Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 11:09

General

  • Target
    Fantom.exe
  • Size 261KB
  • Sample260930-m9b95szwhy
  • SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Path
  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
  • <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>B02FDmslHRAan9nzsasn5bMDkqaL4qDQ7updxK1yoB9EwGc8++TpAwsgFvoEyKQ7KhQyz39ay7Db8Su64G2MOGjLJDpbYoKzhDbCh8euxsmZhtlVtHOUnJjxpzqD1Gsl2duoMV1rQNoX5+9o7yQisiD0LD03u2Ahaqk+bKQTL4CldpIqCADFSbcRLMT0ajR/w5+8BN7NfZvQOLbtHcM628VBpjoBsgzN2JNd0IG6ZZNnxGkKDPdgcmtq/R73Q0JPFPqujViCOMKUY+ZkwXNtCw6XMPEE3igRV+tp7B/ITI65ja4m1zoZlnwDCXZZGRlVML6uXloqnJ/CHAd6Kw05Sw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Family: Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (78) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3260
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:4928

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cef_200_percent.pak

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak
        • Size 16B
        • SHA256 fdb3c7949ad8625c7dc3ec68403af9b6fc53a9ffff60b663e2b0617466552c3d
        • MD5 SHA1 SHA512

        aic_file_icons.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
        • Size 50KB
        • SHA256 8ab6c65d5a950e35881ff8fa75212af67abc2f71d8ffdc020ebbde61292d996d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        selection-actions.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png
        • Size 1KB
        • SHA256 f75f4c6ce59aa0f4023a1b9fed4095d5f49d276bc2a5c4b879a598b2d2a4efac
        • MD5 SHA1 SHA512 TLSH

        selection-actions2x.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png
        • Size 3KB
        • SHA256 a1712ba0c544892298732b2238fa55a30f4df9f1ef89772b900f43aa7f63ca91
        • MD5 SHA1 SHA512 TLSH

        s_remove_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg
        • Size 720B
        • SHA256 8ef0137e9ce58abb1119daa24e1aaf4c303b71703b6a752f2b9dfaf7a4797416
        • MD5 SHA1 SHA512 TLSH

        duplicate.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg
        • Size 1KB
        • SHA256 a312ed0d79573707e52254d0fbcf63b43ddfce237686b1c5eaecc3e0ba689109
        • MD5 SHA1 SHA512 TLSH

        remove.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg
        • Size 1KB
        • SHA256 a0bf6729ff3876a2d2871b10cbe130bb3546395fe312bb74c4b1fc10b92dbb52
        • MD5 SHA1 SHA512 TLSH

        DECRYPT_YOUR_FILES.HTML

        • Path C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
        • Size 1KB
        • SHA256 cb9db1e030438479ac08a3ffe1b9da43999eaab49e8d315a2b8e731ec0dfd761
        • MD5 SHA1 SHA512 TLSH

        af_NEUTER.pak

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\af_NEUTER.pak
        • Size 32B
        • SHA256 4b706250c16822f621eba36b0c0c8ec7e7fa7ec434469779f6099ba02ca97db3
        • MD5 SHA1 SHA512

        win32_LinkNoDrop32x32.gif

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
        • Size 160B
        • SHA256 e58184e2f2f509a5501d9e0ffe240439927400ce221d89dc7d4be76f03a646df
        • MD5 SHA1 SHA512 TLSH

        THIRDPARTYLICENSEREADME-JAVAFX.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
        • Size 192B
        • SHA256 a79e6c3373d62d86833ff8ca68a1a4042b27e84070746c29e6cad05ce29c0094
        • MD5 SHA1 SHA512 TLSH

        THIRDPARTYLICENSEREADME.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
        • Size 192B
        • SHA256 877aeeb5c91157cf5cc9d661359783c218a8b5c05630ae989816ea4036e425c8
        • MD5 SHA1 SHA512 TLSH

        directshow.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
        • Size 1KB
        • SHA256 d4791184cc38d8a4bbb379b8569f40c2eb5193c587a659a2c48f6cbeb09249de
        • MD5 SHA1 SHA512 TLSH

        glib.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
        • Size 31KB
        • SHA256 68927750c9b703fe4a3f22c7de1ba913484874e7aeefa06e65aacffc98f37339
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gstreamer.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
        • Size 34KB
        • SHA256 400bf6a475b7b9a5ec5e43217eb80839793a216de82531a2468e8be986c63ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icu_web.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
        • Size 23KB
        • SHA256 07bbef9c04c18b0242812b6764efd4fc68d037f988d0e4b8fb1fc3eb96481063
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jpeg_fx.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
        • Size 2KB
        • SHA256 0a27242c60e906134e0e8a8cdd9891e4225feefaee0c5cab64b894157ac7259f
        • MD5 SHA1 SHA512 TLSH

        libffi.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
        • Size 1KB
        • SHA256 cf7038e4afa9953c061425d48a75dfa536d9aca9ec9d25b60ff5b03fba290395
        • MD5 SHA1 SHA512 TLSH

        libxml2.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
        • Size 3KB
        • SHA256 acdde7ca81beec1d32bb3483d5d4c1a3b9dcce85a2a8a7d2b555297b7447643f
        • MD5 SHA1 SHA512 TLSH

        libxslt.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
        • Size 2KB
        • SHA256 fd85283db2dc2ba8c4af6db4a827b287b11ac0ee8ad981dfeadd048da8ddc492
        • MD5 SHA1 SHA512 TLSH

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
        • Size 5KB
        • SHA256 079989ba52e40aad6631c6945a76c47f83dbbfadef6bbade405d016d3a971acf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        public_suffix.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
        • Size 17KB
        • SHA256 548d28cbd257d079bf5043ad3a8c5fcf83bd727b66cd0034d8fd7b060e5b8ead
        • MD5 SHA1 SHA512 SSDEEP TLSH

        webkit.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
        • Size 320KB
        • SHA256 815d0a2ec0c676cf64828f569e78f53d1120d71ade1f33d9e037f39723932bf3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        asm.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
        • Size 1KB
        • SHA256 d85a231d91f35f315986c2d614af69b335910d61b67c5190184526053993ae53
        • MD5 SHA1 SHA512 TLSH

        bcel.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
        • Size 10KB
        • SHA256 fbfbeeea913dd45d076db6da59dcb6532234c8ca2c2ff1176c079afe959bde58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cldr.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
        • Size 3KB
        • SHA256 812b10a11d95b490fd389c07b6ecfe004f3b7efbf32424c2a617ce640b768b0f
        • MD5 SHA1 SHA512 TLSH

        colorimaging.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
        • Size 176B
        • SHA256 4114a00e93f3705d2387f67cbc446258c7b4e38b71ae4d0faccfcc213594f1e5
        • MD5 SHA1 SHA512 TLSH

        cryptix.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
        • Size 1KB
        • SHA256 17e5d77eec1f1387372e05a74fe1095c1c9e5654152125037d5f1b9b47429fb2
        • MD5 SHA1 SHA512 TLSH

        dom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
        • Size 3KB
        • SHA256 44c28036e02dc9b8ef5763c9ac023a89e9ad1d5610ddf4ccff5fe85d13b01c42
        • MD5 SHA1 SHA512 TLSH

        dynalink.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
        • Size 1KB
        • SHA256 d0968deb60c9d5cbbaa4eafaa5288c1a91e71e97c807a3a544ff562d89509b04
        • MD5 SHA1 SHA512 TLSH

        ecc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
        • Size 28KB
        • SHA256 0f60594786eb5c845e479aed3c656e249d4932efdda798800295995bfccee602
        • MD5 SHA1 SHA512 SSDEEP TLSH

        freebxml.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
        • Size 2KB
        • SHA256 c2e1ed20bc28e33bd6c8cddc4c422a457ad2635aa6eaea6e4a850a1ed3c65473
        • MD5 SHA1 SHA512 TLSH

        giflib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
        • Size 1KB
        • SHA256 a8fdd2c2f68940d118fa08f6f3f7fe7f3ec540b2091813558df023636cf8de05
        • MD5 SHA1 SHA512 TLSH

        icu.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
        • Size 2KB
        • SHA256 bfbc0637c664a2ee5134c01953679654a64c11970dd52a81347bf8e900701dff
        • MD5 SHA1 SHA512 TLSH

        jcup.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
        • Size 1KB
        • SHA256 12d94f564f9ac75798b8d100a9004b7b7e5594cb7726040ae1ab6206bd74c5fa
        • MD5 SHA1 SHA512 TLSH

        joni.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
        • Size 1KB
        • SHA256 9ce8e0f3dacfdaa07eb2c97518a5133a95d25fced2725c51320d233a661f4f11
        • MD5 SHA1 SHA512 TLSH

        jopt-simple.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
        • Size 1KB
        • SHA256 345c3bfb123f38134c048c44f12e7f5cb0bd9420bd07bb02a2b369e233499799
        • MD5 SHA1 SHA512 TLSH

        jpeg.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
        • Size 3KB
        • SHA256 a5b07f8042fcdbcc565cd89220dd6d8e024248b7b97e669b3e8aa221e6398017
        • MD5 SHA1 SHA512 TLSH

        lcms.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
        • Size 2KB
        • SHA256 260d40e27aacb63708b85c4f3c173d92e94635c49edcaaadd5ab12c956e05166
        • MD5 SHA1 SHA512 TLSH

        libpng.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
        • Size 6KB
        • SHA256 24708d0af4ffe98c558b5f37f38033a0f375fa71197e693919952ba70cfe0155
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
        • Size 5KB
        • SHA256 bacb8df9464e7c0f2c73969ad41740a2c86aaf7777e10b11bd63760a1f54b059
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkcs11cryptotoken.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
        • Size 3KB
        • SHA256 867c05bbeeeb72ae5b73c47413b702ac3114fef6e92225f2206cb0d97028d8af
        • MD5 SHA1 SHA512 TLSH

        pkcs11wrapper.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
        • Size 2KB
        • SHA256 fb18b405c36d13b2ef79647a50db50b96e0254266e6df77ee23e3da52db1276c
        • MD5 SHA1 SHA512 TLSH

        relaxngcc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
        • Size 2KB
        • SHA256 98bb574b1b02fe6551076052575563c461ff5e67d3d6be375df8808eb6504ead
        • MD5 SHA1 SHA512 TLSH

        relaxngdatatype.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
        • Size 1KB
        • SHA256 83a2ea0addff3ed019af8d26f5ca48f037ff8dc9cfe94d4f5321cd51c4b30b2f
        • MD5 SHA1 SHA512 TLSH

        relaxngom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
        • Size 1KB
        • SHA256 0ffbe80f2c3512bdf0d3d37faf3d197a6f321b06b3e8cf566d20a7f24c6e6473
        • MD5 SHA1 SHA512 TLSH

        santuario.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
        • Size 11KB
        • SHA256 386471b2671fb744d42a250f92e4440654e66fa475678b3c99c86a9c51aa6cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        thaidict.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
        • Size 1KB
        • SHA256 9dfc303a6dbd1bcd377be1cdee38f28eef1f860b7f48108c0a650418e07f41f8
        • MD5 SHA1 SHA512 TLSH

        unicode.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
        • Size 2KB
        • SHA256 f48c6f133a382052264895b2ca31be4ada94c7618741f463ec8376ec599e8ca3
        • MD5 SHA1 SHA512 TLSH

        xalan.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
        • Size 11KB
        • SHA256 f2c9975dd4ea22ad1efb606a78e7bf2e69dc3732ec1a934eed67cf0fb689edae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xerces.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
        • Size 11KB
        • SHA256 7d9fdda653e12b118f3f825e0d99721d6d96f370c5a59578974ce103819e6493
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xmlresolver.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
        • Size 11KB
        • SHA256 4eb607c808c21f0c498d4ddae1985173b422b50cdf1394a26b3dcaaf56b7b133
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zlib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
        • Size 1024B
        • SHA256 aa1b2e14ccf49c94cc19aede55be3fb8a77ccdc3b80068e365c54ec3e03ad6aa
        • MD5 SHA1 SHA512 TLSH

        ClientSub2019_eula.txt

        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
        • Size 48B
        • SHA256 382cb2ca9651abfde70ac6ea67bf13645f74845c077a49c2c42a542c274ab501
        • MD5 SHA1 SHA512

        WindowsUpdate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
        • Size 21KB
        • SHA256 489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3260-70-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-104-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-10-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-8-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-6-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-5-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-113-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-99-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-94-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-78-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-62-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-46-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-44-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-42-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-36-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-30-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-28-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-18-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-15-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-135-0x0000000074442000-0x0000000074443000-memory.dmp

        memory/3260-136-0x0000000074430000-0x0000000074BEC000-memory.dmp

        memory/3260-137-0x00000000055A0000-0x00000000055AE000-memory.dmp

        memory/3260-16-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-1-0x0000000002610000-0x0000000002642000-memory.dmp

        memory/3260-2-0x0000000074430000-0x0000000074BEC000-memory.dmp

        memory/3260-3-0x0000000002770000-0x00000000027A2000-memory.dmp

        memory/3260-4-0x0000000074430000-0x0000000074BEC000-memory.dmp

        memory/3260-122-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-128-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-126-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-130-0x0000000004CA0000-0x000000000525A000-memory.dmp

        memory/3260-133-0x0000000074430000-0x0000000074BEC000-memory.dmp

        memory/3260-20-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-132-0x0000000074430000-0x0000000074BEC000-memory.dmp

        memory/3260-131-0x0000000005280000-0x0000000005312000-memory.dmp

        memory/3260-129-0x0000000074430000-0x0000000074BEC000-memory.dmp

        memory/3260-22-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-24-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-26-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-32-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-34-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-38-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-40-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-48-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-50-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-52-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-54-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-56-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-58-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-60-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-64-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-66-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-68-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-0-0x0000000074442000-0x0000000074443000-memory.dmp

        memory/3260-72-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-74-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-76-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-80-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-82-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-84-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-86-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-88-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-90-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-92-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-96-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-100-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-102-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-12-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-106-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-108-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-110-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-114-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-116-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-134-0x00000000053C0000-0x00000000053CA000-memory.dmp

        memory/3260-118-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-120-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/3260-124-0x0000000002770000-0x000000000279B000-memory.dmp

        memory/4928-668-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

        memory/4928-655-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

        memory/4928-578-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

        memory/4928-185-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

        memory/4928-182-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

        memory/4928-173-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

        memory/4928-170-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

        memory/4928-168-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

        memory/4928-154-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

        memory/4928-150-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

        memory/4928-149-0x0000000000B80000-0x0000000000B8C000-memory.dmp

        memory/4928-148-0x00007FFCE555F000-0x00007FFCE5560000-memory.dmp