Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
24/05/2023, 06:08
230524-gv9n7sba37 4Analysis
-
max time kernel
69s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2023, 06:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://psc2.cf2.poecdn.net/7goAcPibDrp81Q9MI1KGgPXs/_next/static/media/chatGPTAvatar.04ed8443.png
Resource
win10v2004-20230220-en
General
-
Target
https://psc2.cf2.poecdn.net/7goAcPibDrp81Q9MI1KGgPXs/_next/static/media/chatGPTAvatar.04ed8443.png
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7b84bb0b-49b6-4962-8b87-cc7f6d751861.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230524060909.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2836 powershell.exe 2836 powershell.exe 4808 msedge.exe 4808 msedge.exe 3292 msedge.exe 3292 msedge.exe 4388 identity_helper.exe 4388 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3292 msedge.exe 3292 msedge.exe 3292 msedge.exe 3292 msedge.exe 3292 msedge.exe 3292 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2836 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3292 msedge.exe 3292 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3292 wrote to memory of 3344 3292 msedge.exe 88 PID 3292 wrote to memory of 3344 3292 msedge.exe 88 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 1824 3292 msedge.exe 89 PID 3292 wrote to memory of 4808 3292 msedge.exe 90 PID 3292 wrote to memory of 4808 3292 msedge.exe 90 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91 PID 3292 wrote to memory of 4780 3292 msedge.exe 91
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://psc2.cf2.poecdn.net/7goAcPibDrp81Q9MI1KGgPXs/_next/static/media/chatGPTAvatar.04ed8443.png1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://psc2.cf2.poecdn.net/7goAcPibDrp81Q9MI1KGgPXs/_next/static/media/chatGPTAvatar.04ed8443.png1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9578f46f8,0x7ff9578f4708,0x7ff9578f47182⤵PID:3344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17088709561615741012,16963171133547593062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:1824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17088709561615741012,16963171133547593062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17088709561615741012,16963171133547593062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:82⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17088709561615741012,16963171133547593062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:12⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17088709561615741012,16963171133547593062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17088709561615741012,16963171133547593062,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17088709561615741012,16963171133547593062,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:12⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17088709561615741012,16963171133547593062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:82⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:504 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x114,0x248,0x7ff64c0a5460,0x7ff64c0a5470,0x7ff64c0a54803⤵PID:216
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17088709561615741012,16963171133547593062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17088709561615741012,16963171133547593062,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:12⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17088709561615741012,16963171133547593062,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵PID:1588
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2760
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5462f3c1360a4b5e319363930bc4806f6
SHA19ba5e43d833c284b89519423f6b6dab5a859a8d0
SHA256fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85
SHA5125584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417
-
Filesize
152B
MD5d2642245b1e4572ba7d7cd13a0675bb8
SHA196456510884685146d3fa2e19202fd2035d64833
SHA2563763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1
SHA51299e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\989d1b02-0423-43dc-b3af-6a54b6025b3d.tmp
Filesize5KB
MD5cdfac82626d88621d01a115a4acc5ec6
SHA1751b0619aabe55dfd158d5b8b44d5cbcac929163
SHA2567fc610b6d425b014c94443b3184546ed2e1c0fd15c68ea5464a4167301635992
SHA512056f6e9c47b93b3bfd7149ee0521cd3c58545df94c83cee8b9ee7c58957bea60b64f86a0d9808ba4d79a5daf739f17c8f5907045c278e9184a089f07f9c5c4a4
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
2KB
MD56650e6a5aebf5c9b5aff8dfb85298c7c
SHA16a667bc55957af06a9a45b571cf58328ffbef8dc
SHA2568d48a9578528d5469f42b5b35d6612e3ab82a23e220cc995b83b071613252d86
SHA512d73b7a2e5502cb174fce8974c39f0be26b53217a92e234b8944c391dfc3184d7069b9d437a874b372253c110484b5f973010a0e0a459eb6b1cd7198bbcf51fc8
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
4KB
MD50c411068c1134b0da377fb10a9cbfd78
SHA1ad0fb10d88b658f1987dde64dc2f34b7237c141f
SHA256b033af821bb387320ad6ee51e1a76e563f62530e79b94fb1d1ea0a247bde63a9
SHA5127954019dd26eec32a37ea8dab673fdc449a4c0f521e34c86c734803554730bb2a27d6a9784cf153648b1d900c597cc8b5458baa1e077de0033d40660d80a4190
-
Filesize
24KB
MD5130644a5f79b27202a13879460f2c31a
SHA129e213847a017531e849139c7449bce6b39cb2fa
SHA2561306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1
SHA512fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01
-
Filesize
24KB
MD569b72d0a4a2f9cbec95b3201ca02ae2f
SHA1fcc44ae63c9b0280a10408551a41843f8de72b21
SHA256996c85ab362c1d17a2a6992e03fdc8a0c0372f81f8fad93970823519973c7b9c
SHA51208d70d28f1e8d9e539a2c0fbac667a8447ea85ea7b08679139abbbbb1b6250d944468b128ed6b386782f41ca03020e3a82491acb1fe101b09635d606b1a298be
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
9KB
MD5e544b0132ba2cbad9e877df51d060376
SHA1a45b68bd8b1f2ad46ddb50d6c9e532d297b80870
SHA256afb649e94342af3a8fa715328cbf97b251dbb5faaca3c277597fe156ee35803e
SHA512a52f3b1cccfdb833854f045a48385c738a343ab95fe29d237b6d99c2fc84ff329512ff3032e10b94f3e3b9d9e47d717d546910cd4122fb07347460b796759ee0
-
Filesize
12KB
MD53ad4cc0a03e0a7aa8e2f427ca7e1eae5
SHA1564a7272f9b7f90cd4d078c0c5fb0cfaf9b84081
SHA25667df09531d874387281c1807c62ae6fb8edab22514e75b283d5ede5c21dd5b31
SHA512bfec2512ad73ac578e5a79c2c9764685170e118b754fcc35f321f49f49f1d9f16c733a0c6768204a881487053ddaadc42c1a64073936e09fc3e53b0f96170de4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD53976dfd54e2b80fa87687f5a6b5140d1
SHA1b6e1d9bc7166b04a8432cf9f3bc2f0a2e0d4259c
SHA256ad0487539ef5433b68180cca77e05f27f2e99a3e4e0ed0b158acf7df852f5305
SHA51231d0e9e18a9fcc599ca9f391f53fe47c8ed26706b2d28f7dcb64015333439a0fedd9adcc6b71e81dcd810509789c31db54bbb1fe8956b72ac9f43295de7262b3