Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
30/06/2023, 14:51
230630-r8fy6aee6s 430/06/2023, 14:38
230630-rzs75ade32 430/06/2023, 14:32
230630-rwfsmadd99 5Analysis
-
max time kernel
208s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2023, 14:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://veiligheids-centrum.dynv6.net
Resource
win10v2004-20230621-en
General
-
Target
http://veiligheids-centrum.dynv6.net
Malware Config
Signatures
-
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6209A691-BD3D-4B8B-AD88-C619B70B5AD9}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{379C0C75-E6DB-4063-8AF2-7EB5593DA190}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6794BD54-5355-4958-BDAD-DFC71066789C}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{57772DA8-4E38-44B3-A584-BA6F20B74918}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E15ED836-E03B-4CCB-B186-25D94FF67E37}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{626D8868-6669-421F-A906-59BA20B21170}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0F087546-7032-4CB4-B88B-8C2B3260BF33}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9B57F5E1-0602-4988-A963-E67CB7DA355B}.catalogItem svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e657fb7a-16a9-4e80-a91b-f85bb587370a.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230630143248.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F0286263-1752-11EE-910D-5A9695CC9A3E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31042399" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3301971544" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042399" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f66cc75fabd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042399" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3301971544" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3313067965" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f06056c75fabd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000003baaf03b17dd442a33931e427c3604200000000020000000000106600000001000020000000bcda68dc45085778fdbc38812523bfa17831f73277a8e19cbe46a518a83e3407000000000e8000000002000020000000d4dd77041a646350492bc890d17090014e8eae7a56079a7263ed08f90b1d5e1820000000374f68943383d264213241a7276b4b5c0ed0c4667b9520eaa7c629b71859d89f4000000092ad562f47042697ff52869f225fd2e8f6636aadff98e79a96fc5691867fdb7361da0fef4f7f6edfcc32b86819c1e80d122ba5bf573350a77214d3d3797210d0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394900523" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000003baaf03b17dd442a33931e427c36042000000000200000000001066000000010000200000008ca13aeace7dc13e89e3159e93c02689cbd32c64832ccfb30d181e84da7828e5000000000e80000000020000200000007ab5970eb6e7b88529845c9b0836c30288b59ebe7d1fd288fd87b014c8aef47c200000002c6db078ea6425a8b55f258d6befb54952501ff90c3ed1edbf57b3bf53f2be2440000000eb2049cf7b739aab15b8844da1d9173a7be6f1ef242e9a076f97a35a5715d813e7cf084006bded3563107592bc83cc53b29cce8a046356973b2613a9212ff13b iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4548 msedge.exe 4548 msedge.exe 4272 msedge.exe 4272 msedge.exe 1540 identity_helper.exe 1540 identity_helper.exe 924 msedge.exe 924 msedge.exe 924 msedge.exe 924 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
pid Process 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 2456 iexplore.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2456 iexplore.exe 2456 iexplore.exe 4428 IEXPLORE.EXE 4428 IEXPLORE.EXE 4428 IEXPLORE.EXE 4428 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2456 wrote to memory of 4428 2456 iexplore.exe 84 PID 2456 wrote to memory of 4428 2456 iexplore.exe 84 PID 2456 wrote to memory of 4428 2456 iexplore.exe 84 PID 4272 wrote to memory of 3508 4272 msedge.exe 88 PID 4272 wrote to memory of 3508 4272 msedge.exe 88 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4300 4272 msedge.exe 90 PID 4272 wrote to memory of 4548 4272 msedge.exe 91 PID 4272 wrote to memory of 4548 4272 msedge.exe 91 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92 PID 4272 wrote to memory of 5004 4272 msedge.exe 92
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://veiligheids-centrum.dynv6.net1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffad32146f8,0x7ffad3214708,0x7ffad32147182⤵PID:3508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:12⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:12⤵PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:12⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:12⤵PID:2224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:12⤵PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:82⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:1940 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff713d65460,0x7ff713d65470,0x7ff713d654803⤵PID:680
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:12⤵PID:5212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:5220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:5400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:12⤵PID:5392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:5988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:12⤵PID:6116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:5304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:5408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:12⤵PID:5388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:12⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6978414693078341199,765594040514711556,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6148 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:924
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3004
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
PID:4608
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
717B
MD560fe01df86be2e5331b0cdbe86165686
SHA12a79f9713c3f192862ff80508062e64e8e0b29bd
SHA256c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
SHA512ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23
-
Filesize
503B
MD5f51cbbcfabf41c45d03fce98c51d9efa
SHA145a3f1dba7907f4104510e6e076a01580b06eb9c
SHA256f1a04d6bde992fd9b3441001feff609d1d862fef62e71765a475b3fb26844e54
SHA51201993c460ce291c0433c0556d9ef2a6e27e8349dd4fcdfff668f97f294148f127bf64c92c1ae8679fe32c1e3963c43565b90cf868d90f4620efebc843c3e9079
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD529d41d3099cada88d08ec367884a6749
SHA1ddaef8a537abc0da31d448cec7bf45a6e4a45f4c
SHA256c9d8291d65631e6d001c1b00a17edd13e0033c62ea8eb26c0dab61ffb2fa4b89
SHA51232faeb2c5cc7683ffd43f46b3deb2ffde5f291d3527f659f007a872ccba4d3363d03b1f3788da5438290c93ced0c425c5bbc0aff8bd393519d3a1bd6adbc7b34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6E3BE2E7273DD3339272753F02B8806D
Filesize552B
MD5c49c4b23cbdb8f09d9ceeabe3a34787d
SHA161c0c07576a98ece4b45faa9e140b6f2e98cfb87
SHA25680d94692e1a14cc4917c6201ebcc0dfcef37cf149c8060d75541aa45a59c4229
SHA512661051346d8efa3ef6dd58fd4fbfb2bfc6a32e9715c2bd9f7142b2f14809b8868ae0a3f1ca64ede873e67c93d39016b18e4e08ca2976cd618cf51a1be9bccaf5
-
Filesize
152B
MD55a9f76dde5876d055fc0a4a821de6d02
SHA13cb30f2ff875cff6a4e4be0c7506254e076ad4df
SHA256323204c96cf3ed35bb893c2f20a444cd0c7aa0b44749174b7b22ab351b2edf1a
SHA512b805309fbbc622f2e47c9d4397662713b37879d0ea0602675c0894e655b9dcd34d483a02c6bdb73b5c6ce084ca7523e038104bce428a5bc7be3569c0d18b9091
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD523c2f2842df48973eb2e2efaaefddf96
SHA11b5b1977798287dd951aa5ddc908ed834963688b
SHA256dc29c9d26ac9a37e8eb0a4ea4766fdf8b717e6ba62098280d8a56ed445559186
SHA51270f1bfe49cd69632e454fcbf59aaa701c06bfcdf9315d00d2444986d7c304d3eb5b7854e26b0399ef3342b28b5f4b7fb16d13d3486ea9f7188fe38c5630ba3f5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize600B
MD5f3dc615d6097e9b2e2446550f089a717
SHA149c22d62b1abd003f00cbebdb6449ef706247edd
SHA256ca0415b7adee3e529224c44dd06c358cb1c6393be705df3879bff250846c281b
SHA5128444e20b6908e1a2f309ba77b68e082eecc068cb72bfb8576f36e1938e2d3d225dc17c413518d7c8aee5f08596d5f984f2acfd18950be6108b1f563886d09d35
-
Filesize
2KB
MD587a8cace9bceeef3547a98992db83a9a
SHA194c692f4082635e9a6f4bd2ac3795279526ec232
SHA25602fbbaf8fb796b4af592523dcec1529e220f5802021794bbcd856b34a51be74d
SHA5127736380c557059b918ec29f07f141258ba3a7033a343273052fa6b2bee255047a72d6d010baaedd101809b31b3adbabb7ea4b0bbfbdd321f43e73cd408d45c18
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
972B
MD5f0d7e4de5db8c0d27ea7c1d6b50e76de
SHA19379290554d98298909a5b3c6a31f385d9e9c287
SHA256cf89181ad5bfe566ffe768e12c8efed8695113e8271dae464a2d94827fe8fb20
SHA512b3d0946394b5aa12138ab322dee3fa846312712a830209ec3c306fcc49a250a834572ca058d2e24a7a4e000336690470d3399a26c9cfd2424ae8f94bb85d64b4
-
Filesize
4KB
MD50c63c0cc58041980711d58121ed76a9f
SHA182a9100e4467fc71e1f1ee3f354fea50e63f3300
SHA25622592a506aa2d749d93818aacb25dc580144ac6fc888cf03eab62060c1a2038e
SHA512c71483d0d75ead5100f4cd9af64741e4cb8c75ee45931eaa916ef9f1799e2aed400320aeb76dedc85d468a2bdfbba0f556d8ce2741838c424f68361d43745e26
-
Filesize
5KB
MD56e8a050474c70ad380217920a150e568
SHA1dbd863562335132fcc75c295f3a90e4b0609e742
SHA256212f006091e55f87e6a83ce8cff4686e24aa7ab3f91bb9c0a6c2688439d0866c
SHA51243817981eb8fecc3249888e277a8f54e9ed638f5872eb1b9c8c8964e16ff12a5cb34dc4b61c292ad08ca56514cbee383fb82c6a79cf802c4e9109d2a9827a4b2
-
Filesize
6KB
MD574918d3c3727a3325ed8fe63ce236694
SHA1da8fdb7752721fb47768532ef052ba26decbe4e4
SHA256c33c30912c99224149212acbccab2bd0f189f365d516461861847cd5736233db
SHA512f0ebd0248982f3d17d6eda3d918887d1dfb5728e738b62afbf032f219f666385c85b7c6ca834c2e3ad71f4b2954943ea77b96fa7b250e65f12ffcd476eda9f3d
-
Filesize
5KB
MD509b3e2335981e822c6275b137abbdc7c
SHA136e9b92612be78793077c825aab5c08e66aeac3a
SHA2566a98071bcceda766eae9c98d591c42af7b9f8430668a6414a088cbec8afd0524
SHA5122f3f37f2d192f0ecd7643c8333efd1054fff1fda115ae2cce628436ff787c60192774c06dcf1c0a5652bfcf8c299f6013a25e30189ac8809d808da0a6d028cb8
-
Filesize
24KB
MD53922931a21a66290ecb769f2d79cc417
SHA1d72bc5af3b2da078125ce71512249f67765624c3
SHA2560eb33cdbc3b30f2dd68d3e4de912b61c6f29f3ddbf17b8e83948e9243763b8d4
SHA512e4b1c22b64afa2120c2ae1385374747b04ea4b509fef1a27384755d57cfd4a86008cbf9af7095a1955c9934148b38cf7aa32b036d08702cbaa0ec9f5f59c3987
-
Filesize
24KB
MD5b359167b3568d1b4953adefdef0deb24
SHA198405d3ec52edeed62f8a42bfe766ecf395a95b6
SHA256177289a899357233597b059fde47b7e54aba35ca95e2a2201fd8d3ca68273578
SHA51228efc3e9bb0350c2229ffdfc0578c0ebc8276405849480c1762c75d616998f6ff654f7ffde3cf0676b62b583b5ec207e514040de1a809b465bb9e734e29c96b9
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f56ab7f1-3109-4cce-836e-b62fed94a38d.tmp
Filesize70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
13KB
MD560faa9876ed4397a4ccc605d5848d49a
SHA1eebbec199642b61a674986aec35bba9127b5a658
SHA256a0c05f840e2cbba976104912e7cbccd1354e0218965dc54f656cab49d3d4b99f
SHA512c3edbeba0c9f6dc66b7304cb5d39e311db53aee952bbf79832cbd62e8b62463db970479cf3eef2d297c8287b4e0714cd57d627f8250617f0ee6ac06e509379d8
-
Filesize
13KB
MD5bca7e630e797c80e5c9bafd150a09272
SHA1624de44cd44873ab85aa955f241b55e16ad7c846
SHA256a19a491c29ee755c7b30b1f97438a7f042bc94c088cb529e67bbea32467c7393
SHA51236c74c7e80b84a5d4003f2ece94609b387ad2f20cabb63ee2ef716e0df52976c10dc534421f6eac59ed2c1ad43f339a02ce01c28b7decc020e8413bc2da4abf4
-
Filesize
9KB
MD59c2723af1558d6da5809430dbc45b88e
SHA13492a204c46d49ee0b8fdc96535ece34c58ac4e0
SHA2562c2c11c9b8ccf9db44075a06ad57755293802f1fa05316cb2f7dc2243d1de32b
SHA512800f48183eb98f3811a799eb4b246d1ce0cb1149b66c89643119147fd0980e7077779ecbec18d774f62242bb31cf66b6d5e7340388c9f6ac4ee8e3c333af7c17
-
Filesize
13KB
MD517b7ea14ef43b39bf08438efeaddde3d
SHA12ef6135cf6ff9333bd19a6bf7133a1ef84975b31
SHA256d4d4fa259ef36447037c3fd7c37c6a5cef4071bac00ee5aa863f9df323da28b1
SHA512f1b33522b69f25da5a01f0fee8b966a9e820d61afe60af579fc7418332a83e9c022bf333021e3965e8cfad045573c70ce83f949731b88c0d7b96a2c77442cce1
-
Filesize
13KB
MD52d5d248ae410eba493641c9d43d061c9
SHA13a25168368d1742c638e2b162e64ea40d20998c8
SHA2562634a87790804b57c7638a0ddb1e6d9f6ec8a3c574525dc51176d59b40ce5c5a
SHA5121210a150514874c1700e902d9f3611b8e672141c35a7d3ef5b1a61a9b9b0977aa38771d6436e188cdd918454ffd5b0ef2f332c2e48a4df996e66feaf8c88af4e
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD535bec79f0672de1c81cddd9f0eebff4b
SHA13f8ab8b4d0d5204cd254cd347f9b453a12d414f7
SHA2563958cbc04a644bfd3fd553a141f0f807453906c81c058e6f7f38b0d7d486855e
SHA5120012e51ad202d871dede0abc8190871838de65730b5c4bfa8ac67cfeec64097c0c429a6af11f21b6eb19a82fbd56373294aebc6c37d4d251f7f5d59d2bc99e5a