Overview

overview

8

Static

static

CurseForge...er.exe

windows7-x64

8

CurseForge...er.exe

windows10-2004-x64

8

Resubmissions

27-12-2022 23:11

221227-26ptdsbh4v 8

27-12-2022 22:22

221227-2aenjsgf44 8

Analysis

  • max time kernel
    126s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-12-2022 23:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CurseForge - Installer.exe

  • Size

    2.1MB

  • MD5

    a6f6582aca8908381fd2a352b7dbaa75

  • SHA1

    1e3cc5173542cb906ae6bff023a004a9a8b2820e

  • SHA256

    2e7f0c723bede988bd546b39c40588f8f52dd2cd90224e4b7633cf8ad1e0a49d

  • SHA512

    8346964d42a0a8861ed46f64034c02853944138a2d1c1b72c48d835c69ad2adf334abf954ead6d754801290e9c3f3d0305c2c1a28c1ab9a631573254cc4ab11e

  • SSDEEP

    49152:uUQqUTxY4ExpsrFpIvDlAVMDlsKtYBNRUcq:uBqOE+TIvDVlg7C

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 24 IoCs
  • Registers COM server for autorun 1 TTPs 20 IoCs
    persistence
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 45 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CurseForge - Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\CurseForge - Installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\OWinstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\OWinstaller.exe" Sel=1&Partner=4047&Extension=cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj&Name=CurseForge&Thanks=https%3A%2F%2Fgo.overwolf.com%2Fcurseforge-thank-you%2F&Referer=download.curseforge.com&Browser=chrome -partnerCustomizationLevel 0 -customPromoPages --app-name="CurseForge" -exepath C:\Users\Admin\AppData\Local\Temp\CurseForge - Installer.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Windows\System32\DxDiag.exe
        "C:\Windows\System32\DxDiag.exe" /tC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.txt
        3⤵
        • Registers COM server for autorun
        • Drops file in System32 directory
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1292
      • C:\ProgramData\Overwolf\Setup\0.215.0.13\OverwolfSetup.exe
        "C:\ProgramData\Overwolf\Setup\0.215.0.13\OverwolfSetup.exe" /S "/TargetDir=C:\Program Files (x86)\Overwolf\" -ignoredotnet
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4280
        • C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe
          "C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /UpdateFWRules "C:\Program Files (x86)\Overwolf\\0.215.0.13\OverwolfBrowser.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3888
        • C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe
          "C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /Register
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4156
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdshow OverwolfUpdater
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:2148
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;S-1-5-18)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:4152
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdshow OverwolfUpdater
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:2312
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;S-1-5-19)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:436
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdshow OverwolfUpdater
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:1676
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;S-1-5-20)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:824
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdshow OverwolfUpdater
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:5080
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;NS)(A;;RPWPCR;;;S-1-5-21-2629973501-4017243118-3254762364-1000)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:2336
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdshow OverwolfUpdater
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:3624
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;NS)(A;;RPWPCR;;;S-1-5-21-2629973501-4017243118-3254762364-1000)(A;;RPWPCR;;;S-1-1-0)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:4596
        • C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe
          "C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe" /RegServer
          4⤵
          • Executes dropped EXE
          • Registers COM server for autorun
          • Loads dropped DLL
          • Modifies registry class
          PID:3700
        • C:\ProgramData\Overwolf\Setup\checkRedist.exe
          "C:\ProgramData\Overwolf\Setup\checkRedist.exe"
          4⤵
          • Executes dropped EXE
          PID:4032
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://go.overwolf.com/curseforge-thank-you/?muid=92ae65fc-31ab-4aa6-a2c3-38b2762cb644&extensionId=cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj"
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:720
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7a864f50,0x7ffc7a864f60,0x7ffc7a864f70
          4⤵
            PID:4328
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1572,10282282719183254540,37251749207135538,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1616 /prefetch:2
            4⤵
              PID:3904
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,10282282719183254540,37251749207135538,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1988 /prefetch:8
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1452
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1572,10282282719183254540,37251749207135538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2328 /prefetch:8
              4⤵
                PID:4064
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1572,10282282719183254540,37251749207135538,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
                4⤵
                  PID:2628
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1572,10282282719183254540,37251749207135538,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1
                  4⤵
                    PID:1028
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1572,10282282719183254540,37251749207135538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4284 /prefetch:8
                    4⤵
                      PID:3456
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:4196
                • C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe
                  "C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3624
                  • C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe
                    -cs
                    2⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:824
                  • C:\Program Files (x86)\Overwolf\Overwolf.exe
                    "C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe" -launchapp ojgnfnbjckbpfaciphphehonokbggjhpnnoafack
                    2⤵
                    • Executes dropped EXE
                    • Checks computer location settings
                    • Loads dropped DLL
                    • Modifies registry class
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2644
                    • C:\Windows\System32\DxDiag.exe
                      "C:\Windows\System32\DxDiag.exe" /tC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.txt
                      3⤵
                      • Registers COM server for autorun
                      • Drops file in System32 directory
                      • Checks SCSI registry key(s)
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      PID:2940
                    • C:\Program Files (x86)\Overwolf\0.215.0.13\OverwolfBrowser.exe
                      "C:\Program Files (x86)\Overwolf\0.215.0.13\OverwolfBrowser.exe" --type=crashpad-handler --no-rate-limit --max-db-size=10 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Overwolf\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Overwolf\User Data" --url=http://localhost:54288/ --annotation=platform=win64 --annotation=product=Overwolf --annotation=version=0.215.0.13 --initial-client-data=0xdbc,0xdc0,0xdc4,0xdb8,0xdc8,0x7ffc88809160,0x7ffc88809170,0x7ffc88809180
                      3⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3068
                    • C:\Program Files (x86)\Overwolf\0.215.0.13\OverwolfBrowser.exe
                      "C:\Program Files (x86)\Overwolf\0.215.0.13\OverwolfBrowser.exe" --type=gpu-process --field-trial-handle=4160,8474129393597287108,17443480073300169303,131072 --enable-features=AudioVideoTracks --disable-features=CookiesWithoutSameSiteMustBeSecure,HeavyAdIntervention,HeavyAdPrivacyMitigations,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --no-sandbox --locales-dir-path="C:\Program Files (x86)\Overwolf\0.215.0.13\Locales" --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 OverwolfClient/0.215.0.13" --lang=en-US --ignore-certificate-errors --ow-process-id=2644 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --mojo-platform-channel-handle=4188 /prefetch:2
                      3⤵
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5084
                    • C:\Program Files (x86)\Overwolf\0.215.0.13\OverwolfBrowser.exe
                      "C:\Program Files (x86)\Overwolf\0.215.0.13\OverwolfBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=4160,8474129393597287108,17443480073300169303,131072 --enable-features=AudioVideoTracks --disable-features=CookiesWithoutSameSiteMustBeSecure,HeavyAdIntervention,HeavyAdPrivacyMitigations,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Program Files (x86)\Overwolf\0.215.0.13\Locales" --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 OverwolfClient/0.215.0.13" --lang=en-US --ignore-certificate-errors --ow-process-id=2644 --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --mojo-platform-channel-handle=4464 /prefetch:8
                      3⤵
                      • Executes dropped EXE
                      • Modifies system certificate store
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3092
                    • C:\Users\Admin\AppData\Local\Overwolf\ProcessCache\0.215.0.13\ppagiehdogdjlomggmoejfamedbjggdggnjbilhe\OverwolfBrowser.exe
                      "C:\Users\Admin\AppData\Local\Overwolf\ProcessCache\0.215.0.13\ppagiehdogdjlomggmoejfamedbjggdggnjbilhe\OverwolfBrowser.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --js-flags=--expose-gc --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --field-trial-handle=4160,8474129393597287108,17443480073300169303,131072 --enable-features=AudioVideoTracks --disable-features=CookiesWithoutSameSiteMustBeSecure,HeavyAdIntervention,HeavyAdPrivacyMitigations,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --enable-blink-features=CSSAspectRatioProperty,AudioVideoTracks --lang=en-US --locales-dir-path="C:\Program Files (x86)\Overwolf\0.215.0.13\Locales" --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 OverwolfClient/0.215.0.13" --uncaught-exception-stack-size=20 --owapp="Overwolf Remote Configurations - index" --ow-enable-features=osr-software-rendering,extension-validation --uid=ppagiehdogdjlomggmoejfamedbjggdggnjbilhe --ow-allow-internal --ow-permissions=64 --ignore-certificate-errors --enable-owc --uid=ppagiehdogdjlomggmoejfamedbjggdggnjbilhe --ow-process-id=2644 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=6108 /prefetch:1
                      3⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3340
                    • C:\Program Files (x86)\Common Files\Overwolf\0.215.0.13\OverwolfHelper.exe
                      "C:\Program Files (x86)\Common Files\Overwolf\0.215.0.13\OverwolfHelper.exe" "path=C:\Program Files (x86)\Overwolf\0.215.0.13\win32\OWExplorerLauncher.dll pid=2644 gamelist=C:\Users\Admin\AppData\Local\Overwolf\Temp\gamelist.json"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4240
                    • C:\Program Files (x86)\Common Files\Overwolf\0.215.0.13\OverwolfHelper64.exe
                      "C:\Program Files (x86)\Common Files\Overwolf\0.215.0.13\OverwolfHelper64.exe" "path=C:\Program Files (x86)\Overwolf\0.215.0.13\OWExplorerLauncher.dll pid=2644 gamelist=C:\Users\Admin\AppData\Local\Overwolf\Temp\gamelist.json"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3424
                    • C:\Program Files (x86)\Overwolf\0.215.0.13\OverwolfBrowser.exe
                      "C:\Program Files (x86)\Overwolf\0.215.0.13\OverwolfBrowser.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --js-flags=--expose-gc --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --field-trial-handle=4160,8474129393597287108,17443480073300169303,131072 --enable-features=AudioVideoTracks --disable-features=CookiesWithoutSameSiteMustBeSecure,HeavyAdIntervention,HeavyAdPrivacyMitigations,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --disable-gpu-compositing --enable-blink-features=CSSAspectRatioProperty,AudioVideoTracks --lang=en-US --locales-dir-path="C:\Program Files (x86)\Overwolf\0.215.0.13\Locales" --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 OverwolfClient/0.215.0.13" --uncaught-exception-stack-size=20 --owapp="Overwolf General GameEvents Provider - index.html" --ow-enable-features=osr-software-rendering,extension-validation --owtk=4004.1947194436967040542 --uid=ggfmakpbllghoepnmfelddbminamnbmfelbahfdp --ow-allow-internal --ow-permissions=272528 --ignore-certificate-errors --enable-owc --uid=ggfmakpbllghoepnmfelddbminamnbmfelbahfdp --ow-process-id=2644 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=6296 /prefetch:1
                      3⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4796
                    • C:\Users\Admin\AppData\Local\Overwolf\ProcessCache\0.215.0.13\cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj\curseforge.exe
                      "C:\Users\Admin\AppData\Local\Overwolf\ProcessCache\0.215.0.13\cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj\curseforge.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --js-flags=--expose-gc --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --field-trial-handle=4160,8474129393597287108,17443480073300169303,131072 --enable-features=AudioVideoTracks --disable-features=CookiesWithoutSameSiteMustBeSecure,HeavyAdIntervention,HeavyAdPrivacyMitigations,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --disable-gpu-compositing --enable-blink-features=CSSAspectRatioProperty,AudioVideoTracks --lang=en-US --locales-dir-path="C:\Program Files (x86)\Overwolf\0.215.0.13\Locales" --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 OverwolfClient/0.215.0.13" --uncaught-exception-stack-size=20 --owapp="CurseForge - background" --ow-enable-features=osr-software-rendering,extension-validation --uid=cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj --ow-allow-internal --ow-permissions=534768 --ignore-certificate-errors --enable-owc --uid=cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj --ow-process-id=2644 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=6232 /prefetch:1
                      3⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2992
                    • C:\Users\Admin\AppData\Local\Overwolf\ProcessCache\0.215.0.13\cmhjmacifnhhboffmobjofpejedkbnfolcgijhpc\Achievement Rewards.exe
                      "C:\Users\Admin\AppData\Local\Overwolf\ProcessCache\0.215.0.13\cmhjmacifnhhboffmobjofpejedkbnfolcgijhpc\Achievement Rewards.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --js-flags=--expose-gc --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --field-trial-handle=4160,8474129393597287108,17443480073300169303,131072 --enable-features=AudioVideoTracks --disable-features=CookiesWithoutSameSiteMustBeSecure,HeavyAdIntervention,HeavyAdPrivacyMitigations,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --disable-gpu-compositing --enable-blink-features=CSSAspectRatioProperty,AudioVideoTracks --lang=en-US --locales-dir-path="C:\Program Files (x86)\Overwolf\0.215.0.13\Locales" --log-file="C:\Users\Admin\AppData\Local\Overwolf\Log\OverwolfCEF_2644.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 OverwolfClient/0.215.0.13" --uncaught-exception-stack-size=20 --owapp="Achievement Rewards - background" --ow-enable-features=osr-software-rendering,extension-validation --uid=cmhjmacifnhhboffmobjofpejedkbnfolcgijhpc --ow-allow-internal --ow-permissions=11952 --ignore-certificate-errors --enable-owc --uid=cmhjmacifnhhboffmobjofpejedkbnfolcgijhpc --ow-process-id=2644 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=7728 /prefetch:1
                      3⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4664
                • C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe
                  "C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe" -Embedding
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4752
                • C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe
                  "C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom SCM
                  1⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4436
                  • C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe
                    "C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom FromService /SelfLaunched /OriginRunningFrom Overwolf
                    2⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4968
                • C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe
                  "C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom SCM
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:116
                • C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe
                  "C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom SCM
                  1⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5032
                  • C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe
                    "C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom FromService /SelfLaunched
                    2⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4832

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.txt
                  Filesize

                  83KB

                  MD5

                  a78f28f1e1609e3385fe76c7fe2d32b1

                  SHA1

                  0ee572d69b3944b1cca9b957e48b4240c1c0d205

                  SHA256

                  cf2cdb4386244b57e96c227f9c27a8c840b9ee97dc30225e45d10f9200f08e8b

                  SHA512

                  685429c0ddda919925fdeedfd4bcbb6301c2a8bb30fbacc19b67a178b818cacf8c3814b6ede38c5e7f6134307339bdec76d640f669c272dc2f21d6cd6337a56c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\CommandLine.dll
                  Filesize

                  60KB

                  MD5

                  9d4c95c1df042691bd634d8400bc3b8e

                  SHA1

                  47470ab9d520b0bb6260764ae8ad7a4fcd497043

                  SHA256

                  97f9e798d47aeae6aa96750ed0242727743750f0e06f589bc5c7e19763e9925e

                  SHA512

                  b771c306cf7fdb4f8d5e3702d2feb8fb0ca500cb7e470cf4c48d9e80da04681b8d3aa34fa98d752b4c0cc839239fabbfe9b7daf40a962aab0eb0d48a53b6631d

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\INetC.dll
                  Filesize

                  24KB

                  MD5

                  640bff73a5f8e37b202d911e4749b2e9

                  SHA1

                  9588dd7561ab7de3bca392b084bec91f3521c879

                  SHA256

                  c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

                  SHA512

                  39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\INetC.dll
                  Filesize

                  24KB

                  MD5

                  640bff73a5f8e37b202d911e4749b2e9

                  SHA1

                  9588dd7561ab7de3bca392b084bec91f3521c879

                  SHA256

                  c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

                  SHA512

                  39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\Newtonsoft.Json.dll
                  Filesize

                  692KB

                  MD5

                  98cbb64f074dc600b23a2ee1a0f46448

                  SHA1

                  c5e5ec666eeb51ec15d69d27685fe50148893e34

                  SHA256

                  7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13

                  SHA512

                  eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\OWInstaller.exe
                  Filesize

                  320KB

                  MD5

                  710bd69f7127dc360bd67b2ca378a293

                  SHA1

                  6e46d8fd272325c0681b8d8bf45d3c38eed530f8

                  SHA256

                  4b3f8bddbf3a51961959a6bb740e5398048eb0ec17d86818a7325fa27647e0d1

                  SHA512

                  8b05df279dcb5fbd7b1c1a19e65dd9671e87a282761269b829c0dbc60fccb42b6639a0899d9b6869a24ff3bf5f751658845354aeed940c00179e475a8bd60352

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\OWInstaller.exe
                  Filesize

                  320KB

                  MD5

                  710bd69f7127dc360bd67b2ca378a293

                  SHA1

                  6e46d8fd272325c0681b8d8bf45d3c38eed530f8

                  SHA256

                  4b3f8bddbf3a51961959a6bb740e5398048eb0ec17d86818a7325fa27647e0d1

                  SHA512

                  8b05df279dcb5fbd7b1c1a19e65dd9671e87a282761269b829c0dbc60fccb42b6639a0899d9b6869a24ff3bf5f751658845354aeed940c00179e475a8bd60352

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\OWInstaller.exe
                  Filesize

                  320KB

                  MD5

                  710bd69f7127dc360bd67b2ca378a293

                  SHA1

                  6e46d8fd272325c0681b8d8bf45d3c38eed530f8

                  SHA256

                  4b3f8bddbf3a51961959a6bb740e5398048eb0ec17d86818a7325fa27647e0d1

                  SHA512

                  8b05df279dcb5fbd7b1c1a19e65dd9671e87a282761269b829c0dbc60fccb42b6639a0899d9b6869a24ff3bf5f751658845354aeed940c00179e475a8bd60352

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\OWinstaller.exe
                  Filesize

                  320KB

                  MD5

                  710bd69f7127dc360bd67b2ca378a293

                  SHA1

                  6e46d8fd272325c0681b8d8bf45d3c38eed530f8

                  SHA256

                  4b3f8bddbf3a51961959a6bb740e5398048eb0ec17d86818a7325fa27647e0d1

                  SHA512

                  8b05df279dcb5fbd7b1c1a19e65dd9671e87a282761269b829c0dbc60fccb42b6639a0899d9b6869a24ff3bf5f751658845354aeed940c00179e475a8bd60352

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\OWinstaller.exe.config
                  Filesize

                  632B

                  MD5

                  82d22e4e19e27e306317513b9bfa70ff

                  SHA1

                  ff3c7dd06b7fff9c12b1beaf0ca32517710ac161

                  SHA256

                  272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827

                  SHA512

                  b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\OverWolf.Client.CommonUtils.dll
                  Filesize

                  593KB

                  MD5

                  1e964edbab259c54c74051c86af66e13

                  SHA1

                  abea67a917e37aabf4969b1e61d26aea86090479

                  SHA256

                  b4384e001e6055802f060bfd2cc5b2f79e8a5d062ece9947d259267ddba756e0

                  SHA512

                  8f68b78ded234489ebcd3b041c3ae0f131ebf5b1a4121f93b4a841b3ad8ed0f8359292d68d0df6af88604a9262b4b84f6045979c75b3fa342aee0300002a2afc

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\OverWolf.Client.CommonUtils.dll
                  Filesize

                  593KB

                  MD5

                  1e964edbab259c54c74051c86af66e13

                  SHA1

                  abea67a917e37aabf4969b1e61d26aea86090479

                  SHA256

                  b4384e001e6055802f060bfd2cc5b2f79e8a5d062ece9947d259267ddba756e0

                  SHA512

                  8f68b78ded234489ebcd3b041c3ae0f131ebf5b1a4121f93b4a841b3ad8ed0f8359292d68d0df6af88604a9262b4b84f6045979c75b3fa342aee0300002a2afc

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\OverWolf.Client.CommonUtils.dll
                  Filesize

                  593KB

                  MD5

                  1e964edbab259c54c74051c86af66e13

                  SHA1

                  abea67a917e37aabf4969b1e61d26aea86090479

                  SHA256

                  b4384e001e6055802f060bfd2cc5b2f79e8a5d062ece9947d259267ddba756e0

                  SHA512

                  8f68b78ded234489ebcd3b041c3ae0f131ebf5b1a4121f93b4a841b3ad8ed0f8359292d68d0df6af88604a9262b4b84f6045979c75b3fa342aee0300002a2afc

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\SharpRaven.dll
                  Filesize

                  79KB

                  MD5

                  8c31af5f985330a041f63484d6a6a31c

                  SHA1

                  58cd5bb128ff464e27761c1e4b22c31a3ea37dbf

                  SHA256

                  78581683e0c61fbf0dcd8cca36391aaab70b184865cd420e93dd9a162c5b719c

                  SHA512

                  e6a7c5b72378b0bce28a9d58afacd61160f5830277689b8013f7d784880e4b533a4d0926a3c5b5db718551db872cd164469147b8917daad78192b994869fa2f0

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\System.dll
                  Filesize

                  11KB

                  MD5

                  7399323923e3946fe9140132ac388132

                  SHA1

                  728257d06c452449b1241769b459f091aabcffc5

                  SHA256

                  5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

                  SHA512

                  d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\UserInfo.dll
                  Filesize

                  4KB

                  MD5

                  9301577ff4d229347fe33259b43ef3b2

                  SHA1

                  5e39eb4f99920005a4b2303c8089d77f589c133d

                  SHA256

                  090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc

                  SHA512

                  77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\_locales\en\messages.json
                  Filesize

                  10KB

                  MD5

                  f70090dc1fe75bb086a33ebc02bc11f5

                  SHA1

                  24acd6da3e37e1bc932b5e95586f97a22df76771

                  SHA256

                  c258cd92fbdc96075f286241777fbca2ac375b315782b6fa512cd3b53bf55cb0

                  SHA512

                  0d074eae4e127e687dbcebb8df1ff682d45b5630f3c8394232e25bcfa6175a6a667b4c9ae43006e6edbad8db24ad88eb185a003ba321779f9e9b9cbc4e5beefb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\_locales\es\messages.json
                  Filesize

                  11KB

                  MD5

                  c921597c9859ad79bfa03389756605b9

                  SHA1

                  4cecf030407852b22b81aa2984b257c65a35391a

                  SHA256

                  04a4e8f640ffa0065cdc1a9a338fdca48e6a108b1615cb28b9883e5aebb93695

                  SHA512

                  273094787467b6697a0c53b977c72945f64f2da40415b526c54ba4cc4515beb17b9ef2adfc891819428d366a221ee06d1b378dd66adbfcd8e9341e6dbf9d7e9c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\assets\fonts\lato\LatoLatin-Regular.eot
                  Filesize

                  66KB

                  MD5

                  6cfad5881181ae658a6efdd68889a690

                  SHA1

                  5b54f6ccc20ed3a078fbdf94d7a68ac80002624d

                  SHA256

                  c6c970b103b3c3aa83f7a45172619a4451ea5f015f9f3ef4fd08c9a4aa895cbc

                  SHA512

                  ddd3d43540eb3d4eef48d0834136de1e7bf23a52f286d0a666cf57c7d685aadf1cea6d37c88f9d7ce5ad6143d7c3213f54b16a11f616b7dce154bba50997bbe7

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\images\bottom-arrow-hover.png
                  Filesize

                  294B

                  MD5

                  f5d76b21fcab6cc89fd0ebc1089c2c26

                  SHA1

                  160645c02dcfdcd4d6d6a8339557a62b80493e40

                  SHA256

                  3b8043e64994a53126afe1250b80fa2934196c3305bf93fd3e7a6963867a6eb9

                  SHA512

                  4c4fd737cd771e8e0c025295c598aeb4ffb2d20df10658f7cb992aa49b4817be5d291c0c6530b4e9aaa241ab76df3c52e01a40a505e7b60d1d968a96fd4de991

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\images\bottom-arrow.png
                  Filesize

                  279B

                  MD5

                  847fab99890ddd7460e758ad8d463ba9

                  SHA1

                  bdf8c1e45993ee33ee0bf9a2e43d6048df71cb8a

                  SHA256

                  46bfb08af2269108c681b78373c98e899b4234adce39394322c7dfd6d40dcdac

                  SHA512

                  0bd2075c61eafc2946a9431bd4fbbbb141f3743144782376874640e4aae1ee97a05844589661b3a0912b23dacdf57e0a667d8ffa8ccd0f4358e5802e653aef1c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\images\checkbox-checked.png
                  Filesize

                  321B

                  MD5

                  6067f0ee8d785e960b2fa9e68b9f5321

                  SHA1

                  ac42da8bc80746f4ae2288c65562105fe6da05e6

                  SHA256

                  deb8825e21f9f0153bd769de7e8537c52df5bdda35c32a2e610078f8f0445581

                  SHA512

                  b8befca32779fc1cfa245bb8e0c9b43bcd932550f1f518766d2946e1b18aa8a634e240627839c646c87c19c8a9ed5a7790cd1799835c5c3dd1d1c4f1043f43a5

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\images\close-hover.png
                  Filesize

                  399B

                  MD5

                  5b691eb1c6836563447358b108bc9f39

                  SHA1

                  14104e60754aa46034effcbdf21af44e13f3c4cb

                  SHA256

                  aaad22634eed5977eb3a690652f16f4efda3143dfb0c165cd391bd862de6eef0

                  SHA512

                  d239bba8ce1c22dcf6d8c830614c158290b1fd9f684f7eda86e959f5cfa86cc572fa01711e0d0850f48e13c654a9e69675d83148a3bf22f64de91f7a51eaa124

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\images\close-normal.png
                  Filesize

                  330B

                  MD5

                  1acb62ec3fa5a82347c330512f2259d6

                  SHA1

                  c81389f19687e791bc4ada896620b17471371c04

                  SHA256

                  e8bd82cb680ae552f587a3f0bdc1df18fc7624dffec501840cc508d327baeec3

                  SHA512

                  a6693f68c41f8a7c137f3129403b14144329c132b99956ff2c1cc5317b046eaec70aef82c7c05b9220c3c3a7f2a417718fb65bbbe486250c05191778456f602a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\images\icon-fallback.png
                  Filesize

                  213B

                  MD5

                  3880ad80fd07870118b0aeb8fff308d4

                  SHA1

                  37b30e87d89d3bc56eb5ca3f8ec6c7f22e5ee6a1

                  SHA256

                  772fe7450824cb84dbcbc9cdb401278dec1a511ca3ae2cceb073e8bf4dc8fa61

                  SHA512

                  3917e7b6623f284a0378702e489a5131c3ad328827a87e1332d24a89d6e54d68e7dca3e5bfeb0bb22fe54da1572d2d8a9107eec8f36b9ba7db1f50c0a5205d8f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\images\icon.ico
                  Filesize

                  99KB

                  MD5

                  e07e7fc2c1d55fde55f0a863a674ce0d

                  SHA1

                  ff7154e061c65db3140ef33a2b2946d00f2001b5

                  SHA256

                  1344eb8d63dc7c80e07d758b8c6af44fed4a9ab4d495b6ccc125fe840895fd09

                  SHA512

                  f9dd9de181527347957e47b581f77b48c6759bb78bd043c60d64bdcddc7df2eac36c5e0ba400c617399cebe4ecbf2b12b7e54aca36004d1752a72b6920fdca06

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\images\minimize-hover.png
                  Filesize

                  171B

                  MD5

                  f4b8851b9ef5a55b0d45392baceb31fb

                  SHA1

                  03a87a04dc75579a8568543d40db963b6e9f4051

                  SHA256

                  d84b877f7a2d601b1d71cf878b33ff78c94c2d144a0f4d72436a7dcf64e712c2

                  SHA512

                  a849659d4ba4e40b924108cd567a58f4b1569afc5c7517a10c26fd6d64422fa61812683292da1c3b19dbe91c63aacd5cd1c5b342ccce98b6815e94b55767ce4f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\images\minimize-normal.png
                  Filesize

                  150B

                  MD5

                  1bcfd10e50ab56ac335a463ec19b8d33

                  SHA1

                  b5054dd1cdd714a6771bc11e43291df361a16ccc

                  SHA256

                  aa2b021cd0dd9563705503dad48866eac926c7ace608ff8d00f755afc509f39b

                  SHA512

                  7257c401db826ed1f4a549b1b899d0fb4a5bcc3c599ced49b07a64fc308b08fb208dc378a32d9c3cd193b4d603ae76f82bb297334998ca6abb790081a5467edf

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\images\welcome-logo.png
                  Filesize

                  995B

                  MD5

                  860785e1633b7a170ec443f4d36551c7

                  SHA1

                  f5a3401fdb22bffabbaae7f912f93cddbb7ea148

                  SHA256

                  2e3dced384fe419468973dcb074794b1444f48bce8f96217aa5e3a98c34e4c01

                  SHA512

                  217b2177b9f990ee27d1e169dca9f99da18e9bd41fc6d7a5ce7d01cf9e35a23f343763835424125b3fa73de196579054e56542e5885327c6922deeb34fd78e16

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\index.html
                  Filesize

                  18KB

                  MD5

                  d367bf95bb13abbb839927ef76618253

                  SHA1

                  95b95767ec022a74f4c9a6b74895557439817ac9

                  SHA256

                  a7db7133613735b6b5c96d4ee3eb8a1630ee783dd41a81260f2461a66c3728d8

                  SHA512

                  98fa35e39b3dc54d410c7b4af0efe31845e195473843d2ce0e25ad4b892784a2fba6a9e99964b47a4c3c1d49bc9e839c210a73c7cc788643ef36abe8a1966952

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\app.js
                  Filesize

                  21KB

                  MD5

                  7c15ecdc0a6c4894af1ebf28e32aed6f

                  SHA1

                  db55a0d8935fb49b9be45da4bb4ee88a5277b7db

                  SHA256

                  5e67c50e827ad0e651d58646ffeae6a22d6c048e34e33b5e8f1fa98a21f40eab

                  SHA512

                  792a28a59330c60f8769d46eb32d1e0c0ff25b27b338288eb6c6e4c7278d3c4dacd44d58bf8c5006e4b8fa5dc313ee23581d0c33e2b0696632dafd7223893472

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\block_inputs.js
                  Filesize

                  789B

                  MD5

                  b5b52c92b90f4283a761cb8a40860c75

                  SHA1

                  7212e7e566795017e179e7b9c9bf223b0cdb9ec2

                  SHA256

                  f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544

                  SHA512

                  16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\libs\cmp.bundle.js
                  Filesize

                  296KB

                  MD5

                  c3dbbd4cfe15de60c8c3606ddf9c8784

                  SHA1

                  ef44afa8b6fb172b04aa62242b78d90b7ff34a3f

                  SHA256

                  a1d99c498fb84e20aeffcb22e7b473fa88e2909f2b9eacdc63d8e09aa56b5aec

                  SHA512

                  849a71028e2db8a14178c14c05de413d23282fa49b59befddbc5279d203f27e0d2b21ee9ef43d0aa15b2c81c17d42301d52760c894b9f7ee78ddad258f31a5f9

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\libs\jquery-1.10.2.min.js
                  Filesize

                  90KB

                  MD5

                  44e3f0db3e4ab6fedc5758c05cf27591

                  SHA1

                  2d408aa1d35661019c95adcc60b78c0727ed25b4

                  SHA256

                  bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144

                  SHA512

                  4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\libs\mixpanel.js
                  Filesize

                  1KB

                  MD5

                  344e4265b3d4e1fecfd81c561293edab

                  SHA1

                  51dbcac23b839e64362d11763bbe64538ad80bb8

                  SHA256

                  88872b5b01a8d1dfee124333aba630ceb8535390130833dd2a312c461ac52217

                  SHA512

                  dcda17cb89861c4cd0be4b7cd93b58283cd1acc3c7a4a2176add3ea6403079c8567bcf88d878aa2e91e96c43b15a7ce668299c3d015c6dc4db5b15cddbe4ea7d

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\models\notifications.js
                  Filesize

                  4KB

                  MD5

                  1b2b45f8bd6b23569be3afb72cc5b5b0

                  SHA1

                  0cfc6b667bc8cf4713049d73241838867cdbb51b

                  SHA256

                  976abfebd516a38b49a23c97ac3c188a00811a379cdea56df31a732c64d858f7

                  SHA512

                  a1492ea26f03ef9f49015872e896bc47ed144bf8c55dc074b2e61ebfd5b285af0a38b09d21fcb37f56a8d208d175fbd0c1e22975e1a31dfd258bf37bc046eb3f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\utils\analytics.js
                  Filesize

                  3KB

                  MD5

                  00da91079bba7d8b219376f9a9b20961

                  SHA1

                  fcaeffa5cc73a667c8ef69442ba62964fddeba5a

                  SHA256

                  15f8b8bd605296723e1322465f220e173c750da0745bdf39ec400ab6215c28c7

                  SHA512

                  d906ae32a0e2d5b65a030ac6a20a95bdba63cb86ded7d48a6f9d809fe000631c309eb81a5445fa68b45e16f06fe5d282827c026208429297f78be1e7d9ed9961

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\utils\commands.js
                  Filesize

                  12KB

                  MD5

                  8077c868435c2ab49cc70683489d229b

                  SHA1

                  31dfe51f87ec33073b2209e60de7ecd647007c7b

                  SHA256

                  72947e14b9e17653b7557c7083a39e453d05f3ef529ddab77c6d6099a95cc881

                  SHA512

                  a9f0247a0e1242c02928567f5e9d71564af930446a2be9bcaf51b415a4d30e3a064b1bcaf2c7115a268b01597f2b57905f49f42bd1989398213c262abbafe2ca

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\utils\cookies.js
                  Filesize

                  1KB

                  MD5

                  6c60e675f8c8c68c0174b644d3a63a2a

                  SHA1

                  3635a3fe07ccc4a6f33a986ddb690522d0611abb

                  SHA256

                  9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287

                  SHA512

                  1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\utils\modal-events-delegate.js
                  Filesize

                  1KB

                  MD5

                  117e4fdbdb0ecf211c8bd909efd337d1

                  SHA1

                  9f8684d856b7c95bdffb139217dfd89f41373187

                  SHA256

                  267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857

                  SHA512

                  f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\utils\strings-loader.js
                  Filesize

                  5KB

                  MD5

                  9c94eb933d8a43dd3825e67a7e30c980

                  SHA1

                  7ec7b16af6f399219209ba5967d377040486a11b

                  SHA256

                  96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf

                  SHA512

                  a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\utils\utils.js
                  Filesize

                  118B

                  MD5

                  a0952ebeab701c05c75710c33d725e7e

                  SHA1

                  1da8a2e889f1213d481ae3cd5571670c01e64adc

                  SHA256

                  b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246

                  SHA512

                  5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\cri\cri-controller.js
                  Filesize

                  4KB

                  MD5

                  332f5af476ffd8a94200c17b83f388f6

                  SHA1

                  529e4c0820218649e78c840ba5294aa09770a209

                  SHA256

                  16032b365d23803cd7c1b8036b01f104eb814c38913b4bdff5b92919a0ab2702

                  SHA512

                  aac2163212f5b7ac457f9558318a254facc116263e6ce1ff99d655555ed97a20fdffe68693874b0140fdc07fb3509ba2af19296f2d3077bbec7cd605d87e2c3f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\cri\template.js
                  Filesize

                  1KB

                  MD5

                  76c1ef0cb437db144c2bed53a5a8a5d7

                  SHA1

                  aaab8fff649f8e46d1e9510018118ee9abe01498

                  SHA256

                  505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e

                  SHA512

                  822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js
                  Filesize

                  1KB

                  MD5

                  01878b1f0f27ba2af34f89c648f3e16f

                  SHA1

                  b45e04411d06052772b4645d1feb7a594b722067

                  SHA256

                  4c96454e5b0493676af666aa5716ba12209aa72fb30e8dbde8e85ab000a4350a

                  SHA512

                  5a7860c8df74ad9dd2eea3bd0927dbfa1fff1de7b9a093a6d727ecc2abb7139d721cbf76c55a7ade24ade5e08e6547321a62e3a1440eb202b7a8569305dfa782

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\finish-with-recommended-app\template.js
                  Filesize

                  681B

                  MD5

                  d1cb34b57cef7e28b9286454b197b712

                  SHA1

                  f3a964b319bab82d4eda07e126bbfd6dec35c349

                  SHA256

                  b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42

                  SHA512

                  3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\finish\finish-controller.js
                  Filesize

                  2KB

                  MD5

                  cbdfd75bb47bda0ae536b3d45958b615

                  SHA1

                  9a69d440e1d8ba1976b2880964f7041c46e8bdf9

                  SHA256

                  b4221b80fbbc4ef93b3a1f668d8a3445353db9f3e1ec77c9b6520a7312ac46f9

                  SHA512

                  e78272fcd6af8656cd054c91b97508603792dcc75c4f7a123880671ff6ed126e03cd19ec13d005f655e8281a1e90f6b190be650ddf07522fa613a940148dd475

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\finish\template.js
                  Filesize

                  1KB

                  MD5

                  f092de7ea66d8e920b345f38537fa35d

                  SHA1

                  82d107a409f18878307ae0cefe24074db64937c4

                  SHA256

                  b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f

                  SHA512

                  14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\main\main-controller.js
                  Filesize

                  11KB

                  MD5

                  15b665a5c915004e1aa7e9e11a710f7e

                  SHA1

                  7821924e42bb19d60c572ff80bbaaa04d7aaeefb

                  SHA256

                  84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653

                  SHA512

                  dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\main\template.js
                  Filesize

                  3KB

                  MD5

                  a118c7724c208f12083240cafccfd10b

                  SHA1

                  f89c676a215b869626737862a08c9eb07d440211

                  SHA256

                  63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc

                  SHA512

                  9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\modal\modal-controller.js
                  Filesize

                  2KB

                  MD5

                  995aa365976d4166ec6de5fe212b0255

                  SHA1

                  0d0e8c6aabfc8c967d5af224f66045314c0564b1

                  SHA256

                  cff5f7519eb05899df67ae1d79c9318ea344b068d95b565ae8dafacb70a1c52b

                  SHA512

                  71a51e34e92e2c478397e70ade9b33e39f4fb9a6da14f04a27997dfd9149978f4d90f0cb6d35e9ede116a2f6ed7f3c6f291383ef84d10994050893c1741f3de6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\privacy\privacy-controller.js
                  Filesize

                  2KB

                  MD5

                  9caf44e466f9dc19ea102980da4ae5d5

                  SHA1

                  da7e0fa627f6f3d2d9f0ec091ba19aa81e66332f

                  SHA256

                  f0b55a937f0bdc60394c4259dc226562b552a6eaaac61950fa29400200f5380a

                  SHA512

                  e88b1e18b14e0abb6f625c4210196609f8f8c001dd3ff66b1807d66113df471468d6c8548bd1af1e1f5c25faf759517c4eb93108394ff1f9abc7b36a8b6ad11f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\privacy\template.js
                  Filesize

                  655B

                  MD5

                  cf8d2c26520d7c84e560dfa79e31dcd3

                  SHA1

                  716f2ec17480d5cc9c145bc147833fbfc39d36f0

                  SHA256

                  95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8

                  SHA512

                  d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\progress\progress-1-controller.js
                  Filesize

                  2KB

                  MD5

                  4bc723bda9cc718301f2533ca3196768

                  SHA1

                  7f78b74746762fd5007ea3fbce45349bb0ef7901

                  SHA256

                  164bbdea64ca671a04b91747191227a89992a34159f1578a2cbf0e16398af1ec

                  SHA512

                  920f898d1592ae8d713410ac3fb43e9d490d567f2bb70b8f8d2958a0899fb8bf6a0a735db63a8eb3e1bf2cb02be70354a0f7b92d12584b1ecbde2d5ec19f9a53

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\progress\template.js
                  Filesize

                  242B

                  MD5

                  92b145e6649ba0add3dee9a69d3fa91e

                  SHA1

                  4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d

                  SHA256

                  a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab

                  SHA512

                  747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\settings\settings-controller.js
                  Filesize

                  6KB

                  MD5

                  bc3f76e8be45effb0ff0d559c75e5c62

                  SHA1

                  f9d14095ec63d749eda9342e456b040e646725b7

                  SHA256

                  35f3169aafb9d8e1f8c619155efe33f01d78ef67f987377344a5460457476a36

                  SHA512

                  812b808474c6a9cfae18934614c86978659bec1985842d35232c2c964a098efe13358df4e57348edc95e0aee97b268a59040c322831aca83af4b2ca7a4d04544

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\settings\template.js
                  Filesize

                  2KB

                  MD5

                  aee08bbe8994d59ce5b0fd4611968394

                  SHA1

                  3533ee4e288625aefdf5b2cd2a17494e340fa097

                  SHA256

                  91bdc29c6bee6de168cec29912e46d8bfb53a2a7c3d5082e3933eff8db887ecf

                  SHA512

                  13462812b482f5bad79260ca1ae9f11db38d32c9ca01204f5b1fb5c512e11b963d070fc2c5ab88d40e0069144d9a96eec86990e4d05b3032085607dca3bc9b51

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\welcome\template.js
                  Filesize

                  1KB

                  MD5

                  17f54fca6723b983875d940d931e0afb

                  SHA1

                  01774cd5cea36bd74c80a708d6f77567e8091024

                  SHA256

                  42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb

                  SHA512

                  401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\js\windows\welcome\welcome-controller.js
                  Filesize

                  2KB

                  MD5

                  6127f0a4ee214776271ea6fce1fb58e9

                  SHA1

                  378cd32ccf043889de731fce6d96b6c21632a165

                  SHA256

                  aa42af897b154c05a5a5bdf5c9420e698bc943cf1a6fcd830aae7c5b8317f654

                  SHA512

                  f2b35ced730fb95b64dd72be81345788d1fb66d38f26f2ddeb205cbecfc767703a12c455d2bb8ba1dbada1a409e123aaf020a822321b8ad80947e67c53e83a9e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\app\manifest.json
                  Filesize

                  691B

                  MD5

                  c2124be4deca586d9da702111c0fe2cf

                  SHA1

                  2a8c1bc6a2b302b8ff1f37f7803c9a275745cdf7

                  SHA256

                  5642aee1d77cbf1fca7d0999e58f0d34b6670ce8da50c278af8f5ee2ec0260b2

                  SHA512

                  6908fcb50b200cdb540dae41a0dc42a15a43844cddd8dc401e03b34c6a1975f7070e58b0bacaf608c1188273c64d2ba8cf93e6777a0b0620a02e1a51ce72eb45

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\log4net.dll
                  Filesize

                  270KB

                  MD5

                  a8f09fea0a1575fa3dca91ee6009e87b

                  SHA1

                  9f7893a10b7392c07a11e9379e5f2b3105c6e16b

                  SHA256

                  41f9d6427e8ca3c302b9e1cad9d4f57554efde343212d41752547d5006dbf874

                  SHA512

                  5f00d65812f0c61049964bc7c434748d9a9e5cd079d1db16f366d94b2f5bde9858054c9668661ca239b6ee6947e1ec82abbe1f0e4ce848c34d709b8b864d1eba

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\uac.dll
                  Filesize

                  14KB

                  MD5

                  adb29e6b186daa765dc750128649b63d

                  SHA1

                  160cbdc4cb0ac2c142d361df138c537aa7e708c9

                  SHA256

                  2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

                  SHA512

                  b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\uac.dll
                  Filesize

                  14KB

                  MD5

                  adb29e6b186daa765dc750128649b63d

                  SHA1

                  160cbdc4cb0ac2c142d361df138c537aa7e708c9

                  SHA256

                  2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

                  SHA512

                  b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nsn7584.tmp\utils.dll
                  Filesize

                  55KB

                  MD5

                  aad3f2ecc74ddf65e84dcb62cf6a77cd

                  SHA1

                  1e153e0f4d7258cae75847dba32d0321864cf089

                  SHA256

                  1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8

                  SHA512

                  8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

                  Download Submit

                • memory/2644-274-0x0000000020650000-0x000000002065A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/2644-290-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/2644-299-0x00000000368A0000-0x00000000368B6000-memory.dmp

                  Filesize

                  88KB

                  Download

                • memory/2644-297-0x000000002B380000-0x000000002B388000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/2644-296-0x0000000036800000-0x000000003680E000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/2644-295-0x0000000036840000-0x0000000036878000-memory.dmp

                  Filesize

                  224KB

                  Download

                • memory/2644-294-0x00000000365B0000-0x00000000365B8000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/2644-289-0x0000000031600000-0x0000000031628000-memory.dmp

                  Filesize

                  160KB

                  Download

                • memory/2644-281-0x0000000027000000-0x00000000270CC000-memory.dmp

                  Filesize

                  816KB

                  Download

                • memory/2644-280-0x00000000235B0000-0x00000000235F0000-memory.dmp

                  Filesize

                  256KB

                  Download

                • memory/2644-278-0x0000000023060000-0x000000002306A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/2644-279-0x0000000023560000-0x000000002356E000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/2644-277-0x0000000022DB0000-0x0000000022DB8000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/2644-273-0x0000000022B20000-0x0000000022B64000-memory.dmp

                  Filesize

                  272KB

                  Download

                • memory/2644-272-0x000000001F5B0000-0x000000001F5C0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/2644-271-0x0000000020630000-0x0000000020644000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/2644-270-0x000000001F550000-0x000000001F558000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/2644-269-0x00000000206B0000-0x00000000206E2000-memory.dmp

                  Filesize

                  200KB

                  Download

                • memory/2644-268-0x0000000020670000-0x00000000206AC000-memory.dmp

                  Filesize

                  240KB

                  Download

                • memory/2644-267-0x000000001F5D0000-0x000000001F600000-memory.dmp

                  Filesize

                  192KB

                  Download

                • memory/2644-266-0x000000001F530000-0x000000001F53C000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/2644-265-0x000000001F560000-0x000000001F596000-memory.dmp

                  Filesize

                  216KB

                  Download

                • memory/2644-263-0x000000001F500000-0x000000001F512000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/2644-264-0x000000001EF30000-0x000000001EF38000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/2644-262-0x0000000020710000-0x0000000020E12000-memory.dmp

                  Filesize

                  7.0MB

                  Download

                • memory/2644-261-0x000000001EF20000-0x000000001EF28000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/2644-260-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/2644-259-0x000000001BFF0000-0x000000001BFFA000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/2644-258-0x000000001BFE0000-0x000000001BFEA000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/2644-257-0x000000001EF40000-0x000000001EFAA000-memory.dmp

                  Filesize

                  424KB

                  Download

                • memory/2644-256-0x000000001EFB0000-0x000000001F0D6000-memory.dmp

                  Filesize

                  1.1MB

                  Download

                • memory/2644-255-0x000000001BF40000-0x000000001BFD0000-memory.dmp

                  Filesize

                  576KB

                  Download

                • memory/2644-254-0x00007FF60AC00000-0x00007FF60AC12000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/2644-252-0x00007FFCA5A40000-0x00007FFCA5A45000-memory.dmp

                  Filesize

                  20KB

                  Download

                • memory/2644-250-0x00007FFCA3220000-0x00007FFCA3225000-memory.dmp

                  Filesize

                  20KB

                  Download

                • memory/2644-246-0x00007FFCA5A20000-0x00007FFCA5A25000-memory.dmp

                  Filesize

                  20KB

                  Download

                • memory/3068-291-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/3068-283-0x0000027A44C20000-0x0000027A44C54000-memory.dmp

                  Filesize

                  208KB

                  Download

                • memory/3068-284-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/3092-288-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/3092-293-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/3888-221-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/3888-219-0x00000000003F0000-0x0000000000668000-memory.dmp

                  Filesize

                  2.5MB

                  Download

                • memory/3888-220-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4156-226-0x0000000003540000-0x000000000357C000-memory.dmp

                  Filesize

                  240KB

                  Download

                • memory/4156-230-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4156-225-0x00000000033D0000-0x00000000033E2000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/4156-241-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4240-320-0x0000000002F22000-0x0000000002F27000-memory.dmp

                  Filesize

                  20KB

                  Download

                • memory/4240-314-0x0000000002EA1000-0x0000000002EE4000-memory.dmp

                  Filesize

                  268KB

                  Download

                • memory/4240-316-0x0000000002EA1000-0x0000000002EE4000-memory.dmp

                  Filesize

                  268KB

                  Download

                • memory/4240-317-0x0000000002EA1000-0x0000000002EE4000-memory.dmp

                  Filesize

                  268KB

                  Download

                • memory/4240-315-0x0000000002EA1000-0x0000000002EE4000-memory.dmp

                  Filesize

                  268KB

                  Download

                • memory/4240-323-0x0000000002F22000-0x0000000002F27000-memory.dmp

                  Filesize

                  20KB

                  Download

                • memory/4240-322-0x0000000002F22000-0x0000000002F27000-memory.dmp

                  Filesize

                  20KB

                  Download

                • memory/4240-321-0x0000000002F22000-0x0000000002F27000-memory.dmp

                  Filesize

                  20KB

                  Download

                • memory/4240-319-0x0000000002F22000-0x0000000002F27000-memory.dmp

                  Filesize

                  20KB

                  Download

                • memory/4280-213-0x00000000031E1000-0x00000000031E3000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/4280-215-0x00000000047E1000-0x00000000047E5000-memory.dmp

                  Filesize

                  16KB

                  Download

                • memory/4280-217-0x00000000047E1000-0x00000000047F1000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4436-298-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4436-304-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4800-136-0x0000000000B11000-0x0000000000B14000-memory.dmp

                  Filesize

                  12KB

                  Download

                • memory/4800-140-0x0000000002451000-0x0000000002455000-memory.dmp

                  Filesize

                  16KB

                  Download

                • memory/4856-153-0x000002086CF00000-0x000002086D428000-memory.dmp

                  Filesize

                  5.2MB

                  Download

                • memory/4856-206-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4856-162-0x000002086CE30000-0x000002086CEE0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/4856-159-0x0000020853450000-0x0000020853468000-memory.dmp

                  Filesize

                  96KB

                  Download

                • memory/4856-155-0x0000020851A60000-0x0000020851AA6000-memory.dmp

                  Filesize

                  280KB

                  Download

                • memory/4856-164-0x000002086CD80000-0x000002086CDA2000-memory.dmp

                  Filesize

                  136KB

                  Download

                • memory/4856-151-0x00000208519E0000-0x00000208519F4000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/4856-229-0x000002086B760000-0x000002086B7DA000-memory.dmp

                  Filesize

                  488KB

                  Download

                • memory/4856-242-0x000002086B550000-0x000002086B574000-memory.dmp

                  Filesize

                  144KB

                  Download

                • memory/4856-276-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4856-196-0x0000021072330000-0x0000021072AD6000-memory.dmp

                  Filesize

                  7.6MB

                  Download

                • memory/4856-211-0x000002107A4E0000-0x000002107A5E2000-memory.dmp

                  Filesize

                  1.0MB

                  Download

                • memory/4856-145-0x0000020851650000-0x00000208516A2000-memory.dmp

                  Filesize

                  328KB

                  Download

                • memory/4856-149-0x0000020853390000-0x0000020853428000-memory.dmp

                  Filesize

                  608KB

                  Download

                • memory/4856-152-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/5084-286-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/5084-292-0x00007FFC86CC0000-0x00007FFC87781000-memory.dmp

                  Filesize

                  10.8MB

                  Download