discordrat | hxxps://github[.]com/Yodusa/Discord-Account-Generator

Analysis

max time kernel
33s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Yodusa/Discord-Account-Generator

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2MDQwNzQ1MjQyODUzMzgzMQ.GYv6Cs.bHorOgR3dzpv33F18dZaRpWKB43NnKIjozVcS8
server_id
1260407315073597510

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
4236	msedge.exe
4236	msedge.exe
3816	identity_helper.exe
3816	identity_helper.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5852	main.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4180	4236	msedge.exe	85
PID 4236 wrote to memory of 4180	4236	msedge.exe	85
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1328	4236	msedge.exe	86
PID 4236 wrote to memory of 1624	4236	msedge.exe	87
PID 4236 wrote to memory of 1624	4236	msedge.exe	87
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88
PID 4236 wrote to memory of 4660	4236	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Yodusa/Discord-Account-Generator
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb35e46f8,0x7ffdb35e4708,0x7ffdb35e4718
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11322169621171905815,9370965452477764749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:5312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5688

C:\Users\Admin\Downloads\Discord-Account-Generator-main\Discord-Account-Generator-main\main.exe
"C:\Users\Admin\Downloads\Discord-Account-Generator-main\Discord-Account-Generator-main\main.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9b5c1578572ca5b5881894c5b26d8705

SHA1
87f7573a97760ee47044b016a44801f62d9b2134

SHA256
ef7b4c4b2d12df41a41d79e121ab68ac1079738c3692536a91b91572d8f44e18

SHA512
43176b76b57f2ae306d6207c7564823ed9d895410af3a4566dbd94a216ea715726a9dad9242e0f9d6855f91f0fdce3a6a8bd16fbe2d1718bf1495e2af8ac4a10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77ac95e27371755d8510f0871697ccab

SHA1
4a1399eaf71c42ff43c91d9c12a3580d5900e301

SHA256
402b6f303abf73dc2f20892c40da73e3c20ffbf599c9bb11d1e1682bcb454963

SHA512
9c5210da9f965f5764c0f0316d03b8fdd234c41e8d8dee8c53b2588be1121a5a7fb297f0deb30949ee7323c93aafb498828f38c9973ace207a5636b51395e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42b1e434e6bf84d3c700dc7eea67b61e

SHA1
e622b264015c12daf15c026b9caf8615b821a85a

SHA256
5722ff03df0ff4a6eedf8ac90a8603b4b576a355f8dbde842cc28f73f5550f2d

SHA512
ddc2b5c3593486e33afc4c6f428d1b3cf9fcd388a9fc09522d9b0e22f6fa89dda29d482aad46e8c1336f5c61200c80d7172f3432b03000c2bfbff535fac0c45e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0afbd99539221d939d3e214f69466dab

SHA1
266bfab6860beacb6a369cc032a302fe52865929

SHA256
61f99a7369512bd06845feaa6f0ea5b5073119e4889e0d1b96f7d0902770f046

SHA512
537a1a8139d8d343835f08bc77e9355d3b5b04ff76f47326f82b70ff2a4ffdf046d50df139c60cb04ad13946982c7ddb8f8e7df2330276698870687f90aa6e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7c632cd3d9d08c9c00946f4cdb623b7f

SHA1
39fc022a882c4ccd9be6d6e1e657e5520a04eafd

SHA256
e5c107dd770bc6c50802967df7ae627a5ca7d629469ef296e7a3a6ab7358ffde

SHA512
4c51859b9dee0efca648b3440eac95ef8c582bf74a5b2107e67642357742425e222ff54cda77962aa667f7d8c2e51f688421355e3784bc8c6fc6abea1b81b463

Download Submit
C:\Users\Admin\Downloads\Discord-Account-Generator-main.zip

Filesize
30KB

MD5
511362586d9aba19d383f896dde752df

SHA1
1a34f7708f083dea2c36e7ce46d0d7297f8c9d86

SHA256
073a3a554da262e3ffaced7bc3940c5ae2024cb0f457fe539df980326ac6acc2

SHA512
27147c22afba73a9027c52a840e5861452f11b65362a0fbe0f58df10f80c16d6d691f847a54c61384dc0c0371ef9b8988521271ea97e72e1c841041ec6d78a2e

Download Submit
memory/5852-218-0x0000023746D40000-0x0000023746D58000-memory.dmp

Filesize
96KB

Download
memory/5852-219-0x00000237612E0000-0x00000237614A2000-memory.dmp

Filesize
1.8MB

Download
memory/5852-220-0x0000023761AE0000-0x0000023762008000-memory.dmp

Filesize
5.2MB

Download