Resubmissions
30-06-2024 20:33
240630-zb2tcsxhrk 730-06-2024 20:26
240630-y78q4svarb 1030-06-2024 20:25
240630-y7p9rsxgjm 1Analysis
-
max time kernel
1680s -
max time network
1685s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-06-2024 20:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Excalisz/Shadow-Grabber-
Resource
win11-20240508-en
General
-
Target
https://github.com/Excalisz/Shadow-Grabber-
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid process 3208 msedge.exe 3208 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 896 identity_helper.exe 896 identity_helper.exe 1584 msedge.exe 1584 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
Processes:
msedge.exepid process 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4748 wrote to memory of 236 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 236 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 1512 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3208 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3208 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3076 4748 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Excalisz/Shadow-Grabber-1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb0aa13cb8,0x7ffb0aa13cc8,0x7ffb0aa13cd82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4408 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1628 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6024 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17807291764789655353,163690377964551298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50d84d1490aa9f725b68407eab8f0030e
SHA183964574467b7422e160af34ef024d1821d6d1c3
SHA25640c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e
SHA512f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50c705388d79c00418e5c1751159353e3
SHA1aaeafebce5483626ef82813d286511c1f353f861
SHA256697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d
SHA512c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD59be00561ffc21d412c33e2dba304fad3
SHA131b759af3a6f46a4a5665cc0bc2b564893f7b26e
SHA25646ec275d83a9fdf202f11152c59f0821e70cfeb873ecd57f83e9a097d7dadb77
SHA5127c94f3eb635e50f0f93f335fdaa386b965ce74355b2d14dd63cd565892a284f691a772d8b5274f78ad8bcef0b8f587b348a9017601857682d22c76d30c79f51f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD50a3e7bf08506393d03e787c41b1a7064
SHA1f79e7570b2c8987dd590e0605b26d2c6183623b0
SHA256283fa80703c8f2ff92b65fd62174395a9327cac222489f14b5cd12d868d31229
SHA512713c871363062f204f5e52536938bc1c8ba6babab89aaf373592340c6b9c19012f9115e42a50455e1633bbcd9fc54cee655738f42e100c103263ded83019c1c8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD51e02f03b4c5b05df8ef0103b954dd653
SHA1c608e4fe2ee0cda3e22095bc70a514f7c263382f
SHA256cdb0c58552e33b074b0e4c3d3215261700c1901566c96319ddde021e79cb31aa
SHA5128dbcb78c6c1d14ddbd3c444c13552df141900f05a63a971829467ef6b2ccae8bc051d7648345e51a193adbe88e97330c0f8356bbda263005b525e2f79f81b014
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD576a3d82b895416536a241ab90f7d7f07
SHA152fd81a27ca7be5c9692c22e9b7ac1becf841f1a
SHA256ef00c7788c1fed5d0e494175e72d25a3bb968128ac694bc2358f526d96a7dae5
SHA512d0b9625dba4ee8d1ebeedf41206bb83780be4cb87dfb23d74118af1ec8aea9bca94e8bcd1ecae9a8525c8ba9f36c0717875e87186177c9e55f04cb6ff9166dba
-
\??\pipe\LOCAL\crashpad_4748_EEYGLYVWEFYFJKQTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e