Analysis

  • max time kernel
    217s
  • max time network
    231s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-05-2024 20:42

Errors

Reason
Machine shutdown

General

  • Target

    https://gofile.io/d/3Yh64o

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIyNjY3Nzc0NjA4MDQxOTg0MA.G6zBpk.HpyiaY9OWvTrH3fLucRzm01u-dTIb22wF8DgPI

  • server_id

    1229484529299882067

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Downloads MZ/PE file
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 54 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/3Yh64o
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc114846f8,0x7ffc11484708,0x7ffc11484718
      2⤵
        PID:5084
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        2⤵
          PID:872
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4896
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
          2⤵
            PID:3724
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
            2⤵
              PID:880
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
              2⤵
                PID:4148
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
                2⤵
                  PID:4508
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
                  2⤵
                    PID:4000
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1272
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
                    2⤵
                      PID:4548
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
                      2⤵
                        PID:3536
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
                        2⤵
                          PID:3640
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
                          2⤵
                            PID:404
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
                            2⤵
                              PID:516
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5340 /prefetch:8
                              2⤵
                                PID:5076
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                                2⤵
                                  PID:2376
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4632
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11867437286237840274,12013195589380928339,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5544 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3608
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3616
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4928
                                  • C:\Windows\System32\rundll32.exe
                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                    1⤵
                                      PID:1744
                                    • C:\Users\Admin\Downloads\Tool\loader.exe
                                      "C:\Users\Admin\Downloads\Tool\loader.exe"
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4264
                                    • C:\Users\Admin\Downloads\Tool\loader.exe
                                      "C:\Users\Admin\Downloads\Tool\loader.exe"
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4152
                                    • C:\Users\Admin\Downloads\Tool\loader.exe
                                      "C:\Users\Admin\Downloads\Tool\loader.exe"
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4268
                                    • C:\Users\Admin\Downloads\Tool\loader.exe
                                      "C:\Users\Admin\Downloads\Tool\loader.exe"
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4836

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\loader.exe.log

                                      Filesize

                                      2KB

                                      MD5

                                      40410643c03eed20267186d4a8f81d38

                                      SHA1

                                      72f574fdade53f6e7d1157f8f76134bf673f2e13

                                      SHA256

                                      c7900de75fe3d442ae4667f3bd5904a2fbad62a65fc362bd87244b9488ab0f5f

                                      SHA512

                                      e90155a8317f711d07158e84d9097897cd85d9b6f97989ced51b0876bb28d0e9361324da33c88bbfeb89b06a02deb12e4a0f3b2fad63d9904bd139b2abbca527

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      1ac52e2503cc26baee4322f02f5b8d9c

                                      SHA1

                                      38e0cee911f5f2a24888a64780ffdf6fa72207c8

                                      SHA256

                                      f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

                                      SHA512

                                      7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      b2a1398f937474c51a48b347387ee36a

                                      SHA1

                                      922a8567f09e68a04233e84e5919043034635949

                                      SHA256

                                      2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

                                      SHA512

                                      4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      288B

                                      MD5

                                      3f1e54a1260e6554b69778b755a2be3b

                                      SHA1

                                      a51ffccfc8a678bdde3dc5751141f1c77da27237

                                      SHA256

                                      90df3a1aefaeeca9b0ced545a8024412fbbe90084748d59e911638b63dadce5d

                                      SHA512

                                      ca1b6f537c3f04dd0af887ac55340fe14c6f6c48e3212967f27833b26999fe46c38288e225a771812f4769a16a5ac45681c7d7a0e9b505d71d16bec27a16893f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      317B

                                      MD5

                                      afc6cddd7e64d81e52b729d09f227107

                                      SHA1

                                      ad0d3740f4b66de83db8862911c07dc91928d2f6

                                      SHA256

                                      b5e81a7c7d80feaaa10ee7bc8aaef9f21a5c1e4b03b3823ed115022311d674a0

                                      SHA512

                                      844edb69585153c378a7c97709983776fc9303a32fb5ef8122ecca32adfc0b265f5ef7118ee07814da5c020ac7ba1bf2a2f66d46312e4d8e6df99aab2e5f9b2a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      b7ba8969c7fabd58e2e00a5a9e653134

                                      SHA1

                                      57f14ab7874541f46d30e5e48f2ee8600f48dd5a

                                      SHA256

                                      3bfbc999932ef9523c033eaafdf39994316fda6a2778cb71d7c681654847d682

                                      SHA512

                                      0a55ad500efb1f3c1179ec3cb14b158296c035b48cf52683801a0272bf888c4acf5ccfa9e037a8c9a2e37004db87bce33028c5759ce9543c513ca3c9d82b9125

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      5221a21c18d5a34b6c4cc5221841b7d8

                                      SHA1

                                      46d58f2b6dd29da1feb0e05952300be2268112b3

                                      SHA256

                                      e275e64f5c1b86440ad26b9ecc134feb1d266d72650f528d4a57ceab4715cc31

                                      SHA512

                                      44e4c9a94e1b8886e4c8ba299e1b9f30745d33b5445da7713e53e1e9266fa25e8fc629469029e225221b869485e66af442ce8366fa53602d579fb7b798b8c2d9

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      420fb01af1a9df954455860fd9a17641

                                      SHA1

                                      bc6efbfd24ee8d8821750099185e8df150ba2c37

                                      SHA256

                                      77ee5421ab777bbfb984c06a36f68497ea3a28c6b0d475860c53f6e69a5bb8f7

                                      SHA512

                                      45ee15a2e9369ee2214ac55167a6d19b0c7f9272acfd7f61cc77cf0431536214e1c9fc837dd09b2d49db96189fe47ab61ffacde5c96874f2fa613c3e04d38e8c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      12KB

                                      MD5

                                      93f94bec951bc2ffa5c19f99d5da2194

                                      SHA1

                                      d598354a84238edf48b363db3c2138fd31f16b96

                                      SHA256

                                      6ec03f98b9eaf3c60b0b9d76b1e59156a0f7abaa792aa2fd4e0ef756bc5bbfbb

                                      SHA512

                                      ff2a4067a60cc2fe739ada1c996f6e922f336912f14f79fdb1cdd2c6b632dc467618996eb77f3ff2b7bce459c4e0839468e68885d3a37ddfc5bb3fdfcd59a360

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      e13e6840db4c7017c4ff895deba4ff5e

                                      SHA1

                                      406784bdba018270e15ae996616a6b56f1c5f3fe

                                      SHA256

                                      3807e6b6cd185bfa41e949acd9831519503a26f2181ca3577f614176e5cf3dc5

                                      SHA512

                                      63aeaaae2737ef5b34ca9c78022e05e79c24f9e6034dd8449e5806355e435d6c16e7ab7241d9f937bd02645615e7b7e2ff16adc8d3b553730b6ce4cc702577ee

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      eb6f0926ae6a0bc89e7bbdb29a174190

                                      SHA1

                                      dabb157a27f0b6c93eb9e37610600d9f5b5271de

                                      SHA256

                                      35efee71c42c78756b6753d005e69aecd52621ecf60708679743f74c3d34d65a

                                      SHA512

                                      c53eafc85b1c5a685b40cf217aa9ffdb310d8f1eb6e238b01707397ba2b0b412102d5c76ac8b5fa1c0cc4c913965c7cc67f660140e21d45a079477e7df1847ef

                                    • C:\Users\Admin\Downloads\Tool.zip

                                      Filesize

                                      28KB

                                      MD5

                                      31b80f7a85c0ebb01f51f1ccd232d016

                                      SHA1

                                      b22e42bd0e341bcdaee525adb416e8137543a1db

                                      SHA256

                                      6f4ee78f926fe4044a23a33c6eb7b9496daf617253262dabe85b89fdbc66f27a

                                      SHA512

                                      49eafa26a7b2a08fb19106d1d0a6ace8892cbf1761a5153d2a6d02498e652e7b38ba0110a9e4cfcb76b42c55eaf0ab5f7dec06f58c4c94704912ac96448740a6

                                    • memory/4152-190-0x000001376CF90000-0x000001376D006000-memory.dmp

                                      Filesize

                                      472KB

                                    • memory/4152-191-0x000001376CEA0000-0x000001376CEB2000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/4152-192-0x000001376CEE0000-0x000001376CEFE000-memory.dmp

                                      Filesize

                                      120KB

                                    • memory/4152-195-0x000001376DCD0000-0x000001376DF9A000-memory.dmp

                                      Filesize

                                      2.8MB

                                    • memory/4264-110-0x000001BEB6750000-0x000001BEB6C78000-memory.dmp

                                      Filesize

                                      5.2MB

                                    • memory/4264-109-0x000001BEB5F50000-0x000001BEB6112000-memory.dmp

                                      Filesize

                                      1.8MB

                                    • memory/4264-108-0x000001BE9B900000-0x000001BE9B918000-memory.dmp

                                      Filesize

                                      96KB

                                    • memory/4264-205-0x000001BE9D570000-0x000001BE9D57E000-memory.dmp

                                      Filesize

                                      56KB