Overview

overview

6

Static

static

3

Diamond RA...ed.exe

windows10-ltsc_2021-x64

6

Diamond RA...ed.exe

windows10-2004-x64

1

Diamond RA...ed.exe

windows11-21h2-x64

1

Diamond RA...ed.exe

windows11-ltsc_2024-x64

1

Diamond RA...ed.exe

ubuntu-22.04-amd64

Diamond RA...ed.exe

debian-9-armhf

Diamond RA...ed.exe

debian-9-mips

Diamond RA...ed.exe

debian-9-mipsel

Analysis

  • user interaction
    yes
  • max time kernel
    136s
  • max time network
    147s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    02/11/2026, 16:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Diamond RAT Cracked.exe
  • Size 4.1MB
  • Sample261102-t3dmysff59
  • SHA256 71bf606f92142a5dcbddd46e0c4877b96cd733ee0784d652b371a5450dff3f45
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Diamond RAT Cracked.exe
    "C:\Users\Admin\AppData\Local\Temp\Diamond RAT Cracked.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3092
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5484
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffe2473c728,0x7ffe2473c734,0x7ffe2473c740
      2⤵
        PID:3856
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1624,i,9325927232381571474,14738636330664052729,524288 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2232 /prefetch:3
        2⤵
        • System Time Discovery
        PID:2676
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,16090406996904494608,8720713125475054889,262144 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2196 /prefetch:2
        2⤵
          PID:4684
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,6298981430694086490,16696384577841211446,524288 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2580 /prefetch:8
          2⤵
            PID:1800
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,5102489354163757077,4769537604762221737,2097152 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3128 /prefetch:1
            2⤵
              PID:4080
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,16849803380366762074,1593185978549497422,2097152 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3160 /prefetch:1
              2⤵
                PID:2180
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,3151858095002766042,610753594400360859,2097152 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4440 /prefetch:2
                2⤵
                  PID:4112
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,1207253197640123059,15822530227297160259,2097152 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4696 /prefetch:1
                  2⤵
                    PID:3832
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,7840877692541109104,4567707775507875381,524288 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5440 /prefetch:8
                    2⤵
                      PID:3852
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,17567297003725899462,3128242154213303027,2097152 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5536 /prefetch:1
                      2⤵
                        PID:3600
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5748,i,12161958889252580534,8040397798198456239,2097152 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5740 /prefetch:1
                        2⤵
                          PID:5072
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3412,i,2711523871595306833,2509242302026479282,2097152 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3152 /prefetch:1
                          2⤵
                            PID:3376
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,16814273909368073871,9718028033196714056,524288 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5908 /prefetch:8
                            2⤵
                              PID:4932
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4672,i,10563302201807925240,5073148240168354891,524288 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5920 /prefetch:8
                              2⤵
                                PID:5408
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3120,i,13908018760174178354,11759897943767415131,524288 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5964 /prefetch:8
                                2⤵
                                  PID:4332
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,16069466042037952256,14318057098013295557,524288 --field-trial-handle=2200,i,13125015739606148402,1899301650107345056,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4504 /prefetch:8
                                  2⤵
                                    PID:116
                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                  1⤵
                                    PID:5372
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:2248
                                    • C:\Windows\System32\rundll32.exe
                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                      1⤵
                                        PID:4948

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            4e2697b1-829c-4ab2-8e20-cb875ad00a9f.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4e2697b1-829c-4ab2-8e20-cb875ad00a9f.tmp
                                            • Size 270KB
                                            • SHA256 4c701a075a4d966df571df699527d809d4705dc11359910eee9c0157474df1b6
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            13a50410-d6d9-47fa-9261-4ece5706c95c.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\13a50410-d6d9-47fa-9261-4ece5706c95c.tmp
                                            • Size 13KB
                                            • SHA256 4edaf729e5407097d32db3224e68a3f16856b4d7acede51adc3ee6a66672ca77
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            45135c6d-b660-4bd1-8ace-5a23e189dff6.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\45135c6d-b660-4bd1-8ace-5a23e189dff6.tmp
                                            • Size 6B
                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            8221db13-8baf-4459-9426-fb8fc8e74ce9.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8221db13-8baf-4459-9426-fb8fc8e74ce9.tmp
                                            • Size 13KB
                                            • SHA256 fed7a47727a1cd865a3016684c334358b72c7687753d60f9f6874752344f4b26
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            temp-index
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                            • Size 5KB
                                            • SHA256 7739c232e31246000d5fbbfd7b9b7e462812a43daa8dfead6a9c4c780d6d51a3
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            CURRENT
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
                                            • Size 16B
                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            4aa958ae-e49b-4819-a5d9-acdf14319450.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4aa958ae-e49b-4819-a5d9-acdf14319450.tmp
                                            • Size 2B
                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            temp-index
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
                                            • Size 120B
                                            • SHA256 422565beb6fe20a5b255a09239c23e94e0b419d121f0c328c6686f77cf418b89
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            the-real-index
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                            • Size 96B
                                            • SHA256 45bc88ff0dde4096282f81ab031451899e1f466482c68a5261fd72d5e82c1363
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            temp-index
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
                                            • Size 96B
                                            • SHA256 2825b495d87cdffdbaf6a2340484626c40a8197d8aeb316467846988a57068bf
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            b618517a-e235-4120-acd9-6aa9170f3403.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b618517a-e235-4120-acd9-6aa9170f3403.tmp
                                            • Size 13KB
                                            • SHA256 e886e0a459a5594e595592479507c32e09528081226014fe6fffc015154a119e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            c40a7eb1-01f4-411c-a7d4-dbdf1ef49d35.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c40a7eb1-01f4-411c-a7d4-dbdf1ef49d35.tmp
                                            • Size 17KB
                                            • SHA256 a01f3ad6b8f1a4a29c3e78d8a2edc9504a0b3bf6cd1cc2b244c3c3f9919648a4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            f1df78c1-97b6-4744-90a1-a13a1acaa64e.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f1df78c1-97b6-4744-90a1-a13a1acaa64e.tmp
                                            • Size 12KB
                                            • SHA256 ce5af91f73ef85a2b43690ab927084eaa6b093f645e7966ed795efb26f321b0d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            f8a12b1d-e064-4d6e-8d88-6e450f45ee32.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f8a12b1d-e064-4d6e-8d88-6e450f45ee32.tmp
                                            • Size 414B
                                            • SHA256 b0b0c4a9899c00df5ecbc588b79ed32f269808095899751deb19caeedde4c691
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            c908d33a-ba1d-4366-a7fb-f01308a2c7d9.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c908d33a-ba1d-4366-a7fb-f01308a2c7d9.tmp
                                            • Size 270KB
                                            • SHA256 b31b24b7bdfc8119a144616c0d2c0a6e91e83ae91bfd28acb1c22107a103403a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            d46ad6bc-02e2-488c-b20e-f16d5680054a.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d46ad6bc-02e2-488c-b20e-f16d5680054a.tmp
                                            • Size 131KB
                                            • SHA256 e0462df6f7dc554164b74d0c28625b36ca58e12b64c31ab2996069f3f647902d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            7b33be2d-c5ce-4f68-a8ed-bde7edd2fa82.tmp
                                            • Path C:\Users\Admin\Downloads\7b33be2d-c5ce-4f68-a8ed-bde7edd2fa82.tmp
                                            • Size 3KB
                                            • SHA256 8391f980297fb8e9030fa0c723199ca03a2abc6971ade766b642c4cf8989222f
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            memory/3092-11-0x000000001CED0000-0x000000001CEE0000-memory.dmp
                                            Download

                                            memory/3092-10-0x000000001CED0000-0x000000001CEE0000-memory.dmp
                                            Download

                                            memory/3092-9-0x000000001CED0000-0x000000001CEE0000-memory.dmp
                                            Download

                                            memory/3092-0-0x0000000000C50000-0x0000000001078000-memory.dmp
                                            Download

                                            memory/3092-12-0x0000000021E90000-0x000000002203E000-memory.dmp
                                            Download

                                            memory/3092-16-0x000000001CED0000-0x000000001CEE0000-memory.dmp
                                            Download

                                            memory/3092-5-0x000000001CED0000-0x000000001CEE0000-memory.dmp
                                            Download

                                            memory/3092-14-0x000000001CED0000-0x000000001CEE0000-memory.dmp
                                            Download

                                            memory/3092-4-0x000000001CED0000-0x000000001CEE0000-memory.dmp
                                            Download

                                            memory/3092-3-0x000000001CED0000-0x000000001CEE0000-memory.dmp
                                            Download

                                            memory/3092-2-0x000000001CED0000-0x000000001CEE0000-memory.dmp
                                            Download

                                            memory/3092-1-0x000000001CED0000-0x000000001CEE0000-memory.dmp
                                            Download