hxxps://steam[.]poweredartcreator[.]com/sharedfiles/filedetails/blaze_demon

Resubmissions

17-10-2024 14:59

241017-sct2kssara 10

17-10-2024 14:18

241017-rmf22a1aqf 10

Analysis

max time kernel
108s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steam.poweredartcreator.com/sharedfiles/filedetails/blaze_demon

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

1120 msedge.exe
1120 msedge.exe
4976 msedge.exe
4976 msedge.exe
1776 identity_helper.exe
1776 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4976 msedge.exe
4976 msedge.exe
4976 msedge.exe
4976 msedge.exe
4976 msedge.exe
4976 msedge.exe

pid	process
1120	msedge.exe
1120	msedge.exe
4976	msedge.exe
4976	msedge.exe
1776	identity_helper.exe
1776	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4976 wrote to memory of 4964	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4964	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 2704	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1120	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1120	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1524	4976	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steam.poweredartcreator.com/sharedfiles/filedetails/blaze_demon
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe1b346f8,0x7fffe1b34708,0x7fffe1b34718
2⤵
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,11795246382981050646,15963644103494102073,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
2⤵
PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,11795246382981050646,15963644103494102073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,11795246382981050646,15963644103494102073,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:8
2⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11795246382981050646,15963644103494102073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11795246382981050646,15963644103494102073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11795246382981050646,15963644103494102073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
2⤵
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11795246382981050646,15963644103494102073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
2⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,11795246382981050646,15963644103494102073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
2⤵
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,11795246382981050646,15963644103494102073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11795246382981050646,15963644103494102073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
2⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11795246382981050646,15963644103494102073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
2⤵
PID:696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\672b7b47-0780-4bc0-92cf-5c1e0071c58a.tmp

Filesize
6KB

MD5
deb762e0b48f3be77d9a9d7c61470fd9

SHA1
fa43d32669e54045e5f60b010a415a517dde58f3

SHA256
dd4e64279949861d6da1bdd87c1a20364c844da2aa4cab58fc83c247421ab650

SHA512
857e9635f5f0d7fa12074af617331c5af422df007e527d86e029df6be4d630d0353dea15ae1e90085a5f949d36311a946f7e472b2248d0ea14ffa3d33ed114dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
c135c40a9778976f22ec29b145bab70d

SHA1
0650c803b1664c04f838dd062f5f63f116d215d5

SHA256
af898acbd7fb72b04754807fa71958704936e6d42509f48b3f4f1c7a070551e8

SHA512
686c164c185ebea517816c1fb4ecd49b7623be3e37dd31a6a2fd7ce747e5ba1580c89b8167320565a7ffce12d395ec8391740b015f537c8494776e193696de13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
629B

MD5
71c74dfcd783312126e6641026c568c0

SHA1
50acbe614236dc9a2372a32d43c84b00260b936c

SHA256
d386457db9b40e9d2559c28918a986b3e2697a28c13e30a190c31e5f54424175

SHA512
94472cc15114e22ee3dbb35e3b01cf0b62d7a98c815d5f719d7083b005a6ae3a9b3131fac15981dabdbbd567dcdb17ba0a706460f02f1ff7d285f907d45a430d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
876e76daa892ac90673b724109bfe1cf

SHA1
faaac982d2c2e3de42dd8c3b3c83ed807423384e

SHA256
cbcd70224b995029e33b6d5f8275dabab063c6ab9a25e61592c77a2796f151f3

SHA512
4b87a5d2b66dedfcacfd7ddc45e4c4d201533bb6e0b521869641ad72bcfba4976bbc4c4d029a0fe8ca546342adc7dc10e688b31bf314e6748f44c9b90bef04e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
708B

MD5
fd82cd4c4a18c4b7a3050a5ba5c58dea

SHA1
ddb5a7f5fe5077b8701db1c7b9fcc259d5208d8e

SHA256
a735ccfda2bf2cab487f2437b0dd0ef7d4090504dca1563604e010a259f86add

SHA512
e6c436892b8543c260337c70096fbdbd9ee49e0f12b6f58e80f1446b952a77b58913758c59577394ca56532acce018978d545bcb180b72dab3aeda39ab1f2498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
708B

MD5
69cc5b70213ea5c78971b5fc88dd5247

SHA1
cd21ff58c92e7b06c96b43cb469772c8ff2a72fc

SHA256
1a75c4d32e4ea1944bf7f8ec0eef6b76d07dcc2e147601c38a9d3364d4ccfb37

SHA512
0f94bc9d1804880bd051ec105ba44c3281fcee854ce7523dd818d8889116746d9d9484b930c58011546cf4f71e357439c5ef26edac848c9644ac7c5f25ebb74a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5815d5.TMP

Filesize
708B

MD5
70c8f4ac9434ae7a2e66b381db74225a

SHA1
4c8228b8ab6239777824437ea871debd4fcb771d

SHA256
332a97db8f68d7e393e8aadbe25def7c6c1024ae12195127e797cc576ea1dda2

SHA512
dce17aece91cac81ebead5258e766a3b3abe989a0a852226a2a32fad3e56467af36e586936a4419e09b7f5ef919f2d3b30bc5939ab6b2b5b672261338f7a2a8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b515c819-2ada-4a2f-bd30-9d0f3a65720f.tmp

Filesize
5KB

MD5
e1faf7d4680eb87367d1a9f13881a178

SHA1
fbc503d92f89d506bde0dbfa2b8bba614d50db18

SHA256
4126dd8b74bcf38eac07a621337478df7766f689f1734bbae3643e733a5818a5

SHA512
2ec42db89f20c3d7c4962f075690ce18d45e27e7427cfcbf7cfe3498c881bcd77cc67cf4e125cae394d8d6a90641548c33f40b89e16b6fc4d976beeea9a9067f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f097e827f1f300f0d0bb76fde814b76c

SHA1
177ccf9e5526fcc9a4339ad31fb4f809c10097d3

SHA256
6d9b0a2d4a7dff0084416380259da6a9ff9a98b5b1417f30bc8ed301d03e9101

SHA512
7c525658f874e3b9380e493b35fae16fd9a4d96a93949e951c54414b898b7bb7c598f3d5184d9dd34957db4c2a0ca6e69528853c48ef541e5befedfaf1ffda98

Download Submit
\??\pipe\LOCAL\crashpad_4976_IXQETPAEBDQISZTQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit