Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

Porofessor...er.exe

windows10-1703-x64

7

Analysis

  • max time kernel
    91s
  • max time network
    93s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/02/2023, 19:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Porofessor.gg - Installer.exe

  • Size

    2.3MB

  • MD5

    67c1ae7ef0d47a91e30f2c5e7a708088

  • SHA1

    e338cabdfb50b6d5661e84c6ae85ae9858eef2a4

  • SHA256

    f043d8610a456d4f996f5d4beb12d6c84e77d2fc721e88e6833afb0ff81a9b10

  • SHA512

    3b405673113f6ad14555d4cb79fe9d004dc4e14459205b47392628136476901ed637624bbff6de99822abb35e5053bc2c895e726f6c3cfa83e7870408b5f3ccd

  • SSDEEP

    49152:REQxE87vxpsrFpIvNWdUtkXC8F5XZs0YpjoRUcT:R/PN+TIvNJtWCaZaaC

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 31 IoCs
  • Registers COM server for autorun 1 TTPs 16 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 14 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Porofessor.gg - Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Porofessor.gg - Installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\OWinstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\OWinstaller.exe" Sel=1&Partner=3776&Extension=pibhbkkgefgheeglaeemkkfjlhidhcedalapdggh&Name=Porofessor.gg&Thanks=https%3A%2F%2Fgo.overwolf.com%2Finstall-successful%2F&UtmSource=porofessor-website&UtmMedium=download-button&UtmCampaign=download-button&Referer=porofessor.gg&Browser=chrome -partnerCustomizationLevel 0 --app-name="Porofessor" -exepath C:\Users\Admin\AppData\Local\Temp\Porofessor.gg - Installer.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:68
      • C:\Windows\System32\DxDiag.exe
        "C:\Windows\System32\DxDiag.exe" /tC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.txt
        3⤵
        • Registers COM server for autorun
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:388
      • C:\ProgramData\Overwolf\Setup\0.217.0.9\OverwolfSetup.exe
        "C:\ProgramData\Overwolf\Setup\0.217.0.9\OverwolfSetup.exe" /S "/TargetDir=C:\Program Files (x86)\Overwolf\" -ignoredotnet
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe
          "C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /UpdateFWRules "C:\Program Files (x86)\Overwolf\\0.217.0.9\OverwolfBrowser.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4524
        • C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe
          "C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /Register
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4748
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdshow OverwolfUpdater
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:3900
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;S-1-5-18)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:4372
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdshow OverwolfUpdater
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:4548
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;S-1-5-19)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:2772
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdshow OverwolfUpdater
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:4520
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;S-1-5-20)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:3872
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdshow OverwolfUpdater
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:4500
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;NS)(A;;RPWPCR;;;S-1-5-21-3844063266-715245855-4050956231-1000)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:1380
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdshow OverwolfUpdater
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:1364
          • C:\Windows\SYSTEM32\sc.exe
            "sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;NS)(A;;RPWPCR;;;S-1-5-21-3844063266-715245855-4050956231-1000)(A;;RPWPCR;;;S-1-1-0)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
            5⤵
            • Launches sc.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:1452
        • C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe
          "C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe" /RegServer
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Registers COM server for autorun
          • Modifies registry class
          PID:2140
        • C:\ProgramData\Overwolf\Setup\checkRedist.exe
          "C:\ProgramData\Overwolf\Setup\checkRedist.exe"
          4⤵
          • Executes dropped EXE
          PID:5024
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://go.overwolf.com/install-successful/?muid=fb683904-d935-4145-88dd-4a05f296c648&extensionId=pibhbkkgefgheeglaeemkkfjlhidhcedalapdggh"
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2292
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffbaad34f50,0x7ffbaad34f60,0x7ffbaad34f70
          4⤵
            PID:4688
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1548,16448256604708544253,5404185713129318165,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1552 /prefetch:2
            4⤵
              PID:3300
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,16448256604708544253,5404185713129318165,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1960 /prefetch:8
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:208
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1548,16448256604708544253,5404185713129318165,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 /prefetch:8
              4⤵
                PID:2160
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,16448256604708544253,5404185713129318165,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2908 /prefetch:1
                4⤵
                  PID:3420
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,16448256604708544253,5404185713129318165,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
                  4⤵
                    PID:2836
            • C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe
              "C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe"
              1⤵
              • Executes dropped EXE
              PID:4792

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.txt
              Filesize

              82KB

              MD5

              ff4c8028431489620848e910f9d28065

              SHA1

              72d5d468cb315f692b81afc0294aef6babe91323

              SHA256

              52c8233d4f4dbf1b8e6adf03acbf2e11a6827ea51da0836c187fbe34e9412256

              SHA512

              b991e631bc6d9fa9aba448eea89de628787d65fae28c84c185750da5c2d7b1b534bb332bf7973c28f9f258e05cd91d3cef3153acaaac4dec3029acfff63cc3ac

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\CommandLine.dll
              Filesize

              75KB

              MD5

              4f7716d91fa0ef49347d75558a5d5f1d

              SHA1

              d8dde91af09124c9aaca3ba9789f075d28982bdd

              SHA256

              1fdc97c19fdaf90249f33315779cb72fa245bc7cabddf087f534771f0524839c

              SHA512

              9a901276c0c6f3bfcbd5eb13e96cb2e9a345d011129465d36894143d022804edc79eb89fcd3dcb0f57026f9a654fd182f48199f36dff981b91597b4716600b20

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\Newtonsoft.Json.dll
              Filesize

              692KB

              MD5

              98cbb64f074dc600b23a2ee1a0f46448

              SHA1

              c5e5ec666eeb51ec15d69d27685fe50148893e34

              SHA256

              7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13

              SHA512

              eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\OWInstaller.exe
              Filesize

              331KB

              MD5

              a524ddfa9456ebeb447d3c20b0bdb123

              SHA1

              e7961864868755e3b057ee16e75b986ec5922170

              SHA256

              5601b56c3ed404b507b34d730e87c2a9be1f037d6a9de4df0ae2fe2290c9bec4

              SHA512

              1cd65de4bb9cd37ade20ce23dffb3cac212ceee2f909a4e97c243a943e918053b04f2f18c993cc7de71ecf860769a7a0f4bb9a9fae791f6e4b1e9f8f713db972

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\OWinstaller.exe
              Filesize

              331KB

              MD5

              a524ddfa9456ebeb447d3c20b0bdb123

              SHA1

              e7961864868755e3b057ee16e75b986ec5922170

              SHA256

              5601b56c3ed404b507b34d730e87c2a9be1f037d6a9de4df0ae2fe2290c9bec4

              SHA512

              1cd65de4bb9cd37ade20ce23dffb3cac212ceee2f909a4e97c243a943e918053b04f2f18c993cc7de71ecf860769a7a0f4bb9a9fae791f6e4b1e9f8f713db972

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\OWinstaller.exe.config
              Filesize

              632B

              MD5

              82d22e4e19e27e306317513b9bfa70ff

              SHA1

              ff3c7dd06b7fff9c12b1beaf0ca32517710ac161

              SHA256

              272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827

              SHA512

              b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\OverWolf.Client.CommonUtils.dll
              Filesize

              582KB

              MD5

              7724b8095286267c832328d4b0924851

              SHA1

              9691a7fcb13b1ed5771a88b6fa15b11dbab13738

              SHA256

              4eb683ab32f3d745b545ff10e86ee4b3e65374181c5605ac74ec4ea1c3929535

              SHA512

              1595f7fe4ed064a5b6ee41be4eb7f81e59af63875be79dda9d346b5a6d38fe5b3e787107a3d4eae802f3fddb6be4c5d554732fc7cc0d2af30b8a0f73d9cca19c

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\SharpRaven.dll
              Filesize

              87KB

              MD5

              e9630d83409b7541aa5ecf18a6489b94

              SHA1

              9c52e733ce819d94bd4381744ed17678166f552a

              SHA256

              242ab09daa979358ce648ca6074a9dfd835b4e7ab9f09b5eff70f6ed192e3efa

              SHA512

              56d896fd3471732ef47d317ce24c8e48894f5ff1700cb5a2965af4d2e4920872bcf006808ad39305be943d942a8c522366a2b95d3b310df5644e472ab29ccb1a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\_locales\en\messages.json
              Filesize

              10KB

              MD5

              e404a0ea1ac8d53b2efb0fda7f1f2795

              SHA1

              ec38cee96fce134fe9b08b83133e2a40c484db43

              SHA256

              448ea9ebb9ef609b852d78976708cd3d3c91674de3e60766704ff2d066f0de53

              SHA512

              8d9e10f2ba26be6bdc0e54b8e650c3f21543358b645bc9342964d258e8a1ca558e08225f3aaab5a19ad411c34fdfccc932d2cc51c6b5ced43415ef32cb9339f0

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\assets\fonts\lato\LatoLatin-Regular.eot
              Filesize

              66KB

              MD5

              6cfad5881181ae658a6efdd68889a690

              SHA1

              5b54f6ccc20ed3a078fbdf94d7a68ac80002624d

              SHA256

              c6c970b103b3c3aa83f7a45172619a4451ea5f015f9f3ef4fd08c9a4aa895cbc

              SHA512

              ddd3d43540eb3d4eef48d0834136de1e7bf23a52f286d0a666cf57c7d685aadf1cea6d37c88f9d7ce5ad6143d7c3213f54b16a11f616b7dce154bba50997bbe7

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\images\bottom-arrow-hover.png
              Filesize

              294B

              MD5

              f5d76b21fcab6cc89fd0ebc1089c2c26

              SHA1

              160645c02dcfdcd4d6d6a8339557a62b80493e40

              SHA256

              3b8043e64994a53126afe1250b80fa2934196c3305bf93fd3e7a6963867a6eb9

              SHA512

              4c4fd737cd771e8e0c025295c598aeb4ffb2d20df10658f7cb992aa49b4817be5d291c0c6530b4e9aaa241ab76df3c52e01a40a505e7b60d1d968a96fd4de991

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\images\bottom-arrow.png
              Filesize

              279B

              MD5

              847fab99890ddd7460e758ad8d463ba9

              SHA1

              bdf8c1e45993ee33ee0bf9a2e43d6048df71cb8a

              SHA256

              46bfb08af2269108c681b78373c98e899b4234adce39394322c7dfd6d40dcdac

              SHA512

              0bd2075c61eafc2946a9431bd4fbbbb141f3743144782376874640e4aae1ee97a05844589661b3a0912b23dacdf57e0a667d8ffa8ccd0f4358e5802e653aef1c

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\images\checkbox-checked.png
              Filesize

              321B

              MD5

              6067f0ee8d785e960b2fa9e68b9f5321

              SHA1

              ac42da8bc80746f4ae2288c65562105fe6da05e6

              SHA256

              deb8825e21f9f0153bd769de7e8537c52df5bdda35c32a2e610078f8f0445581

              SHA512

              b8befca32779fc1cfa245bb8e0c9b43bcd932550f1f518766d2946e1b18aa8a634e240627839c646c87c19c8a9ed5a7790cd1799835c5c3dd1d1c4f1043f43a5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\images\close-hover.png
              Filesize

              399B

              MD5

              5b691eb1c6836563447358b108bc9f39

              SHA1

              14104e60754aa46034effcbdf21af44e13f3c4cb

              SHA256

              aaad22634eed5977eb3a690652f16f4efda3143dfb0c165cd391bd862de6eef0

              SHA512

              d239bba8ce1c22dcf6d8c830614c158290b1fd9f684f7eda86e959f5cfa86cc572fa01711e0d0850f48e13c654a9e69675d83148a3bf22f64de91f7a51eaa124

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\images\close-normal.png
              Filesize

              330B

              MD5

              1acb62ec3fa5a82347c330512f2259d6

              SHA1

              c81389f19687e791bc4ada896620b17471371c04

              SHA256

              e8bd82cb680ae552f587a3f0bdc1df18fc7624dffec501840cc508d327baeec3

              SHA512

              a6693f68c41f8a7c137f3129403b14144329c132b99956ff2c1cc5317b046eaec70aef82c7c05b9220c3c3a7f2a417718fb65bbbe486250c05191778456f602a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\images\icon.ico
              Filesize

              278KB

              MD5

              d7ebedbbf70c4ac7b2eac703d6eaa9a2

              SHA1

              d801b06a5b45a0633307d0b865f61b1cd07dea13

              SHA256

              e1f71c3c13bbb8c5ce30d97bbebe991a20376698a82fadfcd4091f0d31326dad

              SHA512

              9ca720402a13f55accda5a586f150dd48faede2f310d9726559c9d1ddc2ad7e0fed957874950ebd305d6be7102302dce4cf2f6e6909431d557aa8992714585bd

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\images\minimize-hover.png
              Filesize

              171B

              MD5

              f4b8851b9ef5a55b0d45392baceb31fb

              SHA1

              03a87a04dc75579a8568543d40db963b6e9f4051

              SHA256

              d84b877f7a2d601b1d71cf878b33ff78c94c2d144a0f4d72436a7dcf64e712c2

              SHA512

              a849659d4ba4e40b924108cd567a58f4b1569afc5c7517a10c26fd6d64422fa61812683292da1c3b19dbe91c63aacd5cd1c5b342ccce98b6815e94b55767ce4f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\images\minimize-normal.png
              Filesize

              150B

              MD5

              1bcfd10e50ab56ac335a463ec19b8d33

              SHA1

              b5054dd1cdd714a6771bc11e43291df361a16ccc

              SHA256

              aa2b021cd0dd9563705503dad48866eac926c7ace608ff8d00f755afc509f39b

              SHA512

              7257c401db826ed1f4a549b1b899d0fb4a5bcc3c599ced49b07a64fc308b08fb208dc378a32d9c3cd193b4d603ae76f82bb297334998ca6abb790081a5467edf

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\images\more-info.png
              Filesize

              539B

              MD5

              c6911391ca719b6ece307854f40d02be

              SHA1

              451936edbab150559e38a81ec88c75de052bb14b

              SHA256

              b110d583d920fb1065fc7eb587e4f2a256f99d55eb8a562924e088d9b7a971aa

              SHA512

              9728920dd81f2554a37119aae1755751e08ce8d22be5df21ad1b8205d3e37f027cbcb32c25193faa6fa6e270574c7d4eff529ca08bf57565b764b338ea8b1c75

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\images\plus.png
              Filesize

              178B

              MD5

              28a150c80834701792d39b58fe16e741

              SHA1

              f7fa88204163ee7a0df768eb6759bc02b8e1c030

              SHA256

              d25235a308d7b16b6a8694a3eb8935393d124dd3c58380a6c67d4e4f3382e47f

              SHA512

              8222a493bae3316a851b66573886b3c63f8d63b68e4da56ba25f37fb46cdc27ac7dc4e10ca1c3912352812eae5ce4492591fbce09ff7ba1a228ecfb2a49f0c32

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\images\welcome-logo.png
              Filesize

              995B

              MD5

              860785e1633b7a170ec443f4d36551c7

              SHA1

              f5a3401fdb22bffabbaae7f912f93cddbb7ea148

              SHA256

              2e3dced384fe419468973dcb074794b1444f48bce8f96217aa5e3a98c34e4c01

              SHA512

              217b2177b9f990ee27d1e169dca9f99da18e9bd41fc6d7a5ce7d01cf9e35a23f343763835424125b3fa73de196579054e56542e5885327c6922deeb34fd78e16

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\index.html
              Filesize

              18KB

              MD5

              d367bf95bb13abbb839927ef76618253

              SHA1

              95b95767ec022a74f4c9a6b74895557439817ac9

              SHA256

              a7db7133613735b6b5c96d4ee3eb8a1630ee783dd41a81260f2461a66c3728d8

              SHA512

              98fa35e39b3dc54d410c7b4af0efe31845e195473843d2ce0e25ad4b892784a2fba6a9e99964b47a4c3c1d49bc9e839c210a73c7cc788643ef36abe8a1966952

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\app.js
              Filesize

              21KB

              MD5

              7c15ecdc0a6c4894af1ebf28e32aed6f

              SHA1

              db55a0d8935fb49b9be45da4bb4ee88a5277b7db

              SHA256

              5e67c50e827ad0e651d58646ffeae6a22d6c048e34e33b5e8f1fa98a21f40eab

              SHA512

              792a28a59330c60f8769d46eb32d1e0c0ff25b27b338288eb6c6e4c7278d3c4dacd44d58bf8c5006e4b8fa5dc313ee23581d0c33e2b0696632dafd7223893472

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\block_inputs.js
              Filesize

              789B

              MD5

              b5b52c92b90f4283a761cb8a40860c75

              SHA1

              7212e7e566795017e179e7b9c9bf223b0cdb9ec2

              SHA256

              f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544

              SHA512

              16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\libs\cmp.bundle.js
              Filesize

              296KB

              MD5

              c3dbbd4cfe15de60c8c3606ddf9c8784

              SHA1

              ef44afa8b6fb172b04aa62242b78d90b7ff34a3f

              SHA256

              a1d99c498fb84e20aeffcb22e7b473fa88e2909f2b9eacdc63d8e09aa56b5aec

              SHA512

              849a71028e2db8a14178c14c05de413d23282fa49b59befddbc5279d203f27e0d2b21ee9ef43d0aa15b2c81c17d42301d52760c894b9f7ee78ddad258f31a5f9

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\libs\jquery-1.10.2.min.js
              Filesize

              90KB

              MD5

              44e3f0db3e4ab6fedc5758c05cf27591

              SHA1

              2d408aa1d35661019c95adcc60b78c0727ed25b4

              SHA256

              bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144

              SHA512

              4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\libs\mixpanel.js
              Filesize

              1KB

              MD5

              344e4265b3d4e1fecfd81c561293edab

              SHA1

              51dbcac23b839e64362d11763bbe64538ad80bb8

              SHA256

              88872b5b01a8d1dfee124333aba630ceb8535390130833dd2a312c461ac52217

              SHA512

              dcda17cb89861c4cd0be4b7cd93b58283cd1acc3c7a4a2176add3ea6403079c8567bcf88d878aa2e91e96c43b15a7ce668299c3d015c6dc4db5b15cddbe4ea7d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\models\notifications.js
              Filesize

              4KB

              MD5

              a94dbd9bd18433d3bdc6c9efa61cba7e

              SHA1

              16260be72ae3101010b34b7f721edb72d0550dbf

              SHA256

              4eb5c8f6679df6f4a23455fe20230e1dac155324709dc8e5cb97b7ede46614bc

              SHA512

              6ea99466ad1252d203ba4c9a13baf6874b5603422676036aac9a03d4145529747e35b9819ce5fc35182fca78985daa4856c1d621be566b5e86e3e161135b6b61

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\utils\analytics.js
              Filesize

              3KB

              MD5

              00da91079bba7d8b219376f9a9b20961

              SHA1

              fcaeffa5cc73a667c8ef69442ba62964fddeba5a

              SHA256

              15f8b8bd605296723e1322465f220e173c750da0745bdf39ec400ab6215c28c7

              SHA512

              d906ae32a0e2d5b65a030ac6a20a95bdba63cb86ded7d48a6f9d809fe000631c309eb81a5445fa68b45e16f06fe5d282827c026208429297f78be1e7d9ed9961

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\utils\commands.js
              Filesize

              12KB

              MD5

              8077c868435c2ab49cc70683489d229b

              SHA1

              31dfe51f87ec33073b2209e60de7ecd647007c7b

              SHA256

              72947e14b9e17653b7557c7083a39e453d05f3ef529ddab77c6d6099a95cc881

              SHA512

              a9f0247a0e1242c02928567f5e9d71564af930446a2be9bcaf51b415a4d30e3a064b1bcaf2c7115a268b01597f2b57905f49f42bd1989398213c262abbafe2ca

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\utils\cookies.js
              Filesize

              1KB

              MD5

              6c60e675f8c8c68c0174b644d3a63a2a

              SHA1

              3635a3fe07ccc4a6f33a986ddb690522d0611abb

              SHA256

              9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287

              SHA512

              1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\utils\modal-events-delegate.js
              Filesize

              1KB

              MD5

              117e4fdbdb0ecf211c8bd909efd337d1

              SHA1

              9f8684d856b7c95bdffb139217dfd89f41373187

              SHA256

              267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857

              SHA512

              f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\utils\strings-loader.js
              Filesize

              5KB

              MD5

              9c94eb933d8a43dd3825e67a7e30c980

              SHA1

              7ec7b16af6f399219209ba5967d377040486a11b

              SHA256

              96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf

              SHA512

              a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\utils\utils.js
              Filesize

              118B

              MD5

              a0952ebeab701c05c75710c33d725e7e

              SHA1

              1da8a2e889f1213d481ae3cd5571670c01e64adc

              SHA256

              b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246

              SHA512

              5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\cri\cri-controller.js
              Filesize

              5KB

              MD5

              d222c95a2ef0b75ad6c96a3abe20fdc5

              SHA1

              641c39f92a169f0ca435ed12d2a4d276eb415642

              SHA256

              aafb56625ec30b24035baafff7bc20215e8ec7e4be4ea58a90aa5b46bdd14a6e

              SHA512

              e9e66abf6d95fc15a6ffe46cf85c3c9d3b80f3884ca4c8cbb5d2b024fa1dcc46a5e2f39041a4a120a8b8b881d07b3d70b18b552332180aa08c4a67577ea6242b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\cri\template.js
              Filesize

              1KB

              MD5

              76c1ef0cb437db144c2bed53a5a8a5d7

              SHA1

              aaab8fff649f8e46d1e9510018118ee9abe01498

              SHA256

              505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e

              SHA512

              822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js
              Filesize

              1KB

              MD5

              01878b1f0f27ba2af34f89c648f3e16f

              SHA1

              b45e04411d06052772b4645d1feb7a594b722067

              SHA256

              4c96454e5b0493676af666aa5716ba12209aa72fb30e8dbde8e85ab000a4350a

              SHA512

              5a7860c8df74ad9dd2eea3bd0927dbfa1fff1de7b9a093a6d727ecc2abb7139d721cbf76c55a7ade24ade5e08e6547321a62e3a1440eb202b7a8569305dfa782

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\finish-with-recommended-app\template.js
              Filesize

              681B

              MD5

              d1cb34b57cef7e28b9286454b197b712

              SHA1

              f3a964b319bab82d4eda07e126bbfd6dec35c349

              SHA256

              b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42

              SHA512

              3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\finish\finish-controller.js
              Filesize

              2KB

              MD5

              cbdfd75bb47bda0ae536b3d45958b615

              SHA1

              9a69d440e1d8ba1976b2880964f7041c46e8bdf9

              SHA256

              b4221b80fbbc4ef93b3a1f668d8a3445353db9f3e1ec77c9b6520a7312ac46f9

              SHA512

              e78272fcd6af8656cd054c91b97508603792dcc75c4f7a123880671ff6ed126e03cd19ec13d005f655e8281a1e90f6b190be650ddf07522fa613a940148dd475

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\finish\template.js
              Filesize

              1KB

              MD5

              f092de7ea66d8e920b345f38537fa35d

              SHA1

              82d107a409f18878307ae0cefe24074db64937c4

              SHA256

              b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f

              SHA512

              14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\main\main-controller.js
              Filesize

              11KB

              MD5

              15b665a5c915004e1aa7e9e11a710f7e

              SHA1

              7821924e42bb19d60c572ff80bbaaa04d7aaeefb

              SHA256

              84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653

              SHA512

              dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\main\template.js
              Filesize

              3KB

              MD5

              a118c7724c208f12083240cafccfd10b

              SHA1

              f89c676a215b869626737862a08c9eb07d440211

              SHA256

              63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc

              SHA512

              9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\modal\modal-controller.js
              Filesize

              2KB

              MD5

              995aa365976d4166ec6de5fe212b0255

              SHA1

              0d0e8c6aabfc8c967d5af224f66045314c0564b1

              SHA256

              cff5f7519eb05899df67ae1d79c9318ea344b068d95b565ae8dafacb70a1c52b

              SHA512

              71a51e34e92e2c478397e70ade9b33e39f4fb9a6da14f04a27997dfd9149978f4d90f0cb6d35e9ede116a2f6ed7f3c6f291383ef84d10994050893c1741f3de6

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\privacy\privacy-controller.js
              Filesize

              2KB

              MD5

              9caf44e466f9dc19ea102980da4ae5d5

              SHA1

              da7e0fa627f6f3d2d9f0ec091ba19aa81e66332f

              SHA256

              f0b55a937f0bdc60394c4259dc226562b552a6eaaac61950fa29400200f5380a

              SHA512

              e88b1e18b14e0abb6f625c4210196609f8f8c001dd3ff66b1807d66113df471468d6c8548bd1af1e1f5c25faf759517c4eb93108394ff1f9abc7b36a8b6ad11f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\privacy\template.js
              Filesize

              655B

              MD5

              cf8d2c26520d7c84e560dfa79e31dcd3

              SHA1

              716f2ec17480d5cc9c145bc147833fbfc39d36f0

              SHA256

              95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8

              SHA512

              d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\progress\progress-1-controller.js
              Filesize

              2KB

              MD5

              4bc723bda9cc718301f2533ca3196768

              SHA1

              7f78b74746762fd5007ea3fbce45349bb0ef7901

              SHA256

              164bbdea64ca671a04b91747191227a89992a34159f1578a2cbf0e16398af1ec

              SHA512

              920f898d1592ae8d713410ac3fb43e9d490d567f2bb70b8f8d2958a0899fb8bf6a0a735db63a8eb3e1bf2cb02be70354a0f7b92d12584b1ecbde2d5ec19f9a53

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\progress\template.js
              Filesize

              242B

              MD5

              92b145e6649ba0add3dee9a69d3fa91e

              SHA1

              4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d

              SHA256

              a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab

              SHA512

              747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\settings\settings-controller.js
              Filesize

              6KB

              MD5

              7c30acb5d090c141185bf36c991c44ec

              SHA1

              59c12294a10835566e6ababc81ca6f66c0cfa984

              SHA256

              8928a80ed2c782ac5538cf7b2b5cbac05b5b70e03abb2e9c44cdf3061cf2f6ef

              SHA512

              9af7605aec15b76147060b592834568c023618ee9f1b6f375649c1a8f342476775f0b7b1fed1b015362dc481b1065a657f9a4b0aa8ae186a381acf6aef894ed3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\settings\template.js
              Filesize

              2KB

              MD5

              aee08bbe8994d59ce5b0fd4611968394

              SHA1

              3533ee4e288625aefdf5b2cd2a17494e340fa097

              SHA256

              91bdc29c6bee6de168cec29912e46d8bfb53a2a7c3d5082e3933eff8db887ecf

              SHA512

              13462812b482f5bad79260ca1ae9f11db38d32c9ca01204f5b1fb5c512e11b963d070fc2c5ab88d40e0069144d9a96eec86990e4d05b3032085607dca3bc9b51

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\welcome\template.js
              Filesize

              1KB

              MD5

              17f54fca6723b983875d940d931e0afb

              SHA1

              01774cd5cea36bd74c80a708d6f77567e8091024

              SHA256

              42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb

              SHA512

              401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\js\windows\welcome\welcome-controller.js
              Filesize

              2KB

              MD5

              6127f0a4ee214776271ea6fce1fb58e9

              SHA1

              378cd32ccf043889de731fce6d96b6c21632a165

              SHA256

              aa42af897b154c05a5a5bdf5c9420e698bc943cf1a6fcd830aae7c5b8317f654

              SHA512

              f2b35ced730fb95b64dd72be81345788d1fb66d38f26f2ddeb205cbecfc767703a12c455d2bb8ba1dbada1a409e123aaf020a822321b8ad80947e67c53e83a9e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\app\manifest.json
              Filesize

              691B

              MD5

              9a8c966ae7708debf9da18f12da2ca3b

              SHA1

              d3a8e5edeeb19c5eb2de4f96cf73015e4edbebaf

              SHA256

              8d6d8ec96554ce1eb7ee67fc5d4149c21f77986cf866dad28cda26ea5c878bc0

              SHA512

              f868d7e6f54b2211fe795a7fcd42daa06bac9c7002a4cb74009d49a6a7280a0856c1416f673ce7a0e8f46761a2e45a4ab8a96755e607bb5778d83ac5374deff2

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\log4net.dll
              Filesize

              270KB

              MD5

              f15c8a9e2876568b3910189b2d493706

              SHA1

              32634db97e7c1705286cb1ac5ce20bc4e0ec17af

              SHA256

              ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309

              SHA512

              805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e

              Download Submit

            • \Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\INetC.dll
              Filesize

              24KB

              MD5

              640bff73a5f8e37b202d911e4749b2e9

              SHA1

              9588dd7561ab7de3bca392b084bec91f3521c879

              SHA256

              c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

              SHA512

              39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

              Download Submit

            • \Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\INetC.dll
              Filesize

              24KB

              MD5

              640bff73a5f8e37b202d911e4749b2e9

              SHA1

              9588dd7561ab7de3bca392b084bec91f3521c879

              SHA256

              c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

              SHA512

              39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

              Download Submit

            • \Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\OWInstaller.exe
              Filesize

              331KB

              MD5

              a524ddfa9456ebeb447d3c20b0bdb123

              SHA1

              e7961864868755e3b057ee16e75b986ec5922170

              SHA256

              5601b56c3ed404b507b34d730e87c2a9be1f037d6a9de4df0ae2fe2290c9bec4

              SHA512

              1cd65de4bb9cd37ade20ce23dffb3cac212ceee2f909a4e97c243a943e918053b04f2f18c993cc7de71ecf860769a7a0f4bb9a9fae791f6e4b1e9f8f713db972

              Download Submit

            • \Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\OWInstaller.exe
              Filesize

              331KB

              MD5

              a524ddfa9456ebeb447d3c20b0bdb123

              SHA1

              e7961864868755e3b057ee16e75b986ec5922170

              SHA256

              5601b56c3ed404b507b34d730e87c2a9be1f037d6a9de4df0ae2fe2290c9bec4

              SHA512

              1cd65de4bb9cd37ade20ce23dffb3cac212ceee2f909a4e97c243a943e918053b04f2f18c993cc7de71ecf860769a7a0f4bb9a9fae791f6e4b1e9f8f713db972

              Download Submit

            • \Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\OverWolf.Client.CommonUtils.dll
              Filesize

              582KB

              MD5

              7724b8095286267c832328d4b0924851

              SHA1

              9691a7fcb13b1ed5771a88b6fa15b11dbab13738

              SHA256

              4eb683ab32f3d745b545ff10e86ee4b3e65374181c5605ac74ec4ea1c3929535

              SHA512

              1595f7fe4ed064a5b6ee41be4eb7f81e59af63875be79dda9d346b5a6d38fe5b3e787107a3d4eae802f3fddb6be4c5d554732fc7cc0d2af30b8a0f73d9cca19c

              Download Submit

            • \Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\OverWolf.Client.CommonUtils.dll
              Filesize

              582KB

              MD5

              7724b8095286267c832328d4b0924851

              SHA1

              9691a7fcb13b1ed5771a88b6fa15b11dbab13738

              SHA256

              4eb683ab32f3d745b545ff10e86ee4b3e65374181c5605ac74ec4ea1c3929535

              SHA512

              1595f7fe4ed064a5b6ee41be4eb7f81e59af63875be79dda9d346b5a6d38fe5b3e787107a3d4eae802f3fddb6be4c5d554732fc7cc0d2af30b8a0f73d9cca19c

              Download Submit

            • \Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\System.dll
              Filesize

              11KB

              MD5

              7399323923e3946fe9140132ac388132

              SHA1

              728257d06c452449b1241769b459f091aabcffc5

              SHA256

              5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

              SHA512

              d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

              Download Submit

            • \Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\UserInfo.dll
              Filesize

              4KB

              MD5

              9301577ff4d229347fe33259b43ef3b2

              SHA1

              5e39eb4f99920005a4b2303c8089d77f589c133d

              SHA256

              090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc

              SHA512

              77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

              Download Submit

            • \Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\uac.dll
              Filesize

              14KB

              MD5

              adb29e6b186daa765dc750128649b63d

              SHA1

              160cbdc4cb0ac2c142d361df138c537aa7e708c9

              SHA256

              2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

              SHA512

              b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

              Download Submit

            • \Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\uac.dll
              Filesize

              14KB

              MD5

              adb29e6b186daa765dc750128649b63d

              SHA1

              160cbdc4cb0ac2c142d361df138c537aa7e708c9

              SHA256

              2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

              SHA512

              b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

              Download Submit

            • \Users\Admin\AppData\Local\Temp\nsa6F2B.tmp\utils.dll
              Filesize

              55KB

              MD5

              aad3f2ecc74ddf65e84dcb62cf6a77cd

              SHA1

              1e153e0f4d7258cae75847dba32d0321864cf089

              SHA256

              1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8

              SHA512

              8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

              Download Submit

            • memory/68-199-0x000002056A8D0000-0x000002056A962000-memory.dmp

              Filesize

              584KB

              Download

            • memory/68-211-0x000002056B630000-0x000002056B6E0000-memory.dmp

              Filesize

              704KB

              Download

            • memory/68-390-0x000002056A3A0000-0x000002056A3C4000-memory.dmp

              Filesize

              144KB

              Download

            • memory/68-389-0x000002056A3F0000-0x000002056A46A000-memory.dmp

              Filesize

              488KB

              Download

            • memory/68-202-0x000002056AF20000-0x000002056B446000-memory.dmp

              Filesize

              5.1MB

              Download

            • memory/68-204-0x00000205508E0000-0x0000020550926000-memory.dmp

              Filesize

              280KB

              Download

            • memory/68-208-0x000002056A970000-0x000002056A988000-memory.dmp

              Filesize

              96KB

              Download

            • memory/68-201-0x0000020550810000-0x0000020550824000-memory.dmp

              Filesize

              80KB

              Download

            • memory/68-245-0x0000020D70110000-0x0000020D708B6000-memory.dmp

              Filesize

              7.6MB

              Download

            • memory/68-213-0x000002056B5B0000-0x000002056B5D2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/68-195-0x00000205504A0000-0x00000205504F2000-memory.dmp

              Filesize

              328KB

              Download

            • memory/2728-142-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-133-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-170-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-115-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-168-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-167-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-166-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-174-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-175-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-165-0x00000000007B1000-0x00000000007B4000-memory.dmp

              Filesize

              12KB

              Download

            • memory/2728-176-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-162-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-177-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-160-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-159-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-157-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-156-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-155-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-154-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-153-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-152-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-151-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-150-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-149-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-148-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-147-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-146-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-145-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-144-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-143-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-180-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-141-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-140-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-139-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-138-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-137-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-136-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-135-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-134-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-173-0x0000000000851000-0x0000000000855000-memory.dmp

              Filesize

              16KB

              Download

            • memory/2728-132-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-131-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-130-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-129-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-178-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-128-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-127-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-125-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-126-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-124-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-123-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-122-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-121-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-120-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-119-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-118-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-117-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-116-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-181-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-182-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-183-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-184-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-179-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/2728-185-0x0000000077100000-0x000000007728E000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/4524-362-0x0000021327BA0000-0x0000021327E26000-memory.dmp

              Filesize

              2.5MB

              Download

            • memory/4748-374-0x00000259E3900000-0x00000259E393E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4748-372-0x00000259E38A0000-0x00000259E38B2000-memory.dmp

              Filesize

              72KB

              Download

            • memory/4748-388-0x00000259E3960000-0x00000259E3994000-memory.dmp

              Filesize

              208KB

              Download