Analysis

  • max time kernel
    91s
  • max time network
    90s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-08-2024 13:51

General

  • Target

    https://toffeesha.re/c/AjvBHFJXSm

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

185.139.230.87:139

Mutex

1e6e447a-7291-4066-89ed-f787e6609b75

Attributes
  • encryption_key

    E2894C1E8F59B6804B7D339491B97FB42DDCEFF5

  • install_name

    minecraft.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    minecraft

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://toffeesha.re/c/AjvBHFJXSm
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80bb53cb8,0x7ff80bb53cc8,0x7ff80bb53cd8
      2⤵
        PID:4724
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
        2⤵
          PID:1784
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4704
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
          2⤵
            PID:4028
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
            2⤵
              PID:2644
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
              2⤵
                PID:5108
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3512
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
                2⤵
                  PID:3040
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
                  2⤵
                    PID:4788
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                    2⤵
                      PID:4244
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5364 /prefetch:8
                      2⤵
                        PID:3524
                      • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2448
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
                        2⤵
                        • Subvert Trust Controls: Mark-of-the-Web Bypass
                        • NTFS ADS
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5088
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
                        2⤵
                          PID:3416
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
                          2⤵
                            PID:4924
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
                            2⤵
                              PID:5052
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
                              2⤵
                                PID:4288
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3076
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4584
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:4540
                                  • C:\Users\Admin\Downloads\Client-built.exe
                                    "C:\Users\Admin\Downloads\Client-built.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:684
                                    • C:\Windows\SYSTEM32\schtasks.exe
                                      "schtasks" /create /tn "minecraft" /sc ONLOGON /tr "C:\Windows\system32\SubDir\minecraft.exe" /rl HIGHEST /f
                                      2⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2776
                                    • C:\Windows\system32\SubDir\minecraft.exe
                                      "C:\Windows\system32\SubDir\minecraft.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4492
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        "schtasks" /create /tn "minecraft" /sc ONLOGON /tr "C:\Windows\system32\SubDir\minecraft.exe" /rl HIGHEST /f
                                        3⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4852

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    9af507866fb23dace6259791c377531f

                                    SHA1

                                    5a5914fc48341ac112bfcd71b946fc0b2619f933

                                    SHA256

                                    5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

                                    SHA512

                                    c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    b0177afa818e013394b36a04cb111278

                                    SHA1

                                    dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

                                    SHA256

                                    ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

                                    SHA512

                                    d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    312B

                                    MD5

                                    e3bf04d9f28c3b10015fbeda197c5a5f

                                    SHA1

                                    4afbb858914bf630558ebbba4b6386bb60bedf0d

                                    SHA256

                                    4b80c1bd2f8fb328e85b6f3834263f59d1aff6495f5cf1355e93323a9fcdc2b6

                                    SHA512

                                    7f7ce1d39933fd6c2f1902ff23665ad9ab3cbf53ab1c4f8728f92c76748ab95795e10e50b1a6ccb4870d95cf94608986953bc8c4338c75c01cf2f09534f23117

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    907463c5264033f89add66a3491be90c

                                    SHA1

                                    300b67b22bd8255b7980cbf0b27fd4aac68d5721

                                    SHA256

                                    b066dd71ff53c77426824981057ded78a0d9de57cc3f0766a6e411a589513130

                                    SHA512

                                    9a6efea6fbaa279cbdc8def11339ab34ef9f95dc06d9862f55783183d20cd175c21f0640b1186c8d23014f64c5dfb1da4bad1e6df28c840b28fd905c5094d87f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    0a939822feef80b9ce55b5e70f7eb44e

                                    SHA1

                                    85441f074b4c49c35a2d4637b84b2fce141d0041

                                    SHA256

                                    7e490f77fd2fc41b9c385dcf4d540fd981ad924c5e08d96d1af87fe2d21be9f1

                                    SHA512

                                    674d94cb26be40f679ba3e9a645b77652346664498c16627d5281ff9da9f022ec05d89ab634f73118f6f39eeadf40332f2a1bb464da0e060409ab7fe0b3801f1

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    a7ae6e4ce825b1ef8c0d31fa732705e5

                                    SHA1

                                    0663b232904d4277dd33c2d532900ef9ba75e3a5

                                    SHA256

                                    0582ef3c7c92b428397ccd3ecd59164e12e677c2ea2fd7cac0d38391fa05c7a9

                                    SHA512

                                    09ef2686148639274d0f65cf3515c2fed52c929da6fd02bce513a61da32cc736e54658fb72feb47eceb680e450c67b319782e31077dd303cd3dd35bd0dfbb46a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                    Filesize

                                    72B

                                    MD5

                                    696ba2620f2cd32add255665fa89eb40

                                    SHA1

                                    6179db0fe9043b9ed155a011b9d2a701a9649bf0

                                    SHA256

                                    05ba4253e2c0c44cc075040b56f23a61c43688d9e537f15bfae0cbf5eef0e29b

                                    SHA512

                                    0b0325424a6e7952bbeb46bdb441f380b48005c8646ffdd0973e163231df80069c3a4fd6dcf0a6df18bb4de14812adec75cc24187228852157c72888f5dc0ade

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584ce3.TMP

                                    Filesize

                                    48B

                                    MD5

                                    bf47a56a171c6972ecdd20dabd5944bc

                                    SHA1

                                    bb384c7e6d7ffc055393f488bc623b18c2b3d6dd

                                    SHA256

                                    c0ae0c902edf5abecd223d2492d41c815d25260fa0cf2668c8aef2e74e7f7c58

                                    SHA512

                                    237778b92b28eba2e6a2b9d963bc5775a1ee7509d03907611fde266c2d46e70769c8a1ebe58d8faddec7de6fd81fa3c78d0893e35209a5aa7ee59ee2bf3a5fb8

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    46295cac801e5d4857d09837238a6394

                                    SHA1

                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                    SHA256

                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                    SHA512

                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    206702161f94c5cd39fadd03f4014d98

                                    SHA1

                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                    SHA256

                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                    SHA512

                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    d590e5dc138ea8eefa1797270c4191ae

                                    SHA1

                                    065e18b8d4add138998a916eab463f10ad7cb3da

                                    SHA256

                                    2d12fe3712995f8fab48a801bb5526f0e957d8790ce1762c8fe4013f78454498

                                    SHA512

                                    9b3b6dbfa0cae58a6853f918359cc89c96f728d310be89b3536e78fbf766043b03937fd22390e0ac16fc7f26dde163b2ec5432337d770e9d0de5eeab75769685

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    a7424bde66eafe6fd7264502e647246e

                                    SHA1

                                    545f7677242fa16a6ffed10faf1996d5ffd0042d

                                    SHA256

                                    57bb2781e8bcfbe88b052003933b84157054dfbcde7e606ac7fd011598136fa6

                                    SHA512

                                    d6073db5a580f5f3d260c8da96c9b39b770c046fbc327459dec68a07629b4e47b9c10d70dd5122c2319cf950bd906e93e3f949aa017d15629dead63729515d1e

                                  • C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier

                                    Filesize

                                    26B

                                    MD5

                                    fbccf14d504b7b2dbcb5a5bda75bd93b

                                    SHA1

                                    d59fc84cdd5217c6cf74785703655f78da6b582b

                                    SHA256

                                    eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                    SHA512

                                    aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                  • C:\Users\Admin\Downloads\Unconfirmed 535034.crdownload

                                    Filesize

                                    3.1MB

                                    MD5

                                    a8c1154a79ac3d501fd9a751a8031fae

                                    SHA1

                                    53499906987d0bb7c40a9cae4117138444682c6c

                                    SHA256

                                    6a0a4576bfd0e7d98fcdea1c6c0db4801e85737371bdd2bce7d11ef525cbcfe6

                                    SHA512

                                    dccb1237e85aadc590cdd0dfdbf93039f569853e397acd6b89360cbe37a05b450fb76c55c5a5b2812265ea52d0abe380414e12a11768f3177cd05922b36cf7be

                                  • \??\pipe\LOCAL\crashpad_3420_WGOOVJBYAWUAVYYR

                                    MD5

                                    d41d8cd98f00b204e9800998ecf8427e

                                    SHA1

                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                    SHA256

                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                    SHA512

                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                  • memory/684-125-0x0000000000550000-0x0000000000874000-memory.dmp

                                    Filesize

                                    3.1MB

                                  • memory/4492-133-0x000000001BF30000-0x000000001BF80000-memory.dmp

                                    Filesize

                                    320KB

                                  • memory/4492-134-0x000000001C040000-0x000000001C0F2000-memory.dmp

                                    Filesize

                                    712KB

                                  • memory/4492-138-0x000000001C880000-0x000000001CDA8000-memory.dmp

                                    Filesize

                                    5.2MB

                                  • memory/4492-174-0x000000001BF80000-0x000000001C028000-memory.dmp

                                    Filesize

                                    672KB