f06e8684052fe924c9d289f3d6f0e86f0dcbb7f8548a3b270e341ac06b3186ff

Analysis

user interaction
yes
max time kernel
151s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pluto.exe
Size 15.7MB
Sample260820-xbebysfc36
SHA256 f06e8684052fe924c9d289f3d6f0e86f0dcbb7f8548a3b270e341ac06b3186ff
MD5 d538861e64c56b5652f5b18a3e253af5
SHA1 ef451e8c0d9c89f85c6664d6449b747b5db3858c
SHA512 672a24d2914932db750d89ee17afc7b7b0030f996278601f5a92ee401e0e9cbbab82634d8d277635ed36f7182097e37505c48e2f6fe8bb75bc5cca988a7d3d08
SSDEEP 196608:WS/U8dfbwwpRvfvWn+T2mYxrxr07BZOlJGJIGj:RdfBRHW+jYxdYBZgJb+
TLSH
T1F6F649217A5A996DC19BC47483874A720E7130CB0B39B9FF449592382F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pluto.exe

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
27	raw.githubusercontent.com
28	raw.githubusercontent.com
52	raw.githubusercontent.com
54	discord.com
69	discord.com
86	discord.com
88	discord.com
53	discord.com
89	discord.com
111	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_177880161\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4332_999871659\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1108_1721745873\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_177880161\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1108_1721745873\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1783074667\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_678668669\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1108_1721745873\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1108_1973905108\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_678668669\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1108_1721745873\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1783074667\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1108_379009384\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1108_379009384\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1108_1721745873\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1553914391\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_177880161\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1108_1721745873\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1108_1721745873\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1108_379009384\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_737122135\_locales\fr_CA\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5700	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317248795570412"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{F1515E23-B9D5-4068-8D95-1048D6535A55}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{C85F7BA8-B6C7-4456-B0DB-F9D35AAF1D3F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4188	msedgewebview2.exe
4188	msedgewebview2.exe
5364	msedge.exe
5364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1108	msedgewebview2.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4264	pluto.exe
4332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 1108	4264	pluto.exe	89
PID 1108 wrote to memory of 1588	1108	msedgewebview2.exe	90
PID 1108 wrote to memory of 5524	1108	msedgewebview2.exe	91
PID 1108 wrote to memory of 5524	1108	msedgewebview2.exe	91
PID 1108 wrote to memory of 5524	1108	msedgewebview2.exe	91
PID 1108 wrote to memory of 5524	1108	msedgewebview2.exe	91
PID 1108 wrote to memory of 2900	1108	msedgewebview2.exe	92
PID 1108 wrote to memory of 3440	1108	msedgewebview2.exe	93
PID 1108 wrote to memory of 3440	1108	msedgewebview2.exe	93
PID 1108 wrote to memory of 3440	1108	msedgewebview2.exe	93
PID 1108 wrote to memory of 3372	1108	msedgewebview2.exe	94
PID 1108 wrote to memory of 3372	1108	msedgewebview2.exe	94
PID 1108 wrote to memory of 3372	1108	msedgewebview2.exe	94
PID 1108 wrote to memory of 3372	1108	msedgewebview2.exe	94
PID 1108 wrote to memory of 3372	1108	msedgewebview2.exe	94
PID 4264 wrote to memory of 4332	4264	pluto.exe	95
PID 4332 wrote to memory of 3424	4332	msedge.exe	96
PID 4332 wrote to memory of 2008	4332	msedge.exe	98
PID 4332 wrote to memory of 5700	4332	msedge.exe	97
PID 4332 wrote to memory of 2008	4332	msedge.exe	98
PID 4332 wrote to memory of 2008	4332	msedge.exe	98
PID 4332 wrote to memory of 2652	4332	msedge.exe	99
PID 4332 wrote to memory of 2652	4332	msedge.exe	99
PID 4332 wrote to memory of 5564	4332	msedge.exe	101
PID 4332 wrote to memory of 5564	4332	msedge.exe	101
PID 4332 wrote to memory of 5564	4332	msedge.exe	101
PID 4332 wrote to memory of 5672	4332	msedge.exe	102
PID 4332 wrote to memory of 5672	4332	msedge.exe	102
PID 4332 wrote to memory of 5672	4332	msedge.exe	102
PID 4332 wrote to memory of 1832	4332	msedge.exe	103
PID 4332 wrote to memory of 1832	4332	msedge.exe	103
PID 4332 wrote to memory of 1832	4332	msedge.exe	103
PID 4332 wrote to memory of 3208	4332	msedge.exe	104
PID 4332 wrote to memory of 3208	4332	msedge.exe	104
PID 4332 wrote to memory of 3208	4332	msedge.exe	104
PID 4332 wrote to memory of 5212	4332	msedge.exe	106
PID 4332 wrote to memory of 5212	4332	msedge.exe	106
PID 4332 wrote to memory of 4908	4332	msedge.exe	108
PID 4332 wrote to memory of 4908	4332	msedge.exe	108
PID 4332 wrote to memory of 4908	4332	msedge.exe	108
PID 4332 wrote to memory of 5928	4332	msedge.exe	110
PID 4332 wrote to memory of 6284	4332	msedge.exe	113
PID 4332 wrote to memory of 6236	4332	msedge.exe	115
PID 4332 wrote to memory of 6304	4332	msedge.exe	114
PID 4332 wrote to memory of 6288	4332	msedge.exe	116
PID 4332 wrote to memory of 6312	4332	msedge.exe	117
PID 4332 wrote to memory of 6284	4332	msedge.exe	113
PID 4332 wrote to memory of 6316	4332	msedge.exe	118
PID 4332 wrote to memory of 6236	4332	msedge.exe	115
PID 4332 wrote to memory of 6304	4332	msedge.exe	114
PID 4332 wrote to memory of 6312	4332	msedge.exe	117
PID 4332 wrote to memory of 6316	4332	msedge.exe	118
PID 4332 wrote to memory of 7072	4332	msedge.exe	119
PID 4332 wrote to memory of 7072	4332	msedge.exe	119
PID 4332 wrote to memory of 7104	4332	msedge.exe	120
PID 4332 wrote to memory of 7104	4332	msedge.exe	120
PID 4332 wrote to memory of 1608	4332	msedge.exe	122
PID 4332 wrote to memory of 3820	4332	msedge.exe	123
PID 4332 wrote to memory of 5824	4332	msedge.exe	124
PID 1108 wrote to memory of 2276	1108	msedgewebview2.exe	127
PID 1108 wrote to memory of 2276	1108	msedgewebview2.exe	127
PID 1108 wrote to memory of 2276	1108	msedgewebview2.exe	127
PID 4332 wrote to memory of 5860	4332	msedge.exe	128
PID 4332 wrote to memory of 5860	4332	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\pluto.exe
"C:\Users\Admin\AppData\Local\Temp\pluto.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4264.4940.15750183948816519123 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView /prefetch:4 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0xb0,0x7ffefffc5fd8,0x7ffefffc5fe4,0x7ffefffc5ff0
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1720,i,7883497028700661000,7013558505819446174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2024 --field-trial-handle=1720,i,7883497028700661000,7013558505819446174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1720,i,7883497028700661000,7013558505819446174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3368 --field-trial-handle=1720,i,7883497028700661000,7013558505819446174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a /prefetch:1
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=1720,i,7883497028700661000,7013558505819446174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4564 --field-trial-handle=1720,i,7883497028700661000,7013558505819446174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4492 --field-trial-handle=1720,i,7883497028700661000,7013558505819446174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=1720,i,7883497028700661000,7013558505819446174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b272632ae0c599cd0c92ee3a36245883708cd52a
    3⤵
    PID:6348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/By4RWSAG7W
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffefdc3c188,0x7ffefdc3c194,0x7ffefdc3c1a0
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,13162796415932308374,2838271388232630062,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,9933629787330210675,18233632826504710215,262144 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,11543602478098987415,4993671663673258346,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,16042724955512486413,250282408150373622,2097152 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,9864701645168192603,9461290829400793528,2097152 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,1511340202536916043,17881113201020606938,2097152 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,16060177050808956751,4678670469883805329,2097152 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,14757398834911485090,17060870938151628797,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5468,i,7562627043991216292,8343716525512193903,2097152 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,3990722679775940438,11906618959112434065,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,3990722679775940438,11906618959112434065,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,7439638372995063331,7132774881386432075,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:6284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,7589396644213877678,582108127542833434,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:12
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,10944761637385775717,4551783951300820485,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
    3⤵
    PID:6236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,6421181316472860158,14851764133087950810,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
    3⤵
    - Modifies registry class
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,3568503445434865843,3230051372097362828,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:6312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,13389900791581974744,11849643240145956263,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
    3⤵
    PID:6316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,6109769754759073690,7838784840239690541,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:7072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,14932419796198817302,9810569491645791248,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14
    3⤵
    PID:7104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,2355268345023300022,2334174785067249293,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,2334397477196457308,8784953233020143161,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,922306453005627441,3956813043005681929,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,4567232188453043556,4439987522384651354,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,7256591223741394260,2641700459975977117,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:14
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,319189094462410885,2986491568961060033,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
    3⤵
    PID:6300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,16408187338430326276,15209143485249650569,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,17930822427753898187,3917212797830896767,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=1164 /prefetch:14
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=916,i,1854929916486640633,15369111215169212193,262144 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,1777924675523838309,13556131574305744316,524288 --field-trial-handle=2596,i,3220939861086364043,12241751262015118810,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
    3⤵
    PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 bcd1fb010ddf6b496aaa70e755c1072de29c0bd9471e8f3a416964df6107e189
MD5 7aeef08bb5333481250f7b0253a3d754
SHA1 2e9a76740c86bd18543f8a88ff33cdb7f3a26f2b
SHA512 4287fbd0508239710b1b364bf8eb759ba1d7aebc684d3abd156e4f7ba2366f4a5791a84df594f3187339c492b2168c7d3fb355e009426504e85b444fb2f6b0e9
SSDEEP 192:OG7fVJ/k1a+qCLvA7ujDwv1gzHwuQUWyE59KBn7uEvpqvcB+HCofIcR8kjPG472v:PEXzfVHICq2yGTn/
TLSH
T14B223BB20B5D0491C7A2BE71CCEAE445BEF4AFD9080B3E4D415BAC776A47F0240982D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a3123.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3123.TMP
Size 3KB
SHA256 2df863c86a128b2019db5824e59769a223a460492cc384636b82d9428130f9d4
MD5 5d50bc5d6d2b37125c21bc011caa7e8f
SHA1 2fcf915a24a32b8d2f40a38727775f0d91f00b41
SHA512 dc3805874c84df2b730591befe2737bcd7e9c2e970bf7337863b78797ce1133cef2058126337f4084cc00a89b833f729e854962ba8c932de278770942e233e66
TLSH
T1A361C7540B6208E1D3F468B251E9F059FFFDB81E060B2E81904D7DB0AA86F0791ED1E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2de678b561bb058e8bfb5d37376ccfd174c08e7ebf6c9e139de0271269ed4282
MD5 9a29e63f4abe0b5707c46684c41659ac
SHA1 cb40c5618a7446e421dc20c52a4dc9d23a62b5e7
SHA512 091920065610a897ad17d673c13920b662143eac57dcd1051d0d450e9f9f769d250841fde0bb7af3eca3e0920eeed3dc6514bc287be8a6e2d7f4f6712e498018
TLSH
T156718BF3C7E8862DC91196F4AA146E1FCE2C0954431C3C2AC9E5AE1BA3E2571F181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6002249268c870d2fc9c1a1f4a5c1089142d588d1920030be7e62b36c8d622ea
MD5 6456d56627a590b942099b027fa3b13b
SHA1 3aa83d82cac5ee04d1e71f015f42788a3d1e8f9e
SHA512 71b7c65d75fbeb9dca9e6586daa115f63d31e247840de6ae767e5bb629aad2d0e4901e831e5a5ec67b9eb3dc8fe1a6a6069941309c7f6b9c0a8b45adb8f23f82
TLSH
T161219DF3C2E8557D890142F86A143F2BCE2D0955931C3D5AC9D4AB5B93E1871E28095F
MD5 SHA1 SHA512 TLSH

Submit Download

f07baae6-bf8b-41ed-84e5-3257ead4116b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f07baae6-bf8b-41ed-84e5-3257ead4116b.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 09642fa510003fb18d3e2ab87be80dabd2709f8464cd899b03388e07be49d58d
MD5 6f298ce71c83a87ba206d959e502ac88
SHA1 319eab680c6887732244680d774bd393406acb9e
SHA512 c70c7bdfb5b940408e5c4b32cebc467b516c52e6fa0fa1b3a1795ba0c41cfaa96af36a8daf4841f2eaf1ca9bbee45c3d1ca19794e706614adb667a41cf4adde3
SSDEEP 192:sxRcqR5Cl/fWsyUHFSaHzoA8plF/g6+WNpy6/eBPb8JZ6ZGXIgV5VJ:sxRcqel/fWsyUlSauf/51/ec6av
TLSH
T1B142C816AE28A97B4CC7E21DFA16BF53D2F9103261D05E44FAFC961C04EBADD121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 32cc554954de4eaa6781cbf61b59da2493ae399721e530b90840012c350509af
MD5 757dbb4029c996764121842ae8a429d3
SHA1 4e237ce9e81202b10f59e02e204241d5d4e2bbc0
SHA512 d7a1bd1ed5c8ba026b47edd4ae0b8bc9fdb5ffc4686414e260f20241d32283efa304fdf33d616858a9531f4b3ebc9b98d61d895d8450ec1ae77ad8bcb3a43a70
SSDEEP 192:sxRcxR5Cl/fWstHGZNGICzoA8plF/g6+WNpy6/eBPbLlZ6ZGXIgDjTLERJ:sxRcxel/fWstHwNGCf/51/ex6aC
TLSH
T13D42B816AE28693B5CC7E21DFA55BF53D2F9103260D05E44EBFC9A1C04E7ADD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4b129ae9fd410213adeab7a7bfacb5fb8aff06368a86cf4288c9427c27a926cc
MD5 2bd27d6a82540635b039aa4eed9ab299
SHA1 420ca5b1927bdb62d153256f15c5e0b72ac73c51
SHA512 9e05e9bbbeeadd7a1f293036af98d02d6fe5ff7318d1644b044dd5e7f511a1d36a0a6cd63e7d0cf52f80d71fa3f467f106049f2601bf258f4e7efb1a8567d8cd
SSDEEP 192:sxRcxR5Cl/fWstUGZNGICzoA8plF/g6+WNpy6/eBPb8JZ6ZGXIgDJTLERJ:sxRcxel/fWstUwNGCf/51/ec6aA
TLSH
T1A242B816AE28693B4CCBD21DFB55BF53D2F91032A1D05E44EAFC9A1C04EBADD121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7474ba92a59b5f2db45f0ca4eac0b1f2ef0f984d2554605a15b486c61f71ff0c
MD5 01f2c4ede0663d7b06cd9dbb5e335832
SHA1 552df8768c0c4bbc37d3ef93bb6617fe8de5119e
SHA512 fdb529d183c0538f4777817a7d8fe37f9ca1c1aa242068fc16697fc8b2b1781c14481d8e727ac652ee232a3afcf0c694c3e037ae251a33ae4208faeac2b95faf
SSDEEP 768:Fb1poD7pLuL7otWgikf+48F1+UoAYDCx9Tuqh0VfUC9xbog/OVZJ8IbroSSDd0:Fb1po1E7otWgikf+4u1jamyIo/d0
TLSH
T1B6C2D93B740DCA7F4F804ADDE819BE8B6DA802CB5AD8CD8047FE951C02C6BFA51154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\e153209d-c888-4870-b46e-8cef2de04b0d\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 75eb07163d5d327f763cca0bce549326d044f6795dcd27dd96c2f4036b527632
MD5 94394484fec22e8ec1b14d5b517bb799
SHA1 ca4e3dc803b06a963e7cfe25fc599f5c3b3a7269
SHA512 873cd35bcb0c6982d7d2824fab441b34f745303fbdf67e42aba6fc7584c5fa526947a9bcaf6abff2ec2d9670c5c9ab8d1a6b5cd108af08873a855229c0f0ffa1
TLSH
T1B7D0972BE6080406EB730B520621005E02702C8C28C5C44CE023352E10B2E439202FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 2e032110fbb1c094454afb3b99d3a866731e95f7f54e75b953e620e801e2fffc
MD5 b34d3a4b7b006e98e556a7b2ac15563a
SHA1 a5a303ec95a4905bbe2a1a2bb719d1c7cef2e717
SHA512 54cad8f6f38c72dfd5c819e8c8ab730fea3d47ecbd0b5060e125bbb22482e59808bb47d4a17802e2578d38a8c0f42173fb424ef2afb798fbfb053dc0a171583d
TLSH
T17ED0A76BA6485546FBB74B521661106E5671288C24CAD94CB423153A04D2E439142EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59bf6e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59bf6e.TMP
Size 138B
SHA256 0620b1637233e0acd99f7c8d2400d17df0c61be36443fb3fa7f17cdec3f72937
MD5 0cd90e2620c8f99ffef05a350201e848
SHA1 4535efcf7c6126eb3e0e8f79124d12d21f778a71
SHA512 10f768106e281e4c0b74e5c16766eb9830d9e3086bafd2afe9d80acbff007e47b854307acfc270571dad8d3baf7f07cd92475b7495744cce923ca1b6bb2f1610
TLSH
T1BFC08C7BE2040409D71202620222511E43142CCC6C8A844CA02334181032E136102EE1
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a95c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a95c9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d1a850cb43e4b64dc82bfb3638311243b6b08ede602e169f475803bff7a4bced
MD5 f80ce15228132c129784085d815b7280
SHA1 d5f177fba502e230ab4c05e38829b88df575459e
SHA512 82dab5e6f290323a86622f88626a77f980f148eece77b961f09110512b198d33ab4a4f7866a1f64034731ee64665eb6899b3288965a86ec304786776214b697d
SSDEEP 768:l13t6r5BqobGG0UgtZu4aWADIidy8LuK/vmdTr1FjtV:l13tNtZzaNsuVLV/o7JV
TLSH
T1A7F2BF75ED52DDB398FAA344B2473A47AEF891A3C4894E8498DD1B4E00C75AE1317C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 22207c2603a5bb234cd492208c4ff549dce9164dee51f8193fa1656cf936c88d
MD5 b68cb292978e116172588544682b15c1
SHA1 0d6956fe32bc8a7bd690e1eaf113750a662cfdad
SHA512 d22ee7855caf95da5b02314d6beb71f9736534ee16ea81a74e476e0668fecb5bea9d65b9f6016d4129d2c48551d2800bb9abf48a213b2c96dd189ae1cf0a8d5d
SSDEEP 768:9rv+4UNbdC3GsFBqobGG0gpZu4aWADIidy8Lq+eVH1S1C:9bsbw3RpZzaNsuVLpEH1d
TLSH
T17303BF36A859DA739CF79284B2877A077EF89163C6880AD488DD1F4E41DB8AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 85783fd6cff76e1568331cbc1736d3112ea301a28075f461f05c91ce2c8fb914
MD5 e0233622eb4a41a4b8f1e5049f131d34
SHA1 60f4ceb7cd9596d743b6eb9b3883b7bc60fe7071
SHA512 f37b0239338d4514f0ccce3189389cdf6544d8cf27c8de453e445f1391fa7ff34c86e261a6e1d3b00335917cc7d63162ac0203ac73f886f100e7156c098ef8eb
SSDEEP 768:sFQm3Gwgu6ripvG0UOtZu4aWADIidy8LuK/vmdTr1FjtV:fm3TrtZzaNsuVLV/o7JV
TLSH
T1D6038C3AEC51CE7BA8FAA785B3463A47DEF451A3848C99D4D9D91E4D00C71EE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1c6d2bbc92c4ab359d8a240842236cfbd7f68465336c5f76e363599637beea6d
MD5 b6a875f49784ecc54c9c20dd5607857c
SHA1 e748753d7f0cb5b87240bbd27960ce5de4d6b8f9
SHA512 08398bdff20d54d20f81a64a8d086fadb8d6a806bb6b495a5e8e25956056f00d746818392ff287c4b1920b4ae08530eafcacbd2cc1fe19354593e291f32572e8
SSDEEP 768:g13i6r5BqobGG0UgtZu4aWADIidy8LuK/vmdTr1FjtV:g13iNtZzaNsuVLV/o7JV
TLSH
T1EDF2AF75ED52DDB398FAA344B2473A47AEF891A3C4894E84D8DD1F4E00C75AA1317C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b336392d70ec843cb4b0fe3810bc3aa00e82116987f683c27b7b700fd7b94378
MD5 45f25c996fc0b10bbc68cce458cd1b91
SHA1 8ed1ee50a600f586fb0791785042b9226967f561
SHA512 3a01c047accf1324fb880f2171fd8268b4787476cdb89e0ac4f2d236477d9a3e1d058f32ef6054297a455fe79d8fe4a0493af0cb806e8455091cea7f0f7b3bb2
SSDEEP 768:Erv+4UNbdC3i6Z5BqobGG0UxtZu4aWADIidy8LuKo6:Ebsbw3iutZzaNsuVLVo6
TLSH
T15A03BF35FC5A9D738CFAA244F2473A47BEF851A384890AD4D8D91B8E44C74AE131BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0eca2130847a960d5646253601d6604fc56aa63999158e779cbccf4b21592075
MD5 5a1b04a7dad34e835ae3f3c5915bf57a
SHA1 83a6c215c32134c22e2b43b6c073eea630e46dc6
SHA512 ff803a9566379ded8967934a3cc61e459b8ee925ff6775a735b412a6fdc844b39a4374fc2fe658c74e29ff9f939cc29b499c3982c97aea0b605256cee70b28c3
SSDEEP 768:Trv+4UNbdC3uunBqobGG0UvtZu4aWADIidy8LbKeVH1S1C:Tbsbw3rtZzaNsuVLWEH1d
TLSH
T1A203C035A85ADE739CF7A284B1877A477EF861A384880AD4D8DD1F8E44874ED130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

66a36942-4527-41ab-bd74-6e91ccbdec0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\66a36942-4527-41ab-bd74-6e91ccbdec0b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe59d6ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59d6ce.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

a64c8fe2-7052-45be-b4fb-0663e7d8d5f8.tmp

Path C:\Users\Admin\AppData\Local\Temp\a64c8fe2-7052-45be-b4fb-0663e7d8d5f8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4332_1906409736\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0939bac7061dde8d4cdbd4a9a2a277ae0901f2e5b442393f573d38ba8e8a84da
MD5 01d29cd7fbba3d10b4dc82f32cf13aca
SHA1 ac8c82fc78afb71480f98f557d1cb00e7966c7b7
SHA512 c6375bfd50a1a12c87cc2b0daaea967444b94c58d945b834615b9c297f7eaa1a8ab0e06d3c4b6b4fb807c08db308c49d729ba4aeb885ad305d7d3d4515acf010
TLSH
T192D0245733C10D34CC103173004375CD0400C55F430D40005C3DD71D1F4C0500D17453
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5cc6a65778245a38ed01534e8e52c348f9a823ada63003a894424730622b8edf
MD5 620b3ce94c36c24358d0f8234c20f45f
SHA1 b24f63df960ef4d2018767ebf5d3b8746dcc443f
SHA512 dc645bf3a50ae2287bcaad9ba9da7299e0ec4af8724694894c2072eb5ca887f7a7a1fd47af1af6bca75ba083572177f05e1a0caa05faeab34b4d47a04e6c0c42
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 9bf688673c117ad424f029d9a085b6234ad69914b4b09b795e75de771ffa046f
MD5 a52ffae7b9b885009891a48c841ebc05
SHA1 914ac93c087f7eee7c127915cc1fb6bd1dd85095
SHA512 055316a53208ddfd371950fd3f20b10db42272964e488bdd95015e25f990c67dbf7d1da56fb91f31b334b4e755437e70785e2d86b4186db9ce44610ab7716dba
TLSH
T1C2E0A938AC0D8AC5D36ABEB02AC2B7A7BE388CF0474B7C8D0644153C92287008BC2004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fb9c.TMP

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59fb9c.TMP
Size 48B
SHA256 0cf9787c62fcf8ae9a806abc94792eb26f26b46013834f09dcca297d16219956
MD5 46c7e73220d39fcd70bbbe069ac0668d
SHA1 6063c34e0070c0b2661c3bffb66565a5d92e81f8
SHA512 052d018aab0e9e90829faa21c751389e3aa578ec9520225309e8bfba56783273a204cf7068e6ab5c02918c751c8df6aee61829bf3b55304ad47a9ffac1e679c5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\Network Persistent State
Size 249B
SHA256 15953151625dcc71c8eed52c6bf1311bb0c3bda145127e131567f87e720283a0
MD5 2e035a156dc3d8d8a01e03bb6b60c424
SHA1 765bc7c422d83c104116c6e2910483b51434042c
SHA512 7685cef8c2435f8b7b832afd9ff8c4621a36a59d3ea0d035df0e52409b1991ea077839e1e99a890732c795d41de4b2112e90cffe927facbcde14dc9e3bceff12
TLSH
T182D095B251709DFE074183D016347857C97D0002931CCD7BCA74B77843D2079D020907
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a73f9.TMP

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\Network Persistent State~RFe5a73f9.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 e753ebad9ac5b8a37aed22fd418367062a8cff5ae7875391fc8a39035dc90e40
MD5 b718b088ae9d2785beada08255dcd4e6
SHA1 e8cb1919b97f22aab1d27051853655ab338f26f8
SHA512 590ed96f3edac8ef93071e1f730a19eeeb11488d20539693cb842cc50a9c5bc4efb3b5a1321b4d9398dc6c75b4fa112a3fa21b1161f22b6b90127efed61dbec5
TLSH
T13FE0D86381EEB0E750B8466A794069056F7AA430A151A8F5D951A6BCD05D1E66702123
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59ce33.TMP

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\TransportSecurity~RFe59ce33.TMP
Size 188B
SHA256 1081949ed114ede0a3936e73361b6da6557299c27c3ab352e49a1c1d4a888c12
MD5 a63712e1e8d1bdfd9e5d8a03d832f1bb
SHA1 ab4513a5c9dae8777dc09a304c4a183f032ca7d7
SHA512 17006946451ed44d72a1ce55aca5c18fb9040c5033f648aefca64c433742b5f230bbbb8e6375424bc30d865645bb54bef23962b32c1dfb7adf98ed606a761eec
TLSH
T177C0226200A9A07A90B84A221880BD086F3FB030D08064E88A4609689015266BB03022
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Preferences
Size 6KB
SHA256 0611789c81935afa4fec7bc53139a8726d59a785935b0098c8463a8681a45341
MD5 92bea78a7009b52bdf1c9b8b57308422
SHA1 a78bb32748121ef956c6713d1360fda0c267d979
SHA512 73f6dfea56a66c65fc1e8cca3688011c51fc7ec8eb5e8b8abc485da916a2d67875b33efa64b058ba6f1e3296b4c9e4ff33e54d4e6119fbd301d62f25f1025e34
SSDEEP 96:stS/dpfYG6b9yk+IDo5h16Z0Xs7/x+6MhmuecJ2N1ejeIK+g7hZ28XM1C7K:stq3R8DonXsV+Fd2NQj8hDG6K
TLSH
T147D195026F24B97B4CC7F119BA29BA13E3F5606265D51E48EBF84A1C04DBADC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Preferences
Size 6KB
SHA256 d82ff42b963aaf4e92eb7872b3794c01d6b8ddba5ac38607f7ffc632e258201d
MD5 529a3eb87c74049eb3cc691771ebf877
SHA1 4dc8d1cc58be0602556366815590527bc78993c2
SHA512 a192d13e05f45ee969eea96e055ccb23cae33e6c0dab41c8cbf7cfbaf35d1cfa0949bbd69a2cdc5e04c653dd4f7c016c356fc341d4634e4be0ba272d35b307b0
SSDEEP 96:stS/dpfR6b9yk+IDo5h16Z0Xs7/x+6MhmuecJ2N1ejeIK+gAho28XM1C7K:stq3X8DonXsV+Fd2NQj8uqG6K
TLSH
T14ED194016F24B97F4CC7F119BA25BA13E3F5606264D51E58EBF8462C04DBACC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59c9af.TMP

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Preferences~RFe59c9af.TMP
Size 5KB
SHA256 2e560466b7a78eef8a4648d006f77a33f23816123d1a33542de3a3381b790fec
MD5 2de2cd4c4bb9889f4b125f1dc39805fb
SHA1 5f4e422a733e8ea81feb1fc9134a11f196dff1d6
SHA512 2c53f757f558bb9c3116cc3e6404b01c033371215b9b49f4a19dd3fd509349b20fccc5873d6600fdb1786388596fe9068b8588793f539218531df41bdf588a1d
SSDEEP 96:rS/dpfR6b9ykQdo616Z0Xs7/x+6MhmuecJ2N1ejeIK+gN28XM1C7K:rq3X7o6XsV+Fd2NQj83G6K
TLSH
T197C175025F24B97F4CC6F508BA297A17D3F5507265D52D58EBF84A2C04DBACC632B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
Size 2KB
SHA256 58f201c9886607b292debbc67bfed865c88517c5987a6aa26373cba3ed3c6710
MD5 7d7ba750e535a1d2a1a341d725e83c05
SHA1 1321c45a5273bf00823bac6a07ef130fbb52c49c
SHA512 e267522d5046f5144319e63b2b1328e9981ca091521eefe7bf275f82ccf4d794fe4915377aadd64c3f0c7ed22cb43b3904741882a22ccbcf00e7573f6e46b13a
TLSH
T1805192336DA4AB37CAF3A644B9463B63CF759062AAD16F10DAEC0B1800DB55D1356C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
Size 3KB
SHA256 7c607a41119400336a3bfebc18a2d0f16bd4a0e1f1ad747055cf04473ae30d0e
MD5 201ecc4efe80e6a35ac11b8aa1c8ce14
SHA1 507e73cecf98bb66bf5b4912c1a5cfb1a26089ae
SHA512 86b92aca9c319ac6ac701c295fc187d06038a5b86b10eb63ba1cff859148c92f6fe326133b2b7c054c184aaf1e222e578fa225d3f2524c169d2ad614444de492
TLSH
T14A6163376AB4EA278EF3AA41B9863B13ABA55023E5C47F55C9EC0F1C01D728C1352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
Size 3KB
SHA256 1f1403d21598bf0b2cf6e0395672f632dee36148f57584f690b21d1a031ca525
MD5 d9ecae9e7f03902504aaee3297f4a4fb
SHA1 b5b7511c629430d1e26c17dc4f5fc9ddcae78aae
SHA512 0aed906e278ed3493ced37b6f1479bf14a80731f423c2115994be8e2372bd61a4a36826ef91c2a53663f7e9861687e858577c144f5551236867bfbb5c8124941
TLSH
T1B971843669B4AA378EF3E644B9863B03ABA59063A5D57F94C9EC0F0C01D76CD0352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
Size 15KB
SHA256 2682db9dd9866259c5b38fac6798905a50413b966ab9cd3e2dd104ed93a3ec83
MD5 c5dc0f86b7478f250b522b941e57ab33
SHA1 647349fb46a1c992726ca3f3d6e75f832f0e78c0
SHA512 ffc267387fabe19302ed1e6140dcc55edbfc5caac551febf730e5612107e2ea58138629df617cc9cca3a8941dd2ec38c5b66b8111c33be492c556e3c34437637
SSDEEP 384:E+aQikB+z/xvxjg/qhEFNBSRpuOekd/9zn:j/UxvxjgC+ZZM/Fn
TLSH
T18E72AF2F9AB9BE23D5F3F5017959178BCBB894B291C16EA44DAD2F0D02C33D80316813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594cbf.TMP

Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State~RFe594cbf.TMP
Size 1KB
SHA256 c30be98a97c580cba05e6999c507b1661151bfd83e1f8bb6484edb5374ce3759
MD5 bb3528b0a35cf4c9454381631d22876e
SHA1 068d5f354e82852439b0672f66fde4c3a79b4020
SHA512 bb65b277f6bf4759fffa61ece5cb03742015f34e6892d30064f7fe1c12675c8f02212e53c036cd9e3d51ffc9430f0638a42d559d1a985f24f3fe7d4fb1fd634b
TLSH
T142216573A9E49B32DD917342724277975F21506742C08E00D5ED0B2901E708D977BD37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2276-1512-0x00007FFF21FF0000-0x00007FFF21FF1000-memory.dmp

Download

memory/2276-1511-0x00007FFF21540000-0x00007FFF21541000-memory.dmp

Download

memory/3372-102-0x00007FFF21D40000-0x00007FFF21D41000-memory.dmp

Download

memory/4188-1660-0x0000020FBAAB0000-0x0000020FBAAB1000-memory.dmp

Download

memory/4188-1661-0x0000020FBAAB0000-0x0000020FBAAB1000-memory.dmp

Download

memory/4188-1652-0x0000020FBAAB0000-0x0000020FBAAB1000-memory.dmp

Download

memory/4188-1659-0x0000020FBAAB0000-0x0000020FBAAB1000-memory.dmp

Download

memory/4188-1658-0x0000020FBAAB0000-0x0000020FBAAB1000-memory.dmp

Download

memory/4188-1657-0x0000020FBAAB0000-0x0000020FBAAB1000-memory.dmp

Download

memory/4188-1656-0x0000020FBAAB0000-0x0000020FBAAB1000-memory.dmp

Download

memory/4188-1650-0x0000020FBAAB0000-0x0000020FBAAB1000-memory.dmp

Download

memory/5524-188-0x00000149C7EA0000-0x00000149C7ECF000-memory.dmp

Download

memory/5524-24-0x00007FFF21D40000-0x00007FFF21D41000-memory.dmp

Download