b3e52cb3c73dc88627383feee5f2575e2614efb92814d26c3dae8c7f9c1b8
MD5 d4a4e8bc1d331e1807fe2ce21d83f05f
SHA1 969db8f4e28d4d3a3a8156cdaeb2eec42fbf6278
SHA512 ea3cc4c37ebf0df4854a90f2770ee7ce57d8bdd9c8ec5389809282e229d7fe950ae9cc4edc74170f44d72779bc32d948c71644906c268bee41d1bf0432131f8f
TLSH
T178210B6364163FF52B16A36B94862FF506982427CAF504B0818C8F0151EDD7B7346F4C
MD5 SHA1 SHA512 TLSH

Submit Download