Overview

overview

10

Static

static

3

JaffaCakes...94.exe

windows7-x64

10

JaffaCakes...94.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    93s
  • platform
    windows7_x64
  • resource
    win7-20250207-en
  • resource tags

    arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
  • submitted
    27/03/2025, 19:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_8a01bcb09b024896cdaf5a880dd8a094.exe

  • Size

    600KB

  • MD5

    8a01bcb09b024896cdaf5a880dd8a094

  • SHA1

    fa6c9c41d673cc567b909c304380b166538f964b

  • SHA256

    1245110ba2ca69fa0e47a45237891925276be818ea7e0bb1a1ed92f4a610b004

  • SHA512

    6656722e386ec828b9b135110882da1fd2a513fd2df5fda04e28a41d6aa165dc189f71e43783a679ad86b4d42bc4631a0cf0602ad5ede30bff0f8fabe6e89d9c

  • SSDEEP

    12288:s6onxOp8FySpE5zvIdtU+YmefaRfMMMMM2MMMMM:Qwp8DozAdO9aRfMMMMM2MMMMM

Score
10/10
pykspadefense_evasiondiscoverypersistenceprivilege_escalationtrojanworm

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 9 IoCs
    persistence
  • Pykspa

    Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    wormpykspa
  • Pykspa family
    pykspa
  • UAC bypass 3 TTPs 18 IoCs
    defense_evasiontrojan
  • Detect Pykspa worm 2 IoCs
    worm
  • Adds policy Run key to start application 2 TTPs 40 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 6 IoCs
    defense_evasion
  • Executes dropped EXE 27 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
    defense_evasion
  • Loads dropped DLL 30 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 18 IoCs
    defense_evasiontrojan
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 48 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a01bcb09b024896cdaf5a880dd8a094.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a01bcb09b024896cdaf5a880dd8a094.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
      "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_8a01bcb09b024896cdaf5a880dd8a094.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2288
      • C:\Users\Admin\AppData\Local\Temp\xifsu.exe
        "C:\Users\Admin\AppData\Local\Temp\xifsu.exe" "-C:\Users\Admin\AppData\Local\Temp\uqywjckjsjfzlmwm.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:2680
      • C:\Users\Admin\AppData\Local\Temp\xifsu.exe
        "C:\Users\Admin\AppData\Local\Temp\xifsu.exe" "-C:\Users\Admin\AppData\Local\Temp\uqywjckjsjfzlmwm.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2844
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\iiuwnkwzmhhfvaoiciee.exe
      "C:\Windows\iiuwnkwzmhhfvaoiciee.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\iiuwnkwzmhhfvaoiciee.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:744
    • C:\Users\Admin\AppData\Local\Temp\byhguoxxhzwregriz.exe
      "C:\Users\Admin\AppData\Local\Temp\byhguoxxhzwregriz.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\byhguoxxhzwregriz.exe*."
        3⤵
        • Executes dropped EXE
        PID:1860
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Windows\kisshcmnyrplzcogyc.exe
      "C:\Windows\kisshcmnyrplzcogyc.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\kisshcmnyrplzcogyc.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:1456
    • C:\Users\Admin\AppData\Local\Temp\byhguoxxhzwregriz.exe
      "C:\Users\Admin\AppData\Local\Temp\byhguoxxhzwregriz.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\byhguoxxhzwregriz.exe*."
        3⤵
        • Executes dropped EXE
        PID:2480
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\vufgwsdfrlkhwangzez.exe
      "C:\Windows\vufgwsdfrlkhwangzez.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\vufgwsdfrlkhwangzez.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2364
    • C:\Users\Admin\AppData\Local\Temp\iiuwnkwzmhhfvaoiciee.exe
      "C:\Users\Admin\AppData\Local\Temp\iiuwnkwzmhhfvaoiciee.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\iiuwnkwzmhhfvaoiciee.exe*."
        3⤵
        • Executes dropped EXE
        PID:2976
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Windows\vufgwsdfrlkhwangzez.exe
      "C:\Windows\vufgwsdfrlkhwangzez.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2988
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\vufgwsdfrlkhwangzez.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:1964
    • C:\Users\Admin\AppData\Local\Temp\byhguoxxhzwregriz.exe
      "C:\Users\Admin\AppData\Local\Temp\byhguoxxhzwregriz.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:764
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\byhguoxxhzwregriz.exe*."
        3⤵
        • Executes dropped EXE
        PID:1788
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1772
    • C:\Windows\iiuwnkwzmhhfvaoiciee.exe
      "C:\Windows\iiuwnkwzmhhfvaoiciee.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1560
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\iiuwnkwzmhhfvaoiciee.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2304
    • C:\Users\Admin\AppData\Local\Temp\vufgwsdfrlkhwangzez.exe
      "C:\Users\Admin\AppData\Local\Temp\vufgwsdfrlkhwangzez.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2968
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\vufgwsdfrlkhwangzez.exe*."
        3⤵
        • Executes dropped EXE
        PID:2744
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2976
    • C:\Windows\byhguoxxhzwregriz.exe
      "C:\Windows\byhguoxxhzwregriz.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1644
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\windows\byhguoxxhzwregriz.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:1084
    • C:\Users\Admin\AppData\Local\Temp\uqywjckjsjfzlmwm.exe
      "C:\Users\Admin\AppData\Local\Temp\uqywjckjsjfzlmwm.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2496
      • C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
        "C:\Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe" "c:\users\admin\appdata\local\temp\uqywjckjsjfzlmwm.exe*."
        3⤵
        • Executes dropped EXE
        PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

4
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

4
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Safe Mode Boot

1
T1562.009

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\zgzigkdnhjqvsezaboryray.vfz
    Filesize

    272B

    MD5

    45c838e72616d762d740c0ff72bef851

    SHA1

    5eed1d8dabcbc3f5579a919fc2175a852f984858

    SHA256

    41536917dea7f6cc6e4cde5b23500fea04c7268fe1f1bf492eb2a19f125b8c1c

    SHA512

    7f8e92ed2d8e0b0e38b8db3d25e6fae9978430f3ff5f16a6d7a0afa9fa26fc990f96a13f342adbd763d108588bdce4f9e705d3a268d07836a1e574b8a6ec9f7e

    Download Submit

  • C:\Program Files (x86)\zgzigkdnhjqvsezaboryray.vfz
    Filesize

    272B

    MD5

    e63bb8f2686925c3b01bb22466a03f16

    SHA1

    57e282fde2e08420597c1dc09d95c1133fb32dd1

    SHA256

    e2a8dbe5fb7b9884f21c54e8adcabace8792d029ccf86ca92cf05eaffa651551

    SHA512

    0c183fcde8cfc34096f9ea2661f97528dbb996d47abd07e4e9a676b1a80b451c7ddde08cf74715e86501fbe9d6f2f1c7042f8a32d511b820f9a08b85d7884d76

    Download Submit

  • C:\Program Files (x86)\zgzigkdnhjqvsezaboryray.vfz
    Filesize

    272B

    MD5

    0c4b69eb8c8a1d1a3836f6a198075063

    SHA1

    7e9816ee934fbeff320d927d0202bc125ac75f6b

    SHA256

    5a7c2b79c135d29c8b214052c5b32700f835e3d28406db5aba0bd8b4fdeb6a36

    SHA512

    45a6d74dd6ba936642b3f19ca8bb8305eaf256a533482c7a037a858afb5031a783aa6eb21021c5d6a2f668615f1c2317dd2b658016e56e71d37d69836bd4c296

    Download Submit

  • C:\Users\Admin\AppData\Local\meiclaezerjzhekwigumqktimhmzrhpmse.ocu
    Filesize

    3KB

    MD5

    c48a4237533e75a1f0a93183cee059e6

    SHA1

    c67d58fef6483aaac176237d2ab170e9e5361b1f

    SHA256

    e201833c171256ca0b4085a63de5b77535baffd4f1130ad680dacc367c79dc34

    SHA512

    5a20b9cbfb154cd5dcbd09c7fc096181e6de382144d2ded7e4de73278d552214a4838b10411a8dea863f3a10f92623b0df8789d807173b22f834ec18f784dc64

    Download Submit

  • C:\Users\Admin\AppData\Local\zgzigkdnhjqvsezaboryray.vfz
    Filesize

    272B

    MD5

    137d61eabeb9a296b8c427df179aa37b

    SHA1

    a3d57acf2da95ef7f5294ec050c9044446b981e1

    SHA256

    4fd201d8b0e0c54c76756dc74dd9fd2ff02e3121f2c9eeb6d5cd6a426a851d1c

    SHA512

    3ba4ac87f65a3064d0d6ad0c410191fe0f8cc35f99cb636622a0d88cec605d180474612c0963434679f4c5f075221b4bb5bb5c3e0b53ddf8dd7ad4d3efaa8e3c

    Download Submit

  • C:\Windows\SysWOW64\kisshcmnyrplzcogyc.exe
    Filesize

    600KB

    MD5

    8a01bcb09b024896cdaf5a880dd8a094

    SHA1

    fa6c9c41d673cc567b909c304380b166538f964b

    SHA256

    1245110ba2ca69fa0e47a45237891925276be818ea7e0bb1a1ed92f4a610b004

    SHA512

    6656722e386ec828b9b135110882da1fd2a513fd2df5fda04e28a41d6aa165dc189f71e43783a679ad86b4d42bc4631a0cf0602ad5ede30bff0f8fabe6e89d9c

    Download Submit

  • \Users\Admin\AppData\Local\Temp\wlsotepmgvc.exe
    Filesize

    320KB

    MD5

    5203b6ea0901877fbf2d8d6f6d8d338e

    SHA1

    c803e92561921b38abe13239c1fd85605b570936

    SHA256

    0cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060

    SHA512

    d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471

    Download Submit

  • \Users\Admin\AppData\Local\Temp\xifsu.exe
    Filesize

    704KB

    MD5

    89ed6abd85f688bc9fe6bbacfe172a21

    SHA1

    ca5dae2c05eb2b25ff3d9ea6be4091e5b2d922cc

    SHA256

    b9a639ebbc419b74496e992b69ca704692e8d9a45a6ec5f082e5f0b0dfae7c73

    SHA512

    2ce737ea1ca1325188768efc43dba60dc268d3c3726593c4a9ab270083f1eabd924ffc791ff67037cf054fd09101d8f9abe03722d1b8d0878e40179dfc8ee6a1

    Download Submit

  • memory/2104-186-0x0000000004510000-0x0000000004511000-memory.dmp

    Filesize

    4KB

    Download