discordrat | hxxps://github[.]com/TheBloxflipPredictor/Synapse-X-Cracked/archive/refs/heads/main[.]zip

Analysis

max time kernel
63s
max time network
68s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04-09-2024 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/TheBloxflipPredictor/Synapse-X-Cracked/archive/refs/heads/main.zip

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTEyOTI2NjIyNzkxOTk5MDgyNA.GInBmi.k0vV9HhM26FUzP8r3lgj8t304PciR2dvNYNKDQ
server_id
1129494586109206538

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Synapse-X-Cracked-main.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
3872	msedge.exe
3872	msedge.exe
2896	identity_helper.exe
2896	identity_helper.exe
4984	msedge.exe
4984	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	SynapseXCRACKED.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 1020	3872	msedge.exe	79
PID 3872 wrote to memory of 1020	3872	msedge.exe	79
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 2044	3872	msedge.exe	81
PID 3872 wrote to memory of 536	3872	msedge.exe	82
PID 3872 wrote to memory of 536	3872	msedge.exe	82
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83
PID 3872 wrote to memory of 2012	3872	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/TheBloxflipPredictor/Synapse-X-Cracked/archive/refs/heads/main.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd86ea3cb8,0x7ffd86ea3cc8,0x7ffd86ea3cd8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,13063966604552975128,8585525018688991201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:720

C:\Users\Admin\Downloads\Synapse-X-Cracked-main\Synapse-X-Cracked-main\Synapse X CRACKED\Synapse X CRACKED\SynapseXCRACKED.exe
"C:\Users\Admin\Downloads\Synapse-X-Cracked-main\Synapse-X-Cracked-main\Synapse X CRACKED\Synapse X CRACKED\SynapseXCRACKED.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
98f06ed38b56ad34e87b669f4136b226

SHA1
13d12adbc25521cb059a37a46ee5755c48d108af

SHA256
1bf2175e8aec1bc27d6936b931de2601501ed6dd51377c2c79dc44992c223bc6

SHA512
c0fe15b8f43f3d053aec3078ada17d1a1a1952305a2032a19e919d28e7a3b26da9d8c9a63008eb3e1356bbe4848a5c21671231a33b0d6435f43da660faab3b6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bb6e61af6d573c79b953325c40325f56

SHA1
a178a59bc4af96d34b82b259e0bdc290745e4562

SHA256
f2eeaad00e3815abb0fefb6f1a8beb875e0ba9a44e936ff6b9f98a1fdd9e81e3

SHA512
39c739acdfdf775f15355ae104ea1bfc9f8ec05516af375a46df7d0bc8683b62df83b80a3d63bef814b06ff140fbc669ee49368c8a606a1ee9af412e9cdf0ba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
35bee17519a10f5b6cb5eaac9b37544d

SHA1
8a194bee1b6e713d3f4cb11c6f836c80536fe4f4

SHA256
62ad2dd48c305961e1ff23ba3585d06523b1da41481c8b441be1facf9820ee26

SHA512
d8e6e921291e4df5286d90c68a574d2ed6173132c10f4a54392214a87299fab82e5dba631581a84e5f181f5a364ac230751cca526f910a9c59e7c512bf6ab52f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e35f3748580671f333ee4efd59cdee0b

SHA1
0adef49f658277648a80fa9d56bb92c170a54de0

SHA256
fe8cfe78bec47d66926195bedd632769f30f759d6fabacc2d3ace03aa6a748ca

SHA512
62e8192b102d98661be8f7c8770afb42f0c11be9b59f32424be1dae53ebcdc2c13f172ec73540ea162e43ebdd2955ae2ceb0c0073b10c5fafb618baab24fc63b

Download Submit
C:\Users\Admin\Downloads\Synapse-X-Cracked-main.zip

Filesize
29KB

MD5
2adb248e7929c293a0b3af27dea0d512

SHA1
0bd64b466b8b1889cc07f64628b9f0fc43572409

SHA256
c4465a48e8662e9e1d4e26389fbfde2edb58cdad2dabe711b8e744732703ea6c

SHA512
ef66e4b08f8161bc0928e67df667f0e5e4e38ca1a69b222fcfab21d3dbd5611277518b0142f4d0715a29f9282b9e56c6de2f5c6cd8c8b3d54369999515391bb7

Download Submit
C:\Users\Admin\Downloads\Synapse-X-Cracked-main.zip:Zone.Identifier

Filesize
122B

MD5
71b0c8784fc7c1d3d948f45507c76451

SHA1
8745efbde41d564099d4083632922b5f6fe9d960

SHA256
c64896f1c7381f9469fb3a2be84a8f0cc94f00084dd622bf8daa313e424d51b5

SHA512
67f062f9b5d8bbc79e5973883d0346deca4cb06a1dd8b1485e6184b1613528276c45fc80ebf1b5b73400bc71be28115ec19db6065d832ec8c08a9eddd1119238

Download Submit
memory/3464-80-0x000002173C5C0000-0x000002173C5D8000-memory.dmp

Filesize
96KB

Download
memory/3464-81-0x0000021756D60000-0x0000021756F22000-memory.dmp

Filesize
1.8MB

Download
memory/3464-91-0x0000021757560000-0x0000021757A88000-memory.dmp

Filesize
5.2MB

Download