Malware Analysis Report

2025-04-03 09:18

Sample ID 250306-qr2nvszn19
Target b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15
SHA256 b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15
Tags
a4d2cd amadey systembc defense_evasion discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15

Threat Level: Known bad

The file b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15 was found to be: Known bad.

Malicious Activity Summary

a4d2cd amadey systembc defense_evasion discovery trojan

Amadey family

Systembc family

SystemBC

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Identifies Wine through registry keys

Checks BIOS information in registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-06 13:30

Signatures

Amadey family

amadey

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-06 13:30

Reported

2025-03-06 13:33

Platform

win7-20240903-en

Max time kernel

144s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\cpjv\mapgafr.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\cpjv\mapgafr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\cpjv\mapgafr.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine C:\ProgramData\cpjv\mapgafr.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
N/A N/A C:\ProgramData\cpjv\mapgafr.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\cpjv\mapgafr.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
N/A N/A C:\ProgramData\cpjv\mapgafr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2252 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2252 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2252 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2252 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2108 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe
PID 2108 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe
PID 2108 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe
PID 2108 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe
PID 276 wrote to memory of 3004 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\cpjv\mapgafr.exe
PID 276 wrote to memory of 3004 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\cpjv\mapgafr.exe
PID 276 wrote to memory of 3004 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\cpjv\mapgafr.exe
PID 276 wrote to memory of 3004 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\cpjv\mapgafr.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe

"C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe

"C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {8DB71DD5-6174-4C23-B68A-82559D74603B} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]

C:\ProgramData\cpjv\mapgafr.exe

C:\ProgramData\cpjv\mapgafr.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
LU 45.59.120.8:80 45.59.120.8 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4151 towerbingobongoboom.com tcp

Files

memory/2252-1-0x0000000000300000-0x0000000000301000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 a9749ee52eefb0fd48a66527095354bb
SHA1 78170bcc54e1f774528dea3118b50ffc46064fe0
SHA256 b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15
SHA512 9d21f0e1e376b89df717403a3939ed86ef61095bb9f0167ff15c01d3bbbee03d4dd01b3e2769ecd921e40e43bab3cbf0a6844ab6f296982227b0cb507b4b0e25

C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe

MD5 3b4723591e7a82dc45cdd60b2162eee2
SHA1 9618f544c79dbae11634fc14bd472b3cb5eb046d
SHA256 1582d61232dff45c014769e9be4fb06f839ee3e462189dbbf28ca0380a6fa410
SHA512 1559f42a1dbdf1f78f971415f3252a1127ebd2f3490a374a13670fc366b54f50c58bac8234d30a43b3345fbecdf49f65b69500675887c81fa45bc06311917380

memory/2108-26-0x0000000004510000-0x0000000004950000-memory.dmp

memory/2108-25-0x0000000004510000-0x0000000004950000-memory.dmp

memory/2724-28-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2724-29-0x00000000770E0000-0x00000000770E2000-memory.dmp

memory/2724-30-0x0000000000401000-0x0000000000403000-memory.dmp

memory/2724-33-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2724-35-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2724-36-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2724-37-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2724-38-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-41-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 5f600418342bfd7e7e23f7161f5884ce
SHA1 ee9355c464acd4c9e4004d36efae30fd33506b87
SHA256 06fd11f34948ae20cb5c827ccd858930ce68ca6ac124f0470044d3800cc04c1f
SHA512 e01b4bd574ae9765584c75a81415bced5e64c5257eacd97083a2bd000a43d70aab3fbd859263546bbab8074808f878557b33a62acf7e68842d919d50a23f526c

memory/2724-43-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-44-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-45-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2724-46-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-47-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2724-48-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-49-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2724-50-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-51-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2724-52-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2724-53-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-54-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-55-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-56-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-57-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-58-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-59-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-60-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3004-61-0x0000000000400000-0x0000000000840000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-06 13:30

Reported

2025-03-06 13:33

Platform

win10v2004-20250217-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\lxog\axac.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\lxog\axac.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\lxog\axac.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\ProgramData\lxog\axac.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
N/A N/A C:\ProgramData\lxog\axac.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\lxog\axac.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe N/A
N/A N/A C:\ProgramData\lxog\axac.exe N/A
N/A N/A C:\ProgramData\lxog\axac.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe

"C:\Users\Admin\AppData\Local\Temp\b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe

"C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe"

C:\ProgramData\lxog\axac.exe

C:\ProgramData\lxog\axac.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
LU 45.59.120.8:80 45.59.120.8 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4361 towerbingobongoboom.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 a9749ee52eefb0fd48a66527095354bb
SHA1 78170bcc54e1f774528dea3118b50ffc46064fe0
SHA256 b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15
SHA512 9d21f0e1e376b89df717403a3939ed86ef61095bb9f0167ff15c01d3bbbee03d4dd01b3e2769ecd921e40e43bab3cbf0a6844ab6f296982227b0cb507b4b0e25

C:\Users\Admin\AppData\Roaming\10000790100\effectson.exe

MD5 3b4723591e7a82dc45cdd60b2162eee2
SHA1 9618f544c79dbae11634fc14bd472b3cb5eb046d
SHA256 1582d61232dff45c014769e9be4fb06f839ee3e462189dbbf28ca0380a6fa410
SHA512 1559f42a1dbdf1f78f971415f3252a1127ebd2f3490a374a13670fc366b54f50c58bac8234d30a43b3345fbecdf49f65b69500675887c81fa45bc06311917380

memory/2672-25-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2672-26-0x00007FFED37D0000-0x00007FFED39C5000-memory.dmp

memory/2672-29-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2672-30-0x00007FFED37D0000-0x00007FFED39C5000-memory.dmp

memory/2672-31-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-34-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 59b90faac9bd124f998ba57ff3e6c920
SHA1 48e87551cac427cdbd15a2fa5e9eb9dd7422d8be
SHA256 07b5f7e234eb45c19edfa8e43f9f1db52d71376585fbf3c733db5e75fb481f07
SHA512 f8a6baf7a54d7144534f690a5c6d588cce6ab289c0fbf0b704b390d479e84ae57e8dfa29070b28396e94290a25b8bf33a61867ca1a0ff057b962abb774e1325f

memory/2672-37-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-38-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2672-39-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-40-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2672-41-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-42-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2672-43-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-44-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2672-45-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-47-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-49-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-50-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-51-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-52-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-53-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-54-0x0000000000400000-0x0000000000840000-memory.dmp

memory/980-56-0x0000000000400000-0x0000000000840000-memory.dmp