Analysis
- user interaction
yes - max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/07/2026, 03:52
General
- Target dawn-installer.exe
- Size 3.3MB
- Sample260720-efdl4sg151
- SHA256 e6681d3b9e6adcb3dc88c98aebf41bd5a41a10daa89d6b2a5ba8addcab907cf8
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 9 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Loads dropped DLL 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 58 IoCs
- Suspicious use of SendNotifyMessage 58 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dawn-installer.exe"C:\Users\Admin\AppData\Local\Temp\dawn-installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \"Stop\"; $m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsl46AB.tmp\manifest.json\" | ConvertFrom-Json; $i = $m.installers | Where-Object { $_.platform -eq \"windows-amd64\" -and $_.kind -eq \"app-zip\" }; if (-not $i) { Write-Error \"no windows-amd64 app-zip entry\"; exit 1 }; Write-Output $i.path; Write-Output $i.sha256; Write-Output $i.sizeBytes"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsl46AB.tmp\manifest.json\" | ConvertFrom-Json; $i = $m.installers | Where-Object { $_.platform -eq \"windows-amd64\" -and $_.kind -eq \"app-zip\" }; [Console]::Out.Write($i.path.Trim())"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsl46AB.tmp\manifest.json\" | ConvertFrom-Json; $i = $m.installers | Where-Object { $_.platform -eq \"windows-amd64\" -and $_.kind -eq \"app-zip\" }; [Console]::Out.Write($i.sha256.Trim())"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$m = Get-Content -Raw \"C:\Users\Admin\AppData\Local\Temp\nsl46AB.tmp\manifest.json\" | ConvertFrom-Json; [Console]::Out.Write($m.version.Trim())"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \"Stop\"; $hash = (Get-FileHash -Algorithm SHA256 \"C:\Users\Admin\AppData\Local\Temp\nsl46AB.tmp\DawnLauncher.zip\").Hash.ToLower(); $expected = \"bfc4a1559f7a71a3d852c911d847b64a31ff52e3122b874edb27d7a9e6d5b0b8\".Trim().ToLower(); if ($hash -ne $expected) { Write-Error \"SHA-256 mismatch: expected $expected got $hash\"; exit 1 }; Write-Output \"OK\""2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \"SilentlyContinue\"; Get-Process -Name \"Dawn (Feather)\" -ErrorAction SilentlyContinue | Stop-Process -Force; Start-Sleep -Milliseconds 750"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \"Stop\"; $src = \"C:\Users\Admin\AppData\Local\Temp\nsl46AB.tmp\DawnLauncher.zip\"; $dst = \"C:\Users\Admin\AppData\Local\Dawn\"; for ($try = 1; ; $try++) { try { Expand-Archive -Force -Path $src -DestinationPath $dst; break } catch { if ($try -ge 5) { throw }; Start-Sleep -Seconds 1 } }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \"SilentlyContinue\"; Get-AppxPackage -Name \"DawnLauncher\" | Remove-AppxPackage -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe"C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe"C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe"3⤵
- Adds Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' if (Get-AppxPackage -Name 'Microsoft.MinecraftUWP') { 'true' return } $dataRoot = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data' if (Test-Path $dataRoot) { foreach ($item in Get-ChildItem $dataRoot) { $package = Get-ItemProperty $item.PsPath if ($package.PackageFullName -like 'Microsoft.MinecraftUWP_*') { 'true' return } } } 'false'"4⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' if (Get-AppxPackage -Name 'Microsoft.MinecraftWindowsBeta') { 'true' return } $dataRoot = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data' if (Test-Path $dataRoot) { foreach ($item in Get-ChildItem $dataRoot) { $package = Get-ItemProperty $item.PsPath if ($package.PackageFullName -like 'Microsoft.MinecraftWindowsBeta_*') { 'true' return } } } 'false'"4⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe"C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe" --type=gpu-process --no-sandbox --disable-breakpad --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.179 Safari/537.36 DawnLauncher/0.2.0.304 (Dawn Launcher)" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Roaming\.dawn\browser\aditude\native-webview" --libcef-path="C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\libcef.dll" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4508,i,11490217914276511515,15009281490812640875,262144 --field-trial-handle=4732,i,16322174658044257609,1999877943970569700,262144 --disable-features=AutofillServerCommunication,CastMediaRouteProvider,DialMediaRouteProvider,InterestFeedContentSuggestions,IsolateOrigins,MediaRouter,OnDeviceModel,OptimizationGuideModelDownloading,OptimizationHints,site-per-process --variations-seed-version --pseudonymization-salt-handle=4736,i,10337666030356832869,7541700995229232326,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=4740 --mojo-platform-channel-handle=4728 /prefetch:24⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe"C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.179 Safari/537.36 DawnLauncher/0.2.0.304 (Dawn Launcher)" --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Roaming\.dawn\browser\aditude\native-webview" --libcef-path="C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\libcef.dll" --metrics-shmem-handle=4796,i,2703478056239842328,7477885992870748853,524288 --field-trial-handle=4732,i,16322174658044257609,1999877943970569700,262144 --disable-features=AutofillServerCommunication,CastMediaRouteProvider,DialMediaRouteProvider,InterestFeedContentSuggestions,IsolateOrigins,MediaRouter,OnDeviceModel,OptimizationGuideModelDownloading,OptimizationHints,site-per-process --variations-seed-version --pseudonymization-salt-handle=4736,i,10337666030356832869,7541700995229232326,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=4892 --mojo-platform-channel-handle=4888 /prefetch:34⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe"C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.179 Safari/537.36 DawnLauncher/0.2.0.304 (Dawn Launcher)" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\.dawn\browser\aditude\native-webview" --libcef-path="C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\libcef.dll" --metrics-shmem-handle=5080,i,16618496961860053779,5985799908158789507,524288 --field-trial-handle=4732,i,16322174658044257609,1999877943970569700,262144 --disable-features=AutofillServerCommunication,CastMediaRouteProvider,DialMediaRouteProvider,InterestFeedContentSuggestions,IsolateOrigins,MediaRouter,OnDeviceModel,OptimizationGuideModelDownloading,OptimizationHints,site-per-process --variations-seed-version --pseudonymization-salt-handle=4736,i,10337666030356832869,7541700995229232326,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=5240 --mojo-platform-channel-handle=5248 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe"C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.179 Safari/537.36 DawnLauncher/0.2.0.304 (Dawn Launcher)" --disable-print-preview --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\.dawn\browser\aditude\native-webview" --libcef-path="C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\libcef.dll" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-breakpad --disable-notifications --disable-speech-api --js-flags=--max-old-space-size=512 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=6172,i,12254679981998525879,16757539532279427500,2097152 --field-trial-handle=4732,i,16322174658044257609,1999877943970569700,262144 --disable-features=AutofillServerCommunication,CastMediaRouteProvider,DialMediaRouteProvider,InterestFeedContentSuggestions,IsolateOrigins,MediaRouter,OnDeviceModel,OptimizationGuideModelDownloading,OptimizationHints,site-per-process --variations-seed-version --pseudonymization-salt-handle=4736,i,10337666030356832869,7541700995229232326,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=handle --log-file=6192 --mojo-platform-channel-handle=6188 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe"C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.179 Safari/537.36 DawnLauncher/0.2.0.304 (Dawn Launcher)" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\.dawn\browser\aditude\native-webview" --libcef-path="C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\libcef.dll" --metrics-shmem-handle=6764,i,9124437233227660517,4669411120439620873,524288 --field-trial-handle=4732,i,16322174658044257609,1999877943970569700,262144 --disable-features=AutofillServerCommunication,CastMediaRouteProvider,DialMediaRouteProvider,InterestFeedContentSuggestions,IsolateOrigins,MediaRouter,OnDeviceModel,OptimizationGuideModelDownloading,OptimizationHints,site-per-process --variations-seed-version --pseudonymization-salt-handle=4736,i,10337666030356832869,7541700995229232326,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=6772 --mojo-platform-channel-handle=6768 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe"C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\jcef_helper.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.179 Safari/537.36 DawnLauncher/0.2.0.304 (Dawn Launcher)" --disable-print-preview --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Roaming\.dawn\browser\aditude\native-webview" --libcef-path="C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\app\jcef\libcef.dll" --no-sandbox --autoplay-policy=no-user-gesture-required --disable-breakpad --disable-notifications --disable-speech-api --js-flags=--max-old-space-size=512 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=6200,i,456177198129357502,5681773402308154646,2097152 --field-trial-handle=4732,i,16322174658044257609,1999877943970569700,262144 --disable-features=AutofillServerCommunication,CastMediaRouteProvider,DialMediaRouteProvider,InterestFeedContentSuggestions,IsolateOrigins,MediaRouter,OnDeviceModel,OptimizationGuideModelDownloading,OptimizationHints,site-per-process --variations-seed-version --pseudonymization-salt-handle=4736,i,10337666030356832869,7541700995229232326,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=6560 --mojo-platform-channel-handle=6460 /prefetch:14⤵
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe"C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe" --dawn-login-startup1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe"C:\Users\Admin\AppData\Local\Dawn\Dawn (Feather)\Dawn (Feather).exe" --dawn-login-startup2⤵
- Executes dropped EXE
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
Dawn (Feather).exe
af_NEUTER.pak
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
README.JAVASE
classlist
ct.sym
fontconfig.bfc
fontconfig.properties.src
jawt.lib
default.jfc
jrt-fs.jar
jvm.cfg
jvm.lib
psfont.properties.ja
psfontj2d.properties
blocked.certs
cacerts
public_suffix_list.dat
tzdb.dat
tzmappings
release
powershell.exe.log
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_yxrwbnc1.35x.ps1
imageio17472041196521008424.tmp
imageio7896298479804164513.tmp
jna8674616002710760919.dll
glfw.dll
lwjgl.dll
NScurl.dll
System.dll
cookies.txt
manifest.json
nsExec.dll
groups.json
the-real-index
the-real-index
data_0
data_1
data_2
data_3
MANIFEST-000001
SCT Auditing Pending Reports
Preferences
Preferences~RFe5a3a6a.TMP
CURRENT
Local State
Local State~RFe59fd23.TMP
diamond.json
diamond_sword.json
diamond_sword.json
generated.json
handheld.json
diamond.png
diamond.png
diamond_sword.png
catalog.json
first-run.json
aditude-cmp-debug.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
launcher.log
profile.json
memory/1692-138-0x0000000005DA0000-0x0000000005DAA000-memory.dmp
memory/1692-121-0x00000000058A0000-0x0000000005BF4000-memory.dmp
memory/1692-132-0x0000000006F70000-0x0000000006F8E000-memory.dmp
memory/1692-136-0x00000000074E0000-0x00000000074F1000-memory.dmp
memory/1692-137-0x0000000005DB0000-0x0000000005DC2000-memory.dmp
memory/1692-135-0x0000000007340000-0x000000000734A000-memory.dmp
memory/1692-133-0x0000000007210000-0x00000000072B3000-memory.dmp
memory/1692-123-0x0000000006F30000-0x0000000006F62000-memory.dmp
memory/1692-124-0x000000006F4C0000-0x000000006F50C000-memory.dmp
memory/1764-134-0x0000000073AB0000-0x000000007424D000-memory.dmp
memory/1764-82-0x0000000073AB0000-0x000000007424D000-memory.dmp
memory/1764-77-0x0000000073AB0000-0x000000007424D000-memory.dmp
memory/1764-80-0x0000000073AB0000-0x000000007424D000-memory.dmp
memory/1764-81-0x0000000073AB0000-0x000000007424D000-memory.dmp
memory/2176-469-0x00000266CBC40000-0x00000266CBC41000-memory.dmp
memory/2176-470-0x00000266CBC40000-0x00000266CBC41000-memory.dmp
memory/2176-464-0x00000266CBC40000-0x00000266CBC41000-memory.dmp
memory/2176-466-0x00000266CBC40000-0x00000266CBC41000-memory.dmp
memory/2176-465-0x00000266CBC40000-0x00000266CBC41000-memory.dmp
memory/2176-456-0x00000266CBC40000-0x00000266CBC41000-memory.dmp
memory/2176-454-0x00000266CBC40000-0x00000266CBC41000-memory.dmp
memory/2176-455-0x00000266CBC40000-0x00000266CBC41000-memory.dmp
memory/2176-468-0x00000266CBC40000-0x00000266CBC41000-memory.dmp
memory/2176-467-0x00000266CBC40000-0x00000266CBC41000-memory.dmp
memory/2604-1879-0x00000000075C0000-0x00000000075E6000-memory.dmp
memory/2604-1877-0x0000000006B30000-0x0000000006B46000-memory.dmp
memory/2604-1878-0x0000000007500000-0x000000000750A000-memory.dmp
memory/3300-63-0x0000000005A70000-0x0000000005DC4000-memory.dmp
memory/3752-29-0x00000000062C0000-0x00000000062DA000-memory.dmp
memory/3752-15-0x0000000004DF0000-0x0000000004E12000-memory.dmp
memory/3752-11-0x0000000004AC0000-0x0000000004AD0000-memory.dmp
memory/3752-12-0x00000000027E0000-0x0000000002816000-memory.dmp
memory/3752-13-0x0000000004AC0000-0x0000000004AD0000-memory.dmp
memory/3752-14-0x0000000005100000-0x0000000005728000-memory.dmp
memory/3752-16-0x0000000005090000-0x00000000050F6000-memory.dmp
memory/3752-17-0x0000000005730000-0x0000000005796000-memory.dmp
memory/3752-25-0x00000000057A0000-0x0000000005AF4000-memory.dmp
memory/3752-26-0x0000000005DC0000-0x0000000005DDE000-memory.dmp
memory/3752-27-0x0000000005DE0000-0x0000000005E2C000-memory.dmp
memory/3752-28-0x0000000006E60000-0x0000000006EF6000-memory.dmp
memory/3752-30-0x00000000062E0000-0x0000000006302000-memory.dmp
memory/3752-35-0x0000000008760000-0x0000000008C8C000-memory.dmp
memory/3752-33-0x00000000070D0000-0x0000000007292000-memory.dmp
memory/3752-32-0x00000000080E0000-0x000000000875A000-memory.dmp
memory/3752-31-0x00000000074B0000-0x0000000007A54000-memory.dmp
memory/4236-42-0x0000000004A00000-0x0000000004A10000-memory.dmp
memory/4236-43-0x0000000004A00000-0x0000000004A10000-memory.dmp
memory/5996-6241-0x000001BAF4CC0000-0x000001BAF4D04000-memory.dmp
memory/5996-6188-0x000001BA8A130000-0x000001BA8A255000-memory.dmp
memory/5996-5598-0x000001BA8A130000-0x000001BA8A255000-memory.dmp
memory/5996-5597-0x000001BAF4CC0000-0x000001BAF4D04000-memory.dmp
memory/5996-4109-0x000001BA8A130000-0x000001BA8A255000-memory.dmp
memory/5996-4047-0x000001BA8CE20000-0x000001BA8CE21000-memory.dmp
memory/5996-4049-0x000001BA8CE20000-0x000001BA8CE21000-memory.dmp
memory/5996-4048-0x000001BA8CE20000-0x000001BA8CE21000-memory.dmp
memory/5996-6242-0x000001BA8A130000-0x000001BA8A255000-memory.dmp
memory/5996-4108-0x000001BAF4CC0000-0x000001BAF4D04000-memory.dmp
memory/5996-6187-0x000001BAF4CC0000-0x000001BAF4D04000-memory.dmp
memory/6440-3973-0x000001C27ED90000-0x000001C27EDB2000-memory.dmp
memory/6440-3989-0x000001C27EF00000-0x000001C27EF1C000-memory.dmp
memory/6440-3993-0x000001C27F3B0000-0x000001C27F3D6000-memory.dmp
memory/6440-3992-0x000001C27EF00000-0x000001C27EF0A000-memory.dmp
memory/6440-3990-0x000001C27EF20000-0x000001C27EFD5000-memory.dmp
memory/6440-3991-0x000001C27F340000-0x000001C27F356000-memory.dmp
memory/6744-4010-0x0000024AE4F20000-0x0000024AE4FD5000-memory.dmp