a87cedb6644556cbec3c5ba8ec0385b0936357742396d202c094328c286652c6

Analysis

max time kernel
299s
max time network
308s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
14/10/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
recycle-launcher.exe
Size 6.8MB
Sample261014-espvxayshy
SHA256 a87cedb6644556cbec3c5ba8ec0385b0936357742396d202c094328c286652c6
MD5 4c720b45728678dc3126cbd377567391
SHA1 0920f3bb87091438fe72e6768a3f5a5ac06a04ea
SHA512 a70b2ae04912dd1b730f04a49fbb5e4cb1db49c17b0431df2a31b036328d4aaec6c9e5082f40f8c336648887d2a6de0ffce46420c9c15d633bcdb87eb1f6b3ef
SSDEEP 98304:tAb43rbxGL30HzwRfbzbVCY9cJgwf7Vx+Yh0WtIYwn+:D3r3HzcNWgo7VZh0rZ
TLSH
T151668E43F2A181E9C05EC178935AA233F732B8890A34B2FB5BD45B212F66F506F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	recycle-launcher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_456659104\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1547589325\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1408944969\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_456659104\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1547589325\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1547589325\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2088881303\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2088881303\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2056289370\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_456659104\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2088881303\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1408944969\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2056289370\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_456659104\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_456659104\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_456659104\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2056289370\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1353606905\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1353606905\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2088881303\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2088881303\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_456659104\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_456659104\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-hr.hyb	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	recycle-launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	recycle-launcher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\recycle\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\recycle-launcher.exe\" \"%1\""	recycle-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\recycle	recycle-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\recycle\URL Protocol	recycle-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\recycle\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\recycle-launcher.exe,0"	recycle-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\recycle\shell	recycle-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\recycle\shell\open	recycle-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\recycle\ = "URL:recycle-launcher protocol"	recycle-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\recycle\DefaultIcon	recycle-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\recycle\shell\open\command	recycle-launcher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3980	msedgewebview2.exe
3980	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3952	msedgewebview2.exe
3952	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4740	recycle-launcher.exe
4740	recycle-launcher.exe
4740	recycle-launcher.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4740	recycle-launcher.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3952	4740	recycle-launcher.exe	83
PID 3952 wrote to memory of 1568	3952	msedgewebview2.exe	84
PID 3952 wrote to memory of 4108	3952	msedgewebview2.exe	87
PID 3952 wrote to memory of 4108	3952	msedgewebview2.exe	87
PID 3952 wrote to memory of 4108	3952	msedgewebview2.exe	87
PID 3952 wrote to memory of 3776	3952	msedgewebview2.exe	88
PID 3952 wrote to memory of 2220	3952	msedgewebview2.exe	89
PID 3952 wrote to memory of 2220	3952	msedgewebview2.exe	89
PID 3952 wrote to memory of 5580	3952	msedgewebview2.exe	90
PID 3952 wrote to memory of 5580	3952	msedgewebview2.exe	90
PID 3952 wrote to memory of 5580	3952	msedgewebview2.exe	90
PID 3952 wrote to memory of 4316	3952	msedgewebview2.exe	91
PID 3952 wrote to memory of 4316	3952	msedgewebview2.exe	91
PID 3952 wrote to memory of 4316	3952	msedgewebview2.exe	91
PID 3952 wrote to memory of 5064	3952	msedgewebview2.exe	97
PID 3952 wrote to memory of 5064	3952	msedgewebview2.exe	97
PID 3952 wrote to memory of 5664	3952	msedgewebview2.exe	102
PID 3952 wrote to memory of 5664	3952	msedgewebview2.exe	102
PID 3952 wrote to memory of 4396	3952	msedgewebview2.exe	103
PID 3952 wrote to memory of 4396	3952	msedgewebview2.exe	103
PID 3952 wrote to memory of 1792	3952	msedgewebview2.exe	104
PID 3952 wrote to memory of 1792	3952	msedgewebview2.exe	104
PID 3952 wrote to memory of 3980	3952	msedgewebview2.exe	105
PID 3952 wrote to memory of 5928	3952	msedgewebview2.exe	106
PID 3952 wrote to memory of 5928	3952	msedgewebview2.exe	106
PID 3952 wrote to memory of 2004	3952	msedgewebview2.exe	107
PID 3952 wrote to memory of 2004	3952	msedgewebview2.exe	107
PID 3952 wrote to memory of 1888	3952	msedgewebview2.exe	108
PID 3952 wrote to memory of 1888	3952	msedgewebview2.exe	108
PID 3952 wrote to memory of 1104	3952	msedgewebview2.exe	109
PID 3952 wrote to memory of 1104	3952	msedgewebview2.exe	109

C:\Users\Admin\AppData\Local\Temp\recycle-launcher.exe
"C:\Users\Admin\AppData\Local\Temp\recycle-launcher.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4740.4728.14191673806126855109
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x18c,0x190,0x194,0x160,0x164,0x7ffcccd9b078,0x7ffcccd9b084,0x7ffcccd9b090
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1812,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1392,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2396,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:8
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3544,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3536,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4264,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3940,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4324,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3752,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4256,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4684,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4508,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3920,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=recycle-launcher.exe --webview-exe-version=0.6.69 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4856,i,15801299882836547681,1568250413935862270,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:8
    3⤵
    PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07288756-c646-43ec-96dd-978c3ee9cafe.tmp

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\07288756-c646-43ec-96dd-978c3ee9cafe.tmp
Size 16KB
SHA256 ba7cec9466b2184b07e7947d4f4375c9ce04af4918dfdf84e5fed7459fcad45a
MD5 5ff4c74d9f656e274d4670242c060a75
SHA1 bc3fa6cb43f9bca965bc3a99a7622191e7594c98
SHA512 b2c024fef454e799b76099ca56d826512624ed0b0e36ce5169207ee937e207f8071c684041549550be7da8559dff3ff4c289b8ba382c5ab34de29ad864013b5f
SSDEEP 384:zZ+aQikB+z/xvxjg/qhEwNblmNHrJHUaQ9zU:o/UxvxjgC+HFHRQFU
TLSH
T1EA729E3664787E6398F3F515BA9D0B5BDAF88471908269B84EED5F090BC73D82342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b08120b-07f8-48d8-89d8-40b249acec1e.tmp

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\5b08120b-07f8-48d8-89d8-40b249acec1e.tmp
Size 1KB
SHA256 6eb7e4526247d7b8e483f0942edf0c6f8dfd29da3d224ea500f85c7b43d80fcc
MD5 ba014599296ddf9391180e2cd2900271
SHA1 4caeff5819a52ed4461a35b86ab070a8652a655b
SHA512 443ef19679b6fbb17fa2e73367b3e773a942d85dc01ca5bf9e649db914db0fad7e2cc546090a252d4e9c9c94ce6a235d2c640cbcccfa0de9c97308ab3d1852fa
TLSH
T1D731C772F5B43BB2ACD2A554FA873B836D311229D1624E4852DE0B1C03E32CC6715C37
MD5 SHA1 SHA512 TLSH

Submit Download

878e3de9-79e5-4498-be01-7aef819ee68b.tmp

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\878e3de9-79e5-4498-be01-7aef819ee68b.tmp
Size 3KB
SHA256 aef001e38571236810310c0527cb446eb2bfa0d04598432766430d4ef11c3027
MD5 14ff700af5d9acb2a65d42b4e3e26b8c
SHA1 2c8884b653df61faa5dc80a9bd075c93cf9d625d
SHA512 bdb9da5e0ffb470446079908ec301110233c761e4e021222b39c75025ba069091d3b13f2c8754198c72df83c7de163397c9c6b43e69782beaa6996846998de55
TLSH
T1EF719432A978A6778DE3D954F8C63B12B6A91226E5D53F99C6ED0F0C02D73D82301C1B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a09f223c4839497b5a08a8a5bfb9350aa3e4b15279df0f3729486ac6a48d5d9d
MD5 d92c9f0c5f3591a755ba7a4af9b65540
SHA1 57223c05b85ab870adbc35048f18d83ec03d400a
SHA512 e86ba4e8f83b069d39b60095c8da3a56b6018553d6376808f93ef35d09d711592578c29519f6f701988db93054c8f33161ab2be2409015bc4a569ce87e5ed04d
TLSH
T1D0D02B72221A1530C210313B4081E18D2501C21F400680489E35FE1C0F440F10C85D45
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dc5f22c1ab3f3f26c9c77f30ff16071dc5a4fe511de8f83fd8730da3c6651160
MD5 607361bd90290a39b39e6047223cb3a2
SHA1 5df953917de25d52df2e64f6a3c8aa4c87b682f6
SHA512 133e93d8d5c92fb2d28a4713a0a82c4d32882140e410a7e1582c1f5940b68abd6a9cdf1e6ad303964674e565bc92c996a284124c9e23021161e883a1ebe00187
TLSH
T15DD0123236025134C01034370002614E1901D24F80058048D438CA1D1F080A01906845
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 282c3ffbdb35d4872c02e37fffcaff58878690b0dfc14797738e67d6f02a2401
MD5 4adb76bd5077013fdaec5e094145eeb4
SHA1 cdba01840464a6bf7c86f0e67945cedbcb963e04
SHA512 17f06209a8852584681c5b27b38716d1704be350ca2e09438ed42d542a2da766e9f3e1041ffb3425ab7ec5a0392658ce5a3e61d460b8f83e4041b2bd75cf7abb
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

54377c73-93c3-49c5-becc-7de52ae00950.tmp

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\54377c73-93c3-49c5-becc-7de52ae00950.tmp
Size 6KB
SHA256 6b3a6a950ae4b0c163086bcc1fe2ba9c78a4b8992982746c23153845b9a2e030
MD5 b829e283610c5e0641ee89fd76f01986
SHA1 9fb35a8e51a95437027e89520c784a7b776b1397
SHA512 1635056253c5a7349d288d2062e9bae1fbdf139602381182c74b98a393252f2115a33a0d53b08225c0e7c24c9d5507b9a03d4c717947bbaaed1b6c9d7edb3291
SSDEEP 96:stTz059aS5jd1xb9KffqhnZ8i0vhEq0ktT+m/7qx+WVHMSm+uecJ9KM17dQjUt+v:stf06/f0Z8paSX/S+WiT9K+dH0DrMC
TLSH
T182E198029E68697B8CC7F61DBA75BF12E6F9102176D50E58ABFC851C09E66CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Cache\Cache_Data\f_000001
Size 96KB
SHA256 6066ed2848d9166f01c9b4d4ce39dd70ae619ba80c8cae13a63f45cbd1c94461
MD5 3314a6189c143efc1bf66fd1742f1425
SHA1 aa499e4e199671b350da43b7a931d0f9e9120e89
SHA512 009e9bf6acd0d02e25360b48c4afcc96b7077ca76e1690e30314cb066a3f6383600f36079d48931cff31db8a351b92716020303aa949ea41e73611f3ed8bcee7
SSDEEP 1536:DjX2SAivCYIl314ydHapjpQhBMDjzY4S89CLiLdXwM4qg8kmC2YEbyikSX:XJAKvIPR6jpYBA089PvCmvZbzX
TLSH
T181A31210EAAEF48FBD7D1C1F9347930211B9ACE946505B09E8DADE0A1CB9506F67C0AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Cache\Cache_Data\f_000002
Size 1024KB
SHA256 5e39529bb271a04e37ef8bdfd66d206c9b25fd9765a4511748c1e18cfa904733
MD5 f16f505c46a7220db5559e43d62d3e09
SHA1 ec231ceb80866857c806f1bbbdd85eb9f01bd71a
SHA512 8c1d0bdaac92ee460bb9d7e9886bb9bf8faf85507dc819d75813f525ff2d4f27d6586acdd1fa7573369dd7c489d77fcf328b745548da52db2a977df16a564dbc
SSDEEP 768:BhuIId10NZM42pe9IaossHay/dfwsi3P4OQAE3ueOT/EQU9qJt1R62GdceGDcnGz:BAT0NaF9aziif4j3eeOD9rS2Glw/z
TLSH
T1F425B3C963D27C2ADD25B3B4B8E10768327DD8985787034BC35862EF7C9B2E82D816D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Cache\Cache_Data\f_000003
Size 552KB
SHA256 219d9ff4ec0e7e8053ef5cb0e137e6788d4823c8a33f613a1203eab19c8a06a1
MD5 1be5a0b7d491e0bbb608d6cf9d652eb5
SHA1 5c1bd0bf6bf2f02da5c0def1640cfe5bbab1ec57
SHA512 5f012c3ca27a5496d8284d99a1547978582318e7573a8d8b5cf5659401017961193207d3eb0aea6afc12b742866536f132f851914114d7d943539d4d7e98642b
SSDEEP 6144:x8jrzEK23fQDfGxNkHUUfAUKz9uooGvaZMB6L+1Gi5EHGDyehTC8gj2aPJtixfpo:xe/F+uViaZgk+Y8PysOj2awfpbgUE
TLSH
T192C4B1A1FB781517EA6157319AC193247838EDD92343978740DAAB77BC023F4AE870EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 456B
SHA256 d96b3dcc895de02c359266e76506dea23561a6dade728bb323e620218ec3c919
MD5 372dde1e9f820618e4219524ea7d10e7
SHA1 cee95acb117616388a800b78968a23439cdfb213
SHA512 e5e0973e1a068b6fb304251c08a2e9c4a2778e04a54856726b04a6e745bbcc89449e3747617e3b7200eea63857f365dc8b1d10e966508cdb328a85fd130886fd
TLSH
T106F0C7002A2FEC6ED3D6303562C7934572B1422B150B4C0EEFB030BBD022F42A9B14BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8fd0207ae716e12169149ebd689545423a12df36544d30be40f3bf16fd2a2fc1
MD5 74e6664ab9cea15a9352dca799f4d4d6
SHA1 69a17e61687223999590e29c78d17875c5497c4e
SHA512 64db229ff8bf3af75a2a56f5b2541788b2170c97d077f590deda55f77aff0742855d65172d4dd209f1f9c45864abfbb33df848766ffc78aa37173485eef436af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 d11650b9f79aa720c3c90f18ba0dbc09bf5b03d40fe0f2af45ba9fe6cf4816ee
MD5 19f8c2de53cd441db5f40d7fe59f7bce
SHA1 b7be4db366e97b3e6c34077ab957e7611ada4f7a
SHA512 f88130348af4bc5f58a3afea36fe38172a62de121b57efefe0f72a68280a239c5f416298575e494f2b8551c9866d09d844bae6f66fcc3eecdbb87e70e71f2bdc
SSDEEP 3:LstlNllkll/lPYX:LsX3lEtA
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 d9ac12383e41daa4a3debe93da7e105475a9b88c93ff3bd546de28e4481d02a2
MD5 7944ebce1bc26b413817148e8790dcea
SHA1 94579a257e8b2a08584fe0c86c777a22217fbde7
SHA512 d184ab06516c1e21cda751c3e1eb79450c39dbc00b65af31e7bd1e38e099b1653fc6726b19f7e51185c29ff81d1f46b8f31bb3c0de7b0099c16110fd1c4b7932
SSDEEP 3:LsOllllkll/lPYX:LsUlEtA
MD5 SHA1 SHA512 SSDEEP

Submit Download

6a950830-ce7b-44dc-a3e4-176283185100.tmp

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Network\6a950830-ce7b-44dc-a3e4-176283185100.tmp
Size 888B
SHA256 798cbe7ebe2171f5e370033ad3a710aa2b933af68cd5e60a2719e1082dd37ba4
MD5 3588a232148834c390b3e3013cae2462
SHA1 100d02e5eff4bd856c537ff36f07adcdc522c01d
SHA512 3ba45308dbd55acf013bfb14150f187698a025d8809fd68cac314fb078ce9d8bddebd401725aab66ad0afa66c5b403faac4d9abfb51c242e8fe9e430a1d9b57b
TLSH
T1EA11C09186E4C26E86516AE027707817CE7E0519A2182E3BCEDBFBD767D1471D11120F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 9458139226e2d564922d6d1ce942465836ea8b2b0d13360ee9f24fa682bb6049
MD5 1202b480699bf4d74d63010bfd6be745
SHA1 da97a9c0253947e96bf39fbe46c79117946e962d
SHA512 5cd357968ff2c05cd690a5ce3b6c2309b98f9d7419f10676a92cc21eba57572a687ce30dc55dfff86f088c045a35acb62e4ff9fa4d54da4398635a0fd8e2590b
SSDEEP 96:stTz059aS5jd1xb9wffqhnZ8i0vhEq0ktT+m/7qx+WVHMSm+uecJTG/qMk8dQjUG:stf06Bf0Z8paSX/S+WiT6iQdHaDrM8
TLSH
T1ACD1A9029E28797B8CC7E619BB75BB12D6F9106171D50E58EBFC852C08D66DD230790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Local State
Size 1KB
SHA256 24c3505f014dcaae949cd7bd853c52fdfc32cb46f2b475793b070d5d2e7c0670
MD5 93ef982a3eee41debbbc0aff1ff51670
SHA1 32b98dde57672ea7cfa71f6b216837dd90a672e3
SHA512 c55de5efc030eef2d759eea64c589ca6c4f4acd2f15054b2a88c9ae55b3febafa27a2414393f8d86a80557444376d7614840e9cc17ad2607ec1c98e07f0928ff
TLSH
T180219232E5B83BB6ACC2A854FA837B832D705229D1655E0D92CE0B1807EB1DC5722C37
MD5 SHA1 SHA512 TLSH

Submit Download

c36966f9-72ae-472f-9210-37436e80df25.tmp

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\c36966f9-72ae-472f-9210-37436e80df25.tmp
Size 2KB
SHA256 d70e2003ffdf8001ced4055ebcf0258ebefcc4d46af44b553bababd4f986bace
MD5 a32a11393a37e71bb18c60c54912e459
SHA1 a397ec929366ceb9ea678773ab48392659403384
SHA512 e1bba9413feee571462691cb9e18f3c226bc5b16fd842b44f1786b8e43d3a706f2773c09cc0a21fbfa8358225284b8aeaa1417df323c857ef86a90740b01d17f
TLSH
T1D951C732B82867B7C9E39954FD8A3F53D9395265E6A22F5496DD0B1C02D729C2301C3B
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1344338951\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1353606905\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1408944969\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1547589325\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2056289370\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2088881303\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_456659104\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2220-82-0x00007FFCE8FB0000-0x00007FFCE8FB1000-memory.dmp

Download

memory/2220-83-0x00007FFCE9060000-0x00007FFCE9061000-memory.dmp

Download

memory/3980-544-0x00000248DED90000-0x00000248DED91000-memory.dmp

Download

memory/3980-540-0x00000248DED90000-0x00000248DED91000-memory.dmp

Download

memory/3980-539-0x00000248DED90000-0x00000248DED91000-memory.dmp

Download

memory/3980-538-0x00000248DED90000-0x00000248DED91000-memory.dmp

Download

memory/3980-532-0x00000248DED90000-0x00000248DED91000-memory.dmp

Download

memory/3980-541-0x00000248DED90000-0x00000248DED91000-memory.dmp

Download

memory/3980-542-0x00000248DED90000-0x00000248DED91000-memory.dmp

Download

memory/3980-543-0x00000248DED90000-0x00000248DED91000-memory.dmp

Download

memory/3980-534-0x00000248DED90000-0x00000248DED91000-memory.dmp

Download

memory/3980-533-0x00000248DED90000-0x00000248DED91000-memory.dmp

Download

memory/4108-28-0x00007FFCE86B0000-0x00007FFCE86B1000-memory.dmp

Download

memory/5580-93-0x00007FFCE86B0000-0x00007FFCE86B1000-memory.dmp

Download