hxxps://bitly[.]cx/EVFV

Analysis

max time kernel
1169s
max time network
1171s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bitly.cx/EVFV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2940	msedge.exe
2940	msedge.exe
4764	msedge.exe
4764	msedge.exe
1380	identity_helper.exe
1380	identity_helper.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4764 msedge.exe
4764 msedge.exe
4764 msedge.exe
4764 msedge.exe
4764 msedge.exe
4764 msedge.exe
4764 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4764 wrote to memory of 3000	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 3000	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 4172	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2940	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2940	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe
PID 4764 wrote to memory of 2520	4764	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bitly.cx/EVFV
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffe24a846f8,0x7ffe24a84708,0x7ffe24a84718
2⤵
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
2⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
2⤵
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1
2⤵
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
2⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
2⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
2⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
2⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2248132257496796163,3135997452759321993,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4556 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
089ea2979a1a4c9b525f095669c493b5

SHA1
2cf3f03ab2a917801faa916cdd9af44246559ee4

SHA256
fdf0728618fdbcaa43f397ac17307a8c546c6e03493ae1d90356b5b001631722

SHA512
df3c0f6ccda01eaa85d4db76317975586e3c82ee8717cb7f2a489b119d749d45a6ed7e98941689462ccd26a5152d4b172e9d9bfe62f9d3141eb01f3faf71e67a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
b65f97eb581a413e494d83fbd6ef2f3e

SHA1
0f6107c8ced2f78ffc46d5b8b6b86d21295dd893

SHA256
fa6173159429dc9051e187bd29fe7f9d9bb68bda8d65d9cc041bf0830ad1e4a1

SHA512
d31563c703f0053699c7f1c8ca44dda4e2da4ea92e4af277c43f95ec18fe58be4c00761bb5ccb05858ab1c8c3c3344907974448ff23309482b12586afa3404dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
cd8a3326226c765ac4f347090f40c5b5

SHA1
72663abb9d2825c5d12918d2a9035d735d29fc79

SHA256
384674fb1585bc55e88a8f96fd7b3c76db61c08b4a0096f92240df195747d081

SHA512
1db4a6c3065d7145af8b47bb7c6981c74acb74a55cfc8eea3004d5b0aaa8703cb5888f58903e8359d3c09e7649ec76bd6d184ef9d25c2292a97fb31a41c94f6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
121e8a2089a27162efee3abcd6dbda97

SHA1
04fc9b1b9ffd9af1b2772b0ce01327060f5115a3

SHA256
acdab1fffeedf8e28a917c8fcb6d2e3e7db78411d902d6aea9e90aab6637745b

SHA512
074316e48e12b42c758b193600442f77565466b61b65eaf33b105f05d96a0eac0ffc41153e3a279e07bcaa7d0852011e26f05872cb9cabba270c0a7751a2a5f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5fcaed154d2831f7a847dc86787b40c0

SHA1
50b876991c1ccc67727a0ae32c9448b358b9f4aa

SHA256
a9e38272917e2d6228dd4fd702445637306476b10a3a87e6efad0fa9b8c291f2

SHA512
0680e4e009c2db85bf116c3bdf9b9c6514f944eb1122c50b104bd38b7746d456c806d2929e1525d13fee2d3cd50198fb91b4048b6a9415c6ae75b610b2e3f72a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
8cb9d178e235b464f5907295798f6f24

SHA1
e53e1e6fcd49db5bd4b97009c5db1ec1b6860922

SHA256
6888b3ef7f1b0e2205e1330fe683254d5f1e4e7e3558ca51386676e16f44da18

SHA512
3ee1536e5ba1efc1eaa44d2dd18d3efe64628c5ac7d5e37edff3d96b3f8554725823e1c1efc5ef476e67efa2a6239057ff20a68acdccf53e50716a985c7ab2a3

Download Submit
\??\pipe\LOCAL\crashpad_4764_LHNNHOHWACLWVYVY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit