Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20251231-en
  • resource tags

    arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09/01/2026, 08:55

General

  • Target
    Fantom.exe
  • Size 261KB
  • Sample260109-kvvrtsft7g
  • SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Path
  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
  • <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>o5WL63RPJCG+x3AhEAVnq6k5Q00IragmWP4XnPOXMnRxxyu5KvQyN95N0BcpNZAj6gbXBJi7RweAM9DsS1cT+slNwPrjBodLhuKxQ0tw41NtjO1B+nyGRELq6wUpiLUM5vvsMACltautTVPf/1DdIZElAWfBhKzeUV3ie8Xf/x+AQVvqrpqyGQ4AAlY4jtdudQVuNXzdOgXHUFocvnXj92tkJMaj1NMVLO+1EcHQdJmLOefyFoqhbPkcfYTE09gn5Z69Mjf0MXGAxpzKzFKw9qKKbncNb7/dx139wspXXRh5sWtujAofTyECiusbnc/x9mAd2bIp+ALRxx6z5G8wdQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Fantom family
  • Renames multiple (1185) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3996

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DECRYPT_YOUR_FILES.HTML

        • Path C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
        • Size 1KB
        • SHA256 e2ff991dfedccd0fc729ef43794d9bab527f56b16573f8b11659aa362c3fdd92
        • MD5 SHA1 SHA512 TLSH

        af_NEUTER.pak

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\af_NEUTER.pak
        • Size 32B
        • SHA256 6b551a4094d020928f4645ee4d61636cb5d0ee5bbce42f879b95f91987b75596
        • MD5 SHA1 SHA512

        win32_LinkNoDrop32x32.gif

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
        • Size 160B
        • SHA256 dba30184e9879e27f4554023250defea11c81e9d055068ae180db9be7f489a1b
        • MD5 SHA1 SHA512 TLSH

        THIRDPARTYLICENSEREADME-JAVAFX.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
        • Size 192B
        • SHA256 22e562633134495ed25ba0041a9627695af5bb966360db9ab44402740acf5ca4
        • MD5 SHA1 SHA512 TLSH

        THIRDPARTYLICENSEREADME.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
        • Size 192B
        • SHA256 ea73aa6d227014ef11c7bd8b6faaccd4a493b8a45a893976e4560457d17ce262
        • MD5 SHA1 SHA512 TLSH

        directshow.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
        • Size 1KB
        • SHA256 1fb4eac415b378f723d076c307dff02801e0e0157cc3a8d3dd22348f41efaca7
        • MD5 SHA1 SHA512 TLSH

        glib.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
        • Size 31KB
        • SHA256 81d2d5b9701eb5d797c6e4b58803ff47864a70f75dfc522e9d9879d7d6328dac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gstreamer.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
        • Size 34KB
        • SHA256 a38fb91efd52ece4e2c2a5c83cb91c7395cc01b5d83a95c758161276613d19f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icu_web.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
        • Size 23KB
        • SHA256 bb653f869d051a3009b5fe5daf66a43002a51fe8971a11035aacbd5f774ae00d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jpeg_fx.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
        • Size 2KB
        • SHA256 2f47c2e8b8f7ae6e61fcff7456bcefec37c43e30811f7936e0dd869426a54465
        • MD5 SHA1 SHA512 TLSH

        libffi.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
        • Size 1KB
        • SHA256 204d83f7a49301d274d9f5721b35a0753619a95d6b98fb09104112b8775260e5
        • MD5 SHA1 SHA512 TLSH

        libxml2.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
        • Size 3KB
        • SHA256 a6e539edbb8572b1e2533fde255164babb7473f7b443e49398ca57390f32fda8
        • MD5 SHA1 SHA512 TLSH

        libxslt.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
        • Size 2KB
        • SHA256 e4743bc6f135ba1c8860cb2ace68ea65cce54b88b4cb6da2de76decd5c807062
        • MD5 SHA1 SHA512 TLSH

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
        • Size 5KB
        • SHA256 f822a6644fed6189d4dff0527cf37253a312a1680ce8cdf6fca4015777807acf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        public_suffix.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
        • Size 17KB
        • SHA256 3acf254fbb0c3097c3b3c8cc6be035a3d35cd0f5e96d8ac7250db112564fe7b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        webkit.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
        • Size 320KB
        • SHA256 fc6c4b551a0f1b5d3ba4df0f83c1d345fbeb1bac0834584ae9ab2f403de680e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        asm.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
        • Size 1KB
        • SHA256 221a8dc0f9976da047ff06e58f647afc84fbd9e259cc4da43fdab877e9123e25
        • MD5 SHA1 SHA512 TLSH

        bcel.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
        • Size 10KB
        • SHA256 4b1c6ebfdf64b8c2090ac209581971b9db9abb35b58e07818830c63ca86af0d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cldr.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
        • Size 3KB
        • SHA256 37e602aeabd24441597a9875d436231c7d5f0f69f0acb35614a48becb242ab25
        • MD5 SHA1 SHA512 TLSH

        colorimaging.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
        • Size 176B
        • SHA256 6ce10b70ce037412ee2e246767323d7be38bdf3c7d005ac0191a47f5d341f643
        • MD5 SHA1 SHA512 TLSH

        cryptix.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
        • Size 1KB
        • SHA256 6b1c7ec172b7461bf0f655a30bba215b3d84c5d028ab81662ffc4bcba22ab91f
        • MD5 SHA1 SHA512 TLSH

        dom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
        • Size 3KB
        • SHA256 bdf0ff202f60a3e6d9915d139e0b4b193024581549045b92983d0bcbc5b10410
        • MD5 SHA1 SHA512 TLSH

        dynalink.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
        • Size 1KB
        • SHA256 ee5c7b0a52b0264f0835aae640ed524fd8608c8adffdd065827b1da663c71115
        • MD5 SHA1 SHA512 TLSH

        ecc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
        • Size 28KB
        • SHA256 02904d38c91d87c88fd4211277089437f5356486b516d7f9de1691d62af09abf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        freebxml.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
        • Size 2KB
        • SHA256 1c48483136dc87b06051e94b83dfc55667f93c201046f1dfc5912f40c6e2336a
        • MD5 SHA1 SHA512 TLSH

        giflib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
        • Size 1KB
        • SHA256 3d818526b96c1ef66325039dc386e80f5f89ab237d1bb76ced4ca9599a71323f
        • MD5 SHA1 SHA512 TLSH

        icu.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
        • Size 2KB
        • SHA256 ed71f4eb2fc6c19d53d9b1d1abe353b0d74b36b6c5f221b0616039fb33d0ad93
        • MD5 SHA1 SHA512 TLSH

        jcup.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
        • Size 1KB
        • SHA256 233fbd207cc4bf4aa038bf0fad965ed4ce23ea5bdfc168fe8be82f501492d5d9
        • MD5 SHA1 SHA512 TLSH

        joni.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
        • Size 1KB
        • SHA256 3bddb9ce7f4bc7f6fdf54b519beac63aa42aa523de8ec1f7472f01e7262d0566
        • MD5 SHA1 SHA512 TLSH

        jopt-simple.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
        • Size 1KB
        • SHA256 1d1114a5ad7606e6ed7a4e1aef5b3c3e96ddee23246ff170a74c733bd4d3018d
        • MD5 SHA1 SHA512 TLSH

        jpeg.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
        • Size 3KB
        • SHA256 7b319aea7e8f24b98c64e91247f764b0ea5006803a36594cc0ea052943b30107
        • MD5 SHA1 SHA512 TLSH

        lcms.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
        • Size 2KB
        • SHA256 601d6d450f9c9554e8f3d178600f4d50ae979a45db3d529858b4e8704b118f2a
        • MD5 SHA1 SHA512 TLSH

        libpng.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
        • Size 6KB
        • SHA256 9dd304cd0715a2f5abdd5279471cb67a94991d4f2d45af13147a48b7ecb8c3eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
        • Size 5KB
        • SHA256 b9520210ddccea0679d62645f71be6bafd194574614564780b40e56b04ba11e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkcs11cryptotoken.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
        • Size 3KB
        • SHA256 95627474f73a38909412968a6f8a42a5ef838779b45b7bda7fa814c21bb5b595
        • MD5 SHA1 SHA512 TLSH

        pkcs11wrapper.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
        • Size 2KB
        • SHA256 8a6dc7c791734dca07016e3cc7e12e773c185ebdf4aa51b0b76d1081662f3a00
        • MD5 SHA1 SHA512 TLSH

        relaxngcc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
        • Size 2KB
        • SHA256 524fadb8dc3d9a8c5e56a41d0bba9ca5eb244fd65e9974d334a36502e67b7ecb
        • MD5 SHA1 SHA512 TLSH

        relaxngdatatype.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
        • Size 1KB
        • SHA256 b36d66a456f62a39df4dd62d68d5763f133b7ca156e05327df0c6fbb9f29a0be
        • MD5 SHA1 SHA512 TLSH

        relaxngom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
        • Size 1KB
        • SHA256 8a2821d2b8e1f999c83f1c82c27db457d13213b8ee3e331c097e56881b13b6d0
        • MD5 SHA1 SHA512 TLSH

        santuario.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
        • Size 11KB
        • SHA256 7dc1c5bed834380131402f5cb99de795ab1d7da7a70052430cf34f9bb96fe772
        • MD5 SHA1 SHA512 SSDEEP TLSH

        thaidict.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
        • Size 1KB
        • SHA256 46b75b435aef29a9e003ee16dc694f1f3310c1a0352a35f359a24dcddf558145
        • MD5 SHA1 SHA512 TLSH

        unicode.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
        • Size 2KB
        • SHA256 61461a6257a9bf0ed35cd9c35330d8251993635a9dc1446a2356641113f92418
        • MD5 SHA1 SHA512 TLSH

        xalan.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
        • Size 11KB
        • SHA256 ab6e2ddfaaaab8534d276fe7c561d286bca673cf8a427f9c17d09c3314c374d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xerces.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
        • Size 11KB
        • SHA256 d69889e60f9a8a0b982082d0e0c8c724429f3063ec085754bd1f15b5346fe244
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xmlresolver.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
        • Size 11KB
        • SHA256 e4f6b6fd4806af9d479c0dc443e72ae565a58a3574e983baa5e3ebd8bf1ae59b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zlib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
        • Size 1024B
        • SHA256 98efed01c3dc7382b5ffc13c5e7a248d9f7d546cb742a81fa993eda58de42c27
        • MD5 SHA1 SHA512 TLSH

        ClientSub2019_eula.txt

        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
        • Size 48B
        • SHA256 c1a89ed8f0918e47df400f5318d5e12b4a08d04e09f53d01fb30d37ace44747c
        • MD5 SHA1 SHA512

        WindowsUpdate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
        • Size 21KB
        • SHA256 489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3996-148-0x0000000000F70000-0x0000000000F7C000-memory.dmp

        memory/3996-149-0x000000001BEE0000-0x000000001BEF0000-memory.dmp

        memory/4764-87-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-69-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-35-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-33-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-31-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-27-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-25-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-23-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-21-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-71-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-19-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-17-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-59-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-15-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-49-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-13-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-43-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-11-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-38-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-7-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-5-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-4-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-133-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

        memory/4764-134-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

        memory/4764-135-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

        memory/4764-136-0x0000000005630000-0x000000000563E000-memory.dmp

        memory/4764-41-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-45-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-47-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-51-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-53-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-55-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-57-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-61-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-63-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-65-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-67-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-39-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-73-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-75-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-77-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-79-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-81-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-83-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-85-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-0-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

        memory/4764-89-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-91-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-93-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-95-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-97-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-99-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-101-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-103-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-105-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-107-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-109-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-111-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-113-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-117-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-119-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-121-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-123-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-125-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-128-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

        memory/4764-132-0x0000000005420000-0x000000000542A000-memory.dmp

        memory/4764-129-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

        memory/4764-130-0x0000000004CC0000-0x0000000005266000-memory.dmp

        memory/4764-131-0x0000000005270000-0x0000000005302000-memory.dmp

        memory/4764-127-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-115-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-29-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-9-0x0000000002800000-0x000000000282B000-memory.dmp

        memory/4764-3-0x0000000002800000-0x0000000002832000-memory.dmp

        memory/4764-2-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

        memory/4764-1-0x0000000002610000-0x0000000002642000-memory.dmp