f06e8684052fe924c9d289f3d6f0e86f0dcbb7f8548a3b270e341ac06b3186ff

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pluto.exe
Size 15.7MB
Sample260802-mff18sgp2w
SHA256 f06e8684052fe924c9d289f3d6f0e86f0dcbb7f8548a3b270e341ac06b3186ff
MD5 d538861e64c56b5652f5b18a3e253af5
SHA1 ef451e8c0d9c89f85c6664d6449b747b5db3858c
SHA512 672a24d2914932db750d89ee17afc7b7b0030f996278601f5a92ee401e0e9cbbab82634d8d277635ed36f7182097e37505c48e2f6fe8bb75bc5cca988a7d3d08
SSDEEP 196608:WS/U8dfbwwpRvfvWn+T2mYxrxr07BZOlJGJIGj:RdfBRHW+jYxdYBZgJb+
TLSH
T1F6F649217A5A996DC19BC47483874A720E7130CB0B39B9FF449592382F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pluto.exe

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
17	raw.githubusercontent.com
21	raw.githubusercontent.com
50	discord.com
67	raw.githubusercontent.com
73	raw.githubusercontent.com
88	discord.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
51	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_647424395\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_647424395\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_445255254\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_104895390\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_115688405\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_647424395\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_982353016\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1818022647\_locales\et\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2812	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301398780415188"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{F6B40B79-38F6-4694-A5DA-C2AD0CE3214C}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{765C5B36-B2F3-422F-820B-6E2641058922}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6532	msedgewebview2.exe
6532	msedgewebview2.exe
2340	msedge.exe
2340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1860	msedgewebview2.exe
5696	msedge.exe
5696	msedge.exe
5696	msedge.exe
5696	msedge.exe
5696	msedge.exe
5696	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1584	pluto.exe
5696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1860	1584	pluto.exe	90
PID 1860 wrote to memory of 2056	1860	msedgewebview2.exe	91
PID 1860 wrote to memory of 4852	1860	msedgewebview2.exe	92
PID 1860 wrote to memory of 4852	1860	msedgewebview2.exe	92
PID 1860 wrote to memory of 4852	1860	msedgewebview2.exe	92
PID 1860 wrote to memory of 4852	1860	msedgewebview2.exe	92
PID 1860 wrote to memory of 5152	1860	msedgewebview2.exe	93
PID 1860 wrote to memory of 6116	1860	msedgewebview2.exe	94
PID 1860 wrote to memory of 6116	1860	msedgewebview2.exe	94
PID 1860 wrote to memory of 6116	1860	msedgewebview2.exe	94
PID 1860 wrote to memory of 2344	1860	msedgewebview2.exe	95
PID 1860 wrote to memory of 2344	1860	msedgewebview2.exe	95
PID 1860 wrote to memory of 2344	1860	msedgewebview2.exe	95
PID 1860 wrote to memory of 2344	1860	msedgewebview2.exe	95
PID 1860 wrote to memory of 2344	1860	msedgewebview2.exe	95
PID 1584 wrote to memory of 5696	1584	pluto.exe	96
PID 5696 wrote to memory of 3936	5696	msedge.exe	97
PID 5696 wrote to memory of 2812	5696	msedge.exe	98
PID 5696 wrote to memory of 2884	5696	msedge.exe	99
PID 5696 wrote to memory of 2884	5696	msedge.exe	99
PID 5696 wrote to memory of 4708	5696	msedge.exe	100
PID 5696 wrote to memory of 4708	5696	msedge.exe	100
PID 5696 wrote to memory of 4708	5696	msedge.exe	100
PID 5696 wrote to memory of 1764	5696	msedge.exe	102
PID 5696 wrote to memory of 1764	5696	msedge.exe	102
PID 5696 wrote to memory of 4076	5696	msedge.exe	103
PID 5696 wrote to memory of 1764	5696	msedge.exe	102
PID 5696 wrote to memory of 4076	5696	msedge.exe	103
PID 5696 wrote to memory of 4076	5696	msedge.exe	103
PID 5696 wrote to memory of 5604	5696	msedge.exe	104
PID 5696 wrote to memory of 5604	5696	msedge.exe	104
PID 5696 wrote to memory of 5604	5696	msedge.exe	104
PID 5696 wrote to memory of 1668	5696	msedge.exe	105
PID 5696 wrote to memory of 1668	5696	msedge.exe	105
PID 5696 wrote to memory of 1668	5696	msedge.exe	105
PID 5696 wrote to memory of 1076	5696	msedge.exe	107
PID 5696 wrote to memory of 1076	5696	msedge.exe	107
PID 5696 wrote to memory of 3244	5696	msedge.exe	108
PID 5696 wrote to memory of 2852	5696	msedge.exe	109
PID 5696 wrote to memory of 3244	5696	msedge.exe	108
PID 5696 wrote to memory of 2852	5696	msedge.exe	109
PID 5696 wrote to memory of 4652	5696	msedge.exe	111
PID 5696 wrote to memory of 1044	5696	msedge.exe	113
PID 5696 wrote to memory of 1044	5696	msedge.exe	113
PID 5696 wrote to memory of 560	5696	msedge.exe	115
PID 5696 wrote to memory of 560	5696	msedge.exe	115
PID 5696 wrote to memory of 5336	5696	msedge.exe	116
PID 5696 wrote to memory of 5336	5696	msedge.exe	116
PID 5696 wrote to memory of 5336	5696	msedge.exe	116
PID 5696 wrote to memory of 1168	5696	msedge.exe	118
PID 5696 wrote to memory of 2784	5696	msedge.exe	119
PID 5696 wrote to memory of 2784	5696	msedge.exe	119
PID 5696 wrote to memory of 5856	5696	msedge.exe	120
PID 5696 wrote to memory of 5856	5696	msedge.exe	120
PID 5696 wrote to memory of 2524	5696	msedge.exe	121
PID 5696 wrote to memory of 2524	5696	msedge.exe	121
PID 5696 wrote to memory of 6728	5696	msedge.exe	123
PID 5696 wrote to memory of 6744	5696	msedge.exe	124
PID 5696 wrote to memory of 6756	5696	msedge.exe	125
PID 5696 wrote to memory of 3344	5696	msedge.exe	128
PID 5696 wrote to memory of 3344	5696	msedge.exe	128
PID 5696 wrote to memory of 5664	5696	msedge.exe	130
PID 5696 wrote to memory of 5664	5696	msedge.exe	130
PID 1860 wrote to memory of 6476	1860	msedgewebview2.exe	131

C:\Users\Admin\AppData\Local\Temp\pluto.exe
"C:\Users\Admin\AppData\Local\Temp\pluto.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1584.2776.3779993302576959087 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView /prefetch:4 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ffe4da05fd8,0x7ffe4da05fe4,0x7ffe4da05ff0
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1788,i,7150845873887630534,17176526039068375937,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2120 --field-trial-handle=1788,i,7150845873887630534,17176526039068375937,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2328 --field-trial-handle=1788,i,7150845873887630534,17176526039068375937,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3480 --field-trial-handle=1788,i,7150845873887630534,17176526039068375937,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a /prefetch:1
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3980 --field-trial-handle=1788,i,7150845873887630534,17176526039068375937,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:6476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4572 --field-trial-handle=1788,i,7150845873887630534,17176526039068375937,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=816 --field-trial-handle=1788,i,7150845873887630534,17176526039068375937,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6532
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4180 --field-trial-handle=1788,i,7150845873887630534,17176526039068375937,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/By4RWSAG7W
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffe4b42c188,0x7ffe4b42c194,0x7ffe4b42c1a0
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,8513629396959135810,4842925794554412472,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,9407361924969965171,11847519960117213399,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,1570019393251325677,4985325420602427901,262144 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,13216447944173912262,5023088387503355194,2097152 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,5829505293532142216,14793127818980342558,2097152 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,5795095705988675457,5018859632808788128,2097152 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,16151269724942505421,11892173933364922860,2097152 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:9
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,11842236643644458846,14901479716461048309,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,5865393654897528691,7572799335022520023,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,9592022580718174434,5764585712375692731,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,11864061255575010619,7960104912168424780,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,11864061255575010619,7960104912168424780,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,7492755999832275384,9892120534801375612,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,7990442334033613880,15139378436344362686,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6796,i,7936886315542046588,73829086123851626,2097152 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,5171570916751921803,7334641471216585313,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    - Modifies registry class
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,1937072103366785673,13735789116356380434,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:12
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,990289674415878914,1609172163480763374,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,9130510335395104449,7014277770334750657,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,17416190110847065772,408186313698031934,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,12162381515030500396,4514749720940809748,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,7099033135923899040,10424846788265566513,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,8196449773833071338,470875501682940194,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,3106603300120483699,18309817121972000597,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,11479048990406012531,2532440573311147348,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,9727471460072851320,1297328822112800963,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:7052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6788,i,12655261473743221666,130939651016071829,262144 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,2394485144717527495,1560451994200853527,524288 --field-trial-handle=2248,i,16839617964044515173,11797173211125284319,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:14
    3⤵
    PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 19dd09e5f8126c5ee03087d0934242376781968e52bcb6da965fb004abe8ad0c
MD5 adc70e23f9c513b461b4525dd9368dcb
SHA1 ba95697d6450432b4c43f63678219c3bf54e7ac4
SHA512 c64654ee0bd62fa4c4773efe16f5b12c00cc1ded091fe0c9b44bfc9fa09a6af9905068de6942d85d445f879f689b2699fa7ddc5997fe9d7b4feb973a3e72d304
SSDEEP 96:wwwbdG9yBg5kgK3AOIf6r3CEANbyAqDjpQMNu7vJnBrShD5fC3tYJDf7:/0BBVwOI43/amAqxQMNuXrShD5GYd7
TLSH
T122F1945CB2688CC5E710027568F364763AF4A846A40F1EC72860AE7814CDF477EF1AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a2145.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2145.TMP
Size 2KB
SHA256 ea75c43affcdb9a5d397bf522f3866d417bcdc7bcae2b257d79d2bd34a77eb2a
MD5 dada80baf3f28a2977138d99007642f9
SHA1 294dccbd417d5d607d59d4fc88097021a1327e50
SHA512 ce41cf9fbd74feadde195ac1af7888949997bdc4abab90d56153f30470abc300c011e17c499542f49e95b9942547680c8c97425ddc7d43b39b12948664b47035
TLSH
T103512E1DA37614D6E3240772BDD394883FF5CC9A08075E1BA4419EB868C2F17ADD2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 49e6e7ae3fd8ac86c8b710a980e1582c5692323085508a64f37ccbaa28c272c9
MD5 9a3212e1b95b486b9196d8034fb401e2
SHA1 0d11cf162562d96b5917756771339d64ea57c6e7
SHA512 34459e47f9c826a3d8de0e59c3ebc91643f40700a5a2919117b6ed62a9ffd3eae20c2923192e6f94f4a4fd19c11151c13d0ff5cd08ddef26295254a3a994695e
TLSH
T167719DF3C7E8862DC90156F4EA187E1FCE2D0954432C3D6AC8E4AE5B97E3471E181A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3d21ab4caf58d1c37b41299c853e8c2c7b564c6e0d8ead7a1ebc44643578bfc5
MD5 cd8447e96c5eb365c26de8efff226470
SHA1 cd7b94142e53de69262cc8c018590c85993a5765
SHA512 bebcb24b43ae217bb587b97eab27f45cc7113976be7edcc6b8d5c724c3991d6a4e78b4b4af2f8db7b73c3e0c19d415355de202f253f670ae3959725b97204c14
SSDEEP 96:D1OPuOuwMu4paZikz71ueuu6nQusuqwOx:D4PHbMDpaZikv1ruVQTTTx
TLSH
T1CC818BF3C7E8822DC90156F4AA187E1FCE2D0954431C3D6AC8E4AE5B97E3571E181A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5e4c40ec7c6c132ff0876b39de710086e9ab1825b9b6b2205687642adddc68a3
MD5 ad823e9bbd9a46f220887e97c5ba58fc
SHA1 ceda637740f4475ad722a38b8526e73348af5b1e
SHA512 db6ce447cc4e53c57a4c20f157c1f61c79c1d5242586a22e048035205f041ae9ebdf627814975d4bcc3ab17de50515454dbfde1248606abdb04731ebade67804
SSDEEP 192:sxRpRxC6/fisr2rPZ3FNrzoA8plG/g6+WNpMg/eBlnKEiNG2IgD73TDJ:sxRpi6/fisr2rR1NKQ/51/e+TN5
TLSH
T19042C8566D24AD3B8CCBD219BB557FA3E2F95032A1D01E58A7FC9A1C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dec4e39c4e195638dbe0d40a9d71201a84b222b3bc541169d3891f4318cd088c
MD5 d26e35a6fede4cddef90db0c7a89785f
SHA1 e0dfa462089bf55104e5af62f53ddb7f188ed9ab
SHA512 8502ee2c553fb99fb34f4a3d1ad165128ba5e1b974bb0b92c8c5f4cdcb1c87400dff33013ae07614f3462f46a8fa50e4b51a92dfc5bb10bf60a68fe148aaeafc
SSDEEP 192:sxRCRxC6/fis42XprQ5LrzoA8plG/g6+WNpMg/YnK3hNG2IgVPJ:sxRCi6/fis42XAKQ/51/PRNj
TLSH
T1BB42B9166E28AD3B8CCBD21DBB557F93D2F95032A1D41E58A6FC9A1C04EB7DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e9a1b7feccfbc230ec64cfffabe5baec78fbeed4f72a9f71c74ba10d5d6b89f9
MD5 cd218da2d842ede0eb00a199f7fd5bec
SHA1 6d538a3f1b71ccbbf1420c693c4ae58961219dda
SHA512 99a96cc847729582184d711149a892f176c42d8fb0ecf692cbf9fe7db20f0ddbf2ff4db167243b8c183227f7ea0d0e497d7f4bee1699138e937b84debfaed932
SSDEEP 192:sxRpRxC6/fisr2XPZ3FNrzoA8plG/g6+WNpMg/eBlnK3iNG2IgDR3TDJ:sxRpi6/fisr2XR1NKQ/51/e+yNL
TLSH
T1F542C8566E24AD3B8CCBD21DBB557FA3D2F95032A1D01E58A6FC9A1C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f840f4ec213717c7570dcc5589505f8522b44e25edc2d282458c2da159347c82
MD5 fe1dc734f9a234519c14f91dbb3685cb
SHA1 ac6d401eb0c77a8703cecae2684bd63de990656a
SHA512 b5d572e4a541db410f1cd14d7a628676979943b73f18a60e0d7ef99883921472eccfd1b04b8afd97c2aad232765df171a22769d0624b11b037306af52a6a0d44
SSDEEP 768:wb8d2g7pLuL7r6WgoufmM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzu46ZrohEV5R:wb8d2sE7r6WgoufmMu1jasV6SEz
TLSH
T102C2D97B740DCB7E4F800ADDE819BE9F6DA802CB5AD8CD4047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\ac357bb7-d3d1-4244-8a48-f0387ee8af1e\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 c761de83b032bc5312fe8e9c1f5f6254e3feadfc11539a8fa39745a38bf49d52
MD5 314c9a7586a6cbd83970c179cfb8e220
SHA1 db21ab9670f1282472d3c4f4921809f43d7af8bb
SHA512 bb46ab87a133c0c77e875c944c189b6a648fbde5cf99aebdc0077d5e2545b6d637d00f291b556ce9cf3eb5c6ccfdcfafb06eb30d4baa52bf07fc1671df21aa2a
TLSH
T178D09737F0A40421EB7B0B422921A04B8B632C8C048784C8A053382E18B8B57D322FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 30fea16c860f2e630b462b5a461e422a714936fd60945a631927613544349a33
MD5 6611cd0307ac87defa6850b8e83445c1
SHA1 edac97f4b66d8fd8e46708ce505508beb41a43ec
SHA512 37f1587ff6c2169d0bffff8eedd6166473ae06d4831759406c79608fd9f04f1b36b6caf5a526115ad35499782661ae332bc337dc54a4db8c1cba7954d9b3d02d
TLSH
T1C9D09737F0980525EABB8F412921A01B8B133888008B84C86093082E0C80B67A352FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59b4ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59b4ee.TMP
Size 138B
SHA256 173fd9bb759d7bac6a55daab9a1ede3cfd6d46a96de640e5338c785d7fde6438
MD5 90c06873156193516d7d1f202f45942b
SHA1 21ff5c4269ebf0161731410a60199a9a2dc05e07
SHA512 46c39dbbef45096d6a297a5b7786c27fabbb4658764e25bc99d07f53693c3f05143e9db065735c66e2a07961792e569511e79f60b4c3bdc5b9943644728295c3
TLSH
T198C08C77F10805219F2203410222D0894B012C8C088780C96063341920B4A236306EE2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ab4d6397662f6610126ab3413fb139b8d1101caf69e4ea9a41aacd22f4f8ccf8
MD5 c36db4cc332a5522fb3ed04b591435e2
SHA1 7d614f40b73573040a510b1581a2d874e0d702c9
SHA512 567ec9fddbe076398a62673cca8f626c5771aaaa700392daf86c0167a01b5d308070b1c1cdf374dc4d23bb2d320377ccc4e06d0cb7e3c1966f506dae6614acdb
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkvefgwKVS7:CoZs4q26neDsgU1gC/wgziItHU1gkeCT
TLSH
T19F916784307B0284383F651C95B8985ED7817862706DB8EB7BE845914F6BE029EFECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd725476-e6dc-4d12-968f-135c4930158f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\dd725476-e6dc-4d12-968f-135c4930158f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dd6b044f085708ac7c1832036f01e9e5bd4b75db2bcef4f5e4f40b82dc403f7f
MD5 7369a6480d4324118c5b9878c23270cc
SHA1 77633b8a02bdbb1bbd7ede53ae788cb81fd44ff9
SHA512 844aaf4edf9fa2fbdf2a341b9e6157378a49929a37152286bfb8d9b105d00f4794d78358f8e143f8828bd8e914d5a35a5040c568c6fe68c8762384e9869ac1f1
SSDEEP 768:KFQD3Cwgqw/LfZQ5O0Z/ENzc4ReyIsPf2ewBKZOAWm:xD3BItc44bs32evZbD
TLSH
T171038D76E828CD67ECE66786B70A7296AEF05163C5D86DD8DADD5E0C00432DE070FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6e9757de9beb6455fee6dfb2c636b334d513778593a5409446b845d7bbd6cd37
MD5 db96770cda90d33c3c5f3b059dc1dc3e
SHA1 51239d3946dc33fc26f9a76d179292a91f6aeba7
SHA512 7c5d0a5a878e3f8787a23b2203c6351fb97183c893a05aafe19f8a30171d9ce985290d801178e79358b67d6f6a2a0afac9bd6b7a879ecad5d6b62e6153198078
SSDEEP 768:Q33Tw/LeDZIO0Z/kNzc4ReyIsPf2ewBKZOAWm:Q33TXtc44bs32evZbD
TLSH
T108F2AE71A8399C63DCE9A745B61A3292BEF45133C1C42E98DAEDAF0C040329E175FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ae72907ae249f6eeb414797fe50a449be3bd28f303c4b49a75702d5f980c01f2
MD5 bb0b08f9c4a4bc1ef32c1cb08080f8f8
SHA1 15c44498fa8fed67656195aaaefbebea3043e7fc
SHA512 722a2a85f764ade7e1e9f21d071bbeae2bc1fca656c94b04f19c9db9a322ed6f61acaa556e6fe07e03d0337b951d878f375d760f21a09071e78bff464a387b87
SSDEEP 768:Orv+4UNbds3Yw/jeDZIO0Z/kNzc4ReyIsPf2ewBKZOAWK:ObsbS3YFtc44bs32evZbL
TLSH
T1D613BD31B82C9D63DCEA6245B60B72937EF8216784C41AA8DADD6F0C05472DE271FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a6c09184249e3e2bd1027f8f6ab56d351fc5686383dabda6669389eea26f325d
MD5 ae0998b0812d7a3c1abd2c154ca9d07f
SHA1 31b72ee31d27aeec2a7ced72e1939aea574b757c
SHA512 0bd4e8fa17b1cb22862c14599f3f23508081d98514e1161649cbb1a9655eceac1574f8b27f001356cc6278eaf4632c8fe0c2950dc369d2a4a1db548638d3d6fa
SSDEEP 768:6rv+4UNbds37kDZIO0ZaNzc4ReyIsXaeVH1S5D:6bsbS3ctc44bsqEH1Y
TLSH
T11403CF32E8788937ACE66785B14B76533EF8912782D81B94C5DE6F0C4A4B1ED131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8218c8194033d6a23bd7661a205fc5e650e342e762c51932235a9161cfa91907
MD5 08b630b9736ef2015b7f7f09ffaf3b43
SHA1 1ad0fdd40425bbc4590d3dea3bdb3e5fa7a997ee
SHA512 43d8b062887df1ffd7333f7e0f58f8c283cf9e3fd0e48ed7a5db6ca1bb2d043411eca961c2216728b25ed621f752cd7470ad68126453e6ce5a2d9f8060b903db
SSDEEP 768:i33iw/LeDZIO0Z/kNzc4ReyIsPf2ewBKZOAWm:i33iXtc44bs32evZbD
TLSH
T1D4F2AE71A8399C63ECE9A745B61A3292BEF45133C1D42E98D9EDAF0C040329E175FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

d54bfbc3-578a-4a5f-a0e4-50aecf362476.tmp

Path C:\Users\Admin\AppData\Local\Temp\d54bfbc3-578a-4a5f-a0e4-50aecf362476.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5696_1044245639\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9f2ef0f241069f344af942bb1a6c3107bca5806d73aedc88560b811efeb14f39
MD5 b923eff059527018bd19f6a8248ec68c
SHA1 65616b223bb3978d210b7f5516e446eba3daa613
SHA512 2c862b3f0f133a534710e977966a3fd5973e9a2d52eb8d2013796006a8f245ac1acb6f9893583a53dff7cd3d743ba971d7c8c71d5d4124a7132b7bd8fdc21ef4
TLSH
T1D8D0121233214B34C01022730412B1490C00C50B41055004542899FD2E14050091A441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a55b9efdfb5c588881124571de54874506ca6ae07ba5fe56210883dc6d56c103
MD5 0416a3174ae72c6ef4d66de86581e8c7
SHA1 5140877b5f6a3c334555730fab775f82c0ca9a85
SHA512 b4fc529965b4be39938a202684be3ebf13092f2bff1691f46b5a1d291a1005c799919b353d7efa70f0d1bdbe2ed12e79e38bf6b50488c14816c7b9524d07836f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 84e8e6fbc1224fcd9f9cf1e0f247151eace56ca40fb2d1d2752669ae1f9f5f38
MD5 afc0467ba947ff8a7cadd67c3200beeb
SHA1 519ec8499ca37b81cef611f2a2a2840b0bd8c410
SHA512 86d3f60bc5a7963ea6c667342d3c633e823fe2d43089b4aa6c6094250f69c4d06ea273ce3a72927b0710f9e53fafff1c742b959346faa6e6b23de92ff9a4dcb9
TLSH
T1C4E0528DE4008F02E319AEB021F37A96BE300C5C4ABF2CC3026CC030816E3C0E64200B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e13e.TMP

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e13e.TMP
Size 48B
SHA256 5919a5ea0f1ac8b2e11eaff8b96bb47f8dfe56b507d0fd99c1a38068c358d350
MD5 311b0844fad14691b92b8dad484366e3
SHA1 534ae392727af8325b20d3a5484bb8d9cf4b2dc4
SHA512 5d41c55a0fd399c39028411b6d5767d362120492f0f17235aa09ba26253960d1024b6e13be5242fecfc39eec35d4c0fa7c7979af75cc909a11146c6853bc5340
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\Network Persistent State
Size 960B
SHA256 1c81eda1e082b1d76a16613b019a6c29d205908c171aa9e9d87c28b49759f0fd
MD5 2cfad855aaf41df56d5db3be95d6140e
SHA1 f84e261f30020a51d2573582bdf9d501047ef656
SHA512 70cdcc633f3c2addd754541a1bf4b5bace73cfefe461900933862e5508462ddfdb028e81d50c5ccbb3d824a676d52e7eba9fb6da10a1fbf917c32efd2427ae54
TLSH
T1BE115BA283E4C67D8A4156E066343827CD2E0419A2286D37CDEAEBE997E2072E11064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aa1df.TMP

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\Network Persistent State~RFe5aa1df.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Preferences
Size 6KB
SHA256 aaf22fd10ae89959345200ebd295bb1e55c4666f94762d424b9e4d7661510338
MD5 92c1b3f79927c8b83a4f8471fd5f0b82
SHA1 e180daff647e08355515c04983a5ce6fc8cde471
SHA512 be609fe2bf809269af9301582d4bfcb822c15dab31bd8a983b1c8443dfd1bd15a77773db77825cc00d9b231f97b3218abfa9f971e1d4c92f5f34a20fe79edbd9
SSDEEP 96:sti/dpLh3pGQb99kIo5h16Z03s7/x+6MhmuecJjY1ejewK+glm7Q28XM1C7K:st635rbon3sV+FdjYQjgukG6K
TLSH
T198D1A6025A247D7B8CC7E519BA397A53E2F9647274D12E5CEBFC4A1C04DA6DC631380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Preferences
Size 6KB
SHA256 7afcb17a69fd5c7a28c19c242418cb55da1c70d0643b5c27178c3741994532e4
MD5 858f9580876808d847fb567b9a7a8e1a
SHA1 5c8b5b315096f050c2316a1718d4a370fbccb11a
SHA512 a3cb94e6cc3ddc1038bf7c78fb7b218e21d864364980a766be917ceeede79f2f5c5756062498501dc81e9d82e9edaac0bb3542851a1de28fde7310c3c865163f
SSDEEP 96:sti/dpLh3SQb99kIo5h16Z03s7/x+6MhmuecJjY1ejewK+gWpQ28XM1C7K:st635Bbon3sV+FdjYQjgPG6K
TLSH
T166D1A6025E24797B8CC7E519BA35BA57E2F9643174D12E5CEBFC891C04DA6DC631380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59e768.TMP

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Preferences~RFe59e768.TMP
Size 6KB
SHA256 0ad56603e37883e5119a9107f72556dde8ec3ff107ddf5a34cd840a642a94f4f
MD5 0e01e274a1aab08a9218cd203c537e93
SHA1 ecb4f361579fb438527e61713f1521cd1971da3d
SHA512 d71bbc55d92715999a7bcfde47c85e9e553cb4d1945b65a8a3aad4d08ad9671047de7244e0634e57e3d8d2b01357ba96b39d99ecf8cb97c9cd3b98652109f11b
SSDEEP 96:ri/dpLh3SQb99kydo5h16Z03s7/x+6MhmuecJjY1ejewK+gWpQ28XM1C7K:r635BFon3sV+FdjYQjgPG6K
TLSH
T129D1B6015A24697B8CC7E118BA35BA57E2F9643174D12E5CEBFC892C04DA6DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
Size 15KB
SHA256 9347ac16065fb81ead834b88e26b346149cc6047c9cd7d7d4e83315a80a07cb0
MD5 979fbfe7acba47f30cfc0a4fcd866c12
SHA1 abcbfca17886b9fde4a90e96a3ce3f1a0f1dc2c4
SHA512 0b946e7bc9a199d40b9011517bcd9aca3b5cd0feb052459697cadfe813e709602c23230217a68c4c63d742cf91071798f6a69b697d2f2ac6f1fdd51a0844c5d8
SSDEEP 384:u+aQikB+z/xvxjg/qhEWNBSK9iU+wAVdp8qP9zA:5/UxvxjgC+4J+wU8qPFA
TLSH
T16D729E2758792E37E5F7EA05795D178BCBB498B250C12EBC8ABD5F0902C72A81302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
Size 2KB
SHA256 945f85b3d93973017383a6e9cccdb9514909d84888906cc668869a6128ea49d0
MD5 cffe13184d1f40f1de5993a31960bc11
SHA1 32b7dc67bca217c00e4456ea0ba82a34a0527646
SHA512 c9ad7004117d5f2257b897dd803a3664119ebcab6f82985e6b70dd2fce73c2623b5ea12cf1195d47ad171a38bb7747fede663f5a125a3e0cd330d9177ea1d488
TLSH
T1E251A53368205F77C8F2460576473F279E7590B2AA522F28DAED0B0841CB57C1312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
Size 3KB
SHA256 5bf74b9411e42fc8a565ca71d502ff7f69683cadaec1ed45e4f59419e2ca09cb
MD5 33cc1086ca514adf38a0e9b534cdc018
SHA1 2fc7df6be086730b20cdb6d0c205f486fa98e618
SHA512 332093f9454139fa7b57f71adf933d156bc48ada29b2cb662b61ccd1cbf440aefc93475e1f4c97312539f438c6887d19795900d2955793127459967613798211
TLSH
T1B86173336970AA7BCDF29A01B5863B16ABA55073E5813F68DAEC0F0C01D72A81352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe598ce4.TMP

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State~RFe598ce4.TMP
Size 1KB
SHA256 bfaac2f3d9165fc8b817cb14ad425de7d8d6aadff4c819348af49a1c105e516c
MD5 8b8bf8a76c981b99a441c5ac7ae71993
SHA1 8e0470df3d6a3146fe46dc8bbc829e8870f4de6a
SHA512 02029ffcd9161b17579a82e7788d9c0e6d6139b1389220cbe3349e66afb7df054500751bd0c06c08b07ac5ee8b4944b453bb807d877d5648ea1937c9085b4737
TLSH
T15A2162B3D4644F33ECA2660371527FAB6E7050B792414E08E5EE4B1842DB5ADA12BD32
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_2083441548\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2344-101-0x00007FFE6F720000-0x00007FFE6F721000-memory.dmp

Download

memory/4852-523-0x000001D0E2AC0000-0x000001D0E2AEF000-memory.dmp

Download

memory/4852-26-0x00007FFE6F720000-0x00007FFE6F721000-memory.dmp

Download

memory/6476-1354-0x00007FFE6E770000-0x00007FFE6E771000-memory.dmp

Download

memory/6476-1355-0x00007FFE6E4C0000-0x00007FFE6E4C1000-memory.dmp

Download

memory/6532-1472-0x000001CCEE9E0000-0x000001CCEE9E1000-memory.dmp

Download

memory/6532-1479-0x000001CCEE9E0000-0x000001CCEE9E1000-memory.dmp

Download

memory/6532-1478-0x000001CCEE9E0000-0x000001CCEE9E1000-memory.dmp

Download

memory/6532-1481-0x000001CCEE9E0000-0x000001CCEE9E1000-memory.dmp

Download

memory/6532-1480-0x000001CCEE9E0000-0x000001CCEE9E1000-memory.dmp

Download

memory/6532-1482-0x000001CCEE9E0000-0x000001CCEE9E1000-memory.dmp

Download

memory/6532-1483-0x000001CCEE9E0000-0x000001CCEE9E1000-memory.dmp

Download

memory/6532-1474-0x000001CCEE9E0000-0x000001CCEE9E1000-memory.dmp

Download