Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 11:09

General

  • Target
    Fantom.exe
  • Size 261KB
  • Sample260930-m9b95szwhy
  • SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Path
  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
  • <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>NnRH0VAav4QEDmF/rqVQy35GMJAU2ibdfq6tCQw4xSoY3oq6kW18igxeEM8PzS15IAdQp3UUdaoQUdQWZXijR7In2aCkSS4dcrBaBzIGRjfWumK2EbZAVQ9z+yaOadMH6nydR1Bv67Nd/rkBVLKHWEKs1zAp9ckoPqJsjcNnkmQecu2lvmpxbpoD1THGBRxfsaMfQHUw7s+26+pV4ltzRBH472ahKUObXjzLI9zNt153uZxzZFEwPyngyKBwH2/9rm8gqtMGFAUhsKEOP8wbrEcL2A5pYQJKf3NtQUkCmlHDEAfK8abI3EXgQinwLs/rGQz7Xo9mGltE90yewMPLOg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Family: Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1214) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5608
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:1688

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DECRYPT_YOUR_FILES.HTML

        • Path C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
        • Size 1KB
        • SHA256 a9778e9fb3d9e6da1483018b137261f8a637ece934dd1375b9b9381a897ebc38
        • MD5 SHA1 SHA512 TLSH

        af_NEUTER.pak

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\af_NEUTER.pak
        • Size 32B
        • SHA256 2d3a4d270f7b0645f6ddabef850ed1b5b5d98bef33906819bd879defe082c640
        • MD5 SHA1 SHA512

        win32_LinkNoDrop32x32.gif

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
        • Size 160B
        • SHA256 fdc411410da4ee8dae1247ea1ccb025e936d251d37b4e2d22592004559eb277c
        • MD5 SHA1 SHA512 TLSH

        THIRDPARTYLICENSEREADME-JAVAFX.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
        • Size 192B
        • SHA256 b2d4374627dd5dfdc84be75d803d7de1379f522907e23f60b1954d2455d783a4
        • MD5 SHA1 SHA512 TLSH

        THIRDPARTYLICENSEREADME.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
        • Size 192B
        • SHA256 b8e34171c43845fa1daf3f5b5d519c113efe8ac26e1b73031bed0d56da36e2d5
        • MD5 SHA1 SHA512 TLSH

        directshow.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
        • Size 1KB
        • SHA256 6e390a914c6aa10e15fee66044d3baa3b1e35af1fd448a7516a422fd3482883a
        • MD5 SHA1 SHA512 TLSH

        glib.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
        • Size 31KB
        • SHA256 bb070d3db5df0883c3d237be3557821963b80a777ebadd1afc0a1882de325c26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gstreamer.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
        • Size 34KB
        • SHA256 315572f87247bcbf08e268021575c4808141d66466ce0178c6e3c755c9fd871e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icu_web.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
        • Size 23KB
        • SHA256 47b0ff91769e8ebed674810a5dc7b5c72e23cf0934f66adfc6938422b0803630
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jpeg_fx.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
        • Size 2KB
        • SHA256 be00b925728edb8c3e0f04df79e504aa49d1676ae38a4a28aa2be16839d04187
        • MD5 SHA1 SHA512 TLSH

        libffi.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
        • Size 1KB
        • SHA256 0ac70177b6fbd0a8a589f55560ccab5c601139ec4853d17359278fafa7ef74ca
        • MD5 SHA1 SHA512 TLSH

        libxml2.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
        • Size 3KB
        • SHA256 f442e2c8966bef955421ecfa410b67ce4df950c11477ea261c7d539706b5070b
        • MD5 SHA1 SHA512 TLSH

        libxslt.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
        • Size 2KB
        • SHA256 2e4992bf0859e7ea08a673045cbce0be6816a5140e3487b7fb66eff5f0cd57a6
        • MD5 SHA1 SHA512 TLSH

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
        • Size 5KB
        • SHA256 de4ce18cf34cb2a0159c8243f1e2be7b2273de4694cc8f4247878734bc5ce648
        • MD5 SHA1 SHA512 SSDEEP TLSH

        public_suffix.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
        • Size 17KB
        • SHA256 303a696a608355784ade2e44d143fb0f421364b7ec3ed1e08696da238c826f1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        webkit.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
        • Size 320KB
        • SHA256 60ef48f9d6ee322dbd71997ef1701f97872edabacd9ff6fbf1ac28b5b8284159
        • MD5 SHA1 SHA512 SSDEEP TLSH

        asm.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
        • Size 1KB
        • SHA256 5bdd2f6d7f87996dbad75e05e5dda8164cc99ee856bdba73c150a247dc61d834
        • MD5 SHA1 SHA512 TLSH

        bcel.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
        • Size 10KB
        • SHA256 27d30db3cdaff639fea968f873ca74e2204ad1451b11c6971ecf414bf953026d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cldr.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
        • Size 3KB
        • SHA256 4e1967a7ee8fe4edbcd4f547b141d8af3f153fe06141710bbc5078a14c23b137
        • MD5 SHA1 SHA512 TLSH

        colorimaging.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
        • Size 176B
        • SHA256 fd8cad261f116e43b12b15fbfcc6b8e9f851979cf45f3e5fe16681718f751508
        • MD5 SHA1 SHA512 TLSH

        cryptix.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
        • Size 1KB
        • SHA256 77c2c25b84ef2a7796bdb6184b2cdff743ea3b1a8ab8d2b350b0a66d6269fd97
        • MD5 SHA1 SHA512 TLSH

        dom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
        • Size 3KB
        • SHA256 15c537daaf024881ce29e5bdd94f40885fbf035f9331d6ce8a1e605101a47c27
        • MD5 SHA1 SHA512 TLSH

        dynalink.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
        • Size 1KB
        • SHA256 b7dc433335b3f550c52a134c9b58c6fb44a39399eef87b6bad77890ef3a10c54
        • MD5 SHA1 SHA512 TLSH

        ecc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
        • Size 28KB
        • SHA256 39c0aebd164f96cf090fad145fbc80ecdfa38a926b8da5ff37e634e69d643151
        • MD5 SHA1 SHA512 SSDEEP TLSH

        freebxml.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
        • Size 2KB
        • SHA256 acd09c91f675897ad53afe86f212bf642f1add391a36c14a43ceda3c462dc0e7
        • MD5 SHA1 SHA512 TLSH

        giflib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
        • Size 1KB
        • SHA256 1c555264f169f7d9d2d7540b357f0eb24afb98bff047932b12cf1c4c93f11056
        • MD5 SHA1 SHA512 TLSH

        icu.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
        • Size 2KB
        • SHA256 a9dcc4b5d8ff53c12c24e583fa8561975bfe67bb79615d3a524d60fa84b71b2a
        • MD5 SHA1 SHA512 TLSH

        jcup.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
        • Size 1KB
        • SHA256 c880afd888ab56f032c5623ba01ec77cadf2341e9fce70b008f848b76ae3af0a
        • MD5 SHA1 SHA512 TLSH

        joni.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
        • Size 1KB
        • SHA256 8d6c1b83a7d62174b0ef8cb35d0adae506e009d7acbd1f062b2db0aa9a4dc7c9
        • MD5 SHA1 SHA512 TLSH

        jopt-simple.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
        • Size 1KB
        • SHA256 8b51588343e3fd88d516761a5319b42e85f96f47dd132af46529de5a80d2e7e7
        • MD5 SHA1 SHA512 TLSH

        jpeg.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
        • Size 3KB
        • SHA256 693345524079cbe99c6a3684931d20fdcce6be9f0b746f28b00568d8eec0f116
        • MD5 SHA1 SHA512 TLSH

        lcms.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
        • Size 2KB
        • SHA256 697589411b30702e1e4199dd51dac7687e483de82b2a9be6f35a4e8a8ad2710a
        • MD5 SHA1 SHA512 TLSH

        libpng.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
        • Size 6KB
        • SHA256 3841a206dd3c8d8f96982222fb3563a81aa0d8ab474dec30f0cb96ed26c4ec3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
        • Size 5KB
        • SHA256 43862420dbfdc78c04e207e1e4a06a34e94a6b8c02c6de7ccf503a43eaf7b634
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkcs11cryptotoken.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
        • Size 3KB
        • SHA256 822e7b5678d360e48e073d6d27376dac9dc489f73ae374ff713e28c1e7dcbf47
        • MD5 SHA1 SHA512 TLSH

        pkcs11wrapper.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
        • Size 2KB
        • SHA256 4da04b1a135db211961a1a8bd412bc9d1a100d89e23c8d3cd03a2a130f8e2019
        • MD5 SHA1 SHA512 TLSH

        relaxngcc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
        • Size 2KB
        • SHA256 3af247ea403f96f9ea98f0a2b8bd1e6c81672d5bbdae8bb0fd93e58ca972ce95
        • MD5 SHA1 SHA512 TLSH

        relaxngdatatype.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
        • Size 1KB
        • SHA256 28199ddb839fa0a509dfe24f5b1980f0afec4a85fedd64f58bfd60f2512050d7
        • MD5 SHA1 SHA512 TLSH

        relaxngom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
        • Size 1KB
        • SHA256 2d56d893f41a1f7e534cadf3059a39e7c720339d7c9bee4d0c925f3c91434e46
        • MD5 SHA1 SHA512 TLSH

        santuario.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
        • Size 11KB
        • SHA256 8691f80f6a6b9dce3fa96354431ec2a193035c69855f8cd375468316cf06b42f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        thaidict.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
        • Size 1KB
        • SHA256 52a5cdc51dc38a5baa5bd580e99c3e10a13d5b9c80d77750a4035bb1265ba80c
        • MD5 SHA1 SHA512 TLSH

        unicode.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
        • Size 2KB
        • SHA256 00f3f7321efd6e6689e41d4711908ff649306cbce72b2c8fa30fe52fbd8d81e1
        • MD5 SHA1 SHA512 TLSH

        xalan.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
        • Size 11KB
        • SHA256 8a1847297247a7fa591882ac4ee7693e82dec8858a3baf53c02410125599bac6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xerces.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
        • Size 11KB
        • SHA256 01b76157739494038d7fae6d1224a20499f2b3796f41249878995a2932bf0d5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xmlresolver.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
        • Size 11KB
        • SHA256 204da5d1f8e236dc3534735507ee8e7449f73acc10e93c0ea3c16bee5cc8c922
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zlib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
        • Size 1024B
        • SHA256 37f78a718eacd1cf47a3e52598d7559640c8bd9b24918d177172089e7547c12a
        • MD5 SHA1 SHA512 TLSH

        ClientSub2019_eula.txt

        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
        • Size 48B
        • SHA256 94b39dc50728ddf94727be749ac8a3e9d22a07fb2733f39d4991e95b89f41fe9
        • MD5 SHA1 SHA512

        WindowsUpdate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
        • Size 21KB
        • SHA256 489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1688-149-0x0000000000EF0000-0x0000000000EFC000-memory.dmp

        memory/1688-150-0x000000001C7E0000-0x000000001C7F0000-memory.dmp

        memory/1688-612-0x000000001C7E0000-0x000000001C7F0000-memory.dmp

        memory/5608-86-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-72-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-38-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-37-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-35-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-32-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-26-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-25-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-20-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-18-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-16-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-14-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-12-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-10-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-8-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-6-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-114-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-74-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-30-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-28-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-22-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-5-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-134-0x0000000004B80000-0x0000000004B90000-memory.dmp

        memory/5608-135-0x0000000004B80000-0x0000000004B90000-memory.dmp

        memory/5608-136-0x0000000004B80000-0x0000000004B90000-memory.dmp

        memory/5608-137-0x0000000005550000-0x000000000555E000-memory.dmp

        memory/5608-44-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-46-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-48-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-51-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-55-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-56-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-58-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-60-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-63-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-64-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-67-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-68-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-71-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-42-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-76-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-78-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-80-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-82-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-84-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-0-0x0000000004B80000-0x0000000004B90000-memory.dmp

        memory/5608-88-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-90-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-92-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-94-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-96-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-98-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-100-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-102-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-104-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-107-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-108-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-111-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-112-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-116-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-118-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-120-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-122-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-124-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-129-0x0000000004B80000-0x0000000004B90000-memory.dmp

        memory/5608-130-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

        memory/5608-133-0x0000000005370000-0x000000000537A000-memory.dmp

        memory/5608-132-0x0000000005140000-0x00000000051D2000-memory.dmp

        memory/5608-131-0x0000000004B90000-0x0000000005134000-memory.dmp

        memory/5608-126-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-128-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-52-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-40-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

        memory/5608-4-0x0000000004AC0000-0x0000000004AF2000-memory.dmp

        memory/5608-3-0x0000000004B80000-0x0000000004B90000-memory.dmp

        memory/5608-2-0x0000000004B80000-0x0000000004B90000-memory.dmp

        memory/5608-1-0x0000000004A50000-0x0000000004A82000-memory.dmp