hxxps://cdn[.]playrecycle[.]com/recycle-launcher_0[.]6[.]48_x64-setup[.]exe

Analysis

user interaction
yes
max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.playrecycle.com/recycle-launcher_0.6.48_x64-setup.exe
Sample260809-3grgcsxdjf

Score

8^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	6080	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
4532	recycle-launcher_0.6.48_x64-setup.exe
5624	recycle-launcher.exe

Loads dropped DLL 7 IoCs

pid	Process
4532	recycle-launcher_0.6.48_x64-setup.exe
4532	recycle-launcher_0.6.48_x64-setup.exe
4532	recycle-launcher_0.6.48_x64-setup.exe
4532	recycle-launcher_0.6.48_x64-setup.exe
4532	recycle-launcher_0.6.48_x64-setup.exe
4532	recycle-launcher_0.6.48_x64-setup.exe
4532	recycle-launcher_0.6.48_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	recycle-launcher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recycle-launcher_0.6.48_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6080	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307918028865283"	msedge.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle	recycle-launcher_0.6.48_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\ = "URL:recycle-launcher protocol"	recycle-launcher_0.6.48_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\recycle-launcher\\recycle-launcher.exe\",0"	recycle-launcher_0.6.48_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\recycle-launcher\\recycle-launcher.exe\" \"%1\""	recycle-launcher_0.6.48_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\ = "URL:recycle-launcher protocol"	recycle-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\recycle-launcher\\recycle-launcher.exe,0"	recycle-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\URL Protocol	recycle-launcher_0.6.48_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\DefaultIcon	recycle-launcher_0.6.48_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\shell\open\command	recycle-launcher_0.6.48_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\shell	recycle-launcher_0.6.48_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle	recycle-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\URL Protocol	recycle-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\DefaultIcon	recycle-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\shell\open\command	recycle-launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{09EFD42A-58A1-4A0E-A8F0-D749D73D80A5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\recycle-launcher\\recycle-launcher.exe\" \"%1\""	recycle-launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\recycle\shell\open	recycle-launcher_0.6.48_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4532	recycle-launcher_0.6.48_x64-setup.exe
4532	recycle-launcher_0.6.48_x64-setup.exe
976	msedge.exe
976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
6028	msedgewebview2.exe
4764	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	4532	recycle-launcher_0.6.48_x64-setup.exe
Token: SeImpersonatePrivilege	4532	recycle-launcher_0.6.48_x64-setup.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
5624	recycle-launcher.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 3508	4764	msedge.exe	85
PID 4764 wrote to memory of 6080	4764	msedge.exe	86
PID 4764 wrote to memory of 4832	4764	msedge.exe	87
PID 4764 wrote to memory of 4832	4764	msedge.exe	87
PID 4764 wrote to memory of 4832	4764	msedge.exe	87
PID 4764 wrote to memory of 2000	4764	msedge.exe	88
PID 4764 wrote to memory of 2000	4764	msedge.exe	88
PID 4764 wrote to memory of 3884	4764	msedge.exe	90
PID 4764 wrote to memory of 4436	4764	msedge.exe	91
PID 4764 wrote to memory of 3884	4764	msedge.exe	90
PID 4764 wrote to memory of 3884	4764	msedge.exe	90
PID 4764 wrote to memory of 4436	4764	msedge.exe	91
PID 4764 wrote to memory of 4436	4764	msedge.exe	91
PID 4764 wrote to memory of 5920	4764	msedge.exe	94
PID 4764 wrote to memory of 5848	4764	msedge.exe	95
PID 4764 wrote to memory of 5920	4764	msedge.exe	94
PID 4764 wrote to memory of 5848	4764	msedge.exe	95
PID 4764 wrote to memory of 5952	4764	msedge.exe	96
PID 4764 wrote to memory of 4140	4764	msedge.exe	97
PID 4764 wrote to memory of 5952	4764	msedge.exe	96
PID 4764 wrote to memory of 4140	4764	msedge.exe	97
PID 4764 wrote to memory of 4140	4764	msedge.exe	97
PID 4764 wrote to memory of 5708	4764	msedge.exe	100
PID 4764 wrote to memory of 1820	4764	msedge.exe	101
PID 4764 wrote to memory of 2672	4764	msedge.exe	113
PID 4764 wrote to memory of 6064	4764	msedge.exe	114
PID 4764 wrote to memory of 3312	4764	msedge.exe	115
PID 5624 wrote to memory of 6028	5624	recycle-launcher.exe	118
PID 6028 wrote to memory of 3776	6028	msedgewebview2.exe	119
PID 6028 wrote to memory of 4220	6028	msedgewebview2.exe	121
PID 6028 wrote to memory of 4220	6028	msedgewebview2.exe	121
PID 6028 wrote to memory of 4220	6028	msedgewebview2.exe	121
PID 6028 wrote to memory of 1128	6028	msedgewebview2.exe	122
PID 6028 wrote to memory of 6136	6028	msedgewebview2.exe	123
PID 6028 wrote to memory of 6136	6028	msedgewebview2.exe	123
PID 6028 wrote to memory of 4544	6028	msedgewebview2.exe	125
PID 6028 wrote to memory of 4544	6028	msedgewebview2.exe	125
PID 6028 wrote to memory of 4544	6028	msedgewebview2.exe	125
PID 4764 wrote to memory of 1400	4764	msedge.exe	128
PID 4764 wrote to memory of 1400	4764	msedge.exe	128
PID 3500 wrote to memory of 1992	3500	msedge.exe	149
PID 4764 wrote to memory of 1656	4764	msedge.exe	150
PID 4764 wrote to memory of 1656	4764	msedge.exe	150
PID 4764 wrote to memory of 2092	4764	msedge.exe	157
PID 4764 wrote to memory of 2092	4764	msedge.exe	157
PID 4764 wrote to memory of 976	4764	msedge.exe	159

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.playrecycle.com/recycle-launcher_0.6.48_x64-setup.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffec4d9c188,0x7ffec4d9c194,0x7ffec4d9c1a0
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,4206703701076005659,399897649280490665,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,14284176020669919691,11093657213961940696,262144 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,15264804937674152624,14488316782806557358,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,4704774499082937432,15347796339146675734,2097152 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,532995438887345095,16564369463634700211,2097152 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,1329243479921286701,6346525208624533286,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,13617189448982400010,18364803177788802493,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,15306988024128295162,1928969329101349227,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5588,i,6204657276217714888,14766425682288590330,2097152 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,17878416894860048781,11885512908639255891,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,17878416894860048781,11885512908639255891,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,8757647685318846528,2416772617165703887,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,4469501548104750484,3827061819574294839,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,7983777080584955335,16897455024724958776,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,14210035985581845722,3167052016960827744,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,4047082592027014770,3054984779738238451,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,5034736376084698992,16859718210959519816,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,12761816359996557913,4835975116377680107,524288 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6596,i,16125285311807057063,5893209966767974362,262144 --field-trial-handle=2160,i,17467938165120313700,285778957796659624,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5288

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4652

C:\Users\Admin\Downloads\recycle-launcher_0.6.48_x64-setup.exe
"C:\Users\Admin\Downloads\recycle-launcher_0.6.48_x64-setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532
- C:\Users\Admin\AppData\Local\recycle-launcher\recycle-launcher.exe
  "C:\Users\Admin\AppData\Local\recycle-launcher\recycle-launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.48 --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5624.3396.18101652938624476097
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x108,0x190,0x7ffec0aeb078,0x7ffec0aeb084,0x7ffec0aeb090
      4⤵
      PID:3776
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.48 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,7021492099181176313,17167099889502928409,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.48 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,7021492099181176313,17167099889502928409,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:3
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.48 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2332,i,7021492099181176313,17167099889502928409,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.48 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3644,i,7021492099181176313,17167099889502928409,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault844d28e1h89b0h4cd5hb055hc8169431e97a
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault844d28e1h89b0h4cd5hb055hc8169431e97a --edge-skip-compat-layer-relaunch
  2⤵
  PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultad1f0f21h9c82h43c9hb344ha2ad27f92ba4
1⤵
PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault184bb420h4bb3h414dha907hcb2730044785
1⤵
PID:3540

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 acc6d3fe68ef25f21e54d1e9cadb08211237939f9e6197f4336b436314fbbb97
MD5 b582dfe53e03ad82269a6143c0250407
SHA1 5a6a4698d64cbf31118f9c965dbb72e799590fc3
SHA512 44218f0be19dda9f6f0acdf5bd707d7ff5d01fd44b27188ef828ca042f2ebd49e23536999d4557f935abcae5e4339c5a329a7226a0649eff29b2d535e4be8a2c
SSDEEP 192:NEjyPjti0icGc7cVcXcZcNcLcLcLcpcvcmcncecKc7cscscPcicac4cNcCcMcwcP:ijG4v7GYSc8+++EiDW/T6hheXbh039xi
TLSH
T197F1686682ECCB9ACF0611CB4DA4625C60707709FBDCE90823DCD9DD344E5DFE9A6A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 00e506443d4a3a8b0137bb811e06c9ef0d2d3768989fb9285f6e7fb0bccae420
MD5 a2e17f5f8374abdaeac60c6f49bb2d2c
SHA1 df90a85948ba38a5d73d347c7f31253861cb0d3d
SHA512 5de02325e90eb454fe88b6fb29352fcb4212440bff77d56dd9c427d119c4794fe829ec9ab32e2f4f00e8f873d91d10a3203813de56e7830cbff1b7a6555ae158
TLSH
T187E022B6CC22EC6718FD1768A0498746E70023173A52895F3A3C810C8FB072A86D986C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5787a560152fe01d16644a7c5af232ed0605924382fc237335080d686692fd88
MD5 a461f18e507b1e137083c2bc7ed08746
SHA1 cdbc97ae45ede9e26ea61acbedd3070a793eadcf
SHA512 8f19da58e07192baa6d7927ae847fa76de98e078c14ef4db7f4bc1f7d854dd2576d08926c33d6f28fa460b5c2d5725ffaa416460a72e59d4655b812de03b8b9a
TLSH
T1F441CFF787F4856EC91196F0AA187E2BCE2D0514432C3D9A85E0AF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5ca556102c33d75f2fd82aa10797f6c09244e99d8c5abbbe572925ae42b35dc8
MD5 09f56805b6c4d7db4ae2d8fb76d9da0b
SHA1 fd6bfccd4ef0b13d317017fa8eb64d73dbba4be0
SHA512 5b515797eca71209ad7c69b0c2562c7f2d7c9d93cd12d56794e39d2a50d905e32b1f8a15bb0f8116367f0730457f8d6dad15c87dcbaa73929a5290a4c6eedb68
SSDEEP 192:sxZoRxyMqZjK1Ml8Mjw/fHsyQDaZdvzodpLHW6+WNGYv0uQQ7R1EIg5F4J:sxZo2bw/fHsyCazkLHbGE7wfc
TLSH
T15C62E806AA345A7B8CDBD219FA457F53D7F91533A2905E4499FC8A1C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e6d0689d5ff1bd00b5b13b9c36d970d28a33f2f77fdc6b07a3dc1e0c8bc4abe7
MD5 93925d2ff140d09132664938b2b14517
SHA1 3b9175a05d1434c4150879e0ee626a18c6c437bf
SHA512 10e26db0165708d94ce3468a1a9cfc89ecb21307fb2e46c5bbc86e6cd7f0cb42548d7e06070249df025fdbcf6b4adebc6a45df903b9f552fe3035a1e08627d28
SSDEEP 192:sxZoRxyMqZjK1Ml8UQ3jw/fHsyQCZdvzodpLHW6+WNGYvhQP7R1EIg5F4J:sxZo2qzw/fHsyJzkLHbGb7wfc
TLSH
T18662F806AA34597B8CDBD21DF6457F53D7F81533A1905E44A9FC8A1C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 af852edfe75916ef68bb82ea330733beaca97c687475e961747c947da65cf040
MD5 82fac9a0c9ff13691179ba6c03510e7c
SHA1 1d1dc0a03fce561d1d7b1e8d7e9af763a25f5ddf
SHA512 b156e24e2114e18dfdf575a5e3decf7d551f0aff67513936505362401942a6efad5f9f7288882860718dc5f1c80d52f84fb7e906da33a134780a7b9ae0c833e6
SSDEEP 192:sxZoRxyMqZjK1Ml8M9w/fHssCQDaZdvzodpLHW6+WNGYv0C+7R1EIgj4J:sxZo21w/fHssCCazkLHbGN7wjc
TLSH
T14762E8166A349A7B8CDBD219FA457F53D7F81573A2905E4499FCCA0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 86936e144d3d63e961de2aedb6f537e9ceeeb489636bb522dc5e3fb38bdb3f80
MD5 43165060f179323dc0b3bf61107249ef
SHA1 039f169fad50c5881f38cdbd68222da77edf367c
SHA512 d360e84126953ce29e8b7d0a71c4a35d0f6476def876eb191c2f0dace87d9cb229711e69501fcc2cfc6f66bef7b344dd48696d55ab1164a6d98cb17dbc9908ae
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG4:05ppxnY753RNBvRJJdt7p5J9zx/q
TLSH
T12BB27C5A713E0212397E2988B39696365F4135A37058E4AF7FB814A14F27E224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a3703c74ac5636be50c03b221adb4284ef4b304e66f3f348b9d6371f16a487e1
MD5 e8b029ac34c9edce4ff8cd73dde8f133
SHA1 cb3bf77e3a76897dcc1f61e750507c4d3bf60213
SHA512 a2d5ac5dc1e3ba6458a55cbb2502afb616d5509a6486f4bfe0ef8d76f46866622a9fc79f5ab81a78fac4cae6becaf2b1b780b6227c69bfdcba1a9f6af6af36bf
SSDEEP 384:nsiFoZcIpvsNv8TUNTUlI4zXQckCrXSnuphiftGnKBqYb4T7cew6HlytEDq1/tyQ:XFWZOwgW5khQoGwqYET7cewoy6DqZ
TLSH
T1E0D25B32E8A4CAB7EDEB4B89F65A3903AEE4411395DC9AD4D6DD5D1C00DB1DE030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 19edfd67fb702cffd4196655119b86e11500fa5c7a1532b80c6065a95ae1cebe
MD5 9bdf702a2d8b5aa4464575d14dd01905
SHA1 a963592407fbe89cd154661573279cfd34488653
SHA512 699a6ed3adeabd7ffd717af49afa9b5d3c1c4bd1ef6c1b1f659a335ca954124d0bdd402287c680e67975bca9a613223e7b346e609828ce32393fe63c7c71e88e
SSDEEP 768:p8Fccps3ewgbkU4RoGwqYET0cewI8p04n:as3w8CqLlI8p0O
TLSH
T12AC24B32E868CABBECE74B99B75A75039EE04267C58C9AE4DADD1D0C10DB1DD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b3efa556ace599943e277f596a118ed05731c631ccf21071d97f0afb31505f75
MD5 9b8b3e0b296b13a624b72470e6804921
SHA1 0816ce87dbd9001614bc88dc0bea0660f608c9bf
SHA512 7908c459e84bd76a84f8e3397d4af11f3a0bdd16699eb7c50683bba7ccfd6fa8e82fa1ffc0db1569e850745c3645f825bc3e3f2d6b88fcda1f536ea016a4b764
SSDEEP 384:npuiF9CcmyWCs3sNv8TUNTUlI4pXQckCrtbSnuphiftGnKBqYb4TqcewZGty/7IB:pFFccps3Owgm5k5QoGwqYETqcewY
TLSH
T108B22A36E868CAB7ECE74B99B75A3503AEE44163C58C9AE4DADD1D0C10DB1DD030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8147e3331505a87917739a1433229fd005e8523a629cb9e593e2df42d298e598
MD5 ceedb89ec27d844595dc7f550967f4ff
SHA1 378b65dc66b38431576e367da862e2184fc98a3a
SHA512 b3fc71305cd632983fc6501e8a8b2c0de9940ac203597c1bfda44d56a7546a08304757f80b70d679301e7b5b6adcdce74e5a436da9bd8b411d12deb17a2daa9b
SSDEEP 384:npuiFoZcIBsNv8TUNTUlI4zXQckCrXSnuphiftGnKBqYb4Tbcew6HlytEDq1/tyQ:pFFWBOwgW5khQoGwqYETbcewoy6DqZ
TLSH
T14ED25A32E8A4CAB7EDEB4AC9F65A3A03AEE44113959C9AD4D6DD5D1C00DB1DE030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1b58be40711dc996a3e92ad9b9a88bc6fd7ec9329c0a9dbf32b6f633514b6e9c
MD5 ce66dfb47a84b898c2fbb13049a0a8d0
SHA1 a7c15aa7e8dc42523fafa534df9278f980e45732
SHA512 59224d545f9ccde78158b0e2e9f125e38e085077136f8327f3f1ba43390fe2e2de0cc17f6c189cf0d364a524c2e7603d08a29a850c9e28a46da0d6474fe6265b
SSDEEP 384:npHiF9CcmyWCs3sNJ8TUNTUlIm2QckCr9luKphiftGnKBqYb4mcGpme4KV8p0OHn:pCFccps3QwgbkUUkoGwqYEmcZI8p04n
TLSH
T151B25C36E858CAFBEDE74F89B71E7A039EE01167859C9AD4DAD91D0C10971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d87431ec23c6a7c4a27d5646024c9f710ccea19f3ff92966b4dbc85f5ed1f8a6
MD5 193ca4d40840ec98f4e9702d54b0e60c
SHA1 da83017cb6c6d30b3e2b29868d16c3306982ba32
SHA512 234b06b88ade097daa8c87018f21c376532724b88c44baa219cdac6bec42e1242f0897b8c8e3657e08c6a245c48325aba5273992129620aeb3ef15e53258b3fc
SSDEEP 384:nFiFoZcIBsNv8TUNTUlI4zXQckCrXSnuphiftGnKBqYb4Tbcew6HlytEDq1/ty/o:MFWBOwgW5khQoGwqYETbcewoy6DqZ
TLSH
T134D25A32E8A4CAB7EDEB4AC9F65A3903AEE44113959C9AD4D6DD5D1C00DB1DE030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7c7464f3bd0de6c1cc577be3455c2b1baf09d21cf23fb3746fb5b09d17081aa7
MD5 0921d0da39f7ea1b44f348142aa30df8
SHA1 50cb94a01aa9c8b6ec2dabdc4dcca4efec6e183f
SHA512 b8ecf28ff479aa010056d37cb3187e22d6fdf2a9835e182c9765082b4f1d31369d8f33579739cbc2ac03ce417e45570335e7f71822eeb5bb0a590ba57c9d6334
TLSH
T16541F858A6F91108B3776E569BF6A86D487EB9732F06C49D10110E4F0A22B04CD72737
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7F3F.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsn7F3F.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7F3F.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7F3F.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2bda6eebb7498cfadf5b0a037f46060d796e161326ad5e2380e7dfe09b5ca6a5
MD5 6db8f262a93f4619392224d021cc0420
SHA1 1e3d53959df6fde8a7fc2d03070c51edb808bd04
SHA512 2d82b3519cf270bbb2d45cfd08fe0d90e2e6b0adee22f2269ab726ab5fd70158c8923b452a900baf03b68c716922a7421d09d97ff40f76b99ba4e50a1f2310f6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3b7a431316d4996cb5f112839dfa845d1310554e26abb02bcff5a634d44cfb6e
MD5 0c2df4a50c7318fd60d3142af0da7389
SHA1 d24eb1ce2adfea92db5157a776f42e6217df6b38
SHA512 44e263bdbe70fd1526edb39da2acf61fd0f350dd70c9cdfce8ff5ab74b50833caeb29c88c9ae4c5c30a829cd9a1893012656a308a4223582174107f8b8e99bd2
TLSH
T191D012277601013CC02024B31153A70C1440C30B90064104A468C51DAE980500903582
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 57e530a405bed41605ea771e0bede1aad0c5ba42606a97cca274062fc3d82d7a
MD5 30ebdc995a3f8e0c296af34dfa445db6
SHA1 60ad697c291530b050544e075d67fdf265ce2a10
SHA512 e1cd371185cf15f2af22ace913c562e0fb99c82f4f5247aabbecdd6facf9bbb1e1f3c420ee42189722eb582932b187b16b4f2dd91515580d38ddf66cbd1eef8e
TLSH
T158C04C0D740C4420D7F07A3B97E64C59313A45FCA6230D2687B4483B45177758646080
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d3f5.TMP

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58d3f5.TMP
Size 48B
SHA256 f2593448ec35c3d2f0ae8002634321305a4d35d135edabf1bc4c403ad2a571eb
MD5 4b7d0d7d0d140964c381803e77972eba
SHA1 6955ee914af9bc910cd3bf1b8f45cc117c3312af
SHA512 d414c2aeae11773342725eb5d4e1232403e2dd09c4754482bfcbc9b8c3a212e6d96bc10d434c2686d61178a28bccd1f6c0d95c12a3a2cdd2b16087971e7a48f9
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Local State
Size 1KB
SHA256 7664f3b38cc25d36b04a330fca3f604f66f936cd008712dcea19d4772418e0c9
MD5 042c10612443f9a7b79e6d194abb439b
SHA1 74b9d3df033edbca9407225282f2054c70f2051b
SHA512 fef82d144c53765bd049896e1b8af94c89af6d59d56042af6f39e3ca8720b38bd066e6262501e2f85e5091d617348f6c6371de998e4ef0255907bc635693f8d6
TLSH
T176318572E5907F33ACC38149B541AA476D2051AAE1144FDC62DD5B1C02D328CA2AFC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Local State
Size 2KB
SHA256 181367b4a5f6b22ce460124dc63739bf1ca5f4389ff5c1c9dbc87fc1b3ad3342
MD5 fecf8b81268ca6f5edd46699a1026476
SHA1 718f7a1e7754a0010419346f15aeb3044d439220
SHA512 69e772f8c48d05266b1f2410ca347919632af9bd16a5daa14027bf74c138e1edd6be9d497f840281200184bee4efb2ee54840b04975fd0a4be914ec1ae4c27f7
TLSH
T14A519473A814BB3789E38648B9467F139D3552A6E5512FE896DD1B1C01D724C2347C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Local State
Size 3KB
SHA256 4877b9abd8624f9d4f36e8b15219b63e2d8845877904205038dc0e6339bf3bfc
MD5 3607f3955e7c38d11ca5e08a0a9bbf3d
SHA1 b97cb6e1d2fb4e40052d556fa73b43343335cd71
SHA512 28d92d8f5a8e20fd5d8b154d31518ecbdd7399d57ebb62431c086edb3e212fbd070b5c340e9f13fce1becba82789aa658f4624d4c1b6c462037af4d53c66ae94
TLSH
T145719636A964FA274DE3C944B8852B07BA655177E1943FE8DAED1F0C01D73882356C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Local State
Size 4KB
SHA256 1345e57028bbf8e49e5cb9214956d723fdb8ddae27ba6048cb58bfaec186be66
MD5 29b74b3819bba95875237b90b0f652cf
SHA1 daca817faad126b0615e5a9e51abbe497d3a9039
SHA512 9f513346b779945f019fffd1d84ad85136f3dee9138d94310a9407d60074fc7cb245b99efa7d2ccd939cb66477d3ed4a062ce863307a941c86173b37297677be
SSDEEP 96:zupi8p3NkCEQf18mPjHy8Frh/cInURoDotoN5NtEDNOB3jEZ1jn6g9ZCRrh4TxlT:z98p3NbN8ENooDUauYzEZVivgL
TLSH
T175919526A964AA374DF3D909B9452B03AA645167E0947FECDAEC0F1C02D73C82357C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58c02e.TMP

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Local State~RFe58c02e.TMP
Size 1KB
SHA256 c14fa2445b7c60659b3903a3620d4b47576734defd2d3070bf5c71bd25b7bc40
MD5 ae73a757e8866bc25cdda17db3b22b75
SHA1 bdeaa1a6637de977aa788e6793506d67f736940f
SHA512 071f826d555f82ef5ce24799890e9b74aceae9a82af4ac43fcb4dd60784d3825d0ada4e59797eb8998590146513404c9d5b7c8f1009b53a7bcbc146cad11d2e2
TLSH
T17B217073D4847E32AD828048A542AA472D2091AAB1145FDCA2DE561C02D318CA3ABC3B
MD5 SHA1 SHA512 TLSH

Submit Download

The Cycleß Frontier - Official Soundtrack - Bar 01.mp3

Path C:\Users\Admin\AppData\Local\recycle-launcher\music\The Cycleß Frontier - Official Soundtrack - Bar 01.mp3
Size 8.4MB
SHA256 ed337f60344b6154860883217a10b78dda1ec3edca5dc82da2363692de8dd349
MD5 e609d06931fa27d7874561d12052ef7d
SHA1 43de69e8d4677f925f987c0db00ab3d7ab56e735
SHA512 d854c8f95871b38ad5c7d2ada87f8e11ecd1fb017599b966ef0db2e9d25f8f9968f3600f612a0712029d7f07f77e96034753a58b211d0f1741c6184bd9a4e628
SSDEEP 196608:/v8kCzFCw0R4Do/y/5MhidqM5QS9GRJx3FK:/vUC88yxMhidqM+sGRJ1FK
TLSH
T13096334ED301854BE218B3314E6B9218DA9BAFA1032970DF9753B763E3B2654F8C5BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

The Cycleß Frontier - Official Soundtrack - Bar 02.mp3

Path C:\Users\Admin\AppData\Local\recycle-launcher\music\The Cycleß Frontier - Official Soundtrack - Bar 02.mp3
Size 9.1MB
SHA256 2ed34a30b74fbe44d872348d8c6ee5d4b67cd6fb5449de31b8f1eaa10b40e974
MD5 d5a0fbd2c2ddedd1f312c3547dad6dd0
SHA1 bfe2406ac3fe37da33f1c2476941300fa99dc668
SHA512 e34e3bf8aeccff82f3e22cc04f4f63f544e0af2f23667d8ed8fd604b99d4e6fdf391d6fd833fce65c369426af1737554adf45f186034648107c43d4d0e0d2c9a
SSDEEP 196608:CCB1BS/Dxb09ysBFSmibUtRybeFs/9CV2wLw2Q3XKpxhw2SL0Adv:9BSL0BUmibUmeF2YVojbNF
TLSH
T1AEA63329E3019402D19F47729EEF438479BBCF253A42BBCD9541B752A5F22A8F4D331A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

The Cycleß Frontier - Official Soundtrack - ICA.mp3

Path C:\Users\Admin\AppData\Local\recycle-launcher\music\The Cycleß Frontier - Official Soundtrack - ICA.mp3
Size 4.4MB
SHA256 d0a4802f64766316e635080fd93b9a509aab42873b489a0974ea7616eb0ae2e4
MD5 abcd2f1dce5c5b689b296202a16f5a61
SHA1 c5d57088871e53ea19b0c3ff0a6b575f59f5b5a5
SHA512 b96a25f8fbf5fec5c2c8226e71826c57de8a400744c544ba14e8a324bdada5d4d4c05c0ded26859e1827436abd0b9aa1cdd0ff4ce5998b6250b031f2045563c0
SSDEEP 98304:GhQxcdngtqbIKTI4p04c0P2HK0DM+hALPTzDqMb:ON2pgr2HGbHdb
TLSH
T1F82633C3D27009AEC6956A3E6FC6D76867066F952C3CB3C8A996BF5025B16103217FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

The Cycleß Frontier - Official Soundtrack - Korolev.mp3

Path C:\Users\Admin\AppData\Local\recycle-launcher\music\The Cycleß Frontier - Official Soundtrack - Korolev.mp3
Size 4.8MB
SHA256 94776be47bf6d2199241ead7c8354206a9ec0ad5d47324ed0513539c995bede7
MD5 93f96e7b11f1e04e6d3fb4f3f0a6a302
SHA1 8d42728040b67f576046905f3cd648c32bfe1fb7
SHA512 5abe7c3b5870c340ef1f36bd02d959dbc704afd29993054ffcbd92e72c48933094b0069a8d6c59e16676195ae475a2775d2941b095694052025b5546d0020e88
SSDEEP 98304:917YMGW0pZPiqWuGyMt2etL2i/IWZ07DlAIrCKVb7NVQgxhNt3T:rYdW0rvWPh2iAyMxlVQ8rlT
TLSH
T15A3633D3D238524FB192127E1E86E72EEA062B5E3F7F3B99388B9F115872640B157D40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

The Cycleß Frontier - Official Soundtrack - Osiris.mp3

Path C:\Users\Admin\AppData\Local\recycle-launcher\music\The Cycleß Frontier - Official Soundtrack - Osiris.mp3
Size 5.3MB
SHA256 de1f3c1fb1729ffb02b112f06e520a16024039c9b9514d00e589e7e45de195e5
MD5 4371abd4547f4064497b24ecc0b804c0
SHA1 a8eb14237f8e88d8fc4fd2ebc6b252ccad6e5c0c
SHA512 747e818504928d30c73607b29e664d44f1395c5fe6d95f8fd112c27f5359402db85adfc6213cd548640a2fb4eaad20af7a817fd6f466395384a90e0d9a61b99e
SSDEEP 98304:tooOFgA76JmFRo7CISb2mJft2T5KOhlFaUzLCmPIrW:moOaAlFRlISbvt8vyUXTaW
TLSH
T1014633B3E438D85E43082A2E0FE466A84A532F5BA53F7855BD42FF84AC30F55794BC49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recycle-launcher.exe

Path C:\Users\Admin\AppData\Local\recycle-launcher\recycle-launcher.exe
Size 8.2MB
SHA256 21ce0fb6b0e1f210fde52fbbb592525734094f6fde5178d88e4b1432c4f2f386
MD5 064b1e02d731c01e4aeef0d88a21423c
SHA1 ea36f35f8905b6d602536ad557287f351d23863a
SHA512 b7ed7488ec770da276ce3f2d64ee0edc8f6f965722f898ff8b098588a65231c949cd5987effc5d4b60498fe7486d4da04e7d13b62fc7b91de395b5ffcca9e229
SSDEEP 98304:rMu+bjQGh8OszFDJp3XXMlywf7Vx+Yh0WtI6p7yn+:Y3QyOFDdo7VZh0rA7o
TLSH
T1CF868D43F66181E9D0AEC074835AA233F732B8890924B6FB6BD45B313E66F506F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recycle-launcher.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\recycle-launcher.lnk
Size 1KB
SHA256 9e0fa1af9b8b233414f3eafa1b77fc3eaa56ee7f8656016407366342e50a64e8
MD5 142fe782eeecf4cb9a7825e510a5d643
SHA1 db2d6e70ccb458eaf8064337151359eba4239e47
SHA512 7306a0b12ee6669b88e079a8d1ed02184f2233e4a2a3faf1f82cd30d3a9cb092fc11cf81b10855d7a06e888bce896a0ea78d52b69a98761385e17fc417efdba5
TLSH
T17A216B458BE30F26D22A9B79AABB115A8E61BC26B2150F5C5245C3870D2AD025D0CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4220-655-0x000001EF25140000-0x000001EF251EC000-memory.dmp

Download

memory/4220-334-0x00007FFEE09E0000-0x00007FFEE09E1000-memory.dmp

Download

memory/4544-595-0x000001CE90490000-0x000001CE9053C000-memory.dmp

Download

memory/4544-436-0x00007FFEE09E0000-0x00007FFEE09E1000-memory.dmp

Download

memory/6136-405-0x00007FFEDFFF0000-0x00007FFEDFFF1000-memory.dmp

Download

memory/6136-406-0x00007FFEE0000000-0x00007FFEE0001000-memory.dmp

Download