2e7f0c723bede988bd546b39c40588f8f52dd2cd90224e4b7633cf8ad1e0a49d

Resubmissions

27/12/2022, 23:11

221227-26ptdsbh4v 8

27/12/2022, 22:22

221227-2aenjsgf44 8

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/12/2022, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CurseForge - Installer.exe
Size

2.1MB
MD5

a6f6582aca8908381fd2a352b7dbaa75
SHA1

1e3cc5173542cb906ae6bff023a004a9a8b2820e
SHA256

2e7f0c723bede988bd546b39c40588f8f52dd2cd90224e4b7633cf8ad1e0a49d
SHA512

8346964d42a0a8861ed46f64034c02853944138a2d1c1b72c48d835c69ad2adf334abf954ead6d754801290e9c3f3d0305c2c1a28c1ab9a631573254cc4ab11e
SSDEEP

49152:uUQqUTxY4ExpsrFpIvDlAVMDlsKtYBNRUcq:uBqOE+TIvDVlg7C

Score

8^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
972	OWinstaller.exe
4596	OverwolfSetup.exe
364	OverwolfUpdater.exe
1792	OverwolfUpdater.exe
3040	OverwolfTSHelper.exe
1888	checkRedist.exe

Registers COM server for autorun 1 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA35375C-A06A-49AC-9136-31B6C102646B}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Overwolf\\Teamspeak\\OverwolfTSHelper.exe\""	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA35375C-A06A-49AC-9136-31B6C102646B}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Common Files\\Overwolf\\Teamspeak\\OverwolfTSHelper.exe"	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EDBC3E0-49BB-4E0D-860F-80037D14E735}\LocalServer32	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EDBC3E0-49BB-4E0D-860F-80037D14E735}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Overwolf\\Teamspeak\\OverwolfTSHelper.exe\""	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EDBC3E0-49BB-4E0D-860F-80037D14E735}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Common Files\\Overwolf\\Teamspeak\\OverwolfTSHelper.exe"	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\System32\\dxdiagn.dll"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC7899F5-56C9-44F1-9611-080BFC180FD5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Overwolf\\Teamspeak\\OverwolfTSHelper.exe\""	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA35375C-A06A-49AC-9136-31B6C102646B}\LocalServer32	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B0957D9C-810B-4DE0-9C5E-48DB09C5B413}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Overwolf\\Teamspeak\\OverwolfTSHelper.exe\""	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC7899F5-56C9-44F1-9611-080BFC180FD5}\LocalServer32	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B0957D9C-810B-4DE0-9C5E-48DB09C5B413}\LocalServer32	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B0957D9C-810B-4DE0-9C5E-48DB09C5B413}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Common Files\\Overwolf\\Teamspeak\\OverwolfTSHelper.exe"	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC7899F5-56C9-44F1-9611-080BFC180FD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Common Files\\Overwolf\\Teamspeak\\OverwolfTSHelper.exe"	OverwolfTSHelper.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	OWinstaller.exe

Loads dropped DLL 31 IoCs

pid	Process
4756	CurseForge - Installer.exe
4756	CurseForge - Installer.exe
4756	CurseForge - Installer.exe
4756	CurseForge - Installer.exe
4756	CurseForge - Installer.exe
4756	CurseForge - Installer.exe
4756	CurseForge - Installer.exe
972	OWinstaller.exe
972	OWinstaller.exe
972	OWinstaller.exe
972	OWinstaller.exe
972	OWinstaller.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
3040	OverwolfTSHelper.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe
4596	OverwolfSetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Overwolf = "C:\\Program Files (x86)\\Overwolf\\OverwolfLauncher.exe -overwolfsilent"	OWinstaller.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	DxDiag.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\emokficlajnchpkacabnhhjldoakmbdabppoeeme\Icon.png	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\pgohpgeckmkcnmnkpjgdjdlhmefopdopnhcnllfe\Splash.png	OverwolfSetup.exe
File opened for modification	C:\Program Files (x86)\Overwolf\0.215.0.13\D3DCompiler_43.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\NAudio.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Locales\vi\OverWolf.Client.Core.resources.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Licenses\websocket_sharp.license.txt	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Licenses\leveldb-sharp.license.txt	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\jgbnfkaeklillfmfafgkodhlcnfdgkmjmjngaaof\Icon.ico	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\lnhebboianabbebhnpoodokcdcnmikacoeijpjfe\Icon.png	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\uninstaller\Files\css\window-controls.css	OverwolfSetup.exe
File created	C:\Program Files (x86)\Common Files\Overwolf\ow-obs\inject-helper32.exe	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Microsoft.Toolkit.Uwp.Notifications.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Licenses\json-cpp.license.txt	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Locales\fr\OverWolf.Client.Core.resources.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\jgbnfkaeklillfmfafgkodhlcnfdgkmjmjngaaof\Splash.png	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\mdelnbcocknmpmhnljfbkacgamflhbiihkoloocd\Icon.png	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\nmnhbcdlaikhhplofmnadgjhokliacnpcpmjbhbj\Icon.png	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\libEGL.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Microsoft.Windows.Shell.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\Overwolf.exe	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Xilium.CefGlue.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\cef.pak	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\bin\api-ms-win-core-console-l1-2-0.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\win32\OWUtils.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Licenses\Vista_Core_Audio_API_Master_Volume_Control.CPOL.license.html	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\iighjfalpgednmflhnefmogncmaafgaddchbadgn\Icon.ico	OverwolfSetup.exe
File opened for modification	C:\Program Files (x86)\Overwolf\overwolf.ico	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\OpenHardwareMonitorLib.dll	OverwolfSetup.exe
File opened for modification	C:\Program Files (x86)\Overwolf\0.215.0.13\EasyHook.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\uninstaller\Files\js\finishedSlide.js	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\ddldopbhkfcfooplfhjfcppflnfanaedbmkpkhni\Icon.png	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\ddldopbhkfcfooplfhjfcppflnfanaedbmkpkhni\Splash.png	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Licenses\openmcdf.license.txt	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\default_extensions\teamspeak\guild_skin.opk	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\hpdhmnlhpopmgnelabncfdcdjmheadngeamapkhd\Icon.ico	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\uninstaller\Files\css\fonts.css	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\uninstaller\Files\css\style.css	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\bin\api-ms-win-core-fibers-l1-1-0.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\ow-graphics-vulkan64.json	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\System.Threading.Tasks.Extensions.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\bin\api-ms-win-crt-conio-l1-1-0.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\cmaoeodhdocfndbegdhigemkmcccnampbieccfak\Icon.ico	OverwolfSetup.exe
File opened for modification	C:\Program Files (x86)\Overwolf\0.215.0.13\resources\default_extensions\appstore.opk	OWinstaller.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\icudtl.dat	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\OWUninstallMenu.exe.config	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\lbelkhgffoedffcamifhhgglceiibjdddpbbgcnj\Icon.ico	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\uninstaller\Files\js\window-size.js	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Locales\es\OverWolf.Client.Core.resources.dll	OverwolfSetup.exe
File opened for modification	C:\Program Files (x86)\Overwolf\0.215.0.13\OWLog.cfg	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\swiftshader\libEGL.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\teamspeak_control.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Overwolf.Social.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\bin\api-ms-win-core-profile-l1-1-0.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\bin\api-ms-win-crt-heap-l1-1-0.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\bin\msvcp140_2.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Licenses\EasyHook.license.txt	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Licenses\Tweetinvi.license.txt	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\uninstaller\Files\images\logo-small.svg	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Logitech\LogitechGArxControlEnginesWrapper.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\CommandLine.dll	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\uninstaller\Files\assets\svg\sprite.svg	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\builtin_extensions\emokficlajnchpkacabnhhjldoakmbdabppoeeme\manifest.json	OverwolfSetup.exe
File created	C:\Program Files (x86)\Overwolf\0.215.0.13\Resources\uninstaller\Files\css\scrollbar.css	OverwolfSetup.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4488	sc.exe
1532	sc.exe
2392	sc.exe
1540	sc.exe
4012	sc.exe
4200	sc.exe
1360	sc.exe
2408	sc.exe
4880	sc.exe
4052	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DxDiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DxDiag.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBDBC573-E9B2-41EC-867D-172ADEBC9554}\TypeLib\Version = "1.0"	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBDBC573-E9B2-41EC-867D-172ADEBC9554}	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3961296B-2DFE-45BD-8752-AB5FF712CC96}\ = "IClientListResult"	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBDBC573-E9B2-41EC-867D-172ADEBC9554}	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B0957D9C-810B-4DE0-9C5E-48DB09C5B413}\ = "TSWapper Class"	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37AE4F6C-9435-4E72-8C72-8A619C8C469B}\ = "ITSServerInfo"	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPK_File\shell\open\command	OverwolfSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OPK_File\shell\open\command\ = "\"C:\\Program Files (x86)\\Overwolf\\\\OverwolfLauncher.exe\" -install-opk %1"	OverwolfSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPK_File\DefaultIcon	OverwolfSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3219881-CE98-4C8C-A472-280BD9A7D247}\1.0\HELPDIR	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B0957D9C-810B-4DE0-9C5E-48DB09C5B413}\Version	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37AE4F6C-9435-4E72-8C72-8A619C8C469B}	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37AE4F6C-9435-4E72-8C72-8A619C8C469B}\TypeLib	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81A2F1FA-CAA8-4393-B70F-6F245AF97DC1}\ProxyStubClsid32	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.opk	OverwolfSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B0957D9C-810B-4DE0-9C5E-48DB09C5B413}\Programmable	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBDBC573-E9B2-41EC-867D-172ADEBC9554}\TypeLib	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81A2F1FA-CAA8-4393-B70F-6F245AF97DC1}\TypeLib	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EDBC3E0-49BB-4E0D-860F-80037D14E735}	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBDBC573-E9B2-41EC-867D-172ADEBC9554}\ProxyStubClsid32	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC7899F5-56C9-44F1-9611-080BFC180FD5}\Version	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA35375C-A06A-49AC-9136-31B6C102646B}\Version\ = "1.0"	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81A2F1FA-CAA8-4393-B70F-6F245AF97DC1}	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPK_File\shell\edit\command	OverwolfSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OPK_File\shell\edit\command\ = "\"C:\\Program Files (x86)\\Overwolf\\\\OverwolfLauncher.exe\" -install-opk %1"	OverwolfSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EDBC3E0-49BB-4E0D-860F-80037D14E735}\LocalServer32	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3219881-CE98-4C8C-A472-280BD9A7D247}\1.0\0\win64	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81A2F1FA-CAA8-4393-B70F-6F245AF97DC1}\ = "ITSClientInfo"	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3961296B-2DFE-45BD-8752-AB5FF712CC96}\TypeLib\Version = "1.0"	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81A2F1FA-CAA8-4393-B70F-6F245AF97DC1}\TypeLib	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	DxDiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4246620582-653642754-1174164128-1000\{AB181E1F-E739-4D4B-966E-BCB5047C2544}	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA35375C-A06A-49AC-9136-31B6C102646B}\Programmable	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B0957D9C-810B-4DE0-9C5E-48DB09C5B413}\LocalServer32	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3219881-CE98-4C8C-A472-280BD9A7D247}\1.0\FLAGS	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBDBC573-E9B2-41EC-867D-172ADEBC9554}\ProxyStubClsid32	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81A2F1FA-CAA8-4393-B70F-6F245AF97DC1}\ProxyStubClsid32	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B0957D9C-810B-4DE0-9C5E-48DB09C5B413}\Version\ = "1.0"	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA35375C-A06A-49AC-9136-31B6C102646B}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Common Files\\Overwolf\\Teamspeak\\OverwolfTSHelper.exe"	OverwolfTSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3961296B-2DFE-45BD-8752-AB5FF712CC96}	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBABE429-FE8E-4E35-97CF-9D3ED707696A}\TypeLib\Version = "1.0"	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OPK_File\shell\edit\ = "Edit OPK_File"	OverwolfSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC7899F5-56C9-44F1-9611-080BFC180FD5}\TypeLib	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA35375C-A06A-49AC-9136-31B6C102646B}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Overwolf\\Teamspeak\\OverwolfTSHelper.exe\""	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EDBC3E0-49BB-4E0D-860F-80037D14E735}\LocalServer32\ = "\"C:\\Program Files (x86)\\Common Files\\Overwolf\\Teamspeak\\OverwolfTSHelper.exe\""	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBDBC573-E9B2-41EC-867D-172ADEBC9554}\TypeLib\Version = "1.0"	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81A2F1FA-CAA8-4393-B70F-6F245AF97DC1}\TypeLib\Version = "1.0"	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3961296B-2DFE-45BD-8752-AB5FF712CC96}\TypeLib\Version = "1.0"	OverwolfTSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	DxDiag.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	OverwolfUpdater.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	OverwolfUpdater.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	OverwolfUpdater.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
972	OWinstaller.exe
972	OWinstaller.exe
972	OWinstaller.exe
2828	DxDiag.exe
2828	DxDiag.exe
972	OWinstaller.exe
972	OWinstaller.exe
364	OverwolfUpdater.exe
364	OverwolfUpdater.exe
1792	OverwolfUpdater.exe
1792	OverwolfUpdater.exe
972	OWinstaller.exe
972	OWinstaller.exe
824	chrome.exe
824	chrome.exe
4908	chrome.exe
4908	chrome.exe
4968	chrome.exe
4968	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	972	OWinstaller.exe
Token: SeSecurityPrivilege	972	OWinstaller.exe
Token: SeDebugPrivilege	364	OverwolfUpdater.exe
Token: SeDebugPrivilege	1792	OverwolfUpdater.exe
Token: SeSecurityPrivilege	4200	sc.exe
Token: SeSecurityPrivilege	4200	sc.exe
Token: SeSecurityPrivilege	4488	sc.exe
Token: SeSecurityPrivilege	4488	sc.exe
Token: SeSecurityPrivilege	1360	sc.exe
Token: SeSecurityPrivilege	1360	sc.exe
Token: SeSecurityPrivilege	1532	sc.exe
Token: SeSecurityPrivilege	1532	sc.exe
Token: SeSecurityPrivilege	2392	sc.exe
Token: SeSecurityPrivilege	2392	sc.exe
Token: SeSecurityPrivilege	1540	sc.exe
Token: SeSecurityPrivilege	1540	sc.exe
Token: SeSecurityPrivilege	2408	sc.exe
Token: SeSecurityPrivilege	2408	sc.exe
Token: SeSecurityPrivilege	4880	sc.exe
Token: SeSecurityPrivilege	4880	sc.exe
Token: SeSecurityPrivilege	4012	sc.exe
Token: SeSecurityPrivilege	4012	sc.exe
Token: SeSecurityPrivilege	4052	sc.exe
Token: SeSecurityPrivilege	4052	sc.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
972	OWinstaller.exe
972	OWinstaller.exe
972	OWinstaller.exe
2828	DxDiag.exe
972	OWinstaller.exe
972	OWinstaller.exe
972	OWinstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 972	4756	CurseForge - Installer.exe	80
PID 4756 wrote to memory of 972	4756	CurseForge - Installer.exe	80
PID 972 wrote to memory of 2828	972	OWinstaller.exe	81
PID 972 wrote to memory of 2828	972	OWinstaller.exe	81
PID 972 wrote to memory of 4596	972	OWinstaller.exe	93
PID 972 wrote to memory of 4596	972	OWinstaller.exe	93
PID 972 wrote to memory of 4596	972	OWinstaller.exe	93
PID 4596 wrote to memory of 364	4596	OverwolfSetup.exe	94
PID 4596 wrote to memory of 364	4596	OverwolfSetup.exe	94
PID 4596 wrote to memory of 1792	4596	OverwolfSetup.exe	95
PID 4596 wrote to memory of 1792	4596	OverwolfSetup.exe	95
PID 4596 wrote to memory of 3040	4596	OverwolfSetup.exe	96
PID 4596 wrote to memory of 3040	4596	OverwolfSetup.exe	96
PID 4596 wrote to memory of 1888	4596	OverwolfSetup.exe	97
PID 4596 wrote to memory of 1888	4596	OverwolfSetup.exe	97
PID 1792 wrote to memory of 4200	1792	OverwolfUpdater.exe	100
PID 1792 wrote to memory of 4200	1792	OverwolfUpdater.exe	100
PID 1792 wrote to memory of 4488	1792	OverwolfUpdater.exe	102
PID 1792 wrote to memory of 4488	1792	OverwolfUpdater.exe	102
PID 1792 wrote to memory of 1360	1792	OverwolfUpdater.exe	104
PID 1792 wrote to memory of 1360	1792	OverwolfUpdater.exe	104
PID 1792 wrote to memory of 1532	1792	OverwolfUpdater.exe	106
PID 1792 wrote to memory of 1532	1792	OverwolfUpdater.exe	106
PID 1792 wrote to memory of 2392	1792	OverwolfUpdater.exe	108
PID 1792 wrote to memory of 2392	1792	OverwolfUpdater.exe	108
PID 1792 wrote to memory of 1540	1792	OverwolfUpdater.exe	110
PID 1792 wrote to memory of 1540	1792	OverwolfUpdater.exe	110
PID 1792 wrote to memory of 2408	1792	OverwolfUpdater.exe	112
PID 1792 wrote to memory of 2408	1792	OverwolfUpdater.exe	112
PID 1792 wrote to memory of 4880	1792	OverwolfUpdater.exe	114
PID 1792 wrote to memory of 4880	1792	OverwolfUpdater.exe	114
PID 1792 wrote to memory of 4012	1792	OverwolfUpdater.exe	116
PID 1792 wrote to memory of 4012	1792	OverwolfUpdater.exe	116
PID 1792 wrote to memory of 4052	1792	OverwolfUpdater.exe	119
PID 1792 wrote to memory of 4052	1792	OverwolfUpdater.exe	119
PID 972 wrote to memory of 4908	972	OWinstaller.exe	120
PID 972 wrote to memory of 4908	972	OWinstaller.exe	120
PID 4908 wrote to memory of 760	4908	chrome.exe	121
PID 4908 wrote to memory of 760	4908	chrome.exe	121
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122
PID 4908 wrote to memory of 1112	4908	chrome.exe	122

C:\Users\Admin\AppData\Local\Temp\CurseForge - Installer.exe
"C:\Users\Admin\AppData\Local\Temp\CurseForge - Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\OWinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\OWinstaller.exe" Sel=1&Partner=4047&Extension=cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj&Name=CurseForge&Thanks=https%3A%2F%2Fgo.overwolf.com%2Fcurseforge-thank-you%2F&Referer=download.curseforge.com&Browser=chrome -partnerCustomizationLevel 0 -customPromoPages --app-name="CurseForge" -exepath C:\Users\Admin\AppData\Local\Temp\CurseForge - Installer.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\System32\DxDiag.exe
    "C:\Windows\System32\DxDiag.exe" /tC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.txt
    3⤵
    - Registers COM server for autorun
    - Drops file in System32 directory
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2828
- - C:\ProgramData\Overwolf\Setup\0.215.0.13\OverwolfSetup.exe
    "C:\ProgramData\Overwolf\Setup\0.215.0.13\OverwolfSetup.exe" /S "/TargetDir=C:\Program Files (x86)\Overwolf\" -ignoredotnet
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe
      "C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /UpdateFWRules "C:\Program Files (x86)\Overwolf\\0.215.0.13\OverwolfBrowser.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:364
  - - C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe
      "C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /Register
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1792
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" sdshow OverwolfUpdater
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:4200
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;S-1-5-18)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" sdshow OverwolfUpdater
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:1360
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;S-1-5-19)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" sdshow OverwolfUpdater
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;S-1-5-20)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" sdshow OverwolfUpdater
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:2408
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;NS)(A;;RPWPCR;;;S-1-5-21-4246620582-653642754-1174164128-1000)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:4880
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" sdshow OverwolfUpdater
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:4012
    - - C:\Windows\SYSTEM32\sc.exe
        
        "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;NS)(A;;RPWPCR;;;S-1-5-21-4246620582-653642754-1174164128-1000)(A;;RPWPCR;;;S-1-1-0)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
  - - C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe
      "C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe" /RegServer
      4⤵
      Executes dropped EXE
      Registers COM server for autorun
      Loads dropped DLL
      Modifies registry class
      PID:3040
  - - C:\ProgramData\Overwolf\Setup\checkRedist.exe
      "C:\ProgramData\Overwolf\Setup\checkRedist.exe"
      4⤵
      Executes dropped EXE
      PID:1888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://go.overwolf.com/curseforge-thank-you/?muid=413aa178-8adc-45f5-809b-dd077aae4b8a&extensionId=cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb81f44f50,0x7ffb81f44f60,0x7ffb81f44f70
      4⤵
      PID:760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1592,10135940526128591828,5853179754825595104,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:2
      4⤵
      PID:1112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,10135940526128591828,5853179754825595104,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1996 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1592,10135940526128591828,5853179754825595104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2412 /prefetch:8
      4⤵
      PID:4900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,10135940526128591828,5853179754825595104,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
      4⤵
      PID:740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,10135940526128591828,5853179754825595104,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1
      4⤵
      PID:4504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,10135940526128591828,5853179754825595104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4288 /prefetch:8
      4⤵
      PID:4108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,10135940526128591828,5853179754825595104,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
      4⤵
      PID:2584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,10135940526128591828,5853179754825595104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1592,10135940526128591828,5853179754825595104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3016 /prefetch:8
      4⤵
      PID:4888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,10135940526128591828,5853179754825595104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3064 /prefetch:8
      4⤵
      PID:4920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,10135940526128591828,5853179754825595104,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
      4⤵
      PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.txt

Filesize
83KB

MD5
dbb97719da149e0db67c2b8fbe883c98

SHA1
763193003c89440ed832092c788165f18d440cd9

SHA256
97cf60281c17476f0de681fbdd18e4608d2d957218fa9d83468c5b01e5e255ef

SHA512
159b572c20353a14c72c108833f930a903e9398bdc38e9df045f52614859c66ac3e19612a7fe4a15404d795dc477a1f9d4d963d6bdb5e52a933f622cf8c65828

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\CommandLine.dll

Filesize
60KB

MD5
9d4c95c1df042691bd634d8400bc3b8e

SHA1
47470ab9d520b0bb6260764ae8ad7a4fcd497043

SHA256
97f9e798d47aeae6aa96750ed0242727743750f0e06f589bc5c7e19763e9925e

SHA512
b771c306cf7fdb4f8d5e3702d2feb8fb0ca500cb7e470cf4c48d9e80da04681b8d3aa34fa98d752b4c0cc839239fabbfe9b7daf40a962aab0eb0d48a53b6631d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\INetC.dll

Filesize
24KB

MD5
640bff73a5f8e37b202d911e4749b2e9

SHA1
9588dd7561ab7de3bca392b084bec91f3521c879

SHA256
c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

SHA512
39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\INetC.dll

Filesize
24KB

MD5
640bff73a5f8e37b202d911e4749b2e9

SHA1
9588dd7561ab7de3bca392b084bec91f3521c879

SHA256
c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

SHA512
39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\Newtonsoft.Json.dll

Filesize
692KB

MD5
98cbb64f074dc600b23a2ee1a0f46448

SHA1
c5e5ec666eeb51ec15d69d27685fe50148893e34

SHA256
7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13

SHA512
eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\OWInstaller.exe

Filesize
320KB

MD5
710bd69f7127dc360bd67b2ca378a293

SHA1
6e46d8fd272325c0681b8d8bf45d3c38eed530f8

SHA256
4b3f8bddbf3a51961959a6bb740e5398048eb0ec17d86818a7325fa27647e0d1

SHA512
8b05df279dcb5fbd7b1c1a19e65dd9671e87a282761269b829c0dbc60fccb42b6639a0899d9b6869a24ff3bf5f751658845354aeed940c00179e475a8bd60352

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\OWInstaller.exe

Filesize
320KB

MD5
710bd69f7127dc360bd67b2ca378a293

SHA1
6e46d8fd272325c0681b8d8bf45d3c38eed530f8

SHA256
4b3f8bddbf3a51961959a6bb740e5398048eb0ec17d86818a7325fa27647e0d1

SHA512
8b05df279dcb5fbd7b1c1a19e65dd9671e87a282761269b829c0dbc60fccb42b6639a0899d9b6869a24ff3bf5f751658845354aeed940c00179e475a8bd60352

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\OWInstaller.exe

Filesize
320KB

MD5
710bd69f7127dc360bd67b2ca378a293

SHA1
6e46d8fd272325c0681b8d8bf45d3c38eed530f8

SHA256
4b3f8bddbf3a51961959a6bb740e5398048eb0ec17d86818a7325fa27647e0d1

SHA512
8b05df279dcb5fbd7b1c1a19e65dd9671e87a282761269b829c0dbc60fccb42b6639a0899d9b6869a24ff3bf5f751658845354aeed940c00179e475a8bd60352

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\OWinstaller.exe

Filesize
320KB

MD5
710bd69f7127dc360bd67b2ca378a293

SHA1
6e46d8fd272325c0681b8d8bf45d3c38eed530f8

SHA256
4b3f8bddbf3a51961959a6bb740e5398048eb0ec17d86818a7325fa27647e0d1

SHA512
8b05df279dcb5fbd7b1c1a19e65dd9671e87a282761269b829c0dbc60fccb42b6639a0899d9b6869a24ff3bf5f751658845354aeed940c00179e475a8bd60352

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\OWinstaller.exe.config

Filesize
632B

MD5
82d22e4e19e27e306317513b9bfa70ff

SHA1
ff3c7dd06b7fff9c12b1beaf0ca32517710ac161

SHA256
272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827

SHA512
b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\OverWolf.Client.CommonUtils.dll

Filesize
593KB

MD5
1e964edbab259c54c74051c86af66e13

SHA1
abea67a917e37aabf4969b1e61d26aea86090479

SHA256
b4384e001e6055802f060bfd2cc5b2f79e8a5d062ece9947d259267ddba756e0

SHA512
8f68b78ded234489ebcd3b041c3ae0f131ebf5b1a4121f93b4a841b3ad8ed0f8359292d68d0df6af88604a9262b4b84f6045979c75b3fa342aee0300002a2afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\OverWolf.Client.CommonUtils.dll

Filesize
593KB

MD5
1e964edbab259c54c74051c86af66e13

SHA1
abea67a917e37aabf4969b1e61d26aea86090479

SHA256
b4384e001e6055802f060bfd2cc5b2f79e8a5d062ece9947d259267ddba756e0

SHA512
8f68b78ded234489ebcd3b041c3ae0f131ebf5b1a4121f93b4a841b3ad8ed0f8359292d68d0df6af88604a9262b4b84f6045979c75b3fa342aee0300002a2afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\OverWolf.Client.CommonUtils.dll

Filesize
593KB

MD5
1e964edbab259c54c74051c86af66e13

SHA1
abea67a917e37aabf4969b1e61d26aea86090479

SHA256
b4384e001e6055802f060bfd2cc5b2f79e8a5d062ece9947d259267ddba756e0

SHA512
8f68b78ded234489ebcd3b041c3ae0f131ebf5b1a4121f93b4a841b3ad8ed0f8359292d68d0df6af88604a9262b4b84f6045979c75b3fa342aee0300002a2afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\SharpRaven.dll

Filesize
79KB

MD5
8c31af5f985330a041f63484d6a6a31c

SHA1
58cd5bb128ff464e27761c1e4b22c31a3ea37dbf

SHA256
78581683e0c61fbf0dcd8cca36391aaab70b184865cd420e93dd9a162c5b719c

SHA512
e6a7c5b72378b0bce28a9d58afacd61160f5830277689b8013f7d784880e4b533a4d0926a3c5b5db718551db872cd164469147b8917daad78192b994869fa2f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\UserInfo.dll

Filesize
4KB

MD5
9301577ff4d229347fe33259b43ef3b2

SHA1
5e39eb4f99920005a4b2303c8089d77f589c133d

SHA256
090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc

SHA512
77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\_locales\en\messages.json

Filesize
10KB

MD5
f70090dc1fe75bb086a33ebc02bc11f5

SHA1
24acd6da3e37e1bc932b5e95586f97a22df76771

SHA256
c258cd92fbdc96075f286241777fbca2ac375b315782b6fa512cd3b53bf55cb0

SHA512
0d074eae4e127e687dbcebb8df1ff682d45b5630f3c8394232e25bcfa6175a6a667b4c9ae43006e6edbad8db24ad88eb185a003ba321779f9e9b9cbc4e5beefb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\_locales\es\messages.json

Filesize
11KB

MD5
c921597c9859ad79bfa03389756605b9

SHA1
4cecf030407852b22b81aa2984b257c65a35391a

SHA256
04a4e8f640ffa0065cdc1a9a338fdca48e6a108b1615cb28b9883e5aebb93695

SHA512
273094787467b6697a0c53b977c72945f64f2da40415b526c54ba4cc4515beb17b9ef2adfc891819428d366a221ee06d1b378dd66adbfcd8e9341e6dbf9d7e9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\assets\fonts\lato\LatoLatin-Regular.eot

Filesize
66KB

MD5
6cfad5881181ae658a6efdd68889a690

SHA1
5b54f6ccc20ed3a078fbdf94d7a68ac80002624d

SHA256
c6c970b103b3c3aa83f7a45172619a4451ea5f015f9f3ef4fd08c9a4aa895cbc

SHA512
ddd3d43540eb3d4eef48d0834136de1e7bf23a52f286d0a666cf57c7d685aadf1cea6d37c88f9d7ce5ad6143d7c3213f54b16a11f616b7dce154bba50997bbe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\images\bottom-arrow-hover.png

Filesize
294B

MD5
f5d76b21fcab6cc89fd0ebc1089c2c26

SHA1
160645c02dcfdcd4d6d6a8339557a62b80493e40

SHA256
3b8043e64994a53126afe1250b80fa2934196c3305bf93fd3e7a6963867a6eb9

SHA512
4c4fd737cd771e8e0c025295c598aeb4ffb2d20df10658f7cb992aa49b4817be5d291c0c6530b4e9aaa241ab76df3c52e01a40a505e7b60d1d968a96fd4de991

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\images\bottom-arrow.png

Filesize
279B

MD5
847fab99890ddd7460e758ad8d463ba9

SHA1
bdf8c1e45993ee33ee0bf9a2e43d6048df71cb8a

SHA256
46bfb08af2269108c681b78373c98e899b4234adce39394322c7dfd6d40dcdac

SHA512
0bd2075c61eafc2946a9431bd4fbbbb141f3743144782376874640e4aae1ee97a05844589661b3a0912b23dacdf57e0a667d8ffa8ccd0f4358e5802e653aef1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\images\checkbox-checked.png

Filesize
321B

MD5
6067f0ee8d785e960b2fa9e68b9f5321

SHA1
ac42da8bc80746f4ae2288c65562105fe6da05e6

SHA256
deb8825e21f9f0153bd769de7e8537c52df5bdda35c32a2e610078f8f0445581

SHA512
b8befca32779fc1cfa245bb8e0c9b43bcd932550f1f518766d2946e1b18aa8a634e240627839c646c87c19c8a9ed5a7790cd1799835c5c3dd1d1c4f1043f43a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\images\close-hover.png

Filesize
399B

MD5
5b691eb1c6836563447358b108bc9f39

SHA1
14104e60754aa46034effcbdf21af44e13f3c4cb

SHA256
aaad22634eed5977eb3a690652f16f4efda3143dfb0c165cd391bd862de6eef0

SHA512
d239bba8ce1c22dcf6d8c830614c158290b1fd9f684f7eda86e959f5cfa86cc572fa01711e0d0850f48e13c654a9e69675d83148a3bf22f64de91f7a51eaa124

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\images\close-normal.png

Filesize
330B

MD5
1acb62ec3fa5a82347c330512f2259d6

SHA1
c81389f19687e791bc4ada896620b17471371c04

SHA256
e8bd82cb680ae552f587a3f0bdc1df18fc7624dffec501840cc508d327baeec3

SHA512
a6693f68c41f8a7c137f3129403b14144329c132b99956ff2c1cc5317b046eaec70aef82c7c05b9220c3c3a7f2a417718fb65bbbe486250c05191778456f602a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\images\icon-fallback.png

Filesize
213B

MD5
3880ad80fd07870118b0aeb8fff308d4

SHA1
37b30e87d89d3bc56eb5ca3f8ec6c7f22e5ee6a1

SHA256
772fe7450824cb84dbcbc9cdb401278dec1a511ca3ae2cceb073e8bf4dc8fa61

SHA512
3917e7b6623f284a0378702e489a5131c3ad328827a87e1332d24a89d6e54d68e7dca3e5bfeb0bb22fe54da1572d2d8a9107eec8f36b9ba7db1f50c0a5205d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\images\icon.ico

Filesize
99KB

MD5
e07e7fc2c1d55fde55f0a863a674ce0d

SHA1
ff7154e061c65db3140ef33a2b2946d00f2001b5

SHA256
1344eb8d63dc7c80e07d758b8c6af44fed4a9ab4d495b6ccc125fe840895fd09

SHA512
f9dd9de181527347957e47b581f77b48c6759bb78bd043c60d64bdcddc7df2eac36c5e0ba400c617399cebe4ecbf2b12b7e54aca36004d1752a72b6920fdca06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\images\minimize-hover.png

Filesize
171B

MD5
f4b8851b9ef5a55b0d45392baceb31fb

SHA1
03a87a04dc75579a8568543d40db963b6e9f4051

SHA256
d84b877f7a2d601b1d71cf878b33ff78c94c2d144a0f4d72436a7dcf64e712c2

SHA512
a849659d4ba4e40b924108cd567a58f4b1569afc5c7517a10c26fd6d64422fa61812683292da1c3b19dbe91c63aacd5cd1c5b342ccce98b6815e94b55767ce4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\images\minimize-normal.png

Filesize
150B

MD5
1bcfd10e50ab56ac335a463ec19b8d33

SHA1
b5054dd1cdd714a6771bc11e43291df361a16ccc

SHA256
aa2b021cd0dd9563705503dad48866eac926c7ace608ff8d00f755afc509f39b

SHA512
7257c401db826ed1f4a549b1b899d0fb4a5bcc3c599ced49b07a64fc308b08fb208dc378a32d9c3cd193b4d603ae76f82bb297334998ca6abb790081a5467edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\images\welcome-logo.png

Filesize
995B

MD5
860785e1633b7a170ec443f4d36551c7

SHA1
f5a3401fdb22bffabbaae7f912f93cddbb7ea148

SHA256
2e3dced384fe419468973dcb074794b1444f48bce8f96217aa5e3a98c34e4c01

SHA512
217b2177b9f990ee27d1e169dca9f99da18e9bd41fc6d7a5ce7d01cf9e35a23f343763835424125b3fa73de196579054e56542e5885327c6922deeb34fd78e16

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\index.html

Filesize
18KB

MD5
d367bf95bb13abbb839927ef76618253

SHA1
95b95767ec022a74f4c9a6b74895557439817ac9

SHA256
a7db7133613735b6b5c96d4ee3eb8a1630ee783dd41a81260f2461a66c3728d8

SHA512
98fa35e39b3dc54d410c7b4af0efe31845e195473843d2ce0e25ad4b892784a2fba6a9e99964b47a4c3c1d49bc9e839c210a73c7cc788643ef36abe8a1966952

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\app.js

Filesize
21KB

MD5
7c15ecdc0a6c4894af1ebf28e32aed6f

SHA1
db55a0d8935fb49b9be45da4bb4ee88a5277b7db

SHA256
5e67c50e827ad0e651d58646ffeae6a22d6c048e34e33b5e8f1fa98a21f40eab

SHA512
792a28a59330c60f8769d46eb32d1e0c0ff25b27b338288eb6c6e4c7278d3c4dacd44d58bf8c5006e4b8fa5dc313ee23581d0c33e2b0696632dafd7223893472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\block_inputs.js

Filesize
789B

MD5
b5b52c92b90f4283a761cb8a40860c75

SHA1
7212e7e566795017e179e7b9c9bf223b0cdb9ec2

SHA256
f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544

SHA512
16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\libs\cmp.bundle.js

Filesize
296KB

MD5
c3dbbd4cfe15de60c8c3606ddf9c8784

SHA1
ef44afa8b6fb172b04aa62242b78d90b7ff34a3f

SHA256
a1d99c498fb84e20aeffcb22e7b473fa88e2909f2b9eacdc63d8e09aa56b5aec

SHA512
849a71028e2db8a14178c14c05de413d23282fa49b59befddbc5279d203f27e0d2b21ee9ef43d0aa15b2c81c17d42301d52760c894b9f7ee78ddad258f31a5f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\libs\jquery-1.10.2.min.js

Filesize
90KB

MD5
44e3f0db3e4ab6fedc5758c05cf27591

SHA1
2d408aa1d35661019c95adcc60b78c0727ed25b4

SHA256
bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144

SHA512
4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\libs\mixpanel.js

Filesize
1KB

MD5
344e4265b3d4e1fecfd81c561293edab

SHA1
51dbcac23b839e64362d11763bbe64538ad80bb8

SHA256
88872b5b01a8d1dfee124333aba630ceb8535390130833dd2a312c461ac52217

SHA512
dcda17cb89861c4cd0be4b7cd93b58283cd1acc3c7a4a2176add3ea6403079c8567bcf88d878aa2e91e96c43b15a7ce668299c3d015c6dc4db5b15cddbe4ea7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\models\notifications.js

Filesize
4KB

MD5
1b2b45f8bd6b23569be3afb72cc5b5b0

SHA1
0cfc6b667bc8cf4713049d73241838867cdbb51b

SHA256
976abfebd516a38b49a23c97ac3c188a00811a379cdea56df31a732c64d858f7

SHA512
a1492ea26f03ef9f49015872e896bc47ed144bf8c55dc074b2e61ebfd5b285af0a38b09d21fcb37f56a8d208d175fbd0c1e22975e1a31dfd258bf37bc046eb3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\utils\analytics.js

Filesize
3KB

MD5
00da91079bba7d8b219376f9a9b20961

SHA1
fcaeffa5cc73a667c8ef69442ba62964fddeba5a

SHA256
15f8b8bd605296723e1322465f220e173c750da0745bdf39ec400ab6215c28c7

SHA512
d906ae32a0e2d5b65a030ac6a20a95bdba63cb86ded7d48a6f9d809fe000631c309eb81a5445fa68b45e16f06fe5d282827c026208429297f78be1e7d9ed9961

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\utils\commands.js

Filesize
12KB

MD5
8077c868435c2ab49cc70683489d229b

SHA1
31dfe51f87ec33073b2209e60de7ecd647007c7b

SHA256
72947e14b9e17653b7557c7083a39e453d05f3ef529ddab77c6d6099a95cc881

SHA512
a9f0247a0e1242c02928567f5e9d71564af930446a2be9bcaf51b415a4d30e3a064b1bcaf2c7115a268b01597f2b57905f49f42bd1989398213c262abbafe2ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\utils\cookies.js

Filesize
1KB

MD5
6c60e675f8c8c68c0174b644d3a63a2a

SHA1
3635a3fe07ccc4a6f33a986ddb690522d0611abb

SHA256
9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287

SHA512
1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\utils\modal-events-delegate.js

Filesize
1KB

MD5
117e4fdbdb0ecf211c8bd909efd337d1

SHA1
9f8684d856b7c95bdffb139217dfd89f41373187

SHA256
267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857

SHA512
f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\utils\strings-loader.js

Filesize
5KB

MD5
9c94eb933d8a43dd3825e67a7e30c980

SHA1
7ec7b16af6f399219209ba5967d377040486a11b

SHA256
96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf

SHA512
a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\utils\utils.js

Filesize
118B

MD5
a0952ebeab701c05c75710c33d725e7e

SHA1
1da8a2e889f1213d481ae3cd5571670c01e64adc

SHA256
b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246

SHA512
5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\cri\cri-controller.js

Filesize
4KB

MD5
332f5af476ffd8a94200c17b83f388f6

SHA1
529e4c0820218649e78c840ba5294aa09770a209

SHA256
16032b365d23803cd7c1b8036b01f104eb814c38913b4bdff5b92919a0ab2702

SHA512
aac2163212f5b7ac457f9558318a254facc116263e6ce1ff99d655555ed97a20fdffe68693874b0140fdc07fb3509ba2af19296f2d3077bbec7cd605d87e2c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\cri\template.js

Filesize
1KB

MD5
76c1ef0cb437db144c2bed53a5a8a5d7

SHA1
aaab8fff649f8e46d1e9510018118ee9abe01498

SHA256
505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e

SHA512
822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js

Filesize
1KB

MD5
01878b1f0f27ba2af34f89c648f3e16f

SHA1
b45e04411d06052772b4645d1feb7a594b722067

SHA256
4c96454e5b0493676af666aa5716ba12209aa72fb30e8dbde8e85ab000a4350a

SHA512
5a7860c8df74ad9dd2eea3bd0927dbfa1fff1de7b9a093a6d727ecc2abb7139d721cbf76c55a7ade24ade5e08e6547321a62e3a1440eb202b7a8569305dfa782

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\finish-with-recommended-app\template.js

Filesize
681B

MD5
d1cb34b57cef7e28b9286454b197b712

SHA1
f3a964b319bab82d4eda07e126bbfd6dec35c349

SHA256
b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42

SHA512
3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\finish\finish-controller.js

Filesize
2KB

MD5
cbdfd75bb47bda0ae536b3d45958b615

SHA1
9a69d440e1d8ba1976b2880964f7041c46e8bdf9

SHA256
b4221b80fbbc4ef93b3a1f668d8a3445353db9f3e1ec77c9b6520a7312ac46f9

SHA512
e78272fcd6af8656cd054c91b97508603792dcc75c4f7a123880671ff6ed126e03cd19ec13d005f655e8281a1e90f6b190be650ddf07522fa613a940148dd475

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\finish\template.js

Filesize
1KB

MD5
f092de7ea66d8e920b345f38537fa35d

SHA1
82d107a409f18878307ae0cefe24074db64937c4

SHA256
b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f

SHA512
14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\main\main-controller.js

Filesize
11KB

MD5
15b665a5c915004e1aa7e9e11a710f7e

SHA1
7821924e42bb19d60c572ff80bbaaa04d7aaeefb

SHA256
84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653

SHA512
dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\main\template.js

Filesize
3KB

MD5
a118c7724c208f12083240cafccfd10b

SHA1
f89c676a215b869626737862a08c9eb07d440211

SHA256
63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc

SHA512
9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\modal\modal-controller.js

Filesize
2KB

MD5
995aa365976d4166ec6de5fe212b0255

SHA1
0d0e8c6aabfc8c967d5af224f66045314c0564b1

SHA256
cff5f7519eb05899df67ae1d79c9318ea344b068d95b565ae8dafacb70a1c52b

SHA512
71a51e34e92e2c478397e70ade9b33e39f4fb9a6da14f04a27997dfd9149978f4d90f0cb6d35e9ede116a2f6ed7f3c6f291383ef84d10994050893c1741f3de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\privacy\privacy-controller.js

Filesize
2KB

MD5
9caf44e466f9dc19ea102980da4ae5d5

SHA1
da7e0fa627f6f3d2d9f0ec091ba19aa81e66332f

SHA256
f0b55a937f0bdc60394c4259dc226562b552a6eaaac61950fa29400200f5380a

SHA512
e88b1e18b14e0abb6f625c4210196609f8f8c001dd3ff66b1807d66113df471468d6c8548bd1af1e1f5c25faf759517c4eb93108394ff1f9abc7b36a8b6ad11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\privacy\template.js

Filesize
655B

MD5
cf8d2c26520d7c84e560dfa79e31dcd3

SHA1
716f2ec17480d5cc9c145bc147833fbfc39d36f0

SHA256
95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8

SHA512
d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\progress\progress-1-controller.js

Filesize
2KB

MD5
4bc723bda9cc718301f2533ca3196768

SHA1
7f78b74746762fd5007ea3fbce45349bb0ef7901

SHA256
164bbdea64ca671a04b91747191227a89992a34159f1578a2cbf0e16398af1ec

SHA512
920f898d1592ae8d713410ac3fb43e9d490d567f2bb70b8f8d2958a0899fb8bf6a0a735db63a8eb3e1bf2cb02be70354a0f7b92d12584b1ecbde2d5ec19f9a53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\progress\template.js

Filesize
242B

MD5
92b145e6649ba0add3dee9a69d3fa91e

SHA1
4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d

SHA256
a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab

SHA512
747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\settings\settings-controller.js

Filesize
6KB

MD5
bc3f76e8be45effb0ff0d559c75e5c62

SHA1
f9d14095ec63d749eda9342e456b040e646725b7

SHA256
35f3169aafb9d8e1f8c619155efe33f01d78ef67f987377344a5460457476a36

SHA512
812b808474c6a9cfae18934614c86978659bec1985842d35232c2c964a098efe13358df4e57348edc95e0aee97b268a59040c322831aca83af4b2ca7a4d04544

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\settings\template.js

Filesize
2KB

MD5
aee08bbe8994d59ce5b0fd4611968394

SHA1
3533ee4e288625aefdf5b2cd2a17494e340fa097

SHA256
91bdc29c6bee6de168cec29912e46d8bfb53a2a7c3d5082e3933eff8db887ecf

SHA512
13462812b482f5bad79260ca1ae9f11db38d32c9ca01204f5b1fb5c512e11b963d070fc2c5ab88d40e0069144d9a96eec86990e4d05b3032085607dca3bc9b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\welcome\template.js

Filesize
1KB

MD5
17f54fca6723b983875d940d931e0afb

SHA1
01774cd5cea36bd74c80a708d6f77567e8091024

SHA256
42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb

SHA512
401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\js\windows\welcome\welcome-controller.js

Filesize
2KB

MD5
6127f0a4ee214776271ea6fce1fb58e9

SHA1
378cd32ccf043889de731fce6d96b6c21632a165

SHA256
aa42af897b154c05a5a5bdf5c9420e698bc943cf1a6fcd830aae7c5b8317f654

SHA512
f2b35ced730fb95b64dd72be81345788d1fb66d38f26f2ddeb205cbecfc767703a12c455d2bb8ba1dbada1a409e123aaf020a822321b8ad80947e67c53e83a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\app\manifest.json

Filesize
691B

MD5
c2124be4deca586d9da702111c0fe2cf

SHA1
2a8c1bc6a2b302b8ff1f37f7803c9a275745cdf7

SHA256
5642aee1d77cbf1fca7d0999e58f0d34b6670ce8da50c278af8f5ee2ec0260b2

SHA512
6908fcb50b200cdb540dae41a0dc42a15a43844cddd8dc401e03b34c6a1975f7070e58b0bacaf608c1188273c64d2ba8cf93e6777a0b0620a02e1a51ce72eb45

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\log4net.dll

Filesize
270KB

MD5
a8f09fea0a1575fa3dca91ee6009e87b

SHA1
9f7893a10b7392c07a11e9379e5f2b3105c6e16b

SHA256
41f9d6427e8ca3c302b9e1cad9d4f57554efde343212d41752547d5006dbf874

SHA512
5f00d65812f0c61049964bc7c434748d9a9e5cd079d1db16f366d94b2f5bde9858054c9668661ca239b6ee6947e1ec82abbe1f0e4ce848c34d709b8b864d1eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\uac.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\uac.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5DD5.tmp\utils.dll

Filesize
55KB

MD5
aad3f2ecc74ddf65e84dcb62cf6a77cd

SHA1
1e153e0f4d7258cae75847dba32d0321864cf089

SHA256
1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8

SHA512
8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

Download Submit
memory/364-219-0x00000000009B0000-0x0000000000C28000-memory.dmp

Filesize
2.5MB

Download
memory/364-221-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download
memory/364-220-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download
memory/972-155-0x000002CFC47C0000-0x000002CFC4806000-memory.dmp

Filesize
280KB

Download
memory/972-146-0x000002CFC4350000-0x000002CFC43A2000-memory.dmp

Filesize
328KB

Download
memory/972-229-0x000002CFE1870000-0x000002CFE18EA000-memory.dmp

Filesize
488KB

Download
memory/972-152-0x000002CFC46E0000-0x000002CFC46F4000-memory.dmp

Filesize
80KB

Download
memory/972-159-0x000002CFC4790000-0x000002CFC47A8000-memory.dmp

Filesize
96KB

Download
memory/972-206-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download
memory/972-150-0x000002CFDE810000-0x000002CFDE8A8000-memory.dmp

Filesize
608KB

Download
memory/972-196-0x000002D7E3CD0000-0x000002D7E4476000-memory.dmp

Filesize
7.6MB

Download
memory/972-162-0x000002CFDFC70000-0x000002CFDFD20000-memory.dmp

Filesize
704KB

Download
memory/972-153-0x000002CFDEDE0000-0x000002CFDF308000-memory.dmp

Filesize
5.2MB

Download
memory/972-211-0x000002D7EC3F0000-0x000002D7EC4F2000-memory.dmp

Filesize
1.0MB

Download
memory/972-144-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download
memory/972-164-0x000002CFDFBF0000-0x000002CFDFC12000-memory.dmp

Filesize
136KB

Download
memory/1792-241-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download
memory/1792-230-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download
memory/1792-226-0x00000000012F0000-0x0000000001302000-memory.dmp

Filesize
72KB

Download
memory/1792-227-0x0000000002AA0000-0x0000000002ADC000-memory.dmp

Filesize
240KB

Download
memory/4596-213-0x00000000022B1000-0x00000000022B3000-memory.dmp

Filesize
8KB

Download
memory/4596-217-0x0000000002830000-0x000000000284D000-memory.dmp

Filesize
116KB

Download
memory/4596-215-0x00000000022C1000-0x00000000022C5000-memory.dmp

Filesize
16KB

Download
memory/4756-140-0x0000000002A91000-0x0000000002A95000-memory.dmp

Filesize
16KB

Download
memory/4756-136-0x00000000006B1000-0x00000000006B4000-memory.dmp

Filesize
12KB

Download