Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 21:07

General

  • Target
    Fantom.exe
  • Size 261KB
  • Sample260628-zyk45aey9q
  • SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Path
  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
  • <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>Tva5HxpMFIs/MIvYwrmecO+AjDUkDy7UAodQmg6ZDHl8mMHe53HdN0zOuVBjjrg5vfZaLO5pghcAZhvFaf3HjO/0AX96gxI0bktlzG6MvoMEgNOaUiWGMrAxJ84Yh6Vsu9D+EvTlfPMNr2N2eqkv5X45CBHawJj34fa9b0c3SQOhf+kzD2fqC0zr5TnwvIz5ax42WJ+QFFAwMRQlnNFtDyVdNtSCYb3PZUP4dyvyzxTTYVx0KK4lYnXiK+uaJSWrZril4dHpRexY4nyPb2qyouB9nJiCB+hl+xcywTjNE312zU6nG0x+ZYP5W2w1NtWcvradPATk2xB8XLbtMMzzBA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Family: Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 45 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:5272
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4264
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4776
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1532

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cef_200_percent.pak

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak
        • Size 16B
        • SHA256 e65575635688926cd5e1c986ec6eca4fbf45591289384d7f327fe0e924492c86
        • MD5 SHA1 SHA512

        aic_file_icons.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
        • Size 50KB
        • SHA256 425b80db8b5d0fc080e4b672a692c5776347ded2f978e23496be1590ab91f7de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        selection-actions.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png
        • Size 1KB
        • SHA256 8595daadc2735c6d9546d89ab287446dc865485512bef3a9953e17d20c4e2d04
        • MD5 SHA1 SHA512 TLSH

        selection-actions2x.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png
        • Size 3KB
        • SHA256 3ded13c0c169ae9715cf2675ec7bb6b87646f5072a57b90c6b12ff18b14f4875
        • MD5 SHA1 SHA512 TLSH

        s_remove_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg
        • Size 720B
        • SHA256 a5c12fb31a23a0e88885d9bb93ceda6e881dfece05182342d4146ea60cbd75b6
        • MD5 SHA1 SHA512 TLSH

        duplicate.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg
        • Size 1KB
        • SHA256 b38d698534c930a6bfcbeb94dd511e4d6ec0509be2209b8916b2a0ae64aab682
        • MD5 SHA1 SHA512 TLSH

        remove.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg
        • Size 1KB
        • SHA256 b54eb6b66de16741302739010ffa66631186e4d33a657f2f9bc074833e445dde
        • MD5 SHA1 SHA512 TLSH

        s_backarrow_default.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg
        • Size 896B
        • SHA256 d55d3daa17208448144e019011eb31a700d37b27fab6b83efc65b0c27379ed77
        • MD5 SHA1 SHA512 TLSH

        s_comment_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg
        • Size 1KB
        • SHA256 87104211313fc908d20087779abc22f7c37f46b7e9967332970c8f3ad5343554
        • MD5 SHA1 SHA512 TLSH

        s_editpdf_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg
        • Size 1KB
        • SHA256 601c0efd7930ac8f2036d7e9478d6fb88bfccd778ed5b382a9a68ba9d81e1838
        • MD5 SHA1 SHA512 TLSH

        s_export_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg
        • Size 7KB
        • SHA256 37d9f195bfc7ffa8fdca6043cbb36f4a09b9158580129fc99e7bb5dffd404f74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        s_fillandsign_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg
        • Size 2KB
        • SHA256 ca2d021e167acdb89fa881d2154569ee14028d082fab646dd4aadd714fba0d87
        • MD5 SHA1 SHA512 TLSH

        s_folder-default_32.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg
        • Size 560B
        • SHA256 62939ecb4960d5c0f4d72e7de6440054dc282fc73869d5858e01e17d72f54aaf
        • MD5 SHA1 SHA512 TLSH

        s_move_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg
        • Size 1KB
        • SHA256 d2304abbcea1f7f582562e37959faaeeeaf841fb627145dba92f7864209bf75a
        • MD5 SHA1 SHA512 TLSH

        s_nextarrow_default.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg
        • Size 880B
        • SHA256 bda5e5dab1901c8760f229a2e85fa926f469e4376fd4ce191bce5fb04ecb9168
        • MD5 SHA1 SHA512 TLSH

        s_organize_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg
        • Size 1KB
        • SHA256 80d8f5c6007322edff4db776db5127320e948202750e68b00a4bf7b007b2574c
        • MD5 SHA1 SHA512 TLSH

        s_rename_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg
        • Size 1KB
        • SHA256 9bdd4c79b2a2ca6e8f11bebee94b5b4eba65436ee9fd9b859b8dde00a6fb80a6
        • MD5 SHA1 SHA512 TLSH

        s_sendforsignature_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg
        • Size 2KB
        • SHA256 2de56b7a86dfca9df8c62663f29e103680e2a2b08732f2a62273bb4d2ed32271
        • MD5 SHA1 SHA512 TLSH

        s_share_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg
        • Size 1KB
        • SHA256 3ec23876264e690c31cbd525c2fdec8ceb099f140235465689c6673994b7da1b
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js
        • Size 3KB
        • SHA256 aa7219c1e45f631de6f17bfd6eae7f40ef6d2bdf1e4a4d9dc52bcfea606e6ef3
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js
        • Size 28KB
        • SHA256 6fbb703dd883540c6a397976b40bca5eb9325a417cc13b8dcb9604e95347fdfc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js
        • Size 7KB
        • SHA256 b9673553b7283b9d5704d20189aead72e0e4b7d6b782db235470f99f970ea021
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js
        • Size 896B
        • SHA256 7788bb172d301432127031b0d53002d418671d7d81116a6717bd8b0692ca6485
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js
        • Size 4KB
        • SHA256 d6f0081c438bac30b4d1ace2a97f11f53160b267576fc222fdf07aa15d925c3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js
        • Size 1KB
        • SHA256 6b53573806441ec8264a5da14b0257c7811892e538311bbc77cbe1111b3c760d
        • MD5 SHA1 SHA512 TLSH

        convertpdf-rna-selector.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js
        • Size 175KB
        • SHA256 120f18ada1b74b62c503277124f0de4582dc4dfa2db10f6e3959fbab4d930a06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        convertpdf-rna-tool-view.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js
        • Size 376KB
        • SHA256 e09758ff90522a0a3c9560669ec07a097fadca326bfb86d10f653ad942496928
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js
        • Size 2KB
        • SHA256 2b2922fbb050cb3efcaeec139f1817d873f26078cc522cb9a65c167be40b2a87
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js
        • Size 1KB
        • SHA256 75a469a08d7c89f17af49e8757e94892e5ae395adf796f2747b4b3e73b06064e
        • MD5 SHA1 SHA512 TLSH

        example_icons.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
        • Size 688B
        • SHA256 5e1be3d36732e204d0f88637b09194d25d585d752520193ad5dda6c4325faf87
        • MD5 SHA1 SHA512 TLSH

        example_icons2x.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
        • Size 1KB
        • SHA256 7362fec4406496a79168425a6c0e3d6f120f9e7a56eabb35ce3aa65f9137958d
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
        • Size 448B
        • SHA256 602fdc47de440806f9e8f74679c6a9b53d36d6189babfe28756f877e72037b23
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_2x.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
        • Size 624B
        • SHA256 5d559ef00e16aa656f62f6e5fa6fe547b14eef56177243bd39bf200a335dff72
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_hover.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
        • Size 400B
        • SHA256 4dbbda869b9be4e946f2e088bfe18cac26cb8d90cb46897381959c47a0814609
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_hover_2x.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
        • Size 560B
        • SHA256 5e76ca312c407c84420f2d32d37d3a6cb261adba92d185630a8dc73e0a510a55
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
        • Size 400B
        • SHA256 be52d7758a33fbd9eb31ca75eb3b182bac7f7257385dc6992333ec1f9836a430
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_2x.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
        • Size 560B
        • SHA256 51cf54952e070b88f0ed3cf903ec09b647c1d2dfc690fffda109d226afed9a69
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_hover.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
        • Size 400B
        • SHA256 83ea472484e2b4c21b82db3f7f973620704966f5222b054f398e45987ab00602
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_hover_2x.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
        • Size 560B
        • SHA256 a06d3502b62766226686c789834df19a4b78da6712b18f3b7fb911fcf5003692
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js
        • Size 1KB
        • SHA256 d17043914402223c8cbf757cd05eddd96a2ee2daacd164c89dabff8ba979f92c
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js
        • Size 1KB
        • SHA256 fdb6b75d05f3eecda57aac9a55ddecb84917e7818fd23eb9ed276e63591d84e5
        • MD5 SHA1 SHA512 TLSH

        s_checkbox_unselected_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_checkbox_unselected_18.svg
        • Size 912B
        • SHA256 f5ea8a153c79a9f5b888fcb2f3bb2c0db2040be7027b1e102367f3fb18650001
        • MD5 SHA1 SHA512 TLSH

        s_checkbox_selected_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_selected_18.svg
        • Size 1KB
        • SHA256 5902a0fbc133d5b3ba95e8df6637853c10170cd0372d0bbf895ff4239d363b42
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js
        • Size 8KB
        • SHA256 b1e3e58cc1517b4059d04fcb01c3fdd0d6a989dc80386fd29fb5075d1cfe2e15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js
        • Size 1KB
        • SHA256 44f77b9f98554350032df0d0390f0485be886a4210c9bca4a55d9913f601a926
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js
        • Size 1KB
        • SHA256 d478c67686031e973bd5ab7f59974abe998738c02b836488305fe2e4f93c4563
        • MD5 SHA1 SHA512 TLSH

        icons.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
        • Size 7KB
        • SHA256 15d3ec7b4e61c7ecedeb1b0bb82726c4bcca73b4ee4e05aebe2c4bd9f1e67a13
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icons_ie8.gif

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
        • Size 7KB
        • SHA256 d5e5340beae42fd52bdb5205f56c7b0534c0e58e5cea9b34cf79b133a5623b4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icons_retina.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
        • Size 15KB
        • SHA256 9dafceea02ac2bc613a2efecd2eed1f47e82cf9fd8cb6e8f4f0b70cd7f7c5d3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        new_icons.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
        • Size 8KB
        • SHA256 73241813aae981c9e7266b5dd5c46f25f37648c72e376606057d66888f43551e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        new_icons_retina.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
        • Size 17KB
        • SHA256 163e69f951feb42d3db5da3461712660ef8c15be791cccf5a6750bcfc7a9517a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js
        • Size 832B
        • SHA256 61dfad6163062bb1dff060df21859263181d2f507222102c0e83a4524538cae5
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js
        • Size 864B
        • SHA256 90abafd52c8ce0c3bb2cee0bc01fa8c62a8058323976316a8b906fcf0425c60e
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js
        • Size 1KB
        • SHA256 0cecc7486c2e6d87f3e57559e79735f3f8eaceef40cba2ad0450ab33b05d7e4e
        • MD5 SHA1 SHA512 TLSH

        bg_pattern_RHP.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
        • Size 192B
        • SHA256 c4c819dca1aade355c592151b0f435d3fb2a1308bd62eec5a3c2926fecde1212
        • MD5 SHA1 SHA512 TLSH

        bg_patterns_header.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
        • Size 704B
        • SHA256 645e63837becb556184fa45a526b162181fe4bd1dea77550ed7c3190fca56ead
        • MD5 SHA1 SHA512 TLSH

        illustrations.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
        • Size 8KB
        • SHA256 ae5aabc3082d3be1b92c4b3a299a581a7f09fa8de2b59de96cfb1c5336e6bd85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        illustrations_retina.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
        • Size 19KB
        • SHA256 795ad3fcff40c4892c6a5b21868d477c6bdf68d93e939e4b9d175af6058824e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js
        • Size 1KB
        • SHA256 380e706bebcb8f7a9a8b2155e0a9732c08e221aa3416ba04ef2b27c1f4f193a7
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js
        • Size 1KB
        • SHA256 5a8c312e05b670dd02c25f9273d3e7570f21a8deeed08fb52d261b62f5cf5f05
        • MD5 SHA1 SHA512 TLSH

        main-selector.css

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css
        • Size 816B
        • SHA256 e13db4b7b0bc5d05cd7907ece8117a6eaa7e11baf2b1579c9b63e542b5a24df3
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js
        • Size 1KB
        • SHA256 0572bc2a5a783ce41a021335bc139af7ae864dbe050e858a9fb5c1e9a8a1d816
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js
        • Size 1KB
        • SHA256 659312541272902a89a69bd6201781b9a99d9bbbd73d0a330937600e37ce066b
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js
        • Size 1008B
        • SHA256 fa7ac51d956d694663e3b4bbf76b61b8b9cf602670a1e6165f66d1925e830ea3
        • MD5 SHA1 SHA512 TLSH

        DECRYPT_YOUR_FILES.HTML

        • Path C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
        • Size 1KB
        • SHA256 33425138b7f205bf2401f49d683554772cbcb35a1c3b6296199350d73ec595fe
        • MD5 SHA1 SHA512 TLSH

        af_NEUTER.pak

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\af_NEUTER.pak
        • Size 32B
        • SHA256 1381e47867e8ccc2c5358d8f5750fc708f96edbcf15ef86b5e8a615c4b366a8e
        • MD5 SHA1 SHA512

        win32_LinkNoDrop32x32.gif

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
        • Size 160B
        • SHA256 46c99df5b42a9a20d4a3dbea737f36bfa1839840e626cc6abdf648cae2087511
        • MD5 SHA1 SHA512 TLSH

        THIRDPARTYLICENSEREADME-JAVAFX.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
        • Size 192B
        • SHA256 4f4d527f7aade0cf9a6502c68648e87a84acc280b2b2fa02ad0faa24dfe04876
        • MD5 SHA1 SHA512 TLSH

        THIRDPARTYLICENSEREADME.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
        • Size 192B
        • SHA256 946957578dae2bb6238013301aff4b5f99ef0392d0e2b9214d29145515073c27
        • MD5 SHA1 SHA512 TLSH

        directshow.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
        • Size 1KB
        • SHA256 0d2566e9bc8a13465bfbe8666145460d7f7493ce514495aaad8bb7661c89f0f8
        • MD5 SHA1 SHA512 TLSH

        glib.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
        • Size 31KB
        • SHA256 8f8a27aeafdcd178a0a421c5e3d88e3d9d036c2e8e371745cb167554b3041e03
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gstreamer.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
        • Size 34KB
        • SHA256 2673c993da7152bc27a17aa700380449a99c76dfa1b14b0fbc99ecdb9e584e45
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icu_web.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
        • Size 23KB
        • SHA256 23f37347866eeac2380eae69c8ee9062fb2645ffd878c578231991fa3aa7dc8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jpeg_fx.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
        • Size 2KB
        • SHA256 ed4aab1338a8eca3e834b70d1764ae0e164ee12f2e206474b4705ecee2c701a2
        • MD5 SHA1 SHA512 TLSH

        libffi.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
        • Size 1KB
        • SHA256 78846e1be421b4fc9b500b6b80dc5a82e3a3f39482790afd790524a02331e808
        • MD5 SHA1 SHA512 TLSH

        libxml2.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
        • Size 3KB
        • SHA256 51293e66e5c48064bec12220ac2f76373348088178f9a2a8066b97f82b29c704
        • MD5 SHA1 SHA512 TLSH

        libxslt.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
        • Size 2KB
        • SHA256 8a19c477ad5eb4c79b764ed3942260ead7e8be8277ff92699729665cbf81a9eb
        • MD5 SHA1 SHA512 TLSH

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
        • Size 5KB
        • SHA256 489992b80d5d4fe15f2abf067486006a56ded62c51952bdfa5127edcfe502785
        • MD5 SHA1 SHA512 SSDEEP TLSH

        public_suffix.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
        • Size 17KB
        • SHA256 b420a10d74bb1fb282eb876d0b13c419c12c99f1b43892202370d32bf76e65cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        webkit.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
        • Size 320KB
        • SHA256 4ee5437e310ccfde3bf8229911c0e5a3295288a14861d337eea39fb4bb3fe503
        • MD5 SHA1 SHA512 SSDEEP TLSH

        asm.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
        • Size 1KB
        • SHA256 f044754e34411286ae3d4cdab8f8f672e38c3f4859a9482aefff6a114fcde355
        • MD5 SHA1 SHA512 TLSH

        bcel.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
        • Size 10KB
        • SHA256 fc68d227e26a898eddc202d841722deb87680b96031e9fa9898e9f6c40e3e0f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cldr.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
        • Size 3KB
        • SHA256 5341b6b351a2c3866e16873ec50f5edd3f32e10f10edc0c9b113d69f19cc8484
        • MD5 SHA1 SHA512 TLSH

        colorimaging.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
        • Size 176B
        • SHA256 764dd576cb3835b5c734654fbaffe004889dc1f725d88a42b0cd15f532f6e81b
        • MD5 SHA1 SHA512 TLSH

        cryptix.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
        • Size 1KB
        • SHA256 aa0f42be992d239c3ad9326f029a8b3789e1e4883472934471c7425d134867d8
        • MD5 SHA1 SHA512 TLSH

        dom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
        • Size 3KB
        • SHA256 fd47813ec254f8c40440046422899c0440290269a0a53d3c02a7458a0f15b7da
        • MD5 SHA1 SHA512 TLSH

        dynalink.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
        • Size 1KB
        • SHA256 1a5c84393337363508f1fd78c17794a248597050a0fd529e16d279d9ce091c8e
        • MD5 SHA1 SHA512 TLSH

        ecc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
        • Size 28KB
        • SHA256 9c1079f1be59fccb0db77759f24af408fae1078dd8fde630a0c0637f9ecfa7de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        freebxml.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
        • Size 2KB
        • SHA256 1c05061028234cf0878919329752f3b6687177f7b92776584c35ee7d2af8c6f2
        • MD5 SHA1 SHA512 TLSH

        giflib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
        • Size 1KB
        • SHA256 04c47cb0e6edbe48adf387cf52cf5c2e6afd1a9fe226ceae317d7e14a22a55c0
        • MD5 SHA1 SHA512 TLSH

        icu.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
        • Size 2KB
        • SHA256 ac84218dae4d83f11b7f6f97fd98c88588f28dd300b23f63f63c0f589f35e003
        • MD5 SHA1 SHA512 TLSH

        jcup.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
        • Size 1KB
        • SHA256 aee0604902fd11f15d91a6049744ea949781b2f0ade0198f093ee183115ba0e4
        • MD5 SHA1 SHA512 TLSH

        joni.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
        • Size 1KB
        • SHA256 698b3377fb682c0369c676ca32b41b19a31f7e59f8b9c371fe5b3b71ead561c7
        • MD5 SHA1 SHA512 TLSH

        jopt-simple.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
        • Size 1KB
        • SHA256 bc84d81e275a613e71369ce988d27dfe9bbb9d02b8f035e2e30280a96312d4da
        • MD5 SHA1 SHA512 TLSH

        jpeg.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
        • Size 3KB
        • SHA256 194deb0d355909c14a0ab0e69e9576209b55e96e032eb6b8875eb9b4a3d10b93
        • MD5 SHA1 SHA512 TLSH

        lcms.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
        • Size 2KB
        • SHA256 ff04e914b3698d4157dd31949ac2edfe90dbaa07166dcc896eaffb1096b2d754
        • MD5 SHA1 SHA512 TLSH

        libpng.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
        • Size 6KB
        • SHA256 9456d04d58ceea68e1be932bc571a2a2fb8a8f1c8686064d21ab2dc48c662730
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
        • Size 5KB
        • SHA256 99df72eca0b54f02c02df717aaeb8e4a245d70f5ea0b4907f3c95beedfbe9f87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkcs11cryptotoken.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
        • Size 3KB
        • SHA256 251629803573693db81c132f5d7b000ded87cf72558fe5b9f543a8b03846f7c5
        • MD5 SHA1 SHA512 TLSH

        pkcs11wrapper.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
        • Size 2KB
        • SHA256 93070f53315cacb12148331ddf722888ddf274d525a9b3c8be6ebd0a14c68e83
        • MD5 SHA1 SHA512 TLSH

        relaxngcc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
        • Size 2KB
        • SHA256 2f7d8f310ae9fe74bd65f882cdd17fe02ef6c45f8a8526bc6381aee5db2e47b6
        • MD5 SHA1 SHA512 TLSH

        relaxngdatatype.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
        • Size 1KB
        • SHA256 e164d34d783d5c5f08c3c8fcf3f16d72dd5362ebeb663c645b69dd41a8b246c7
        • MD5 SHA1 SHA512 TLSH

        relaxngom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
        • Size 1KB
        • SHA256 217d5781ad66ed3979c9c0e60da739f7bc194b08f8b201eefa8448c30ce5f735
        • MD5 SHA1 SHA512 TLSH

        santuario.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
        • Size 11KB
        • SHA256 b54d93d9e0091de2d9c4fbbb48cbcbdb3671b0789f52eea1121829c383b9a534
        • MD5 SHA1 SHA512 SSDEEP TLSH

        thaidict.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
        • Size 1KB
        • SHA256 961d3394d6882e9f5a051dfcd0dee001f1b5ec4ee35375a757b0da0c3bae0897
        • MD5 SHA1 SHA512 TLSH

        unicode.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
        • Size 2KB
        • SHA256 7d1a8307126a9669900e149b30acd69cb0a6c97e6a16238801e3c20ff464f6ce
        • MD5 SHA1 SHA512 TLSH

        xalan.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
        • Size 11KB
        • SHA256 2c69a528b11ca9b4fc97b5a14b6485402a6d055d64ab90a41bc228340c1a0f58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xerces.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
        • Size 11KB
        • SHA256 b9aac18de518af9e8f4e25f2cf28b656c37aaf7425ea1c9d13d1714dd59e601b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xmlresolver.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
        • Size 11KB
        • SHA256 4be1014241461c44684ceae50008b3b8d0be5242399c94e34708a8be3b79d820
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zlib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
        • Size 1024B
        • SHA256 22f3b812b2636d00d09bf0828a1a57798503a1ea7b1f171efcdbac671f8447ee
        • MD5 SHA1 SHA512 TLSH

        ClientSub2019_eula.txt

        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
        • Size 48B
        • SHA256 7911a3e363739d3d1c1a8d178f18f3a65d7bb7305a09336d675d1cec8a5df2ea
        • MD5 SHA1 SHA512

        prep_Activatable Class_Hermes_perf.cache

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 595B
        • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
        • MD5 SHA1 SHA512 TLSH

        WindowsUpdate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
        • Size 21KB
        • SHA256 489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4776-138-0x00000190801E0000-0x00000190802E0000-memory.dmp

        memory/4948-23-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-63-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-5-0x0000000074700000-0x0000000074EBC000-memory.dmp

        memory/4948-121-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-99-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-101-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-77-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-69-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-53-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-45-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-37-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-135-0x0000000074712000-0x0000000074713000-memory.dmp

        memory/4948-136-0x0000000074700000-0x0000000074EBC000-memory.dmp

        memory/4948-324-0x0000000006830000-0x000000000683E000-memory.dmp

        memory/4948-6-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-9-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-11-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-13-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-15-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-17-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-19-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-21-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-1-0x0000000002620000-0x0000000002652000-memory.dmp

        memory/4948-25-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-27-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-29-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-31-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-33-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-35-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-39-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-41-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-43-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-47-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-49-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-51-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-55-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-57-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-59-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-61-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-0-0x0000000074712000-0x0000000074713000-memory.dmp

        memory/4948-65-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-67-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-71-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-73-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-75-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-79-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-81-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-83-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-85-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-87-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-89-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-91-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-93-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-95-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-97-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-103-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-105-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-107-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-109-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-111-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-113-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-115-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-117-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-119-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-124-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-125-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-134-0x0000000004DF0000-0x0000000004DFA000-memory.dmp

        memory/4948-127-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-129-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-133-0x0000000004CB0000-0x0000000004D42000-memory.dmp

        memory/4948-132-0x0000000074700000-0x0000000074EBC000-memory.dmp

        memory/4948-130-0x0000000074700000-0x0000000074EBC000-memory.dmp

        memory/4948-131-0x0000000004E40000-0x00000000053FA000-memory.dmp

        memory/4948-7-0x0000000002660000-0x000000000268B000-memory.dmp

        memory/4948-4-0x0000000074700000-0x0000000074EBC000-memory.dmp

        memory/4948-3-0x0000000074700000-0x0000000074EBC000-memory.dmp

        memory/4948-2-0x0000000002660000-0x0000000002692000-memory.dmp

        memory/5272-335-0x0000000000A80000-0x0000000000A8C000-memory.dmp