hxxps://www[.]luckypatchers[.]com/download/

Resubmissions

12/05/2024, 22:37

240512-2jyg1sbe36 6

12/05/2024, 22:36

12/05/2024, 22:34

12/05/2024, 22:32

12/05/2024, 22:27

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.luckypatchers.com/download/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1162180587-977231257-2194346871-1000\{56FA631D-D54E-42AD-BCBE-109547707F09}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
2616	msedge.exe
2616	msedge.exe
4744	identity_helper.exe
4744	identity_helper.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2624	2616	msedge.exe	84
PID 2616 wrote to memory of 2624	2616	msedge.exe	84
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 3924	2616	msedge.exe	86
PID 2616 wrote to memory of 5032	2616	msedge.exe	87
PID 2616 wrote to memory of 5032	2616	msedge.exe	87
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88
PID 2616 wrote to memory of 564	2616	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.luckypatchers.com/download/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9103946f8,0x7ff910394708,0x7ff910394718
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1588 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1464 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6560 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1328 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,11536562069907509044,16703875464761265271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x4dc
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
83KB

MD5
6b27d92d6c8aad94222e6b1bc8c9d1df

SHA1
8b6bb552d72cba2862fd5e9841fafdcf9c813f17

SHA256
dbd4fe958243d4f91758898820c58ec1b99df8579b0bac9958b767adc179a557

SHA512
4bb72540db5ba1c4c68f710cf6c991d32e2769af7edf50d3d6d0deec52c6c9d7466e6c50ce839e3074ddd4370fe7267eaed4136ac1ed5c9765a96c462213a760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
73KB

MD5
3daae733be26d54d151d49493c2c5d04

SHA1
cda3ddf9dc1c068cfb0f73f85a303bf852d4ea72

SHA256
9522bf2ebfa09501f2efa05813c2f81e52ff280203ad2ca38aaa872255865222

SHA512
038bb7d36d15ec05fd09053c6d24b11d73f4779762b541f8d128f8c4972adf88b603350e42a7c8afeba24bd08bf95dbdcce977371cea5f16526436e4237a7e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
88KB

MD5
9e0da4767efe848fd96bd60ff1a13abe

SHA1
2e939e420b4dc247dfc126a846ea5c35e9a82154

SHA256
31474011ed9131408b0d7506518a95918c8ab02a692a7bca24a7735cfbb217ff

SHA512
96f95a8df8f6af34d6ad893cd72c3a3fff1f599eafad13ecb2abdebd03f965e7c227bd6c3a751a21dbcf6d6dc14f1cbd1b5cda053033e3402ea745e418d15b9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
eff544844d7ef8c1c079f8e48a10c632

SHA1
dfd673470ecbfb650f08f046d96f5560c5b6c9d7

SHA256
74abb74bb502cf412a1e107615a7a872a3744b0b50e9a1288ae8aa8cdd9c1c17

SHA512
8fe6275db6ce821823bb0112d6e8b567ca1e163108647b2360561027347c308487cbbe24c4725255b0f33ba1e5bfa3a93214a3f6c517c37fc3404a051b256564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
ba82c12e54045e5803a40f8e636f2b8f

SHA1
a83487c38cb59ade340825634d7f2b1d8c6cd88d

SHA256
3068554e2530a564b2714d350300b1b9b90fc4d432a05db33e13596b8f7d5bae

SHA512
5b3ee011dfb7876926f9139e1efeef993affeef19d9bc32c1f9ed142216c6a0ab0794952b2398729ca3118d4f2c3e7693845804c80e78b430636ebc127041afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
b5046ca9bfba81f71cd1f9825dc9cf49

SHA1
b658cd5bbdace28c7042a62b48d4eaf7c5257589

SHA256
258ca3a5da5f98a59f7aad6bd3d568fde757a7fd777d1d8ad242f982bce570c0

SHA512
2df572846373003251d380c1a81919186de52281a725af812df0b4e3ea2664e3ddcadbdbb5ab3b0d8d6ea19a3b7d88ee5f16721de92322013f45933ce9c6b29f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7ac7ce81d32f177f651d2524fe9351a3

SHA1
0a625356ee0f5b5ede6b8537141a6858779d07b8

SHA256
cd159e62677757186c80fa346c68457f67ff49685d924fd5a22575ac3ff08c69

SHA512
d594367d385b12b43dac56bbc0a35cbc1e382b957a7477a574587c7b46c8efcc7940402f4a41d550f8eb8ee7d5d7e58e3e207434aa5862607175c0f068a850fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1c42830229c910c2e333ca92b44d930b

SHA1
e857050d0a644a172991b54d7e4c5d05ba3f3711

SHA256
35df5e4decd64299d44b6ba570d5aacdcb849468fcfd29ffe13f5adef8fd76b7

SHA512
24cf87c12f12711b8ceeacbe851880e3b9f581afbdb2477db7a2334d2c90d324e39219acad9dffe08a9e52097ed488d7ef189c07430c6bf8c974d12a924691ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0491039caf415a33c17372323e9bb47

SHA1
0596a2a8c0d6f111d350a92b25b6e092836abd2c

SHA256
3ec3617a4d113a5fa1cbbb4f21b8979ef65eabff9c28eb06ecedaba1d115852b

SHA512
d6b93cb0ca5341907ede42196cf6172fd874f62c05c6419bb05984775c368655fb74bff1ac2acb33f5bfb02337a47bafecb436d6312a699795829fad08a7fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4b5e8ba73507cdeecb344cdf1dff511f

SHA1
6e27cb7cf7c5bdaf7564aab06d75de9d3e192435

SHA256
2cf5628616e683a307c5360a3879c3edc14d98500761faec03a49b0605b94be0

SHA512
18f6939c0525393dc65afaa73b632579b579f2e557f50742aac0b4c6dc9e4a2e2e73d0cffe42b0d81fb851bb30c8fd2c001d618eda58dc5499f8fdc09c3a80c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
649d7507c9937e481eda174bac32469f

SHA1
259b37fa950d8487cebb1d09a6ca85da6a1a768b

SHA256
6c63066d4d2762c2bbee125aa080608ff6370712c5124e08544d7ed826eaedb8

SHA512
37480fddd718e0658acdc9f4272fe1bd4923b4a50c341225e810e54974409159ea7fc29a618bcde6f36e845ec8176cfab31767d82cb962c31e7a0c14d530879e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d27e7e35550ca32fb54391a09079f7ac

SHA1
3eb97e35be6a8e18777fcd478aeb4d5fff798710

SHA256
b219ecf075e8f35a2b40d4da395815d7dc73692e5155ddc3d0e91d58932d23ee

SHA512
b50187116c1fff1095242dd8b632ebbed04fbef4c51549dda501fd78b9570ada9f9337e2bdde5b4b3c17da2c206cd43304634cba04b5e017e533818e5e2405a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
73ea5bc59b341ae89134b84b2ef131c5

SHA1
dff22d8097bbdeaf3667eea6562b5a0e295283aa

SHA256
50e988e0dc5d6032d9807174de540eb9baf3769dbe77073a5f1829867cc68462

SHA512
f9eed9d2ac8fc623d688dae1629846756c167bb64c281f0dc7c27542ef5907023a5ef3ca91092350752127e88a084631b57fed2833aa92a96d2aa5a03b072a27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
275458ea27613412d6e88233d937a538

SHA1
9794bd026318c2773421607b355580c5f0d57235

SHA256
b12d2e7ff9c6ad52edb083591f05be829815ea88033a148112702b2accfc66dd

SHA512
0411d198e98423d08e3ecfbab54f5d77bfd060d26fa085527ce493c742dc6c4ba6ae874abaf338cb7ade823b02774bcf6116189161cc81560401b781293a809a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eef1cae069cc23228d23ab7e74856653

SHA1
55e6118bf641d2dfe976a4146bd2afe77d1abdb4

SHA256
228a398bc2f52a7f65abf20888c1655690346468cc35685c527dbc59f5a74988

SHA512
4274ac17d519fabbdf9a2b0646dd2ebe72bd24507b150d31904723ee2ec25346342b48e7e479f98036081d2ce40ac1702aaa89ff50d00606488a4b6d389916bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c104e78a9c5ad9591e9ea39cba6929ca

SHA1
9d79b188e4756ac814daf8be0a13d2aaff35bd9d

SHA256
664578e47e42369bf5eec341f30bbc984ef140792be637dd4420d109a41375e5

SHA512
05a356794c7f7dfbbdb732b3ea5490bef46d8aac00be183d62d8f76a2cbd5d8f58333104d0aeada587e8ea06f7c0321d9d33cbd8430200aa0d56c83b39ecc8ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
7f22d57671f88965380dbf5adfb75246

SHA1
4f1c06b77d6e242e369ab28a60667d7213fc5d46

SHA256
20e4eff59eac3c4b42b2eca5ed23cb4ac802f26d44afe983ca53f0e884eb1d42

SHA512
3ec18a81a163467bfc7b0e9af1f509bbff340904662dc61a11d10924b164b20814c4840df9f272cbfb34417ee2c97fe4667334e2e00ab6485fa109e070fab3cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
88a46e7d51a261852c52f9c7c2cf571b

SHA1
ce4f096182a380d630f57d73217c74f7eae591d5

SHA256
2505c4866cf7faf9a67f118e6451c29de0a6125dda4bc6c2309b3f68fc19eff6

SHA512
976b970a62786eb9b8dd2ebf5d0a06217eead5afe1ef1f9d7432db4087c1a6d00b8b19dd12f7a32c106ba4305a145a88bd0ae354792f7966a4fd5cac00505cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cc3ee75a12af22cc389afc88e7460347

SHA1
1286f370086259f3c81a45efc55d2e29fb9c7fd6

SHA256
eac127d2e78971f569ada3b224d808f99efbda990fdc135838ba865e01533d3e

SHA512
a99f905950437c5185a051178e833a24cc38e926ddf69a3cb7d1696c1eab8bc83308d0bafeef4efd8ae67ce6c58b80f45e78f0a35c6a69bb2f6acf2facb0389e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
e191279886f56dbf36057258c6766251

SHA1
801256196281a171d1477d05f7794c61b79fb170

SHA256
61ec3515c2e2a4fb312e7f101db84244c1d35e4e67587398bf2b642dd3f612bf

SHA512
a53a6d93360edd753601da4e84502c7bb26c94c1f6a617a95756fc8ee0825d1691b721c0e1d6f61b2d3ca4623274b4f66fd55e4516230c09fb20b3eac48d1dec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
29194867b0d142fa518f215ae6436111

SHA1
a59f63d9abbdf44520ced08e6c697a81910d2749

SHA256
314750c72c50079bb3e9cca414bb1913f812fcb57d6da3f88a1b37c465e80cd3

SHA512
9141cb5963f7c93aa0e07adc7ef414e9863685e3e89e852b1d5d994c640536b18cb4bf4d8cf9c8f70fc3f2cd80d22dd0330d0977c95b470b3f83b6e50d39fe37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
80d0289d7c813d9d9d2e54b6ff6fc4b6

SHA1
56068bcac3f4e39c9f14bd407537880bb6b70e05

SHA256
0eb110a054d73614da24d96c1d0ae25a79bc62d1306a39a347989db6627b1945

SHA512
c2249abaaca23cb07bd383bfb29a1f4580d36fe48ee2f0ba77feca1f338ca2a1dd161ca66cc1264df3cc2a6959412b4ded4a6de7901f0b7f5d13a155290c5021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578aea.TMP

Filesize
538B

MD5
97019004f7e53bbafdadf4e48d92f470

SHA1
66a6b1c37f34c9d90d0bba49bc5cc2ad8ca9f9e9

SHA256
e3595d53fdb0cdab8d4c18423a04c217045236f75d5d5780fd9b3d41c0d55081

SHA512
96a5779b161657aac8f5bb6bcd033138464f25513b14f8bfef32a3860ac2b0bc38a4a40ce1caa1ce5a5bc8359c93510eaff421e39ad712b9ea8bf66477b9276f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6212fb8d53637b46b383068e12350795

SHA1
ccac0f82284afa4200eed98460c23e10aada897f

SHA256
766c34d5a7704e6c0f151359e2949d9e99e3ae45eaee2e2aec834ec20a26f8cf

SHA512
31cce48d31e7e41189f8664a0a0a8747fd9c872e9ce6650873c62691237f0af1e1f4f9a4b454bffebd2da9ba6bab5e69dffc397abcc21783c36eead14187fe2d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
6b8ecac2b5c0561a33aece36f1c47fdb

SHA1
0f7c6e5fe4f7b592cad461eeab88740c1047f0a3

SHA256
93dbc4b1e585cc3668e35d983b6d2462fe7327cad683316d214903d5fb9e74c3

SHA512
d3e7c39ea650e35847ca5a93e95b005e030f068f5f77c05a732463fa71bbbd1b2ea5ae42bbe27bfa3c013b9e8426835fee6f25f0f269ca797777222ac4c5c875

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ca058d0bd0ec2d58c0ef5fbc52769b73

SHA1
19a43bb19bae97ce567f09a164f1a53521771677

SHA256
ff20278dcc4d4e3b4af1f15a833bbb57eb929c3109e13fc3eee9440423a4269f

SHA512
6df44b025d1cb74e4861f209b81aa54ecf91baf22741a72c0adf9d4ab502a504fcda2eb013d8fe9c806a1e3b884739b4daa7d9a41800eb27c3bb6d4af76b2af9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
45aa6ec1eb96b8b6688aecb46cda9631

SHA1
eff109d6fb5ba72dab8489e4eb89be3a54872f68

SHA256
f57940873d2436cab6b35110c6dcdf7b0465cefa8f25078b7fdc8db8f3703594

SHA512
c82d203779138cb91c5a17f9bff202fe057789e5c3dbfd92eb909852c6f542703f5d80ea00e08bef844b18ad5d69f4a2387cac84fd31bb3a08360367306ba979

Download Submit