27d633f27917b8f04c1530932075fe064103b2cf3a19b855702cd28c63daa1dc

Analysis

max time kernel
61s
max time network
67s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-12-2022 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

6.7MB
MD5

4e6e8cb85d0c62b34c13f69971a7de11
SHA1

893d8bff0bf46a20f462e7b142c3703f63b4f9ae
SHA256

27d633f27917b8f04c1530932075fe064103b2cf3a19b855702cd28c63daa1dc
SHA512

f19bb449aa5edd5ba1baf2507a68e082315dc882047480334a6298147790512220395bb603bc4a98ad89b192fa2c346d3bf8e2e695fe2ebd258101da81823d54
SSDEEP

196608:fvtAZj41WJ6pzqZjwT6p14pwOY20lnz0Iw:HKZ9JozqZjWac0lnzk

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.backup	hosts.exe

Executes dropped EXE 26 IoCs

pid	Process
1644	setup.tmp
1676	FlushFileCache.exe
1936	unins000.exe
1576	_iu14D2N.tmp
1204	hosts.exe
1116	hosts.exe
1932	hosts.exe
1912	hosts.exe
1420	hosts.exe
1464	hosts.exe
1680	hosts.exe
1076	hosts.exe
1700	hosts.exe
668	hosts.exe
1572	hosts.exe
556	hosts.exe
1004	hosts.exe
944	hosts.exe
1528	hosts.exe
364	hosts.exe
1036	hosts.exe
1464	hosts.exe
976	hosts.exe
1600	hosts.exe
1456	hosts.exe
1924	hosts.exe

Loads dropped DLL 38 IoCs

pid	Process
1660	setup.exe
1644	setup.tmp
1644	setup.tmp
1644	setup.tmp
1644	setup.tmp
1644	setup.tmp
1644	setup.tmp
1644	setup.tmp
1644	setup.tmp
1644	setup.tmp
1644	setup.tmp
1644	setup.tmp
1644	setup.tmp
1936	unins000.exe
1576	_iu14D2N.tmp
1576	_iu14D2N.tmp
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe
1132	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 51 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "82"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2421"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2421"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "82"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "4536"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{424DE2D1-8647-11ED-8F62-626C2AE6DC56} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2503"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2509"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2509"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "4536"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2503"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2509"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "4536"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2421"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "82"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2503"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1644	setup.tmp
1644	setup.tmp

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	2040	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2040	AUDIODG.EXE
Token: 33	2040	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2040	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	1676	FlushFileCache.exe
Token: SeProfSingleProcessPrivilege	1676	FlushFileCache.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1644	setup.tmp
1644	setup.tmp
1576	_iu14D2N.tmp
1616	iexplore.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1616	iexplore.exe
1616	iexplore.exe
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
1616	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1644	1660	setup.exe	28
PID 1660 wrote to memory of 1644	1660	setup.exe	28
PID 1660 wrote to memory of 1644	1660	setup.exe	28
PID 1660 wrote to memory of 1644	1660	setup.exe	28
PID 1660 wrote to memory of 1644	1660	setup.exe	28
PID 1660 wrote to memory of 1644	1660	setup.exe	28
PID 1660 wrote to memory of 1644	1660	setup.exe	28
PID 1644 wrote to memory of 1676	1644	setup.tmp	33
PID 1644 wrote to memory of 1676	1644	setup.tmp	33
PID 1644 wrote to memory of 1676	1644	setup.tmp	33
PID 1644 wrote to memory of 1676	1644	setup.tmp	33
PID 1644 wrote to memory of 1936	1644	setup.tmp	35
PID 1644 wrote to memory of 1936	1644	setup.tmp	35
PID 1644 wrote to memory of 1936	1644	setup.tmp	35
PID 1644 wrote to memory of 1936	1644	setup.tmp	35
PID 1644 wrote to memory of 1936	1644	setup.tmp	35
PID 1644 wrote to memory of 1936	1644	setup.tmp	35
PID 1644 wrote to memory of 1936	1644	setup.tmp	35
PID 1936 wrote to memory of 1576	1936	unins000.exe	36
PID 1936 wrote to memory of 1576	1936	unins000.exe	36
PID 1936 wrote to memory of 1576	1936	unins000.exe	36
PID 1936 wrote to memory of 1576	1936	unins000.exe	36
PID 1936 wrote to memory of 1576	1936	unins000.exe	36
PID 1936 wrote to memory of 1576	1936	unins000.exe	36
PID 1936 wrote to memory of 1576	1936	unins000.exe	36
PID 1644 wrote to memory of 1616	1644	setup.tmp	38
PID 1644 wrote to memory of 1616	1644	setup.tmp	38
PID 1644 wrote to memory of 1616	1644	setup.tmp	38
PID 1644 wrote to memory of 1616	1644	setup.tmp	38
PID 1644 wrote to memory of 1132	1644	setup.tmp	39
PID 1644 wrote to memory of 1132	1644	setup.tmp	39
PID 1644 wrote to memory of 1132	1644	setup.tmp	39
PID 1644 wrote to memory of 1132	1644	setup.tmp	39
PID 1132 wrote to memory of 1204	1132	cmd.exe	41
PID 1132 wrote to memory of 1204	1132	cmd.exe	41
PID 1132 wrote to memory of 1204	1132	cmd.exe	41
PID 1132 wrote to memory of 1204	1132	cmd.exe	41
PID 1616 wrote to memory of 2012	1616	iexplore.exe	42
PID 1616 wrote to memory of 2012	1616	iexplore.exe	42
PID 1616 wrote to memory of 2012	1616	iexplore.exe	42
PID 1616 wrote to memory of 2012	1616	iexplore.exe	42
PID 1132 wrote to memory of 1116	1132	cmd.exe	43
PID 1132 wrote to memory of 1116	1132	cmd.exe	43
PID 1132 wrote to memory of 1116	1132	cmd.exe	43
PID 1132 wrote to memory of 1116	1132	cmd.exe	43
PID 1132 wrote to memory of 1932	1132	cmd.exe	44
PID 1132 wrote to memory of 1932	1132	cmd.exe	44
PID 1132 wrote to memory of 1932	1132	cmd.exe	44
PID 1132 wrote to memory of 1932	1132	cmd.exe	44
PID 1132 wrote to memory of 1912	1132	cmd.exe	45
PID 1132 wrote to memory of 1912	1132	cmd.exe	45
PID 1132 wrote to memory of 1912	1132	cmd.exe	45
PID 1132 wrote to memory of 1912	1132	cmd.exe	45
PID 1132 wrote to memory of 1420	1132	cmd.exe	46
PID 1132 wrote to memory of 1420	1132	cmd.exe	46
PID 1132 wrote to memory of 1420	1132	cmd.exe	46
PID 1132 wrote to memory of 1420	1132	cmd.exe	46
PID 1132 wrote to memory of 1464	1132	cmd.exe	47
PID 1132 wrote to memory of 1464	1132	cmd.exe	47
PID 1132 wrote to memory of 1464	1132	cmd.exe	47
PID 1132 wrote to memory of 1464	1132	cmd.exe	47
PID 1132 wrote to memory of 1680	1132	cmd.exe	48
PID 1132 wrote to memory of 1680	1132	cmd.exe	48
PID 1132 wrote to memory of 1680	1132	cmd.exe	48

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\is-CE13O.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CE13O.tmp\setup.tmp" /SL5="$90120,6468567,140800,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\FlushFileCache.exe
    "C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\FlushFileCache.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- - C:\Games\The Legend of Zelda - Breath of the Wild\unins000.exe
    "C:\Games\The Legend of Zelda - Breath of the Wild\unins000.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\The Legend of Zelda - Breath of the Wild\unins000.exe" /FIRSTPHASEWND=$A01F4 /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:1576
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://bit.ly/fitgirl-repacks-site
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\host.cmd"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:668
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:556
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:944
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add *.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:364
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:976
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1924

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x564
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Games\The Legend of Zelda - Breath of the Wild\_Redist\QuickSFV.EXE

Filesize
101KB

MD5
4b1d5ec11b2b5db046233a28dba73b83

SHA1
3a4e464d3602957f3527727ea62876902b451511

SHA256
a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c

SHA512
fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\_Redist\QuickSFV.ini

Filesize
155B

MD5
c5c28798bca6e9ed5d84fa67b656065a

SHA1
4b6fa3465f1b393e22e9f083b177462028a48e93

SHA256
74ca5a42469197eded04f5a0bf34ca251c72f7cc06a3416ac035230cb8e81629

SHA512
c06baa4b31e2866fc3f298826930f43fb1d9c2de24e0984594e41f72f022a9090712b478e84d3cb46e0cb0f45d4e81d6c6443b69c7513775340324d9eda92963

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\_Redist\dxwebsetup.exe

Filesize
292KB

MD5
56d52c503adf02184f19eee4767ef60a

SHA1
ca133f67a286f4f20282e19837b53b38a27a1caa

SHA256
ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494

SHA512
246f35664a9af548d402878a3e6ce6d8901a0978477b145db5fd4e5857021efc4016369e9e02e709a27cf5c84f44a32e106008668ba96e2b45d4d06599090d8f

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\_Redist\fitgirl.md5

Filesize
5.0MB

MD5
a450d7b88cbf9074df99759d2f664612

SHA1
3ff168443530bb25da044f49842ccf10a80b8e4d

SHA256
ddff9b1c4f87c9add70b97bd69a8e91280a8c0e6a50f5cbb80dc0851bad2c4bc

SHA512
747792d573e43445349aa52d65322cffe4c0a97bb0fd6f5cdedc6c9a2d9f56ddc3d5a3be5870ff1f274c7f35917155486dcc3067b07012336920a67bc452441c

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\_Redist\vc_redist.x64.exe

Filesize
14.5MB

MD5
77c0f604585fb429c722be111ca30c37

SHA1
bdb645ebaf3c91eceb1a143be6793ca57e6435c3

SHA256
7434bf559290cccc3dd3624f10c9e6422cce9927d2231d294114b2f929f0e465

SHA512
1de6aaaf0390d3def3bf07e8186454e6a480b1f0c800ed99c4dc737198a48c1fddb03ea9530bac9d4acbe4459cd20faf80693ed08baaa91cc817c58ad2ae911e

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\_Redist\vc_redist.x86.exe

Filesize
13.8MB

MD5
8dac0e58fdcd659c9de1715aed297cf2

SHA1
370583c380c26064885289037380af7d8d5f4e81

SHA256
2da11e22a276be85970eaed255daf3d92af84e94142ec04252326a882e57303e

SHA512
ef9a9430ade4d511c1514a1ea688871f4b5c010ec886e45d6df3f3d6d769752f675ead243e3f1dfd0bb7e48ccd7d085a18484de3777cc55cae02b962e384304b

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\cemu\settings.xml

Filesize
5KB

MD5
ac2b752099b2729145cdbd3921c93a31

SHA1
1ea5e9d6403b86a4125f1a21275b2d6efbf185a7

SHA256
0fc4398d7f1883fe89d0e0e1858842cc9c456d0b951fa380d48e9fa27be2591b

SHA512
55d2c8336f4274d7a8a847fe5eef51267716efd4deee68c539186b2bbe83d29dbd8bfa82ee1292c9acb6fa1f77b6aeb08234dfc57120df6f62c3664be202a326

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\cemu\zelda_icon.ico

Filesize
9KB

MD5
3aea663bd9181292310ded79ac170d13

SHA1
6dc8e050930619056ae3a9c85ba54b3eae42029b

SHA256
084e2c4cc8d8d5b4a2b80a4ca8a8e0f2dfbbfca097406675ac9e67e0c62ec4a3

SHA512
280736ec1fa4a397a063f6f56dac9eabc937cf3b662d280da30a67b36f654f59ac3a0ee7c6aea5041d36b722b00a6e2bb19b102f36f9346e5b8d93712cefd92c

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\country.txt

Filesize
1KB

MD5
2b9cf203be9ee31b907efb45fdf6d4df

SHA1
2e4265b273babf5dcc13119176a48ed5bd5336a7

SHA256
beada5896654472e599d609bed0bc1ff06f741bf5fd9c543520d16186f2fa529

SHA512
eb5f84e0fd062e617d47b0c8c972c2af1a3e7a90c48dc3cb66a1c9594f18d38497b74bd58b467dd0ed944390f53e96e46f25de2b605ca2b78bb11f1e64b5d404

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\language.txt

Filesize
84B

MD5
d4be16f01b3da359bfb81a92c30d7ce2

SHA1
26e0555cb400362ffae8399ef4cb48369eedac5c

SHA256
58bb49edda24028d6e18ab22ce55d888e8c6485ac8476c3d81b6c8872b94228d

SHA512
0dc9eaa4b042ea87b0ace0641da8bb8de984abe9a01d7a66f00c0ca4b13e1df27e12b7e048c47e75ec7293bbb23b7638dabadb39e226f1402df4ce310b2da667

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\unins000.dat

Filesize
198KB

MD5
58665b8e30631f6d88fdea334a1b9f6b

SHA1
0d46549e049cf6d6d024e230637da9658001cef7

SHA256
2310b84564e44cb918d28cd5dbdc03248a19e3fecd7d06c2a611961c02e4e476

SHA512
7d2462db01e018007cdd66fd4257b2cfa9d37d86d5b378eb766bdb76483fac3652988b4ea9d89f2d5f386c15ecca9513823c83b7f8da0286bf63b480f27b6d5d

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\unins000.exe

Filesize
1.4MB

MD5
a69fb8e0af7d6b1fa8018f39c7457952

SHA1
662b2ad3cf1ff9608e162213b3a3197a9dc716b7

SHA256
d8124906995e012b943dea0a90b09c735eba3d8b1ab250bb954643922fa4347d

SHA512
5fef885aacbb16963e28315a15b69604bbf15b03d91e0764ad665d8e0bb06e7dc4c64f0aa9bcc2b6c71cf3851229be00110a37eddda3739d4184a460a1752cc9

Download Submit
C:\Games\The Legend of Zelda - Breath of the Wild\unins000.exe

Filesize
1.4MB

MD5
a69fb8e0af7d6b1fa8018f39c7457952

SHA1
662b2ad3cf1ff9608e162213b3a3197a9dc716b7

SHA256
d8124906995e012b943dea0a90b09c735eba3d8b1ab250bb954643922fa4347d

SHA512
5fef885aacbb16963e28315a15b69604bbf15b03d91e0764ad665d8e0bb06e7dc4c64f0aa9bcc2b6c71cf3851229be00110a37eddda3739d4184a460a1752cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
1.4MB

MD5
a69fb8e0af7d6b1fa8018f39c7457952

SHA1
662b2ad3cf1ff9608e162213b3a3197a9dc716b7

SHA256
d8124906995e012b943dea0a90b09c735eba3d8b1ab250bb954643922fa4347d

SHA512
5fef885aacbb16963e28315a15b69604bbf15b03d91e0764ad665d8e0bb06e7dc4c64f0aa9bcc2b6c71cf3851229be00110a37eddda3739d4184a460a1752cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
1.4MB

MD5
a69fb8e0af7d6b1fa8018f39c7457952

SHA1
662b2ad3cf1ff9608e162213b3a3197a9dc716b7

SHA256
d8124906995e012b943dea0a90b09c735eba3d8b1ab250bb954643922fa4347d

SHA512
5fef885aacbb16963e28315a15b69604bbf15b03d91e0764ad665d8e0bb06e7dc4c64f0aa9bcc2b6c71cf3851229be00110a37eddda3739d4184a460a1752cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\FlushFileCache.exe

Filesize
29KB

MD5
df77f2b6126f4f258f2e952b53b22879

SHA1
fedda8401ebfe872dd081538deec58965e82f675

SHA256
a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8

SHA512
623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\_Redist\builder.exe

Filesize
146KB

MD5
3ed84ad98177e3bea38ed075631503c3

SHA1
02cb214a838d2e20adbdc0275b7cfad78820a98e

SHA256
1c362db98474f6896e741234519f3c63234cfcf74071bf232e2d27990de282a2

SHA512
9e956497b4c27c5aa75a2528949be2f82b395a52f0a4f9462add44ff19d6a13fadd900747476367efc01bea599f255def7ef671fdd3c10f7a221f90cc6e6de07

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\host.cmd

Filesize
1KB

MD5
acda67e86c74bd9499e4d730e20329af

SHA1
c48f08db6662a91b2d74b18fdca2075e9847a79d

SHA256
302a43e6396fcd5de189546fbf0daa273d603113dd26f48ae14bfc43e2a79980

SHA512
384f63388cb86492a77302cba0b77284303dc5ebc4181c86baee761d2be78a9144a0461dad7471ece9f119a1d6e2dfbb96021d02218d949575692aebc1ff3c6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CE13O.tmp\setup.tmp

Filesize
1.4MB

MD5
ae9890548f2fcab56a4e9ae446f55b3f

SHA1
e17c970eebbe6d7d693c8ac5a7733218800a5a96

SHA256
09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449

SHA512
154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CE13O.tmp\setup.tmp

Filesize
1.4MB

MD5
ae9890548f2fcab56a4e9ae446f55b3f

SHA1
e17c970eebbe6d7d693c8ac5a7733218800a5a96

SHA256
09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449

SHA512
154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb

Download Submit
C:\Users\Public\Desktop\The Legend of Zelda - Breath of the Wild.lnk

Filesize
1KB

MD5
159b3007166c8c0b10ca17fc7ce559da

SHA1
55ecaac32ae396286458c89accc57a2876b3b5de

SHA256
5be28cf0d70d2b3c3fe4d30cc432fd15e7535f3dc4b52838ccbad7420f8071b7

SHA512
bbd883036fb6980c1b3e2a1618da0cd8f4612065235ebda7bff92dff3494d1eaa7c94556adfceca6d7cc8e54766101cb99b556e4b6d11e324f740a410a94784f

Download Submit
\??\c:\windows\system32\drivers\etc\hosts

Filesize
968B

MD5
fe4c90648c5c1182d7c63c2618c3a514

SHA1
e2425a8a8c757085c3e78a4d62242f28c791a40d

SHA256
7085e2dff8a24bc0ecb179d8b53becbdb3456e1db512d9b60f264a418008eaa4

SHA512
3cb9cd1a84b4dc27dcd8c577cb2acf22eafd29b4f7855a91b677915ec88e7c4bd6d3b81e09e280f6262b2b702afcef59036c05302dff46f8ee5647685d1502ee

Download Submit
\??\c:\windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
6926974ba5b7fd36f30f3b5feef72fb5

SHA1
7f34546f6073414e5c2e354ee19a1d432e827107

SHA256
7f53cc9026970ef3642459e744649d200d382f8aeb973a26935a331b989eb405

SHA512
a29559d87bc7669944c9aa7525832d08055d8be235efb096e6ca7a28339c3dfa39885da0632568583004d2e3330f7b7d2a1626fda86bcfc54ebfbb4a213eaf45

Download Submit
\??\c:\windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
dfb5d5276a5c2af2da95cdf12461ed77

SHA1
d6584dd82d7c823779fc4cdbb3728798f1a7e74d

SHA256
cb2daa3b796b88ca80ee85746086f6b530987a2798379ae1c4ee34b01602ed37

SHA512
39d02c6944d63ca3bcf1960667ec4e409148e15b9af2bf17f48e72a9a3ddcae202d62deb17999544b36c354e1e92a5098cc1f5ac7cbe88be22fdd6043cee04d8

Download Submit
\??\c:\windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
e5467bf3858aac10fe178370386587b1

SHA1
f2cc6538bffccb519b28b2b19b9c98a1e4f6959d

SHA256
399a05655fbdf4ee51b9e05ac5df0041057b1b120445f65d1e581219335e496b

SHA512
3b80baedd033bf37f2208465a973ad1595f93ab77c2cef427680eecc88d21abd7609e656b1634221ed243eb413a221b55a72ec4e0dc1622b91a646f4bf275f01

Download Submit
\??\c:\windows\system32\drivers\etc\hosts.rollback

Filesize
896B

MD5
cd6c35ee08d32e92e8ec0983c1aea706

SHA1
fe0e9c516376420d257236dddecb9033728125af

SHA256
bd26701a6a90874aee6c2d6f7450196f2f2992827a0afeeee3f24107d59193ae

SHA512
30da175c54b54ad37db4283ef2b3b1384c8a5ae86d978f33c05944cc6782c30680eb0b3f91cc7dd84df2570400ca5af3100cbfd6f6d6f498903c04e815ff949b

Download Submit
\??\c:\windows\system32\drivers\etc\hosts.rollback

Filesize
968B

MD5
fe4c90648c5c1182d7c63c2618c3a514

SHA1
e2425a8a8c757085c3e78a4d62242f28c791a40d

SHA256
7085e2dff8a24bc0ecb179d8b53becbdb3456e1db512d9b60f264a418008eaa4

SHA512
3cb9cd1a84b4dc27dcd8c577cb2acf22eafd29b4f7855a91b677915ec88e7c4bd6d3b81e09e280f6262b2b702afcef59036c05302dff46f8ee5647685d1502ee

Download Submit
\??\c:\windows\system32\drivers\etc\hosts.rollback

Filesize
1KB

MD5
6926974ba5b7fd36f30f3b5feef72fb5

SHA1
7f34546f6073414e5c2e354ee19a1d432e827107

SHA256
7f53cc9026970ef3642459e744649d200d382f8aeb973a26935a331b989eb405

SHA512
a29559d87bc7669944c9aa7525832d08055d8be235efb096e6ca7a28339c3dfa39885da0632568583004d2e3330f7b7d2a1626fda86bcfc54ebfbb4a213eaf45

Download Submit
\??\c:\windows\system32\drivers\etc\hosts.rollback

Filesize
1KB

MD5
dfb5d5276a5c2af2da95cdf12461ed77

SHA1
d6584dd82d7c823779fc4cdbb3728798f1a7e74d

SHA256
cb2daa3b796b88ca80ee85746086f6b530987a2798379ae1c4ee34b01602ed37

SHA512
39d02c6944d63ca3bcf1960667ec4e409148e15b9af2bf17f48e72a9a3ddcae202d62deb17999544b36c354e1e92a5098cc1f5ac7cbe88be22fdd6043cee04d8

Download Submit
\??\c:\windows\system32\drivers\etc\hosts.rollback

Filesize
1KB

MD5
4b25541d2c015a1fb8e2165283209f51

SHA1
e70f5b449af1e88a8a39a6c53a8dd468a77005de

SHA256
b7ec40b2e1fc3f92ae9e161683a0cef523617fdd86ee5e1eb926eeb3a647d4a4

SHA512
3792753a951d0afed4d6c00488bf78e51b89b3116b82ea255e29cfed6721de969909aff4dfafe72481605fc1d14932f3ee5a053622dd4c2593c5786e790f9801

Download Submit
\??\c:\windows\system32\drivers\etc\hosts.rollback

Filesize
1KB

MD5
e5467bf3858aac10fe178370386587b1

SHA1
f2cc6538bffccb519b28b2b19b9c98a1e4f6959d

SHA256
399a05655fbdf4ee51b9e05ac5df0041057b1b120445f65d1e581219335e496b

SHA512
3b80baedd033bf37f2208465a973ad1595f93ab77c2cef427680eecc88d21abd7609e656b1634221ed243eb413a221b55a72ec4e0dc1622b91a646f4bf275f01

Download Submit
\Games\The Legend of Zelda - Breath of the Wild\unins000.exe

Filesize
1.4MB

MD5
a69fb8e0af7d6b1fa8018f39c7457952

SHA1
662b2ad3cf1ff9608e162213b3a3197a9dc716b7

SHA256
d8124906995e012b943dea0a90b09c735eba3d8b1ab250bb954643922fa4347d

SHA512
5fef885aacbb16963e28315a15b69604bbf15b03d91e0764ad665d8e0bb06e7dc4c64f0aa9bcc2b6c71cf3851229be00110a37eddda3739d4184a460a1752cc9

Download Submit
\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
1.4MB

MD5
a69fb8e0af7d6b1fa8018f39c7457952

SHA1
662b2ad3cf1ff9608e162213b3a3197a9dc716b7

SHA256
d8124906995e012b943dea0a90b09c735eba3d8b1ab250bb954643922fa4347d

SHA512
5fef885aacbb16963e28315a15b69604bbf15b03d91e0764ad665d8e0bb06e7dc4c64f0aa9bcc2b6c71cf3851229be00110a37eddda3739d4184a460a1752cc9

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\BASS.dll

Filesize
103KB

MD5
8005750ec63eb5292884ad6183ae2e77

SHA1
c83e31655e271cd9ef5bff62b10f8d51eb3ebf29

SHA256
df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15

SHA512
febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\CallbackCtrl.dll

Filesize
4KB

MD5
f07e819ba2e46a897cfabf816d7557b2

SHA1
8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

SHA256
68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

SHA512
7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\FlushFileCache.exe

Filesize
29KB

MD5
df77f2b6126f4f258f2e952b53b22879

SHA1
fedda8401ebfe872dd081538deec58965e82f675

SHA256
a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8

SHA512
623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\FlushFileCache.exe

Filesize
29KB

MD5
df77f2b6126f4f258f2e952b53b22879

SHA1
fedda8401ebfe872dd081538deec58965e82f675

SHA256
a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8

SHA512
623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\ISDone.dll

Filesize
452KB

MD5
4feafa8b5e8cdb349125c8af0ac43974

SHA1
7f17e5e1b088fc73690888b215962fbcd395c9bd

SHA256
bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71

SHA512
d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\hosts.exe

Filesize
32KB

MD5
a7f30bb876775a914422675a13dd56b3

SHA1
3ea28fe66a04ebbad2507a7dfdebf1622c701d43

SHA256
49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119

SHA512
6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\idp.dll

Filesize
220KB

MD5
af555ac9c073f88fe5bf0d677f085025

SHA1
5fff803cf273057c889538886f6992ea05dd146e

SHA256
f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb

SHA512
c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
\Users\Admin\AppData\Local\Temp\is-5RER4.tmp\wintb.dll

Filesize
16KB

MD5
9436df49e08c83bad8ddc906478c2041

SHA1
a4fa6bdd2fe146fda2e78fdbab355797f53b7dce

SHA256
1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435

SHA512
f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf

Download Submit
\Users\Admin\AppData\Local\Temp\is-CE13O.tmp\setup.tmp

Filesize
1.4MB

MD5
ae9890548f2fcab56a4e9ae446f55b3f

SHA1
e17c970eebbe6d7d693c8ac5a7733218800a5a96

SHA256
09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449

SHA512
154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb

Download Submit
\Users\Admin\AppData\Local\Temp\is-M1JL6.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-M1JL6.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/364-181-0x0000000000E70000-0x0000000000E7E000-memory.dmp

Filesize
56KB

Download
memory/364-180-0x0000000000000000-mapping.dmp

Download
memory/556-169-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

Filesize
56KB

Download
memory/556-168-0x0000000000000000-mapping.dmp

Download
memory/668-163-0x00000000003D0000-0x00000000003DE000-memory.dmp

Filesize
56KB

Download
memory/668-162-0x0000000000000000-mapping.dmp

Download
memory/944-175-0x00000000002E0000-0x00000000002EE000-memory.dmp

Filesize
56KB

Download
memory/944-174-0x0000000000000000-mapping.dmp

Download
memory/976-190-0x0000000001150000-0x000000000115E000-memory.dmp

Filesize
56KB

Download
memory/976-189-0x0000000000000000-mapping.dmp

Download
memory/1004-171-0x0000000000000000-mapping.dmp

Download
memory/1004-172-0x0000000000390000-0x000000000039E000-memory.dmp

Filesize
56KB

Download
memory/1036-183-0x0000000000000000-mapping.dmp

Download
memory/1036-184-0x0000000000340000-0x000000000034E000-memory.dmp

Filesize
56KB

Download
memory/1076-157-0x0000000000000000-mapping.dmp

Download
memory/1116-117-0x0000000000000000-mapping.dmp

Download
memory/1116-119-0x0000000000D90000-0x0000000000D9E000-memory.dmp

Filesize
56KB

Download
memory/1132-108-0x0000000000000000-mapping.dmp

Download
memory/1204-112-0x0000000000000000-mapping.dmp

Download
memory/1204-114-0x0000000000A40000-0x0000000000A4E000-memory.dmp

Filesize
56KB

Download
memory/1420-138-0x0000000000000000-mapping.dmp

Download
memory/1420-140-0x0000000001330000-0x000000000133E000-memory.dmp

Filesize
56KB

Download
memory/1456-195-0x0000000000000000-mapping.dmp

Download
memory/1464-186-0x0000000000000000-mapping.dmp

Download
memory/1464-147-0x0000000001330000-0x000000000133E000-memory.dmp

Filesize
56KB

Download
memory/1464-145-0x0000000000000000-mapping.dmp

Download
memory/1464-187-0x0000000000200000-0x000000000020E000-memory.dmp

Filesize
56KB

Download
memory/1528-178-0x0000000000A50000-0x0000000000A5E000-memory.dmp

Filesize
56KB

Download
memory/1528-177-0x0000000000000000-mapping.dmp

Download
memory/1572-165-0x0000000000000000-mapping.dmp

Download
memory/1572-166-0x0000000000900000-0x000000000090E000-memory.dmp

Filesize
56KB

Download
memory/1576-89-0x0000000000000000-mapping.dmp

Download
memory/1600-192-0x0000000000000000-mapping.dmp

Download
memory/1600-193-0x0000000001150000-0x000000000115E000-memory.dmp

Filesize
56KB

Download
memory/1644-58-0x0000000000000000-mapping.dmp

Download
memory/1644-67-0x0000000002ED1000-0x0000000002EF0000-memory.dmp

Filesize
124KB

Download
memory/1644-70-0x0000000074531000-0x0000000074533000-memory.dmp

Filesize
8KB

Download
memory/1644-73-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1644-76-0x00000000047F0000-0x00000000047FF000-memory.dmp

Filesize
60KB

Download
memory/1644-77-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1644-65-0x0000000002060000-0x0000000002075000-memory.dmp

Filesize
84KB

Download
memory/1660-200-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1660-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1660-68-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1660-55-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1676-80-0x0000000000000000-mapping.dmp

Download
memory/1680-152-0x0000000000000000-mapping.dmp

Download
memory/1700-159-0x0000000000000000-mapping.dmp

Download
memory/1700-160-0x00000000013B0000-0x00000000013BE000-memory.dmp

Filesize
56KB

Download
memory/1912-131-0x0000000000000000-mapping.dmp

Download
memory/1912-133-0x00000000011E0000-0x00000000011EE000-memory.dmp

Filesize
56KB

Download
memory/1924-197-0x0000000000000000-mapping.dmp

Download
memory/1924-198-0x00000000012F0000-0x00000000012FE000-memory.dmp

Filesize
56KB

Download
memory/1932-124-0x0000000000000000-mapping.dmp

Download
memory/1932-126-0x0000000000D90000-0x0000000000D9E000-memory.dmp

Filesize
56KB

Download
memory/1936-83-0x0000000000000000-mapping.dmp

Download