Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 13:54
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://api.sparknotifications.walmart.com/api/track?action=click&campaign=bsjy1uwl6v9y9x1&message_id=BQ6NGO3PoZ-1660831276514&trackingid=BvI-3ijv7u&redirect=http://wn7oigjn.duo0hvt.carolynsembroidery.com.///?YYY#[email protected]
Resource
win10v2004-20230220-en
General
-
Target
http://api.sparknotifications.walmart.com/api/track?action=click&campaign=bsjy1uwl6v9y9x1&message_id=BQ6NGO3PoZ-1660831276514&trackingid=BvI-3ijv7u&redirect=http://wn7oigjn.duo0hvt.carolynsembroidery.com.///?YYY#[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133242260857104181" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1912 chrome.exe 1912 chrome.exe 4792 chrome.exe 4792 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1912 wrote to memory of 3240 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3240 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 772 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 1312 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 1312 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe PID 1912 wrote to memory of 3576 1912 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://api.sparknotifications.walmart.com/api/track?action=click&campaign=bsjy1uwl6v9y9x1&message_id=BQ6NGO3PoZ-1660831276514&trackingid=BvI-3ijv7u&redirect=http://wn7oigjn.duo0hvt.carolynsembroidery.com.///?YYY#[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffec3ef9758,0x7ffec3ef9768,0x7ffec3ef97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1892,i,10230079264969002914,15934829442158359941,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1892,i,10230079264969002914,15934829442158359941,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1892,i,10230079264969002914,15934829442158359941,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1892,i,10230079264969002914,15934829442158359941,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3156 --field-trial-handle=1892,i,10230079264969002914,15934829442158359941,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4492 --field-trial-handle=1892,i,10230079264969002914,15934829442158359941,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1892,i,10230079264969002914,15934829442158359941,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1892,i,10230079264969002914,15934829442158359941,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4916 --field-trial-handle=1892,i,10230079264969002914,15934829442158359941,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4960 --field-trial-handle=1892,i,10230079264969002914,15934829442158359941,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4084 --field-trial-handle=1892,i,10230079264969002914,15934829442158359941,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
721B
MD5c5af93edbb9efdafc49766c6bfb780d4
SHA121d47ea82cc63e1815c37cd2e4e1e881c48fe521
SHA256f79df688a4f29c2e1890e9b4143aeed1eccbc523ff9a321b81f9e6abb08eb8e0
SHA512fa7f029b500640b9d1064ef36dfe5bbf2798215d3710a2aac0211a500085a445441e652a0e0a952eb129111fb10879592084514328f735057b374f4978f4eef5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5299e0d50fdeb434372cc11e102d81405
SHA1b238170272471e1a7f8fd2b02bf906561b8c2c76
SHA25644d710667b86ee88fc5e70362a561307f6cc43167ae405a8f64e50972b240404
SHA512ac330c2b15f737445f500d02563fd885633584d82d57a80074975092cd85e1447166db2b4e1aa0367bf58a120b78381a03be89a1031510d56ee4b2c58171882e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5c323c4c8273583045af03827a7a02fd2
SHA1011c742771ce521721875e48a16c54efedcb57d9
SHA25657a3619106aef071c21141842cf8aa132aa00acfb29ebd5204f5c4cc3a179c06
SHA51257cbb3c77ed7659a04555c977540fab52825225586a37c8e8d2836812251cd00d9ccda7643d72cc349080dbf26364f11e2f8fe8336dfc5294e958739354760fc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5c3a20aa3a9958b1eb6d520119d7d7019
SHA120b0096ce3302c318100944a6dd2e551ab87761d
SHA256a2cdf576fdd5db3f9337f7f93fb29f8a2d73c7b9e32d7f6b6676ae7fec6c9c65
SHA512e2e42d1b045ccbbce0577237a0df0998f28d15ab46596fa4385eddf72222ad58e1c33327ce14c5ebb3f55a0deec040d142066145822d7d4cb88f4532dd809221
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD58cabfa71189224e7ef8640edaf69a426
SHA1210adf016c2a47848913adcaeb18436226573284
SHA25619f2e4bc3a6a3391d0585101e14d5e4d80bf3323a39e8f6ca64bf0aade08bdee
SHA51265b23bdf8960f13a0d7481dd197c8b5d36af78f16ca1d46846ea230aa469bc1cf25e7b8e42429297d16bed259a66fbaa4a0366dca47e04ca177227957ebce572
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD54abe652a1a9fea4a256b907795050ad7
SHA190221dc79489320804f8f0d7c2a5ca2a33b1ce57
SHA256f9362160ba7fabd8a5c4d983502e3f0d402ffa480f93b08867a3ccf1c17cf918
SHA5122ab2cc734e7639f6804fd06328fba54e2f651f1ea81495ddba942f838b1128040841e87dbb64513f334395ab134e45aa33bf91d73a0a55d976b3a65367c050f4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_1912_YDPOFJHCUJROICYPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e