hxxps://cdn[.]discordapp[.]com/attachments/1206344501166342215/1232738694130171914/NitroGiftcodeGenerator[.]exe?ex=664e255f&is=664cd3df&hm=5bf0dfbabf791e05d6ac0d9120e9aeb419a1a21725b0b4692ecd5634626b05c0&

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1206344501166342215/1232738694130171914/NitroGiftcodeGenerator.exe?ex=664e255f&is=664cd3df&hm=5bf0dfbabf791e05d6ac0d9120e9aeb419a1a21725b0b4692ecd5634626b05c0&

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 570236.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 570236.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3248	msedge.exe
3248	msedge.exe
464	msedge.exe
464	msedge.exe
1320	identity_helper.exe
1320	identity_helper.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

464 msedge.exe
464 msedge.exe
464 msedge.exe
464 msedge.exe
464 msedge.exe
464 msedge.exe
464 msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

msedge.exe

pid	process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 464 wrote to memory of 3400	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 3400	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 2580	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 3248	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 3248	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe
PID 464 wrote to memory of 1204	464	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1206344501166342215/1232738694130171914/NitroGiftcodeGenerator.exe?ex=664e255f&is=664cd3df&hm=5bf0dfbabf791e05d6ac0d9120e9aeb419a1a21725b0b4692ecd5634626b05c0&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc66746f8,0x7fffc6674708,0x7fffc6674718
2⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
2⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
2⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
2⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
2⤵
PID:804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
2⤵
PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
2⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5692 /prefetch:8
2⤵
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 /prefetch:8
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
2⤵
PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
2⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14332675792302635849,11317495513649043777,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd875039195daef61885e3af6ff0c4a0

SHA1
e076efaabac47c17b6687d2cfb7b85ad9d284766

SHA256
02f6d02b5553ade1f8904aeda25a54b21e05cb5216e56740d858944c8b49d6f0

SHA512
331284da60944a204480b31360dc462c184187ff369b2af25a8d5cd50aad281a5c83eb2f89a9b601566268f19a41434dc9446290c5c3270a28f97805161e8c4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45cbba3c5e1f7a79cd4d6075ccb48dc1

SHA1
9c555d99c125d1d8d72b4d29e7744bdb6e6b2b63

SHA256
988d24995abb5a4f445813e672955c24b432eb648385aa36311e2c3e03061d62

SHA512
0b8e879446279b9491da260983eba3d444ee5e21015c41c5be6b16046c9d002ea83e3d0182b16bac2730a4a3898a6e876d58702b092be195cf69fe8e2d998a35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
54c2d42e36c8b6f765a4c36f4898fdce

SHA1
3f4b539008c7e5dd1489ab5d0cea4a5cc4b74bb8

SHA256
e516ebbbff1dfe9cb7a629741b5863f2808be17f10c20d68e42b07cc5377672c

SHA512
cb1a96289877fd1d98b8a2a722c6af5865db8650169443eaa9c9b3d61af794e5e31066afcdb917de55b9757ecc24468a38e8ed96e22fe36d259b4218b9d43803

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 570236.crdownload

Filesize
8.2MB

MD5
6a399715839b831bbd87cb241d265362

SHA1
ac4e4bae4b93345c7b949f141309e12462153c41

SHA256
0bfc560359c932416b42305b5eba6ed37e3262913c0c5b358ad6e6fc180888bb

SHA512
d8933ee453ea821f1f90b71dba1f6f3ae304c22c00b94e77270ad4780cc9a42b3be47e5e683df9fa15c6ff9f4ee2e192763d57ef8322ab4679fc712e53068001

Download Submit
\??\pipe\LOCAL\crashpad_464_BZJGVZDZICLUBHXM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit