hxxps://recs[.]page/daily-dev?

Resubmissions

03/08/2026, 16:03

260803-thsw5seq5x3

03/08/2026, 14:26

260803-rr89dadl6v3

Analysis

user interaction
yes
max time kernel
130s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://recs.page/daily-dev?
Sample260803-thsw5seq5x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4064	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302466407586782"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{23FA93D5-06A0-40B7-9D8B-742AF1DF69EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
632	msedge.exe
632	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 612	3632	msedge.exe	86
PID 3632 wrote to memory of 4064	3632	msedge.exe	87
PID 3632 wrote to memory of 5080	3632	msedge.exe	88
PID 3632 wrote to memory of 5080	3632	msedge.exe	88
PID 3632 wrote to memory of 5080	3632	msedge.exe	88
PID 3632 wrote to memory of 4548	3632	msedge.exe	89
PID 3632 wrote to memory of 4548	3632	msedge.exe	89
PID 3632 wrote to memory of 2372	3632	msedge.exe	91
PID 3632 wrote to memory of 3420	3632	msedge.exe	92
PID 3632 wrote to memory of 2372	3632	msedge.exe	91
PID 3632 wrote to memory of 2372	3632	msedge.exe	91
PID 3632 wrote to memory of 3420	3632	msedge.exe	92
PID 3632 wrote to memory of 3420	3632	msedge.exe	92
PID 3632 wrote to memory of 1304	3632	msedge.exe	93
PID 3632 wrote to memory of 4484	3632	msedge.exe	94
PID 3632 wrote to memory of 1304	3632	msedge.exe	93
PID 3632 wrote to memory of 1304	3632	msedge.exe	93
PID 3632 wrote to memory of 4484	3632	msedge.exe	94
PID 3632 wrote to memory of 4484	3632	msedge.exe	94
PID 3632 wrote to memory of 4968	3632	msedge.exe	97
PID 3632 wrote to memory of 4968	3632	msedge.exe	97
PID 3632 wrote to memory of 4968	3632	msedge.exe	97
PID 3632 wrote to memory of 4120	3632	msedge.exe	100
PID 3632 wrote to memory of 4120	3632	msedge.exe	100
PID 3632 wrote to memory of 4120	3632	msedge.exe	100
PID 3632 wrote to memory of 4904	3632	msedge.exe	101
PID 3632 wrote to memory of 4904	3632	msedge.exe	101
PID 3632 wrote to memory of 4904	3632	msedge.exe	101
PID 3632 wrote to memory of 3920	3632	msedge.exe	103
PID 3632 wrote to memory of 2044	3632	msedge.exe	102
PID 3632 wrote to memory of 3920	3632	msedge.exe	103
PID 3632 wrote to memory of 2044	3632	msedge.exe	102
PID 3632 wrote to memory of 2392	3632	msedge.exe	106
PID 3632 wrote to memory of 3152	3632	msedge.exe	117
PID 3632 wrote to memory of 2976	3632	msedge.exe	118
PID 3632 wrote to memory of 1968	3632	msedge.exe	119
PID 3632 wrote to memory of 3572	3632	msedge.exe	120
PID 3632 wrote to memory of 3572	3632	msedge.exe	120
PID 3632 wrote to memory of 3572	3632	msedge.exe	120
PID 3632 wrote to memory of 2096	3632	msedge.exe	121
PID 3632 wrote to memory of 2096	3632	msedge.exe	121
PID 3632 wrote to memory of 632	3632	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://recs.page/daily-dev?
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa09cac188,0x7ffa09cac194,0x7ffa09cac1a0
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,13611157114628476154,6512197227577996015,524288 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,4502487859079888413,193926685976985123,262144 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,609215222735327873,1876287792365603997,524288 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,17265850286450317180,17376412855007130507,2097152 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,5273564795550485716,5740039171681324472,2097152 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,17841732006087987726,10517944382691184173,2097152 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,5936785576881043556,362578077780956429,2097152 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5160,i,17786455257973245925,784111634267113838,2097152 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3496,i,11141645856333466601,136030855400830943,2097152 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4972,i,5491642643927286890,16272203425755456669,2097152 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,13057741314862407996,17947137523680222267,524288 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,4716278075598177151,14372167631390496145,524288 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,779495376798879850,7917069640659925783,524288 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,779495376798879850,7917069640659925783,524288 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,5887733161452596992,10883050939389863645,524288 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,17356121149831377460,8232396732471292450,524288 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,17971463061990378006,16894939276645318124,524288 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4464,i,13006778437828286805,11720954547681540009,2097152 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,274586143975295896,2037109644887024143,524288 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5812,i,15936013310179278186,8916240978049399368,262144 --field-trial-handle=2328,i,7020175794444726663,961598773078551955,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1098f813085e13524060146c145ac32a6221d290c6533c7c95709e645967e6ea
MD5 5eab6486a548c99d199f0e0a60e62b75
SHA1 0ee64577438468c17b7c933ae3d41c1f821bedf9
SHA512 45ebc6e1c45f3aafb367b2f9b00a9b3160f867155637febde44ba33c5786f9a554d005e2d64619c5ef84f3c8f4275fc91055c4a7c02837e39ef469e831763014
TLSH
T10351C670476D64E0D32D16F0C8E3C6993B3593C4FB4B5F3201745F36AA2A7A90616F18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 57747c59bef4fe828b6d8694ca857b6c80a8ef6b7e157ac30519cf54555c2232
MD5 2f70a99c9601a97589aac0da2d6fae98
SHA1 eaa28c4c561eff5544df04dc5be0b7f6b52a15a4
SHA512 2cbea6bccb243d81602c882dedc8d978d87490a937fbf7011630f329ef497a6071d0f5de11a7153d169d4b362b3f12bdb28a5a6b8055ab19c611ff467108e66a
TLSH
T18751A474475E68E0E32D06F0C8E3C6993B3453C8FB4B6F3601745F36AA2A7A90656F19
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 844d9894ad8985211aa16513a428bd5b422046819cafc447af02c7928dd467f2
MD5 542799dcb4ec11557419e9aebcffd853
SHA1 8bc62dfad8017dfe23fed4f7e67b6f0009d7d4ed
SHA512 8a306c70edb469bea63ab8add3ff479b7bb8aadd6349d7c6e3ab4e9994f0a33d41c9c21411862f491df3ea55291e3de4a84ce8f1e891c222c9a29fc33bf92601
TLSH
T15C51C674479E64E0D32D02F0C8E3D68A3B3543C9FB4B6F3202745F36AA2A7A50656F19
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58df9d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58df9d.TMP
Size 2KB
SHA256 2ea3ec2a3349a75bcb8f687afec86117850ad6dbb727eb54723b697f43767330
MD5 ae55e44ef9283c89daa7146b2af462f6
SHA1 8fe94a8b382dea666dc2a155982470106f6c74b8
SHA512 b00fe8b1850722c45cbc79895548239031eafa541601f1361805b73d469ffa52e0fc07bd2b880d49380b779aa19bf880402ff09d096dcfa7f003634917dd1bfe
TLSH
T15B51737047AE24E0D32D06F0C8E3C6993B3593C5FB4B5F3205701F36AA267A94666F18
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 886a23f53615673485c9a07c8b167766ead9560f52b2ac122049b217555131e1
MD5 8151ad4db9ec5882c295c561b5d3784c
SHA1 ce6a3c612ef2ab59e12f3daa2ba112e9c08f68cb
SHA512 ac8e325292f7e682f1a28a10a924c1e0ab91205cabf4ce360926462a26d0b7f06333ed155bbe24fdf1fc760795bbbe328a2ec495eee0dcd4b825a04a957599dc
TLSH
T19961ACE2C7E5866ED82113F0AE246E27DE2D0915436C3D1ACAE4BF0B63E30B1D10199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b719989342c4b041703a206fea4412de9b0d5ef0c38884a1b76f76b82fa87981
MD5 83d4e2830b5a243e66c74aaefb60ab52
SHA1 09da9fd4d0b981ed6145e4e3a82963ecc50748f6
SHA512 2761742bbdf095ad51e015c2eaa8b8004e5d7d318f4d9e823f656bc817abfb190bfe6523e1c360be09b09760a92f9df71b862d4e3e75eb655a62f4fce275b139
SSDEEP 192:sxZIRWk2/fvstq3n8IdpE/fHW6+WNdok/Y9Ig7m+4IgrJ:sxZIb2/fvstq3lwHbp/H99
TLSH
T15822C8126E28A97B8CC7D20DBB29BF13D2F9503191D15E58FAFC961C04E6ADD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a4a1187ea0700b39541f83f977faf85d50112b44090f82eefc72f674ce0a9cf7
MD5 81d9a41079d85f2df87297c428e8fe51
SHA1 85253de07e2265886d3263770dd6b5bc17f0f4b1
SHA512 9f81aa077c84a7f118d593751e04b82cf36b40a39cbfb5349b72642733a52f35adc85c212155c27f402a8a6685db546a45efafc0437f2a82eddc4d48372abfe0
SSDEEP 192:sxZIRdk2/fvsWD3n8Idpy/JHW6+WNd19XY9Ipym+4Ig5mJ:sxZIk2/fvsWD3lUHbhX59U
TLSH
T1BE32E9126A68A97B8CC7E21DFA19BF13E2F9103255911E58F6FCD61C04E7ADE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d32514b774b958a264f03cbdfc8298220a36c5d64a7ddeb54cf5f11857afac7c
MD5 c4b9d23a8638dafa4171b5755dc21d7e
SHA1 06c62c20b238b43b21d154da4cc4e8af55df6a29
SHA512 712e9886938174c60198719cf986f03454fb5c1280898b4eb27bf14aab7c7db22c3fa1aefc7bb943b35ba313e3d3a8cceb26fab3eb8ff1d10783fb46a19356bf
SSDEEP 192:sxZIRWk2/fvsWq3n8IdpE/fHW6+WNdpGXY9IB7m+4Ig5EJ:sxZIb2/fvsWq3lwHbiXQ9W
TLSH
T19422C7126E68A97B8CCBD20DBB19BF53D2F9103191951E58E6FC961C04E6ADD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3f6f2598441d1b052c1b93e7ec9251b99beadcc3f40027a8fb86f7850cf2ade5
MD5 8949bb4b39bc57faa801075400a37ec4
SHA1 34e01d3fb8d7093e65f0a3197378bc4bc84d8dab
SHA512 afcff211ae33a66904ff766798ba61772148a2fbdbb0e0ffb3980b74b53f91bd6474a96d9f431ab5c0e8f030b99c62c3440793d341ca3c648714f23e24f086f5
SSDEEP 192:sxZIRWk2/fvsWD3n8IdpE/JHW6+WNdQ3ZY9Islm+4Ig5mJ:sxZIb2/fvsWD3luHbaZT9U
TLSH
T18032D9126E68A97B8CC7D20DBB19BF13E2F5503155911E58E6FC961C04E7ACE220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cd0fccc4d21329604a94d0ca10665feeb4e9af782f7bca9627558a62ad88e159
MD5 e4951a5e07ea19376e2359ed12d3201c
SHA1 e20cac23edf3c7846eadefd58c2a991f11615493
SHA512 765f8ec7b809d34933dccaa1ce97b76c8bbfba11e519cbb5ce3ef88c2f8bc1fefd8d92f659633d4a7c734b25c8419a625d4f9beafe82b6e8980963059feba9d6
SSDEEP 768:btyvIZwWvu+I+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7groWbOM:btyvIZwWvu+I+u1jamFLeR7rWl
TLSH
T197C2E93B240CCB7E5F801A9D9D5A6F9B3EA802CB67588D4047FD994C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0b9be47b36dda3dca7931f156e13ac4002340d262a9f3d5723a0cc77825158bf
MD5 7fa2db4a32251f6307b4cafd69580dd9
SHA1 78e065cc359e26be489424070079c697b499752a
SHA512 a5d5920230c03191a2862d14ba496c704d11fdfdacec3977237176b78e2e0110b039e44228f1185bc7c129bcbbf1010664f7774e4198ae3be49ba66e4f7b5a72
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDygQKVWKPa8KrSag:mTr74ng
TLSH
T1F7918401713B0792287E296CA3A295364E823167341CE96F7BB800A78F67E155DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3308d042-e4ee-4ca5-b750-3679353656cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3308d042-e4ee-4ca5-b750-3679353656cc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0ae47154ec3644cc8e1b93dad538e49ab20d0d5488876e589a5c46619337007c
MD5 ba09a280af111d003eb4363e35406aed
SHA1 211b9eae53f5e25d61a3b3548e46f419fcb85cde
SHA512 374223be3f4183ac75301d4f5eb789905fffce64c94f2ce664e748b367f10ed8af9db0c40d99df25ae4b0d8def82bf460069d93cafe7d532a9dfceb8bae51dac
SSDEEP 384:1ZcIhsNEU73Nziu1Me+CfOESJryb6HlytEDq1iWs:NhmdFnnOEShyboy6Dq0Ws
TLSH
T163928C3199782C775AA6A151F88B39039FF85027E7D57ED4D1DDBF2C01CA2E8130A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4c4786a7b5779b82acfe0048f1938df9040794a5e237c7612842c97bb77df3df
MD5 2f5d5db51237d5bdce2a28edd330767e
SHA1 9889f8492bc2432bf741ca947332b863827e3c65
SHA512 f63694b3b643e4502d905a81df75b2466d5791aabf42ce71505cfbeeea53bcd0affddf9459958bbbddb14b70645956053a7cd797de17b1c2284d3d53b87cd205
SSDEEP 384:ziFiZcIizsNF8TUNTUlIli3NziuWMe+CfOESJrNb6HlytEDq1iWs:eFQqowgudmnnOEShNboy6Dq0Ws
TLSH
T17DD229F149E74836DAAE5743E77E2D028EBCC063B5956A90B3C8691CCC861BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8accde8a92d65f6a928aed6a405a3a93f170c25234fbdb19b4b2c8fbecc3e6b5
MD5 5878eccca2b05a88cab05ff799d171d5
SHA1 86639035170c2bd7147e20172b48267ef82f4a04
SHA512 175668f8bfd62e63b9a43f8e8d4bf15cf5a62532faf5862b5105b33b8f11fdffb55f6eeb20f7102a9d635aced3f6cb20c1f2f912e619c5d2497637f5242b23e2
SSDEEP 192:JONys6v+YLNQmiUyR4Zh+CGSOImWusM4U6:JONys6vz/PZh+CfOupU6
TLSH
T1F802F935AD682C6B9FB2AE45F48737175FA8213BE6953F80D9D82F1C01D779C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d90f59d1196b8a50d6c36cbd9861178cf5b4685f2fd1650e4b4f3bf7d809acc4
MD5 dcd71c8821e7f79e5b1bfe4d251ac26a
SHA1 4f80e53d018ab4c826986d3188738ef05cace8ed
SHA512 ba4e23ced112ea6ce7d5ea351e237a283767b79e0e0b11c10e6aa608c0dd00f393249c5b6fa4d2c705f2e057b18d97b05920f8add436eeae541456dbc3be3967
SSDEEP 384:nZcIhsNEUi3Nziu1Me+CfOESJryb6HlytEDq1iWs:PhHdFnnOEShyboy6Dq0Ws
TLSH
T15B928C3199782C775AA6A151F88B39039EF85027E7D57ED4D1DDBF2C01CA2E8130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 953b5c2025787aef6fc67874ff354fa1f49d8d96c678ca16472b330c6ff3d98d
MD5 aa8cecca20fc6ead086a4eb662c5edde
SHA1 9f6d2d65898603594168d7e888fe25a0dbdabe6e
SHA512 1e4d7531508dd218e569aa93a451a322e98e5f397b6ae2f31275e75ebf228a5216e73dcfb29a88eaa578fd632eab511b141e6132973263ee3730b0c23ccd604b
SSDEEP 192:kON26v+YLxQmiUyM4ch+CGSOImqnSJrjCHyqLU6:kON26vzjgch+CfOESJrwbU6
TLSH
T1F7121B3178786C6B5EE2A554F48735139EB8513BEA4A3F90D5DC3E1C02DF79C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 389313a9b7b0fabcf0e821d7b4d7f4a6a5ba696ac29492cfcb128dd4257f0d43
MD5 aeca13fefd0b68a7de0a90c59a7d1e3c
SHA1 1b7d2b6a9fd7b23de4c63cf9fdef59da06ac60bb
SHA512 8b40cb7ae3c709d72ace18c37a542e9b7d6b3e36dbf797cf47c6d29604234c239c47b64b7aee019a2e088aab664758a0383d9ce542cf152e9216b2f736629547
TLSH
T17CE00455D000403FD01C033000C31F3137F0541103F74704451405F43C117003330D50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe598795.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe598795.TMP
Size 392B
SHA256 eb18dd69f6d95dddb14754dbcc9f23c01eafa1ad7a2e180093fa9f00208220cf
MD5 0ccab23986d923db88e62402585a0891
SHA1 6f78424fc212f0264d3fb95b76686669086339d9
SHA512 e5e842a127d63acc6eb1f82ccc635efde7b445ad38b45165a973491c785cac2f206dc3d1642c4595abdc77463848cf39185eb4fa78a57c05871882f532afef3f
MD5 SHA1 SHA512

Submit Download

c91370ce-0024-42e3-a361-b455f4583998.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c91370ce-0024-42e3-a361-b455f4583998.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1686b4e92f27e59d825c6613250e9b272e2440507a2086d559b82d72b57b84e9
MD5 abb735790d9626a6763ba6a6fe715294
SHA1 ab41d931583dabeabce57514b2ac450fd644de4a
SHA512 28580648ab6710e1afed42f63a965f38ae712f05e007927b9c98b0af5345f605981275367dceffcc7a00c3311dd4c4b3aafe9edfee779294bd3fbc070077c326
TLSH
T10F411768AAF91118B3B36E5AABF7A86E447E79332F06C59D10110E4E4663B40DC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download