Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 03:13
Static task
static1
Behavioral task
behavioral1
Sample
65d04edcfdc707a6be0e2d1883752d5c_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
65d04edcfdc707a6be0e2d1883752d5c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65d04edcfdc707a6be0e2d1883752d5c_JaffaCakes118.html
-
Size
54KB
-
MD5
65d04edcfdc707a6be0e2d1883752d5c
-
SHA1
1854c2d735cf5b2604f43ea625961c798fb33e58
-
SHA256
622f537633335e6d1a52a6dbbf58e916029208769c1da9895b7573dc0cb29c32
-
SHA512
8defda58cac16aa13e457294de20a173c19c948e86687c4cd60dffc2862c632aa94dbaa75a81cecbcd4cb7560e3a3c23c86b5425cd9502bc227e9035df915ff0
-
SSDEEP
768:PqGOT0EupBa082Be/KA7zFnuf2bdXPOUJHF6soe+D29LR:iGOTCpBa082Be/KAHMgRHF6soe+Q
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1212 msedge.exe 1212 msedge.exe 4088 msedge.exe 4088 msedge.exe 1616 identity_helper.exe 1616 identity_helper.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4088 wrote to memory of 3088 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 3088 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1000 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1212 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1212 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe PID 4088 wrote to memory of 1920 4088 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65d04edcfdc707a6be0e2d1883752d5c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e347182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,7888584393693789392,13232797411618763904,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
96B
MD54e14ebbe22e71fb43ec4b2088dc4327a
SHA1137c8b1caf21a5b3d82297bce56b60e77ea556f7
SHA256adb86be5089070762909749e3b3496925f30f849ae7a17e493df25f6433c4422
SHA51204446577322f69b9f0f379196c9f3d7a45a4e06d8a089179c16528165480d650f7f07f17aafbec93375cfc61d310db7a1bc2fe1adf8ab570c881013df059d152
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
983B
MD5998809e75bfc03206a79ac1ccc74b229
SHA16a3fac19246d8b536889ab7f7505bb8506fffdc9
SHA256eb906963045d2d0acf7030611871b56b0fdaebf86566988ce1ba26b5aef67777
SHA51229acd123ef39d12df674038c899fc1e6a87274d5c750a45e8c26b08fed3d7293777c303c48fa54ccb8397d60553af8fa9f3e27e78b3c321969fe02ebe5b53aee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5d707edf543c4d672573a3da02fabddc8
SHA1ec1443a902b2226b8a61725b5d34ecd1af82a497
SHA2569b0ffc84dac0d3d386a04cac2949ab1c17c546e2ef96ec30aa1d8fd0be557b41
SHA5122da1277b11522a38f4664ee9fd0dfc6abdf09be592f79073409d7c65c204a5f128c4e2396b8869550396963788d74822800da0caa42f33f6a9f58c4550e1762d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5601f9dacaa1d9dd61174fb14c2633696
SHA1216a53cc89f0c5b28092df11daf95ad55477a234
SHA2564e46c7bde780c2a41f2a25f3a96e6ffef537e803cddff41b8d1dc86532de6d02
SHA512047cec472de811e622259539ab807f3c0870855f2fd85af4473661da4f94b85f97777775a3f5217c98c4d7addbe947d81caab6eb9b2d1ad3e3bf47e0ca11d024
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD549b3af96af11c9085bf92a775ee89259
SHA1d034419f5e884160739be61cc04eac5f0f9ab6e2
SHA256a07ae5820ca91100be18c2efe749c4a31923d01e5caf924f9965a402bd601be2
SHA512a22b492db21d526bce69d622d945d5bbfdcd925b958e9d13412ef1126a983fbad09d10b4d9dc013b53979d80c834406965e03edfa426010f65a9d4cf84cf05bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5c28d15fb45deb2187b6e20eec9146cdb
SHA10aeb9b23a156555934d7365a2c0d9c3d9608af97
SHA25660abb9ef85c2f58ffed1194e64f8dfc5a872fdf7538991e99789b8337d936e7b
SHA51290d47ac51a557336a7805f58288762bdc8d59d69a6d405cb88b4c68085b546f7397539305b10622dd0b38ab449faab47f5cbf9ddada12c40ed2f7e1b5acbf89f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5c2342c132777a9ca608f5b72c07a5e02
SHA1502a9a3ab0d377fa3207d3be6a08f18a8556f2b7
SHA256193b5805e28bfef4bc1ade88df418f1ead80ac242be4c962236ced62cb47f09a
SHA512f0f4240ffacfe7612d8fbad64415d22ce6520e8879464110fe9ca052bce17cf68f4bffd398f5668422890f0d0f7c7e00b41c3feb006190b875305ef14f92548a
-
\??\pipe\LOCAL\crashpad_4088_YGNDSWXHCJJZNIJIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e