Resubmissions

23/03/2026, 02:00

260323-cffqcsds9n10

05/03/2026, 16:32

260305-t1xm2scx3k10

11/02/2026, 21:18

260211-z5q9qaav8h10

11/05/2025, 03:54

250511-egp2javwat10

03/09/2024, 14:02

240903-rb57sazdqf10

03/09/2024, 13:51

240903-q59avszclf10

02/09/2024, 19:51

240902-yk8gtsxbpd10

02/09/2024, 02:27

240902-cxh7tazflg10

02/09/2024, 02:26

240902-cwxc2sygll10

21/06/2024, 19:37

240621-yca7cszgnd10

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/06/2024, 17:07

General

  • Target
    Ransomware/criticalupdate01.exe
  • Size 261KB
  • Sample240609-vm7rjadd73
  • SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Path
  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
  • <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>ndnBqI2zMaMH++Dp/rQmk67qxZ7gItiZViR8j875+1IJAdYxVT9Ugm4p4kMxwL3/2U4NzL5NQmpo4fuNeg5GSbCrm4Tyr+wIFU2FBLD79pA40mUB1RSz7S1nyW2/pX2HnQy23hvUgWu8jw7g3XC/Z4jLs8P7P8636IRSXB6Dp/qzgWAL0h6kfrZ4OTwRw6u+Ey+hSbljwrs8FsNRL/pP5U0n/4RYvy4jB+mpUGOC+6MUpfFk0xhOQnImTFCsUGFRroYrn+0/oI5B5tCxMRN+MdgcUSIiz+UgyWPRbb8VrTvAFdrUXbWMC7+X4zpb+1+jol6HGoEaH5sXuGzo3YwUJQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1438) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:168
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:1720

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cef_200_percent.pak

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak
        • Size 16B
        • SHA256 3a54d0190c06d70dd74f09db17a09d6d838a1d39c997ad4efab0e740a284e26d
        • MD5 SHA1 SHA512

        aic_file_icons.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
        • Size 50KB
        • SHA256 2ce24c3c6c5bb6db8b0ca1647d703d5d651bdf7a7d88601619e2a9bb9e93437a
        • MD5 SHA1 SHA512 SSDEEP

        selection-actions.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png
        • Size 1KB
        • SHA256 2461ad165329fb9b6d7e5c949b07fc94c858574837b3092a79916da99ccb1339
        • MD5 SHA1 SHA512

        selection-actions2x.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png
        • Size 3KB
        • SHA256 57079530693c4c23d3eb520650ef7a055f0a13a046cfe3859b5c9dfa61f2b518
        • MD5 SHA1 SHA512

        s_remove_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg
        • Size 720B
        • SHA256 704170d4f31cdd988083e13a3580e26ebd963de6099667dc5d4235481a547d2b
        • MD5 SHA1 SHA512

        duplicate.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg
        • Size 1KB
        • SHA256 a6dc5bd479436ee51722bc1d1187597332326ed16d3595285f56c1ece41e5f28
        • MD5 SHA1 SHA512

        remove.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg
        • Size 1KB
        • SHA256 c00a0f0d53a26d83196ee55edd2d1fd13f69e70cb80b5f2a257f6f211b0271f3
        • MD5 SHA1 SHA512

        s_backarrow_default.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg
        • Size 896B
        • SHA256 c4a12c845b23fb293d3ea7c438feb128c58cbb8d68f718555472c3a8c6e9bdd6
        • MD5 SHA1 SHA512

        s_comment_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg
        • Size 1KB
        • SHA256 25a72505d4a6946d8e8a3c4d794df8f7e18a23c09d66c5bd054b4cd6dac80dc1
        • MD5 SHA1 SHA512

        s_editpdf_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg
        • Size 1KB
        • SHA256 bfad994f5cbeaf73d5712ba5130ae73acab16fe84a58ee1bc8e90d47c2e2457b
        • MD5 SHA1 SHA512

        s_export_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg
        • Size 7KB
        • SHA256 5ff91d29f101986ed5e7d9497539c39a5089face6ed1d1085c34522f6a30a7e1
        • MD5 SHA1 SHA512 SSDEEP

        s_fillandsign_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg
        • Size 2KB
        • SHA256 34c278364d7ae03cd1c120967ae0806ded59d720d3c25759d2862d0a056d2c06
        • MD5 SHA1 SHA512

        s_folder-default_32.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg
        • Size 560B
        • SHA256 deb51b9bef0281a93e9d4710502061347f874748a9881b9bd9d0e2114c6faa59
        • MD5 SHA1 SHA512

        DECRYPT_YOUR_FILES.HTML

        • Path C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
        • Size 1KB
        • SHA256 ff6be14128a6ab0a3c4f9bdcb4be3f133598ad92125b6104e0ec1a3856c54dc6
        • MD5 SHA1 SHA512

        win32_LinkNoDrop32x32.gif

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
        • Size 160B
        • SHA256 01290ded6d58ff1d1cde70a7f329a0fbdce197ffd340fa29e23b7d5a2379ccd1
        • MD5 SHA1 SHA512

        THIRDPARTYLICENSEREADME-JAVAFX.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
        • Size 192B
        • SHA256 cdbfc7473974ba1f2e50e4d8165820fefe9d1fc2dfda529af0b4391284a7e446
        • MD5 SHA1 SHA512

        THIRDPARTYLICENSEREADME.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
        • Size 192B
        • SHA256 318aa3a1058f22e54c5bb021a1530e76c0d790ab6ce0e24d7437f06f523d335d
        • MD5 SHA1 SHA512

        directshow.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
        • Size 1KB
        • SHA256 cb3df76f6c9c0c3b66f6fc512a82a2d1184b425f63201c60ce8b1062de308180
        • MD5 SHA1 SHA512

        glib.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
        • Size 31KB
        • SHA256 2b9e0ada91d1ed9338344d88118f053001a57c243af9695694586738e7fcd399
        • MD5 SHA1 SHA512 SSDEEP

        gstreamer.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
        • Size 34KB
        • SHA256 a3d6aa0524b5fb93d8cb99f70b985f1b357f34756ae4f435b040bfb2f76ab07b
        • MD5 SHA1 SHA512 SSDEEP

        icu_web.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
        • Size 23KB
        • SHA256 f3278179ff3a1a4e6f5c3b4b9211e629ddd9661d77dd14e15da08d5f99b83ae8
        • MD5 SHA1 SHA512 SSDEEP

        jpeg_fx.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
        • Size 2KB
        • SHA256 1c1bb319c088d2481e8e901e71f06cf8761251d271edc9a190945735b12b681d
        • MD5 SHA1 SHA512

        libffi.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
        • Size 1KB
        • SHA256 6e6979ae46950ab07e6aed1c2dd48e08e33d552f64edc0eaa8103b78f445583e
        • MD5 SHA1 SHA512

        libxml2.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
        • Size 3KB
        • SHA256 60ffe9782a5254a93d40289ae60adbbb0bc0bc3844b19fa5af04421330a54392
        • MD5 SHA1 SHA512

        libxslt.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
        • Size 2KB
        • SHA256 102bdaffebd13d7f0247457761317dd7bc98a1857de25e2d92b14e11c4bfe211
        • MD5 SHA1 SHA512

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
        • Size 5KB
        • SHA256 0615ff47574c780ea8731e0a665f6cdf8a4987f515c33ab743d1bad1cd8de658
        • MD5 SHA1 SHA512 SSDEEP

        public_suffix.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
        • Size 17KB
        • SHA256 14ef99fa406ac7496e6af83303310caa4577d663adaa6dbe221d43f7937752fa
        • MD5 SHA1 SHA512 SSDEEP

        webkit.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
        • Size 320KB
        • SHA256 623563c8f28ce7ff11bec3e78e7ff14c8944e3a80fda27281c762ed0c8b26e81
        • MD5 SHA1 SHA512 SSDEEP

        asm.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
        • Size 1KB
        • SHA256 2d46783182b18c14402f9e943b356cdb38c051834e21fa3b0a3858ee2d2d0ad1
        • MD5 SHA1 SHA512

        bcel.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
        • Size 10KB
        • SHA256 520efef74c645f219f0ffeff8dc95835a593632fdc3153ee9a24cb3a8c8e347c
        • MD5 SHA1 SHA512 SSDEEP

        cldr.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
        • Size 3KB
        • SHA256 8defa3f8149beb4961ccc7e2adb26630175cf3e7faa22a33413311030f1b6b27
        • MD5 SHA1 SHA512

        colorimaging.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
        • Size 176B
        • SHA256 6e8fed12ffd87df373a36c5b7eba986c78ede2a131e16854450b6d4e3634b889
        • MD5 SHA1 SHA512

        cryptix.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
        • Size 1KB
        • SHA256 0aa9930c11b69a834bdee25f6e18da558041f0605677b5ce2defce96a13ecef5
        • MD5 SHA1 SHA512

        dom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
        • Size 3KB
        • SHA256 5e3788ef399422f9886e830eb2316bcbc8a1402582f75b84581654864961615f
        • MD5 SHA1 SHA512

        dynalink.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
        • Size 1KB
        • SHA256 4f5291067b0d339db536fecb74a9aa4acc8e5ece3377d5254c0ee3d9178023ee
        • MD5 SHA1 SHA512

        ecc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
        • Size 28KB
        • SHA256 7afcdf64c57337774ef313f692aaf36a207f44bebcb0f66072743f46851fef8f
        • MD5 SHA1 SHA512 SSDEEP

        freebxml.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
        • Size 2KB
        • SHA256 351f369c20d3ed8bc22805344e6e6e556fefcdf4be5da7db01a6d26f236eecbe
        • MD5 SHA1 SHA512

        giflib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
        • Size 1KB
        • SHA256 ff0b058f1e2dd3247d0e1c2b17f0841389cdbe6d37d9d7eb1e6a08bc2143d683
        • MD5 SHA1 SHA512

        icu.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
        • Size 2KB
        • SHA256 51d5b3b51e0ce1356814ac83d7f89be49897f67da93a2a538e7d94636742a057
        • MD5 SHA1 SHA512

        jcup.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
        • Size 1KB
        • SHA256 62523e40fd39f0cb5096241cc527f8ae7004fefa4f790c2497505a0d93813e9a
        • MD5 SHA1 SHA512

        joni.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
        • Size 1KB
        • SHA256 1fcabe79914bcc9de4fc5d87962723637df83dffbaf0f9df4d8538050f6a3732
        • MD5 SHA1 SHA512

        jopt-simple.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
        • Size 1KB
        • SHA256 e09a83280060b0b1eaca8ebae36d17e37b514866cecd7bece615893e06178be2
        • MD5 SHA1 SHA512

        jpeg.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
        • Size 3KB
        • SHA256 353749a79a926c39a1a44dcc6cb08fd78c741f2e476053c819c588bed871d1b2
        • MD5 SHA1 SHA512

        lcms.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
        • Size 2KB
        • SHA256 2782f621c8c83ccdb0d4ee3372eccb3790b88798d7c1116686d3aa8fe0025ac0
        • MD5 SHA1 SHA512

        libpng.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
        • Size 6KB
        • SHA256 94763b7d60965f9cf8e9afad8da343d673afe77c6116eb487b8d0c8bfa9aa4c1
        • MD5 SHA1 SHA512 SSDEEP

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
        • Size 5KB
        • SHA256 f9fe67467a1bb373b2c697c3b0347a48cce3a37982c3796fa9e2b495326eab8c
        • MD5 SHA1 SHA512 SSDEEP

        pkcs11cryptotoken.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
        • Size 3KB
        • SHA256 4a71b5e99f72651bfa5e16ab50a7300ce03f3a5bd24a95dc0c9c0dd34fe8460a
        • MD5 SHA1 SHA512

        pkcs11wrapper.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
        • Size 2KB
        • SHA256 842d48c95dde578191d0eff76b625fa2f6d16edfcfb2407418134869de75e4d2
        • MD5 SHA1 SHA512

        relaxngcc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
        • Size 2KB
        • SHA256 74c78bd7574f2f3ca846eeac3a240b1a70e0307732ebb8396c9af378471046cd
        • MD5 SHA1 SHA512

        relaxngdatatype.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
        • Size 1KB
        • SHA256 f72a7a1369a7b7d63edd4a0d76f12d56e3a404d4803e81c01d9b1dc26a185f0b
        • MD5 SHA1 SHA512

        relaxngom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
        • Size 1KB
        • SHA256 f175e68bb50a42bf8a78f69bddb35456312450d865d0e8038ac90b9a5b49cbd0
        • MD5 SHA1 SHA512

        santuario.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
        • Size 11KB
        • SHA256 b2db7b786c00a198cfcf64fda0db8f783396ca3bca25d685c44e7258b4b59193
        • MD5 SHA1 SHA512 SSDEEP

        thaidict.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
        • Size 1KB
        • SHA256 700415ec1b25dbc4d0dde0032e236f6bbee2903f45639176601db0454f258902
        • MD5 SHA1 SHA512

        unicode.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
        • Size 2KB
        • SHA256 de37e3afbc743dfd02d40464e4d5031e51e863481284988a3008176183a48603
        • MD5 SHA1 SHA512

        xalan.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
        • Size 11KB
        • SHA256 2936e76ee2ea2d01e1f05c61ed07f56ba53521eb71c29f6424d0c86b856907c7
        • MD5 SHA1 SHA512 SSDEEP

        xerces.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
        • Size 11KB
        • SHA256 4f0db33c95457940fc8814ac40135dd622842f0833c70681877f1ff1728b5069
        • MD5 SHA1 SHA512 SSDEEP

        xmlresolver.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
        • Size 11KB
        • SHA256 93c2cb35accdc514843b762199e2116ef54c6f84b715017992a9c22db66dca2f
        • MD5 SHA1 SHA512 SSDEEP

        zlib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
        • Size 1024B
        • SHA256 468fb85412476cad05ce40af9d070d3cd1087a51419d2d3244f794d7a65b8883
        • MD5 SHA1 SHA512

        ClientSub2019_eula.txt

        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
        • Size 48B
        • SHA256 f32cda7b57a875e991c3e1f683c24d4a6936d269e18e2c9c5c445038d1448662
        • MD5 SHA1 SHA512

        WindowsUpdate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
        • Size 21KB
        • SHA256 489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
        • MD5 SHA1 SHA512 SSDEEP

        memory/168-64-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-14-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-62-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-18-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-66-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-68-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-10-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-16-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-20-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-26-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-28-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-30-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-33-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-34-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-36-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-38-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-40-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-42-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-44-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-46-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-134-0x0000000073E20000-0x000000007450E000-memory.dmp

        memory/168-132-0x0000000005220000-0x000000000522A000-memory.dmp

        memory/168-133-0x0000000073E20000-0x000000007450E000-memory.dmp

        memory/168-50-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-0-0x0000000073E2E000-0x0000000073E2F000-memory.dmp

        memory/168-48-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-12-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-8-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-6-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-5-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-4-0x0000000073E20000-0x000000007450E000-memory.dmp

        memory/168-135-0x0000000073E2E000-0x0000000073E2F000-memory.dmp

        memory/168-136-0x0000000073E20000-0x000000007450E000-memory.dmp

        memory/168-137-0x0000000005410000-0x000000000541E000-memory.dmp

        memory/168-2-0x0000000002420000-0x0000000002452000-memory.dmp

        memory/168-1-0x00000000021C0000-0x00000000021F2000-memory.dmp

        memory/168-3-0x0000000073E20000-0x000000007450E000-memory.dmp

        memory/168-22-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-25-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-52-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-54-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-56-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-58-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/168-130-0x0000000004B20000-0x000000000501E000-memory.dmp

        memory/168-131-0x0000000005020000-0x00000000050B2000-memory.dmp

        memory/168-129-0x0000000073E20000-0x000000007450E000-memory.dmp

        memory/168-60-0x0000000002420000-0x000000000244B000-memory.dmp

        memory/1720-3059-0x00007FFAEFCA0000-0x00007FFAF068C000-memory.dmp

        memory/1720-2266-0x00007FFAEFCA3000-0x00007FFAEFCA4000-memory.dmp

        memory/1720-143-0x00007FFAEFCA3000-0x00007FFAEFCA4000-memory.dmp

        memory/1720-144-0x0000000000E20000-0x0000000000E2C000-memory.dmp

        memory/1720-145-0x00007FFAEFCA0000-0x00007FFAF068C000-memory.dmp