920b2a2171b4e48018cc4de4edf4da432315e9a495c62f2ba7c2399d3f18f375

Analysis

max time kernel
85s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/10/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Heroes of Might and Magic III Complete HD Repack by ZoTaC.exe
Size 701.0MB
Sample241026-kfknbasdmg
SHA256 920b2a2171b4e48018cc4de4edf4da432315e9a495c62f2ba7c2399d3f18f375
MD5 72e0e6212e73668d2f80be66c6c83ae6
SHA1 35f785112b9a9f18a16b20d2342db35f21db9720
SHA512 b99d5e92fb80afa36afcde5aa57240f51c5f18d20038f2de5e7e6d7d6be26fa943faaf19513c3987e0223d45c3c485d875006bc89c2185453255c6511c613700
SSDEEP 12582912:mV8ZdlWC+e30EZMT3knPYchenmOtRiPzyq08zSctptUnXSV4T:m2LWrg4kPYHmeI7X03C5E
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
244	takeown.exe
184	takeown.exe
2132	icacls.exe
3948	icacls.exe

Executes dropped EXE 1 IoCs

pid	Process
2188	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
244	takeown.exe
184	takeown.exe
2132	icacls.exe
3948	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\en-US	xcopy.exe
File opened for modification	C:\Windows\en-US\winhlp32.exe.mui	xcopy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heroes of Might and Magic III Complete HD Repack by ZoTaC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1320	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2188	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
2188	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeTakeOwnershipPrivilege	244	takeown.exe
Token: SeTakeOwnershipPrivilege	184	takeown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 2188	552	Heroes of Might and Magic III Complete HD Repack by ZoTaC.exe	91
PID 552 wrote to memory of 2188	552	Heroes of Might and Magic III Complete HD Repack by ZoTaC.exe	91
PID 552 wrote to memory of 2188	552	Heroes of Might and Magic III Complete HD Repack by ZoTaC.exe	91
PID 2188 wrote to memory of 1968	2188	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp	107
PID 2188 wrote to memory of 1968	2188	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp	107
PID 2188 wrote to memory of 1968	2188	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp	107
PID 1968 wrote to memory of 3324	1968	cmd.exe	109
PID 1968 wrote to memory of 3324	1968	cmd.exe	109
PID 1968 wrote to memory of 3324	1968	cmd.exe	109
PID 1968 wrote to memory of 548	1968	cmd.exe	110
PID 1968 wrote to memory of 548	1968	cmd.exe	110
PID 1968 wrote to memory of 548	1968	cmd.exe	110
PID 1968 wrote to memory of 2452	1968	cmd.exe	111
PID 1968 wrote to memory of 2452	1968	cmd.exe	111
PID 1968 wrote to memory of 2452	1968	cmd.exe	111
PID 1968 wrote to memory of 4312	1968	cmd.exe	112
PID 1968 wrote to memory of 4312	1968	cmd.exe	112
PID 1968 wrote to memory of 4312	1968	cmd.exe	112
PID 1968 wrote to memory of 2676	1968	cmd.exe	113
PID 1968 wrote to memory of 2676	1968	cmd.exe	113
PID 1968 wrote to memory of 2676	1968	cmd.exe	113
PID 1968 wrote to memory of 3988	1968	cmd.exe	114
PID 1968 wrote to memory of 3988	1968	cmd.exe	114
PID 1968 wrote to memory of 3988	1968	cmd.exe	114
PID 1968 wrote to memory of 1320	1968	cmd.exe	115
PID 1968 wrote to memory of 1320	1968	cmd.exe	115
PID 1968 wrote to memory of 1320	1968	cmd.exe	115
PID 1968 wrote to memory of 244	1968	cmd.exe	116
PID 1968 wrote to memory of 244	1968	cmd.exe	116
PID 1968 wrote to memory of 244	1968	cmd.exe	116
PID 1968 wrote to memory of 184	1968	cmd.exe	117
PID 1968 wrote to memory of 184	1968	cmd.exe	117
PID 1968 wrote to memory of 184	1968	cmd.exe	117
PID 1968 wrote to memory of 2132	1968	cmd.exe	118
PID 1968 wrote to memory of 2132	1968	cmd.exe	118
PID 1968 wrote to memory of 2132	1968	cmd.exe	118
PID 1968 wrote to memory of 3948	1968	cmd.exe	119
PID 1968 wrote to memory of 3948	1968	cmd.exe	119
PID 1968 wrote to memory of 3948	1968	cmd.exe	119
PID 1968 wrote to memory of 4520	1968	cmd.exe	120
PID 1968 wrote to memory of 4520	1968	cmd.exe	120
PID 1968 wrote to memory of 4520	1968	cmd.exe	120
PID 1968 wrote to memory of 4236	1968	cmd.exe	121
PID 1968 wrote to memory of 4236	1968	cmd.exe	121
PID 1968 wrote to memory of 4236	1968	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\Heroes of Might and Magic III Complete HD Repack by ZoTaC.exe
"C:\Users\Admin\AppData\Local\Temp\Heroes of Might and Magic III Complete HD Repack by ZoTaC.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\is-B2MCU.tmp\Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-B2MCU.tmp\Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp" /SL5="$B0110,734458995,181760,C:\Users\Admin\AppData\Local\Temp\Heroes of Might and Magic III Complete HD Repack by ZoTaC.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\WinHlp32\Install.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3324
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /il "5\.2\."
      4⤵
      System Location Discovery: System Language Discovery
      PID:548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2452
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /il "5\.1\."
      4⤵
      System Location Discovery: System Language Discovery
      PID:4312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2676
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /il "5\.0"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im winhlp32.exe /t
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1320
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f "C:\Windows\en-US\winhlp32.exe.mui"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:244
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f "C:\Windows\ru-RU\winhlp32.exe.mui"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:184
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\en-US\winhlp32.exe.mui" /grant "Admin":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2132
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\ru-RU\winhlp32.exe.mui" /grant "Admin":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3948
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy /r /y /h /q "en-EN\winhlp32.exe.mui" "C:\Windows\en-US"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      PID:4520
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy /r /y /h /q "ru-RU\winhlp32.exe.mui" "C:\Windows\ru-RU"
      4⤵
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_Launcher.exe

Path C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\HD_Launcher.exe
Size 1.0MB
SHA256 712873099e430e17b253b3c9c8d5dca0062d7ad357bcf6ded70af144af8fc9d9
MD5 1ded5a4c08f7158c03b27d0dd408914a
SHA1 bd68aebe52e3a58ff8b544cd17a0bba1e001de4b
SHA512 d99823edc6be68aa0c64f6c9a3988460199acdffa82f026778d129fbc1771ec93e7353c51ddbffe5435f8ddb06b181afd8d579a1233440a96a26e9cd5c711f07
SSDEEP 24576:T5TLa7lZFhwyBHfKxJqP6gzIeP6oceZ9:FLaFhhH2qS+IeSteZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Heroes3.exe

Path C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Heroes3.exe
Size 2.7MB
SHA256 c8bdbd6b1bf6f89f9a57799c70f9a5556ef17528728c98e607f48d46cae8d55e
MD5 4a30f5fff261a24f91c0d479662095dd
SHA1 258607bafd5e319a94ef57622b6450c7ec69c279
SHA512 8e91f50be81f112c1b567b7ae9480a506b3a3ba8713c6be656f027d1640d27bebeed799853d8cbf6428be4830c4e55c0df82afffcbb0248cfe92ed0dbccde08b
SSDEEP 49152:Mp/ICD9cpm3lvVZ++juEyMGylKjFpYg3Y90lS37f7E:MpAGcp4H++juohE4prz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.bat

Path C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\WinHlp32\Install.bat
Size 1KB
SHA256 f55f39ff86bce9814dbc46b70295f4131ed8af6a26cb2c220ade8c4bbf5c110d
MD5 3f795f3953ea3feb3b77da6c7bc0cecd
SHA1 3c5e6e1f7e27454c2ff08d126fef6a0287fb3c94
SHA512 bbaa6339c98a3134c1aa84b39fd6132bbcb9a7cfc44f7c482c1482dbdbdfafa226e353b757c04158f5c47974fa6d44aba761b212fe920a4d1f029fbb6d2456c1
MD5 SHA1 SHA512

Submit Download

winhlp32.exe.mui

Path C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\WinHlp32\en-EN\winhlp32.exe.mui
Size 30KB
SHA256 2300ef062d22e8eebcd4baac907f8599bd898b4cd1f051ac138fd9f961d8e94d
MD5 4ed03cfaff6cfbdbe092148299ca9716
SHA1 d1745a1da7c9388892fcc0e36e3595e58e53bb32
SHA512 497ab164d4fd181547e4edf42e54d603542c67358934616c313f4bc65c1e589783563b223b2640b60a7e93ff70e1330e585049a31725e1d29b48c16b0396f1eb
SSDEEP 384:KWjedtRLU8e0XcYQJzVrZosTKJUqSh6yb4Gu4lwjVI6WMkVe4W:g9e0XcYQpVrGIKJUph6yb4G8R0Ve
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-TQQU9.tmp

Path C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-TQQU9.tmp
Size 469KB
SHA256 b25012747f6872e1e8ffd38cd6c6cf58223d11a0774cba0833bc10b2a8bfd496
MD5 71289e4d008c2118268e7f0647ebf2c2
SHA1 c62d1f5c3af38dcfd16d7293a2c89ff9c5fe22f6
SHA512 ea9d8dd10a9967f2e8c59a4c43486cafe4c31cff9896fce30dcc10da9eca81528a5dc4bdcc72cac46c2bce6c66bc6260a70d6f3befc2be157221eaf410d6761c
SSDEEP 6144:TsSLW0HyDvWhlKExo4WejNN61K2i8V3xKgcOCxNJU7:7WLDvWhlZxvWejNN6Xi8CFOCxNJU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-JI0ON.tmp

Path C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Compability\#wog358\is-JI0ON.tmp
Size 16B
SHA256 1f3b7af922efccfd6273f8ad98c967fff764852ec0aeb900d9df58b0d4e944dc
MD5 7fa33a2088683f93b1db22c8ab988e85
SHA1 43e1b42f3f6af23cf55d1fd9b3a5fd8e4d0b7237
SHA512 bf5064fbfbf7a1acbf70fc9bde5205d3bf6c9e144a3e9e414b9ce9670c211aeacece58776b0426f83bd64ceed673b398eb8a022a4a52e2324ebf401dbb84775e
MD5 SHA1 SHA512

Submit Download

is-BLQKQ.tmp

Path C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-BLQKQ.tmp
Size 350KB
SHA256 8d02bf4afa3c7b775d943cf3bb60dae7b9568ba4761d024acaf33349443422db
MD5 1a3674b168e09aa829764f3be106f70f
SHA1 0e39ec4ba96920dfe9fbc00e855be899b559f7f6
SHA512 3d3e568a85bf93dd6d869255eee3be93776aab02470ed1bff83fab751132b9fff78f61e5f7f7c3a2c296613ce33b8b2948e1fa677ac1c4125ca77cea062529ae
SSDEEP 6144:y/EV5HYjcs0XAfpt4kGjftzRyMx0B31qoDFsEj69vpZNpHitjEO+B0KSQ:y/EV5HYjcFKqJjft9yO0zqoDFsEj69vt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-B2MCU.tmp\Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
Size 1.2MB
SHA256 6817b64c5f85051a09691532bd9ee83f53571b9fe31252cf40bc1cc243f44a35
MD5 8ac57715cf83ecb51e8418aa66aff844
SHA1 cfc3ccb1278e080c358dcfa1a9ff404cd1989fe2
SHA512 9f6bfda1d1f92877eb4efa381d0b6ef25093d6d2df8b2bf1aa95c75695d87fcc5b47dc5e0b42e2d3011bf5885d7c79349f5289d7614733519db8b6d4caef458d
SSDEEP 24576:3qLK2jlBhij2oVxRFDyoZoefo9SUBELDNrsj9Tx9lF:aDGF9yEUMADV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-11-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/552-0-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/552-2-0x0000000000401000-0x0000000000412000-memory.dmp

Download

memory/552-2626-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/2188-2281-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/2188-2593-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/2188-14-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/2188-6-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/2188-12-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/2188-2616-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/2188-1513-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/2188-2622-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/2188-2625-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/2188-2133-0x0000000000400000-0x000000000053C000-memory.dmp

Download

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\DPWSOCKX.DLL	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-OP6F9.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-VP586.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-BNJG4.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Mp3\is-C31CR.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-PETOL.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-NQVT0.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-TOJC8.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\is-N8LAS.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\is-72TK6.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-TNQ4R.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-TSVS4.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-RQ8D5.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-SQE39.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Lang\is-I0JFE.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-GI6DP.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\Fix.Cosmetic\is-I92CE.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-DBDO8.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-BM2R0.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\Fix.Cosmetic\is-MOKQL.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-GH4T0.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Duration_Spells\is-9L0SE.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-MIGO9.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-4NBB8.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\is-K5RVT.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\is-2HARC.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\is-VN5VI.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-BDB83.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-93260.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-SKI19.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-LRQM1.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-5M0K3.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-CJFSU.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-MG7M2.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Estates_Level_Hero\is-9I3JE.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\is-UAURI.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\is-4FSH6.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\is-5PFN4.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-2ETB1.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-0E4HP.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-34SCG.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-TSUPA.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-RNA0T.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-VEIJU.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Settings\is-BA601.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\is-0F726.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\Fix.Cosmetic\is-E6IO6.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\New_Eagle_Eye\is-4ESSN.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\is-JLCM2.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Data\is-HTKUD.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-GFN46.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\is-AIM3O.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\is-KDA42.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-O8S40.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-85RKO.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-SA8JT.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Compability\#wog358\is-PPSQI.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\SoD_SP_1.19.0.9\is-6PT3B.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Mp3\is-F3L6V.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\Englification_Plus_1.2\is-I3O6V.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-JGGH1.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Common\is-QPOBM.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File created	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\Maps\~ Лучшие авторские карты ~\is-H64DS.tmp	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp
File opened for modification	C:\Program Files (x86)\Heroes of Might and Magic III Complete HD\_HD3_Data\Packs\New_Disguise\NewDisguise.dll	Heroes of Might and Magic III Complete HD Repack by ZoTaC.tmp