Overview

overview

9

Static

static

1

jaffacakes...pe.exe

windows10-2004-x64

9

jaffacakes...pe.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    122s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 03:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_not-a-virus.Downloader.Win32.Agent.kupe.exe
  • Size 112KB
  • Sample261014-ebdfjse191
  • SHA256 fb5d05b3c47b9958caf11a9017f3aa684dde72d24210e39ae8c5b9aabda68ea6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstallerspywarestealer

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Downloads MZ/PE file 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 7 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 64 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 3 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.kupe.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.kupe.exe"
    1⤵
    • Downloads MZ/PE file
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\GamesManagerInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=110341560 -config.uri=http://gm/iwin/index.html -config.channelName=Iplay -config.iwinrequest=PF/5498298969203920516/5498298973175097753/13/0
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4880
      • C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
        "C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe" -gmregchannelid=110341560
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5928
  • C:\Program Files (x86)\GMInstaller\ugm_installer.exe
    "C:\Program Files (x86)\GMInstaller\ugm_installer.exe" -installer.createiwinshortcuts=yes -config.channel=110341560 -config.uri=http://gm/iwin/index.html -config.channelName=Iplay -config.iwinrequest=PF/5498298969203920516/5498298973175097753/13/0
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
      "C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe" -config.uri=http://gm/iwin/index.html -config.channel="110341560" -config.iwinrequest="PF/5498298969203920516/5498298973175097753/13/0"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4340
      • C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
        "C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe" --type=renderer --enable-logging --log-level=2 --no-sandbox --user-agent="NextDM/2.16.2.1015 AppleWebKit/535.19 (KHTML, like Gecko) GamesManager/2.16.2.1015 110341560 WinVer/6.2 [x64]" --awesomium-log-path="C:\Users\Admin\AppData\Local\GamesManager\./awesomium.log" --lang --channel=4340.03421C80.137419318 /prefetch:3
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        PID:4144
      • C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
        "C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe" --type=gpu-process --channel=4340.034B5AA0.25266137 --enable-logging --log-level=2 --no-sandbox --awesomium-log-path="C:\Users\Admin\AppData\Local\GamesManager\./awesomium.log" /prefetch:12
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        PID:3820
      • C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
        "C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe" -gmregcopysrc="HKEY_LOCAL_MACHINE\Software\iWinArcade" -gmregcopydest="HKEY_CURRENT_USER\Software\IplayArcade" -gmregcopylocalmachinedest="HKEY_LOCAL_MACHINE\Software\IplayArcade" -gmregisiwin=true -gmchannelcode=110341560 -game.sku="5498298969203920516" -game.name="Delicious - Emily's Home Sweet Home" -gmregcopyvirtual=HKU\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade -gmreg="Software\IplayArcade" -gmexe="IplayGames.exe" -gmregkey="Install_Dir" -installer="C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\5498298969203920516.exe" -preinstallurl="http://gm-iplay.iwin.com/dl/preinstall-options.exe" -gamestring=5498298969203920516 -config.installRoot="c:\games\Iplay Games" -gmInstallRootRegKey="HKEY_CURRENT_USER\Software\iWinArcade\installRoot"
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5500
        • C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
          "C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe" -gamestring=5498298969203920516 /S
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4308
        • C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\5498298969203920516.exe
          "C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\5498298969203920516.exe" /S
          4⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3076
          • C:\Users\Admin\AppData\Local\Temp\nsa73CB.tmp\iWinInstallOptions.exe
            "C:\Users\Admin\AppData\Local\Temp\nsa73CB.tmp\iWinInstallOptions.exe" /S
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3460
      • \??\c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe
        "c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5498298969203920516
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Direct Volume Access: Opens a physical disk for reading
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:5424
      • \??\c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe
        "c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5498298969203920516
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Direct Volume Access: Opens a physical disk for reading
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:1852
      • \??\c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe
        "c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5498298969203920516
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Direct Volume Access: Opens a physical disk for reading
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:2152
      • \??\c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe
        "c:\games\Iplay Games\Delicious - Emily's Home Sweet Home\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid5498298969203920516
        3⤵
          PID:3140
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3880

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          iWinLauncher.exe
          • Path C:\Program Files (x86)\GMInstaller\iWinLauncher.exe
          • Size 771KB
          • SHA256 3dde4433e16f9ca97c8955b24a8a85162eb6ccca9d5a83931012d856fa714962
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          iWinUpgrader.exe
          • Path C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
          • Size 1.5MB
          • SHA256 86cb79cb393ccbebd65e137cf509f09e0cabaecb93a2d21369488002712af118
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cdata.dat
          • Path C:\Users\Admin\AppData\Local\GamesManager\110500670\cdata.dat
          • Size 379KB
          • SHA256 db67ca3cf89a6fccd13aa21207e279c3fd3c7bcaf181c65ecfc18cf2da289eb3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000001
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000001
          • Size 248KB
          • SHA256 5e663896f40416a2d5f159e0433dbc9019dbe9d05abb34c1f3a5b38a88b5c03a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000002
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000002
          • Size 36KB
          • SHA256 49f14bad610f40f0ae76a33c55ef89a1e694219bab49b1b99cb53d754774c0fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000003
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000003
          • Size 51KB
          • SHA256 4d191ea72953f5806161c3c16ae8e4bb629b47156481bd074acfa5db08000016
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000004
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000004
          • Size 242KB
          • SHA256 0a6c4c4db171663b9b1c533a4dd6938e22cb4d5b9607d0ca92a20c1354018b49
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000005
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000005
          • Size 58KB
          • SHA256 74d4acb9d62968980f8a096977e3bf42c1ccffb0c7501a7fff1a0ba589b56bd7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000006
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000006
          • Size 16KB
          • SHA256 b0b84f6aca649b3b9131799ed0983e03b113497df4f33e30a3389ee1b34687ee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000007
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000007
          • Size 63KB
          • SHA256 2f49797d196f00bb331663ac1564c775d65ed1bfb508aec9e4c3b6fc89bb4dc0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000008
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000008
          • Size 21KB
          • SHA256 12d5f1be9a764164f4cc6e7dda726c4ea3d19ea79382d28c75b0dea862608968
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000009
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000009
          • Size 48KB
          • SHA256 209dc679252feca2725cafb6e8fc314f2618bd748db846be6b4e0ca71c55a330
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_00000a
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000a
          • Size 39KB
          • SHA256 3e05db9eae5443e2b629ae73496a7872602094fcf63d11eb5d99e63911c89d1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_00000b
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000b
          • Size 151KB
          • SHA256 13bf19f7b084c49a6ef22dee10328411f4764e765209956bc1d01c8120cdacdb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_00000c
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000c
          • Size 66KB
          • SHA256 53c53364808c175a6038f9d0aae8fe3d1f5ce3cf87d5e9fa08f603d845633b37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_00000d
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000d
          • Size 77KB
          • SHA256 de5c4e5ba7b850bbe5d35de5b20f4fd875be1f77ef73f7431172d1e0f6496dc6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_00000e
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000e
          • Size 39KB
          • SHA256 cd299b9251186ebf3bb0e928e4f710b3b542f0cde01bea6832cbada49138a85d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_00000f
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_00000f
          • Size 46KB
          • SHA256 a6db907a7ac399d7e920de4ac4b4a92808542039ba32dc6758637bffb413d56d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000010
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000010
          • Size 246KB
          • SHA256 1717ea1fde8ceb7584341a24efc85c853083c660a1185968fbf94520f7193de2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000011
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000011
          • Size 25KB
          • SHA256 379bc709031d0e429a41012efd921210bcfd409ecaabe35257a3716032eb99a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000012
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000012
          • Size 82KB
          • SHA256 6c5c0a29044c5aeec37211b18908acd0576b9dabc9d6fe95c8066cdc55146c0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000013
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000013
          • Size 581KB
          • SHA256 295eac26825508b5f37f27c69b99d426582fe80752f636c69f1795be8f5d5ea4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000014
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000014
          • Size 160KB
          • SHA256 74cd4d1f792e1200fd426048b53970c4eaeb5e5c1c789d034bffdff68167b3be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000015
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000015
          • Size 238KB
          • SHA256 7f6a44eb7632c2cb6f990ede10a58c2cc3fb923bae1761f1be8e2a9ea3847b78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000016
          • Path C:\Users\Admin\AppData\Local\GamesManager\defaultappcache\AppCache\Cache\f_000016
          • Size 620KB
          • SHA256 f148af9bffe215b1396117bb04aeb9f35fc82f346999a767a363198e9878ceae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          drmworker5498298969203920516
          • Path C:\Users\Admin\AppData\Local\Temp\GameManager\DRMWorker\drmworker5498298969203920516
          • Size 80B
          • SHA256 ce63d5ef4d33d5f98e0e81f596c02e9f219d05e044f9dd0a2cba46467e282095
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nse65B1.tmp\System.dll
          • Size 10KB
          • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StdUtils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\StdUtils.dll
          • Size 26KB
          • SHA256 c169393e49723cfdcdcbcf80e062be9e841539f90e4b7b85b482212715a1f7c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsProcess.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nseE8D5.tmp\nsProcess.dll
          • Size 4KB
          • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsf110F.tmp\System.dll
          • Size 11KB
          • SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NSISdl.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\NSISdl.dll
          • Size 14KB
          • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\System.dll
          • Size 11KB
          • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          preinstall-options.exe
          • Path C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
          • Size 77KB
          • SHA256 626953268197dacf5491197a3c4c60b4f2a14c3e878efb640eb48f34c9b23e31
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1852-1161-0x0000000002A20000-0x0000000002C2C000-memory.dmp
          Download

          memory/1852-1167-0x0000000000400000-0x000000000060C000-memory.dmp
          Download

          memory/1852-1165-0x0000000002A20000-0x0000000002C2C000-memory.dmp
          Download

          memory/1852-1160-0x0000000000400000-0x000000000060C000-memory.dmp
          Download

          memory/1852-1159-0x0000000000400000-0x000000000060C000-memory.dmp
          Download

          memory/1852-1158-0x0000000000400000-0x000000000060C000-memory.dmp
          Download

          memory/1852-1154-0x0000000002A20000-0x0000000002C2C000-memory.dmp
          Download

          memory/1852-1150-0x0000000002A20000-0x0000000002C2C000-memory.dmp
          Download

          memory/2152-1169-0x0000000000400000-0x000000000060C000-memory.dmp
          Download

          memory/2152-1187-0x0000000000400000-0x000000000060C000-memory.dmp
          Download

          memory/3140-1206-0x0000000000400000-0x000000000060C000-memory.dmp
          Download

          memory/3820-988-0x00000000008C0000-0x00000000008D2000-memory.dmp
          Download

          memory/4144-955-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-981-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-960-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-957-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-956-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-962-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-954-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-952-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-950-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-951-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-949-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-948-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-947-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-946-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-945-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-943-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-944-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-942-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-941-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-937-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-958-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-953-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-934-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-940-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-939-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-935-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-967-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-982-0x00000000719A0000-0x00000000719C7000-memory.dmp
          Download

          memory/4144-983-0x0000000071960000-0x0000000071993000-memory.dmp
          Download

          memory/4144-961-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-984-0x00000000008F0000-0x00000000008F1000-memory.dmp
          Download

          memory/4144-963-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-1024-0x0000000071960000-0x0000000071993000-memory.dmp
          Download

          memory/4144-1022-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-1023-0x00000000719A0000-0x00000000719C7000-memory.dmp
          Download

          memory/4144-964-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-965-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-929-0x00000000005A0000-0x00000000005B2000-memory.dmp
          Download

          memory/4144-938-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-936-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-959-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-966-0x00000000719D0000-0x0000000071B82000-memory.dmp
          Download

          memory/4144-974-0x0000000071960000-0x0000000071993000-memory.dmp
          Download

          memory/4144-973-0x0000000071960000-0x0000000071993000-memory.dmp
          Download

          memory/4144-972-0x0000000071960000-0x0000000071993000-memory.dmp
          Download

          memory/4144-971-0x0000000071960000-0x0000000071993000-memory.dmp
          Download

          memory/4144-968-0x0000000071960000-0x0000000071993000-memory.dmp
          Download

          memory/4144-969-0x0000000071960000-0x0000000071993000-memory.dmp
          Download

          memory/4144-970-0x0000000071960000-0x0000000071993000-memory.dmp
          Download

          memory/5424-1148-0x0000000000400000-0x000000000060C000-memory.dmp
          Download

          memory/5424-1146-0x0000000002970000-0x0000000002B7C000-memory.dmp
          Download

          memory/5424-1144-0x0000000002970000-0x0000000002B7C000-memory.dmp
          Download

          memory/5424-1143-0x0000000000400000-0x000000000060C000-memory.dmp
          Download

          memory/5424-1142-0x0000000000400000-0x000000000060C000-memory.dmp
          Download

          memory/5424-1141-0x0000000000400000-0x000000000060C000-memory.dmp
          Download

          memory/5424-1138-0x0000000002970000-0x0000000002B7C000-memory.dmp
          Download

          memory/5424-1134-0x0000000002970000-0x0000000002B7C000-memory.dmp
          Download

          memory/5424-1132-0x0000000000400000-0x000000000060C000-memory.dmp
          Download