amadey | e3e1cbd1c005c4da3daefa10b395827d3f0eca9d474387fa97ca9947be7f41f5

Analysis

max time kernel
114s
max time network
128s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/12/2022, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 301KB
Sample221229-bmtecscb35
SHA256 e3e1cbd1c005c4da3daefa10b395827d3f0eca9d474387fa97ca9947be7f41f5
MD5 a2769a969bde2c3c0e0fdfce24ce4f0b
SHA1 4089d87a23e17d74b45fb313da3495525030c241
SHA512 8258f9a4906f53b0d3deeaffb03173efebfdccfd872fcc0bcd4a9458f2b9129aa876c78df99c47117626fc69fb4862e417e381cce89978f78b734317805a7f56
SSDEEP 6144:4LeghkddSnUuX7FZV+KJUdnVMMJ2iDtmmUXT:4VPnUMFjJsV92iDtmtT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey collection persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.63

62.204.41.17/8bdSvcD/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Amadey credential stealer module 6 IoCs

resource	yara_rule
behavioral1/files/0x00080000000122fb-91.dat	amadey_cred_module
behavioral1/files/0x00080000000122fb-92.dat	amadey_cred_module
behavioral1/files/0x00080000000122fb-93.dat	amadey_cred_module
behavioral1/files/0x00080000000122fb-94.dat	amadey_cred_module
behavioral1/files/0x00080000000122fb-95.dat	amadey_cred_module
behavioral1/memory/1488-96-0x00000000001E0000-0x0000000000204000-memory.dmp	amadey_cred_module

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	1488	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
2036	nbveek.exe
1168	linda5.exe
920	nbveek.exe
1648	nbveek.exe

Loads dropped DLL 8 IoCs

pid	Process
2000	file.exe
2000	file.exe
2036	nbveek.exe
748	regsvr32.exe
1488	rundll32.exe
1488	rundll32.exe
1488	rundll32.exe
1488	rundll32.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000011051\\linda5.exe"	nbveek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1488	rundll32.exe
1488	rundll32.exe
1488	rundll32.exe
1488	rundll32.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2036	2000	file.exe	28
PID 2000 wrote to memory of 2036	2000	file.exe	28
PID 2000 wrote to memory of 2036	2000	file.exe	28
PID 2000 wrote to memory of 2036	2000	file.exe	28
PID 2036 wrote to memory of 1552	2036	nbveek.exe	29
PID 2036 wrote to memory of 1552	2036	nbveek.exe	29
PID 2036 wrote to memory of 1552	2036	nbveek.exe	29
PID 2036 wrote to memory of 1552	2036	nbveek.exe	29
PID 2036 wrote to memory of 1168	2036	nbveek.exe	33
PID 2036 wrote to memory of 1168	2036	nbveek.exe	33
PID 2036 wrote to memory of 1168	2036	nbveek.exe	33
PID 2036 wrote to memory of 1168	2036	nbveek.exe	33
PID 1168 wrote to memory of 748	1168	linda5.exe	34
PID 1168 wrote to memory of 748	1168	linda5.exe	34
PID 1168 wrote to memory of 748	1168	linda5.exe	34
PID 1168 wrote to memory of 748	1168	linda5.exe	34
PID 1168 wrote to memory of 748	1168	linda5.exe	34
PID 1168 wrote to memory of 748	1168	linda5.exe	34
PID 1168 wrote to memory of 748	1168	linda5.exe	34
PID 1804 wrote to memory of 920	1804	taskeng.exe	36
PID 1804 wrote to memory of 920	1804	taskeng.exe	36
PID 1804 wrote to memory of 920	1804	taskeng.exe	36
PID 1804 wrote to memory of 920	1804	taskeng.exe	36
PID 2036 wrote to memory of 1488	2036	nbveek.exe	37
PID 2036 wrote to memory of 1488	2036	nbveek.exe	37
PID 2036 wrote to memory of 1488	2036	nbveek.exe	37
PID 2036 wrote to memory of 1488	2036	nbveek.exe	37
PID 2036 wrote to memory of 1488	2036	nbveek.exe	37
PID 2036 wrote to memory of 1488	2036	nbveek.exe	37
PID 2036 wrote to memory of 1488	2036	nbveek.exe	37
PID 1804 wrote to memory of 1648	1804	taskeng.exe	38
PID 1804 wrote to memory of 1648	1804	taskeng.exe	38
PID 1804 wrote to memory of 1648	1804	taskeng.exe	38
PID 1804 wrote to memory of 1648	1804	taskeng.exe	38

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
  "C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\1000011051\linda5.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011051\linda5.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /S AWYuID.Sh4
      4⤵
      Loads dropped DLL
      PID:748
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - outlook_win_path
    PID:1488

C:\Windows\system32\taskeng.exe
taskeng.exe {FE5C3685-8A4F-4653-8EFF-3132A824E98E} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
  C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
  C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
  2⤵
  - Executes dropped EXE
  PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

linda5.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011051\linda5.exe
Size 1.6MB
SHA256 4efe8814fed12848173ac6f73cf929931c298b04562ef8a93dab2997846637ea
MD5 07af7909022d06c617c9eff098c173f6
SHA1 dea48caf042901fd7e19e5c8faec5231cb7cbc93
SHA512 57947935a4cd816cbaf97f6fc65b1a20a479457a9d0974f7939c599911fe8dc4ed163d34836d9d21896da0f21602da855c36f4fd167ec96c7382b6d3b95b1a79
SSDEEP 24576:gJr8tE+gHqSo1NBI5C6b1DFCFMmriybAGOcwzyohNYqtRFn0AqqEEecxMnB5:gJ4NSoOC6b1JCFRisAXPIgzVyLcxk5
MD5 SHA1 SHA512 SSDEEP

Submit Download

linda5.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011051\linda5.exe
Size 1.6MB
SHA256 4efe8814fed12848173ac6f73cf929931c298b04562ef8a93dab2997846637ea
MD5 07af7909022d06c617c9eff098c173f6
SHA1 dea48caf042901fd7e19e5c8faec5231cb7cbc93
SHA512 57947935a4cd816cbaf97f6fc65b1a20a479457a9d0974f7939c599911fe8dc4ed163d34836d9d21896da0f21602da855c36f4fd167ec96c7382b6d3b95b1a79
SSDEEP 24576:gJr8tE+gHqSo1NBI5C6b1DFCFMmriybAGOcwzyohNYqtRFn0AqqEEecxMnB5:gJ4NSoOC6b1JCFRisAXPIgzVyLcxk5
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbveek.exe

Path C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
Size 301KB
SHA256 e3e1cbd1c005c4da3daefa10b395827d3f0eca9d474387fa97ca9947be7f41f5
MD5 a2769a969bde2c3c0e0fdfce24ce4f0b
SHA1 4089d87a23e17d74b45fb313da3495525030c241
SHA512 8258f9a4906f53b0d3deeaffb03173efebfdccfd872fcc0bcd4a9458f2b9129aa876c78df99c47117626fc69fb4862e417e381cce89978f78b734317805a7f56
SSDEEP 6144:4LeghkddSnUuX7FZV+KJUdnVMMJ2iDtmmUXT:4VPnUMFjJsV92iDtmtT
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbveek.exe

Path C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
Size 301KB
SHA256 e3e1cbd1c005c4da3daefa10b395827d3f0eca9d474387fa97ca9947be7f41f5
MD5 a2769a969bde2c3c0e0fdfce24ce4f0b
SHA1 4089d87a23e17d74b45fb313da3495525030c241
SHA512 8258f9a4906f53b0d3deeaffb03173efebfdccfd872fcc0bcd4a9458f2b9129aa876c78df99c47117626fc69fb4862e417e381cce89978f78b734317805a7f56
SSDEEP 6144:4LeghkddSnUuX7FZV+KJUdnVMMJ2iDtmmUXT:4VPnUMFjJsV92iDtmtT
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbveek.exe

Path C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
Size 301KB
SHA256 e3e1cbd1c005c4da3daefa10b395827d3f0eca9d474387fa97ca9947be7f41f5
MD5 a2769a969bde2c3c0e0fdfce24ce4f0b
SHA1 4089d87a23e17d74b45fb313da3495525030c241
SHA512 8258f9a4906f53b0d3deeaffb03173efebfdccfd872fcc0bcd4a9458f2b9129aa876c78df99c47117626fc69fb4862e417e381cce89978f78b734317805a7f56
SSDEEP 6144:4LeghkddSnUuX7FZV+KJUdnVMMJ2iDtmmUXT:4VPnUMFjJsV92iDtmtT
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbveek.exe

Path C:\Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
Size 301KB
SHA256 e3e1cbd1c005c4da3daefa10b395827d3f0eca9d474387fa97ca9947be7f41f5
MD5 a2769a969bde2c3c0e0fdfce24ce4f0b
SHA1 4089d87a23e17d74b45fb313da3495525030c241
SHA512 8258f9a4906f53b0d3deeaffb03173efebfdccfd872fcc0bcd4a9458f2b9129aa876c78df99c47117626fc69fb4862e417e381cce89978f78b734317805a7f56
SSDEEP 6144:4LeghkddSnUuX7FZV+KJUdnVMMJ2iDtmmUXT:4VPnUMFjJsV92iDtmtT
MD5 SHA1 SHA512 SSDEEP

Submit Download

AWYuID.Sh4

Path C:\Users\Admin\AppData\Local\Temp\AWYuID.Sh4
Size 1.5MB
SHA256 f5e198abce5a306fd621978b027100343a6e54f1d9293d8998e5a901cc4eb69f
MD5 b17c462e94412450fe2f51270042fc57
SHA1 31486090a022c7324eaecbce180b8ab83c0fa463
SHA512 23bc4b7051b9eb7d50e979e8177b18d2edc30e10c9b0b8949d2c8c2ca4d27ebcff58653fb0460cb45ced21db0181a072abb7c0aef356d012fafee27d6855b7eb
SSDEEP 49152:K2Zmchg2UBPTlv8GF9QXJJnS5u72esMmFEeXq71jspvcBgsFi:KSmchgZBPTlv8GF94J5S5uPsMm+L71jo
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Size 126KB
SHA256 53bb660c1ae533d41b887a771ab2d8a2f73320c4d1441448c4bf75dfbc875321
MD5 9cb722f11d688872348be236f8e5d149
SHA1 e54f80b631c1931b574baf6953a3948fe3d7d354
SHA512 52e318939fd63c89ee8f92b3c7e17f08919f6a5ac229418a6f0678daad9a3f285f121ad4aab7ef4bb575d368c989fc02e07a654b919f9bb1ba7fe7a9c5c37774
SSDEEP 3072:ox7pOYzBekNmWDWCMq6As523HeS9FAiZ87vO2rlL3RnG9:ox7ZNhN/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

linda5.exe

Path \Users\Admin\AppData\Local\Temp\1000011051\linda5.exe
Size 1.6MB
SHA256 4efe8814fed12848173ac6f73cf929931c298b04562ef8a93dab2997846637ea
MD5 07af7909022d06c617c9eff098c173f6
SHA1 dea48caf042901fd7e19e5c8faec5231cb7cbc93
SHA512 57947935a4cd816cbaf97f6fc65b1a20a479457a9d0974f7939c599911fe8dc4ed163d34836d9d21896da0f21602da855c36f4fd167ec96c7382b6d3b95b1a79
SSDEEP 24576:gJr8tE+gHqSo1NBI5C6b1DFCFMmriybAGOcwzyohNYqtRFn0AqqEEecxMnB5:gJ4NSoOC6b1JCFRisAXPIgzVyLcxk5
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbveek.exe

Path \Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
Size 301KB
SHA256 e3e1cbd1c005c4da3daefa10b395827d3f0eca9d474387fa97ca9947be7f41f5
MD5 a2769a969bde2c3c0e0fdfce24ce4f0b
SHA1 4089d87a23e17d74b45fb313da3495525030c241
SHA512 8258f9a4906f53b0d3deeaffb03173efebfdccfd872fcc0bcd4a9458f2b9129aa876c78df99c47117626fc69fb4862e417e381cce89978f78b734317805a7f56
SSDEEP 6144:4LeghkddSnUuX7FZV+KJUdnVMMJ2iDtmmUXT:4VPnUMFjJsV92iDtmtT
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbveek.exe

Path \Users\Admin\AppData\Local\Temp\3858e4df6b\nbveek.exe
Size 301KB
SHA256 e3e1cbd1c005c4da3daefa10b395827d3f0eca9d474387fa97ca9947be7f41f5
MD5 a2769a969bde2c3c0e0fdfce24ce4f0b
SHA1 4089d87a23e17d74b45fb313da3495525030c241
SHA512 8258f9a4906f53b0d3deeaffb03173efebfdccfd872fcc0bcd4a9458f2b9129aa876c78df99c47117626fc69fb4862e417e381cce89978f78b734317805a7f56
SSDEEP 6144:4LeghkddSnUuX7FZV+KJUdnVMMJ2iDtmmUXT:4VPnUMFjJsV92iDtmtT
MD5 SHA1 SHA512 SSDEEP

Submit Download

aWyuId.Sh4

Path \Users\Admin\AppData\Local\Temp\aWyuId.Sh4
Size 1.5MB
SHA256 f5e198abce5a306fd621978b027100343a6e54f1d9293d8998e5a901cc4eb69f
MD5 b17c462e94412450fe2f51270042fc57
SHA1 31486090a022c7324eaecbce180b8ab83c0fa463
SHA512 23bc4b7051b9eb7d50e979e8177b18d2edc30e10c9b0b8949d2c8c2ca4d27ebcff58653fb0460cb45ced21db0181a072abb7c0aef356d012fafee27d6855b7eb
SSDEEP 49152:K2Zmchg2UBPTlv8GF9QXJJnS5u72esMmFEeXq71jspvcBgsFi:KSmchgZBPTlv8GF94J5S5uPsMm+L71jo
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path \Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Size 126KB
SHA256 53bb660c1ae533d41b887a771ab2d8a2f73320c4d1441448c4bf75dfbc875321
MD5 9cb722f11d688872348be236f8e5d149
SHA1 e54f80b631c1931b574baf6953a3948fe3d7d354
SHA512 52e318939fd63c89ee8f92b3c7e17f08919f6a5ac229418a6f0678daad9a3f285f121ad4aab7ef4bb575d368c989fc02e07a654b919f9bb1ba7fe7a9c5c37774
SSDEEP 3072:ox7pOYzBekNmWDWCMq6As523HeS9FAiZ87vO2rlL3RnG9:ox7ZNhN/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path \Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Size 126KB
SHA256 53bb660c1ae533d41b887a771ab2d8a2f73320c4d1441448c4bf75dfbc875321
MD5 9cb722f11d688872348be236f8e5d149
SHA1 e54f80b631c1931b574baf6953a3948fe3d7d354
SHA512 52e318939fd63c89ee8f92b3c7e17f08919f6a5ac229418a6f0678daad9a3f285f121ad4aab7ef4bb575d368c989fc02e07a654b919f9bb1ba7fe7a9c5c37774
SSDEEP 3072:ox7pOYzBekNmWDWCMq6As523HeS9FAiZ87vO2rlL3RnG9:ox7ZNhN/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path \Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Size 126KB
SHA256 53bb660c1ae533d41b887a771ab2d8a2f73320c4d1441448c4bf75dfbc875321
MD5 9cb722f11d688872348be236f8e5d149
SHA1 e54f80b631c1931b574baf6953a3948fe3d7d354
SHA512 52e318939fd63c89ee8f92b3c7e17f08919f6a5ac229418a6f0678daad9a3f285f121ad4aab7ef4bb575d368c989fc02e07a654b919f9bb1ba7fe7a9c5c37774
SSDEEP 3072:ox7pOYzBekNmWDWCMq6As523HeS9FAiZ87vO2rlL3RnG9:ox7ZNhN/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path \Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Size 126KB
SHA256 53bb660c1ae533d41b887a771ab2d8a2f73320c4d1441448c4bf75dfbc875321
MD5 9cb722f11d688872348be236f8e5d149
SHA1 e54f80b631c1931b574baf6953a3948fe3d7d354
SHA512 52e318939fd63c89ee8f92b3c7e17f08919f6a5ac229418a6f0678daad9a3f285f121ad4aab7ef4bb575d368c989fc02e07a654b919f9bb1ba7fe7a9c5c37774
SSDEEP 3072:ox7pOYzBekNmWDWCMq6As523HeS9FAiZ87vO2rlL3RnG9:ox7ZNhN/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/748-76-0x0000000002210000-0x0000000002395000-memory.dmp

Download

memory/748-77-0x0000000073F70000-0x00000000740FC000-memory.dmp

Download

memory/748-80-0x0000000002090000-0x0000000002176000-memory.dmp

Download

memory/748-81-0x0000000000150000-0x000000000021E000-memory.dmp

Download

memory/920-88-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/920-87-0x000000000061B000-0x000000000063A000-memory.dmp

Download

memory/1488-96-0x00000000001E0000-0x0000000000204000-memory.dmp

Download

memory/1648-100-0x000000000055B000-0x000000000057A000-memory.dmp

Download

memory/1648-101-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/2000-54-0x0000000075501000-0x0000000075503000-memory.dmp

Download

memory/2000-59-0x000000000030B000-0x000000000032A000-memory.dmp

Download

memory/2000-61-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/2000-60-0x0000000000290000-0x00000000002CC000-memory.dmp

Download

memory/2036-79-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/2036-65-0x000000000028B000-0x00000000002AA000-memory.dmp

Download

memory/2036-66-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/2036-78-0x000000000028B000-0x00000000002AA000-memory.dmp

Download