Overview

overview

7

Static

static

3

jaffacakes...b5.exe

windows10-2004-x64

7

jaffacakes...b5.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/09/2026, 18:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_2ff7496ecd8a0b94a61aab0d2ef7a9cdba4dc57eae1df59d4dd31f1a32a2d7b5.exe
  • Size 28KB
  • Sample260925-xbgr3stfqa
  • SHA256 2ff7496ecd8a0b94a61aab0d2ef7a9cdba4dc57eae1df59d4dd31f1a32a2d7b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 41 IoCs
  • Loads dropped DLL 42 IoCs
  • Adds Run key to start application 2 TTPs 43 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of SetWindowsHookEx 32 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3240
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2ff7496ecd8a0b94a61aab0d2ef7a9cdba4dc57eae1df59d4dd31f1a32a2d7b5.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2ff7496ecd8a0b94a61aab0d2ef7a9cdba4dc57eae1df59d4dd31f1a32a2d7b5.exe"
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1960
    • C:\Windows\DiskMan32.exe
      C:\Windows\DiskMan32.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4768
    • C:\Windows\muvrgf.exe
      C:\Windows\muvrgf.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5044
    • C:\Windows\rpphhr.exe
      C:\Windows\rpphhr.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3756
    • C:\Windows\uwqiik.exe
      C:\Windows\uwqiik.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4780
    • C:\Windows\tezbsh.exe
      C:\Windows\tezbsh.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:852
    • C:\Windows\rrfaol.exe
      C:\Windows\rrfaol.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5468
    • C:\Windows\wlzqyx.exe
      C:\Windows\wlzqyx.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2064
    • C:\Windows\yhojvz.exe
      C:\Windows\yhojvz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3504
    • C:\Windows\byohef.exe
      C:\Windows\byohef.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1680
    • C:\Windows\dypond.exe
      C:\Windows\dypond.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:724
    • C:\Windows\bhjzgk.exe
      C:\Windows\bhjzgk.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5024
    • C:\Windows\dvykmn.exe
      C:\Windows\dvykmn.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4052
    • C:\Windows\gycexp.exe
      C:\Windows\gycexp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4344
    • C:\Windows\fdasxi.exe
      C:\Windows\fdasxi.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2268
    • C:\Windows\ltrveq.exe
      C:\Windows\ltrveq.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5460
    • C:\Windows\gevbhn.exe
      C:\Windows\gevbhn.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5748
    • C:\Windows\fmecjk.exe
      C:\Windows\fmecjk.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2532
    • C:\Windows\skslwp.exe
      C:\Windows\skslwp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:532
    • C:\Windows\xyxcsb.exe
      C:\Windows\xyxcsb.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4824
    • C:\Windows\sppibz.exe
      C:\Windows\sppibz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4712
    • C:\Windows\xgglzp.exe
      C:\Windows\xgglzp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:728
    • C:\Windows\xkfzhh.exe
      C:\Windows\xkfzhh.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3384
    • C:\Windows\cxkyll.exe
      C:\Windows\cxkyll.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1988
    • C:\Windows\fplwmr.exe
      C:\Windows\fplwmr.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4940
    • C:\Windows\ahocph.exe
      C:\Windows\ahocph.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4424
    • C:\Windows\aajduv.exe
      C:\Windows\aajduv.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5168
    • C:\Windows\eyphyu.exe
      C:\Windows\eyphyu.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1244
    • C:\Windows\ecnvgm.exe
      C:\Windows\ecnvgm.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2704
    • C:\Windows\kittkq.exe
      C:\Windows\kittkq.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6188
    • C:\Windows\gknklc.exe
      C:\Windows\gknklc.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6352
    • C:\Windows\mmhvfj.exe
      C:\Windows\mmhvfj.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6536
    • C:\Windows\muropg.exe
      C:\Windows\muropg.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6684
    • C:\Windows\rzxmtj.exe
      C:\Windows\rzxmtj.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6840
    • C:\Windows\uyxtuq.exe
      C:\Windows\uyxtuq.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6996
    • C:\Windows\oumezk.exe
      C:\Windows\oumezk.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6264
    • C:\Windows\onzney.exe
      C:\Windows\onzney.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1788
    • C:\Windows\wzsbeu.exe
      C:\Windows\wzsbeu.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6748
    • C:\Windows\zvhukw.exe
      C:\Windows\zvhukw.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7036
    • C:\Windows\bykfvg.exe
      C:\Windows\bykfvg.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6448
    • C:\Windows\yzfqpg.exe
      C:\Windows\yzfqpg.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:4264
    • C:\Windows\lgsztk.exe
      C:\Windows\lgsztk.exe
      1⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6908
    • C:\Windows\gujlfs.exe
      C:\Windows\gujlfs.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:7072

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DiskMan32.exe
          • Path C:\Windows\DiskMan32.exe
          • Size 28KB
          • SHA256 2ff7496ecd8a0b94a61aab0d2ef7a9cdba4dc57eae1df59d4dd31f1a32a2d7b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DiskMan32.dll
          • Path C:\Windows\SysWOW64\DiskMan32.dll
          • Size 19KB
          • SHA256 09eba83b46d15cee946e6a8afabdf824cf026e2b5ff0d437b6a4bea9687833da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/532-281-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/724-171-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/728-319-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/852-105-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/1244-400-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/1680-157-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/1960-46-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/1988-345-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2064-131-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2268-225-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2532-270-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2704-414-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3240-233-0x000000000A8C0000-0x000000000A8C1000-memory.dmp
          Download

          memory/3240-285-0x000000000B920000-0x000000000B921000-memory.dmp
          Download

          memory/3240-122-0x0000000009EB0000-0x0000000009EB1000-memory.dmp
          Download

          memory/3240-110-0x0000000009E10000-0x0000000009E11000-memory.dmp
          Download

          memory/3240-135-0x00000000014C0000-0x00000000014C1000-memory.dmp
          Download

          memory/3240-463-0x000000000D110000-0x000000000D111000-memory.dmp
          Download

          memory/3240-148-0x0000000009F00000-0x0000000009F01000-memory.dmp
          Download

          memory/3240-97-0x0000000000F60000-0x0000000000F61000-memory.dmp
          Download

          memory/3240-162-0x000000000A650000-0x000000000A651000-memory.dmp
          Download

          memory/3240-449-0x000000000D050000-0x000000000D051000-memory.dmp
          Download

          memory/3240-176-0x0000000003250000-0x0000000003251000-memory.dmp
          Download

          memory/3240-435-0x000000000AE80000-0x000000000AE81000-memory.dmp
          Download

          memory/3240-190-0x0000000008C50000-0x0000000008C51000-memory.dmp
          Download

          memory/3240-420-0x000000000C570000-0x000000000C571000-memory.dmp
          Download

          memory/3240-204-0x000000000AC30000-0x000000000AC31000-memory.dmp
          Download

          memory/3240-406-0x000000000C430000-0x000000000C431000-memory.dmp
          Download

          memory/3240-218-0x0000000003290000-0x0000000003291000-memory.dmp
          Download

          memory/3240-84-0x0000000009570000-0x0000000009571000-memory.dmp
          Download

          memory/3240-2-0x0000000002D60000-0x0000000002D61000-memory.dmp
          Download

          memory/3240-60-0x0000000008150000-0x0000000008151000-memory.dmp
          Download

          memory/3240-248-0x000000000A8F0000-0x000000000A8F1000-memory.dmp
          Download

          memory/3240-262-0x000000000A920000-0x000000000A921000-memory.dmp
          Download

          memory/3240-392-0x000000000C400000-0x000000000C401000-memory.dmp
          Download

          memory/3240-274-0x0000000009D50000-0x0000000009D51000-memory.dmp
          Download

          memory/3240-72-0x0000000008D40000-0x0000000008D41000-memory.dmp
          Download

          memory/3240-377-0x000000000C0C0000-0x000000000C0C1000-memory.dmp
          Download

          memory/3240-363-0x000000000BF60000-0x000000000BF61000-memory.dmp
          Download

          memory/3240-298-0x000000000BA80000-0x000000000BA81000-memory.dmp
          Download

          memory/3240-351-0x000000000BF30000-0x000000000BF31000-memory.dmp
          Download

          memory/3240-312-0x000000000BAB0000-0x000000000BAB1000-memory.dmp
          Download

          memory/3240-62-0x0000000008D20000-0x0000000008D21000-memory.dmp
          Download

          memory/3240-325-0x0000000008C80000-0x0000000008C81000-memory.dmp
          Download

          memory/3240-338-0x000000000BF00000-0x000000000BF01000-memory.dmp
          Download

          memory/3384-332-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3504-144-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3756-80-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4052-197-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4344-211-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4424-373-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4712-307-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4768-56-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4780-92-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4824-294-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4940-359-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5024-185-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5044-68-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5168-386-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5460-240-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5468-118-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6188-429-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6352-443-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6536-457-0x0000000010000000-0x0000000010009000-memory.dmp
          Download