7d4a8307baedfd7ff8662a99f8e315015df0646256107783c26a4a5fc60ce27b

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe
Size 92KB
Sample261018-2th53sh18j
SHA256 7d4a8307baedfd7ff8662a99f8e315015df0646256107783c26a4a5fc60ce27b
MD5 cef362ff99cc8992ed8020380a65d855
SHA1 8c0e7b6dc94bb347e5ef95428c37beec7229beb3
SHA512 5dff03969467fa6c9b5ac2084a81a36791e2db791655decfe91cdbc269de2d172af599543c2d84a0ee094f93def447e80ad049a500925df8d96311bc405a1c71
SSDEEP 1536:UJ/kcc/tqrxQvhHnH/lpVexEXnUbqrRAwZT9LiJX2l/I30lQb/XGsIPUGNio6GiN:qc/tqrxQv93wxHb0tl6X2l/VQ7XG7jNm
TLSH
T1269302CD2D043C2AEA9E58BC17BF969B291FD4C727252EB08D004C71A97805D3CBE65E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1700-0-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral2/memory/1700-73-0x000000000EA00000-0x000000000EA34000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe
1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe
1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe
1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe
Token: SeDebugPrivilege	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2076	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	80
PID 1700 wrote to memory of 740	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	5
PID 1700 wrote to memory of 944	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	8
PID 1700 wrote to memory of 956	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	9
PID 1700 wrote to memory of 964	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	10
PID 1700 wrote to memory of 544	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	11
PID 1700 wrote to memory of 412	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	12
PID 1700 wrote to memory of 472	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	13
PID 1700 wrote to memory of 1104	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	14
PID 1700 wrote to memory of 1164	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	15
PID 1700 wrote to memory of 1200	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	16
PID 1700 wrote to memory of 1240	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	17
PID 1700 wrote to memory of 1328	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	18
PID 1700 wrote to memory of 1400	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	20
PID 1700 wrote to memory of 1408	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	21
PID 1700 wrote to memory of 1520	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	22
PID 1700 wrote to memory of 1556	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	23
PID 1700 wrote to memory of 1604	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	24
PID 1700 wrote to memory of 1680	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	25
PID 1700 wrote to memory of 1692	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	26
PID 1700 wrote to memory of 1952	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	27
PID 1700 wrote to memory of 1508	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	28
PID 1700 wrote to memory of 1664	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	29
PID 1700 wrote to memory of 2120	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	30
PID 1700 wrote to memory of 2128	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	31
PID 1700 wrote to memory of 2160	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	32
PID 1700 wrote to memory of 2368	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	33
PID 1700 wrote to memory of 2432	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	34
PID 1700 wrote to memory of 2488	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	35
PID 1700 wrote to memory of 2584	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	36
PID 1700 wrote to memory of 2620	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	37
PID 1700 wrote to memory of 2680	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	38
PID 1700 wrote to memory of 2688	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	39
PID 1700 wrote to memory of 2716	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	40
PID 1700 wrote to memory of 2724	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	41
PID 1700 wrote to memory of 2832	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	42
PID 1700 wrote to memory of 2996	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	43
PID 1700 wrote to memory of 1368	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	44
PID 1700 wrote to memory of 2508	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	45
PID 1700 wrote to memory of 3148	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	46
PID 1700 wrote to memory of 3212	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	47
PID 1700 wrote to memory of 3460	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	49
PID 1700 wrote to memory of 3496	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	50
PID 1700 wrote to memory of 3504	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	51
PID 1700 wrote to memory of 3516	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	52
PID 1700 wrote to memory of 3580	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	53
PID 1700 wrote to memory of 3588	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	54
PID 1700 wrote to memory of 3616	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	55
PID 1700 wrote to memory of 3260	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	56
PID 1700 wrote to memory of 1196	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	57
PID 1700 wrote to memory of 4340	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	58
PID 1700 wrote to memory of 4380	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	59
PID 1700 wrote to memory of 4456	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	60
PID 1700 wrote to memory of 4640	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	61
PID 1700 wrote to memory of 4752	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	62
PID 1700 wrote to memory of 4964	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	63
PID 1700 wrote to memory of 4996	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	64
PID 1700 wrote to memory of 5204	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	65
PID 1700 wrote to memory of 5616	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	68
PID 1700 wrote to memory of 1264	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	70
PID 1700 wrote to memory of 3456	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	71
PID 1700 wrote to memory of 5808	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	73
PID 1700 wrote to memory of 2444	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	76
PID 1700 wrote to memory of 2712	1700	jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe	77

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:956
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:944
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4340
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4380
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4752
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
  2⤵
  PID:4996
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:4528
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
  2⤵
  PID:2784
- C:\Windows\System32\smartscreen.exe
  C:\Windows\System32\smartscreen.exe -Embedding
  2⤵
  PID:5408

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:964

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-aaf70d75-e5c8-4914-8c3a-90f1d31f9d09 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-99aaa876-f674-47f8-90b0-3f96f67a5307 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-44774141-136a-4836-ab73-ff8e55fa9caa -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f6f03c54-84b2-45f1-9ebb-af08268af276 -LifetimeId:1707c8c5-0d2e-4360-88f8-11acb3ae584e -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1664
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3852
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe
      "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.SpyEyes.alrp.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2620
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000264;000000000000026C;
  2⤵
  PID:4964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2832

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3212

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4640

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2444

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1700-73-0x000000000EA00000-0x000000000EA34000-memory.dmp

Download

memory/1700-1-0x0000000000401000-0x0000000000403000-memory.dmp

Download

memory/2076-2-0x0000000000400000-0x0000000000434000-memory.dmp

Download