Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2023, 05:46

General

  • Target

    1177d948403b0efc96899542aa7121d3.exe

  • Size

    3.8MB

  • MD5

    1177d948403b0efc96899542aa7121d3

  • SHA1

    3cd7bf300f6482728cd5f46ea07d0a0685decfc1

  • SHA256

    db356737d8940879b057bd0173aae780602b9ceb0a5790bd90e12c5cfc194088

  • SHA512

    da3239d8c283d8786d81f01badfa4f2eb787a23add947cd2ecff78b65019b2ca168198263e978e664bbacd3520489a98b7c7b0d5775b2e1571396924bcc07a11

  • SSDEEP

    98304:PuXEdPN+TIvz8Uv3gifh55G1bNc50ymOMFQ:Pc0P2ZsgKH5G1RUNMm

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DCRat payload 9 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 14 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe
    "C:\Users\Admin\AppData\Local\Temp\1177d948403b0efc96899542aa7121d3.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4684
      • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\OWinstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\OWinstaller.exe" Sel=0&Extension=mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc&Name=Hone&Referer=hone.gg&Browser=microsoftedge -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc -AllowWindowsInsider --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --auto-close --silent-setup --app-name="Hone" -exepath C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3164
    • C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat
      "C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Runtimemonitornet\CYRXQuRYufl9oKefmNyIPlQ7hY.vbe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4316
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Runtimemonitornet\Xr0neB4HusMZHl.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2232
          • C:\Runtimemonitornet\portbrowserdriver.exe
            "C:\Runtimemonitornet\portbrowserdriver.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2092
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6665eb4-bd2b-4cf2-894f-16be7eb5636a.vbs"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1696
              • C:\Runtimemonitornet\portbrowserdriver.exe
                C:\Runtimemonitornet\portbrowserdriver.exe
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4980
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f38d3c87-4118-4abe-a775-9af70a18b777.vbs"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2756
                  • C:\Runtimemonitornet\portbrowserdriver.exe
                    C:\Runtimemonitornet\portbrowserdriver.exe
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4860
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e276a6f8-d41b-4947-b539-ec96a3a688bc.vbs"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3916
                      • C:\Runtimemonitornet\portbrowserdriver.exe
                        C:\Runtimemonitornet\portbrowserdriver.exe
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        PID:2692
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c772b212-b0d2-4844-813b-ff39ef5ca764.vbs"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:64
                          • C:\Runtimemonitornet\portbrowserdriver.exe
                            C:\Runtimemonitornet\portbrowserdriver.exe
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2472
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\45039ff4-24ed-4449-9f35-69718d48d3c3.vbs"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3092
                              • C:\Runtimemonitornet\portbrowserdriver.exe
                                C:\Runtimemonitornet\portbrowserdriver.exe
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:2652
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36bca1ab-683e-4ed2-9df0-d534bb3e6349.vbs"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5108
                                  • C:\Runtimemonitornet\portbrowserdriver.exe
                                    C:\Runtimemonitornet\portbrowserdriver.exe
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:4800
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78856b8e-2d84-4cec-804d-94940c28e8dd.vbs"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2856
                                      • C:\Runtimemonitornet\portbrowserdriver.exe
                                        C:\Runtimemonitornet\portbrowserdriver.exe
                                        19⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:1740
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6979a8f-2558-4ed4-9bac-fb4c10b26964.vbs"
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1412
                                          • C:\Runtimemonitornet\portbrowserdriver.exe
                                            C:\Runtimemonitornet\portbrowserdriver.exe
                                            21⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:4248
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df29deff-edca-426b-ad29-8b75eeaf1a5e.vbs"
                                              22⤵
                                                PID:3024
                                                • C:\Runtimemonitornet\portbrowserdriver.exe
                                                  C:\Runtimemonitornet\portbrowserdriver.exe
                                                  23⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:560
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eeabca42-3bad-4380-a888-d9225dd10d43.vbs"
                                                    24⤵
                                                      PID:5064
                                                      • C:\Runtimemonitornet\portbrowserdriver.exe
                                                        C:\Runtimemonitornet\portbrowserdriver.exe
                                                        25⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1212
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d971302-3dd3-4f2a-a1c1-94f91d446e5a.vbs"
                                                          26⤵
                                                            PID:2964
                                                            • C:\Runtimemonitornet\portbrowserdriver.exe
                                                              C:\Runtimemonitornet\portbrowserdriver.exe
                                                              27⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2136
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b4bc957-b211-4936-a988-69e7cf74d76b.vbs"
                                                                28⤵
                                                                  PID:4000
                                                                  • C:\Runtimemonitornet\portbrowserdriver.exe
                                                                    C:\Runtimemonitornet\portbrowserdriver.exe
                                                                    29⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4380
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d74ba59-89ea-4cf2-8ee7-fd2eaaccdacd.vbs"
                                                                      30⤵
                                                                        PID:4756
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1a90011-2519-466c-a697-8c66b138fbdd.vbs"
                                                                        30⤵
                                                                          PID:4972
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32eccbb9-f1a9-47aa-a602-4011d582b9b5.vbs"
                                                                      28⤵
                                                                        PID:1864
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e54f31ed-f452-4808-956a-9dbf5f54abf1.vbs"
                                                                    26⤵
                                                                      PID:3924
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\342058f6-9b04-4ea4-9770-6cd662507c3d.vbs"
                                                                  24⤵
                                                                    PID:2772
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb169d80-0e69-467c-88a9-9ef32c33ff40.vbs"
                                                                22⤵
                                                                  PID:1936
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa3b4abd-ecb0-47fd-95a6-dc1602523cc3.vbs"
                                                              20⤵
                                                                PID:4120
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\51e11ed7-3566-4c4c-aa54-a2b22ab74621.vbs"
                                                            18⤵
                                                              PID:2860
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d469d512-4d0c-4f03-ba45-2474264a889c.vbs"
                                                          16⤵
                                                            PID:4792
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6ced2c57-7f9a-45ce-8c30-ebf7f8534bb8.vbs"
                                                        14⤵
                                                          PID:5080
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef14018d-d931-4b4a-a6ce-b9b34b7f9f30.vbs"
                                                      12⤵
                                                        PID:4252
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63a44c51-daf4-4557-9428-5001fad23003.vbs"
                                                    10⤵
                                                      PID:1276
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5cb68c2-6bd9-491b-a3b8-f1cbf1e7be2f.vbs"
                                                  8⤵
                                                    PID:3496
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebd6dbb7-4497-4360-a2be-131db968c7fb.vbs"
                                                6⤵
                                                  PID:2868
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                                5⤵
                                                • Modifies registry key
                                                PID:2772

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Runtimemonitornet\CYRXQuRYufl9oKefmNyIPlQ7hY.vbe

                                              Filesize

                                              208B

                                              MD5

                                              7a23d255d6096654045e124588467fa3

                                              SHA1

                                              fc48f5ec448a8cfa325d78687e3f77d34acbbdf6

                                              SHA256

                                              a2764a313331d16396cae1ae82678b5ec9b59f3da9e263156c9fab19c861453c

                                              SHA512

                                              4243cd89fa69179abadc8b6f0ba795097dfb970845f787ed59ae6a22078236deba6dba954edc8a289854f535b15913aab523d390717ca913b7166d5f6d18946b

                                            • C:\Runtimemonitornet\Xr0neB4HusMZHl.bat

                                              Filesize

                                              156B

                                              MD5

                                              8e3e659843bd305ae3a47604863d7a6f

                                              SHA1

                                              5d54189572d9d7e25459be0f4c65cd5f71fb1245

                                              SHA256

                                              2558798b22ce74da0bbbc3c15cf866117bb995d310dabd9cf2b31cfb5208c3c5

                                              SHA512

                                              52ed9fe42f01618ecf46ce5929e8fc08b1fd2779b8a2a796feab2ce3fc7b211ec41f515fc39abc5554ba3958b61af935153e55f247413167302cf8cffa10602c

                                            • C:\Runtimemonitornet\portbrowserdriver.exe

                                              Filesize

                                              1.4MB

                                              MD5

                                              bf33ffbb2565a4a0b60c09a4271d927d

                                              SHA1

                                              3bf2db7fe39d7942706013138db1ba0062d1f51c

                                              SHA256

                                              ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f

                                              SHA512

                                              f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

                                            • C:\Runtimemonitornet\portbrowserdriver.exe

                                              Filesize

                                              1.4MB

                                              MD5

                                              bf33ffbb2565a4a0b60c09a4271d927d

                                              SHA1

                                              3bf2db7fe39d7942706013138db1ba0062d1f51c

                                              SHA256

                                              ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f

                                              SHA512

                                              f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

                                            • C:\Runtimemonitornet\portbrowserdriver.exe

                                              Filesize

                                              1.4MB

                                              MD5

                                              bf33ffbb2565a4a0b60c09a4271d927d

                                              SHA1

                                              3bf2db7fe39d7942706013138db1ba0062d1f51c

                                              SHA256

                                              ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f

                                              SHA512

                                              f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\portbrowserdriver.exe.log

                                              Filesize

                                              1KB

                                              MD5

                                              3690a1c3b695227a38625dcf27bd6dac

                                              SHA1

                                              c2ed91e98b120681182904fa2c7cd504e5c4b2f5

                                              SHA256

                                              2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

                                              SHA512

                                              15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

                                            • C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml

                                              Filesize

                                              752B

                                              MD5

                                              39900278ca451ecbe6e064b28879ac7f

                                              SHA1

                                              d8649b05f0f953828487cf86a5e89e9eed2fc721

                                              SHA256

                                              37ce1941597375d1580b12fd147f0eab5a3f896bace6a478acae337917739984

                                              SHA512

                                              28a7bf1e48c93eeac3e78683d83e491156eb09f5d43f6a43eef8796eeac20debfcf704b5850b05402c683abc4d6a44f1ea65e64881fa5625088286f048f0235b

                                            • C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat

                                              Filesize

                                              1.7MB

                                              MD5

                                              c1804f2b71c50f2c16dd52fb0035546e

                                              SHA1

                                              899b844a27275b81d99fc658aa34f49a9ad7e6b7

                                              SHA256

                                              25072743dadf6a8053ab2f45ecbf37c0e18c6a404665a46baf1896220ceeb67a

                                              SHA512

                                              29082d88915b8430c1c5fe32366fe58536ebdffc40bc101de2e2b9cfd0e5b894092aec4a2b3afd17938e2f189271118d5447572f0d8ca99a72a2d98594321416

                                            • C:\Users\Admin\AppData\Local\Temp\Disable telemetry.bat

                                              Filesize

                                              1.7MB

                                              MD5

                                              c1804f2b71c50f2c16dd52fb0035546e

                                              SHA1

                                              899b844a27275b81d99fc658aa34f49a9ad7e6b7

                                              SHA256

                                              25072743dadf6a8053ab2f45ecbf37c0e18c6a404665a46baf1896220ceeb67a

                                              SHA512

                                              29082d88915b8430c1c5fe32366fe58536ebdffc40bc101de2e2b9cfd0e5b894092aec4a2b3afd17938e2f189271118d5447572f0d8ca99a72a2d98594321416

                                            • C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

                                              Filesize

                                              2.0MB

                                              MD5

                                              16f8c13e8690e478a74743b896b83198

                                              SHA1

                                              96c6f52d49bb4786203185308d067249653d7b4f

                                              SHA256

                                              5309138fcb49980b09cbcd1f28d12ac92fb64fe491e6afaef66c8825b7862687

                                              SHA512

                                              61c9c8ea27d940353d5a6c4216a92dbf86767614ddcdfad792598df5093d2c42f21c60e016c8755efe7586208e157c86d13f1d7596f09345d71ffde0cc5be88f

                                            • C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

                                              Filesize

                                              2.0MB

                                              MD5

                                              16f8c13e8690e478a74743b896b83198

                                              SHA1

                                              96c6f52d49bb4786203185308d067249653d7b4f

                                              SHA256

                                              5309138fcb49980b09cbcd1f28d12ac92fb64fe491e6afaef66c8825b7862687

                                              SHA512

                                              61c9c8ea27d940353d5a6c4216a92dbf86767614ddcdfad792598df5093d2c42f21c60e016c8755efe7586208e157c86d13f1d7596f09345d71ffde0cc5be88f

                                            • C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe

                                              Filesize

                                              2.0MB

                                              MD5

                                              16f8c13e8690e478a74743b896b83198

                                              SHA1

                                              96c6f52d49bb4786203185308d067249653d7b4f

                                              SHA256

                                              5309138fcb49980b09cbcd1f28d12ac92fb64fe491e6afaef66c8825b7862687

                                              SHA512

                                              61c9c8ea27d940353d5a6c4216a92dbf86767614ddcdfad792598df5093d2c42f21c60e016c8755efe7586208e157c86d13f1d7596f09345d71ffde0cc5be88f

                                            • C:\Users\Admin\AppData\Local\Temp\b0b47d4e6d8e600bf159cf0db54899db27b6d691.exe

                                              Filesize

                                              1.4MB

                                              MD5

                                              bf33ffbb2565a4a0b60c09a4271d927d

                                              SHA1

                                              3bf2db7fe39d7942706013138db1ba0062d1f51c

                                              SHA256

                                              ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f

                                              SHA512

                                              f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

                                            • C:\Users\Admin\AppData\Local\Temp\b0b47d4e6d8e600bf159cf0db54899db27b6d691.exe

                                              Filesize

                                              1.4MB

                                              MD5

                                              bf33ffbb2565a4a0b60c09a4271d927d

                                              SHA1

                                              3bf2db7fe39d7942706013138db1ba0062d1f51c

                                              SHA256

                                              ed4e14018c839630f61178d195d00e20b95f1c0337253e8c89d7655c1486231f

                                              SHA512

                                              f2bbe667029224306e42c5b4283f63e426e730c47b585b3c392239beb6ce69666c8b6978607797dbb8f94e811e77d36bfdea2c3f11165baa2eafe079147abc24

                                            • C:\Users\Admin\AppData\Local\Temp\c5cb68c2-6bd9-491b-a3b8-f1cbf1e7be2f.vbs

                                              Filesize

                                              494B

                                              MD5

                                              e0582c5c1d9a78c5bb67fe86473ed543

                                              SHA1

                                              075dcfd4ceb5646d2cb445fd7ec907a53479b917

                                              SHA256

                                              40044111c66871c2bc442ad37487626c46a4e14858424cd56765213f818d0a66

                                              SHA512

                                              035f1b5fb3bd5977597fc38ed2c70a6eaf43c0e520c9dc5c09bab7befcc094cb97a19a5ee495a7bd30d921dbf125c2af42b63f164ea007841143083bb9990a19

                                            • C:\Users\Admin\AppData\Local\Temp\ebd6dbb7-4497-4360-a2be-131db968c7fb.vbs

                                              Filesize

                                              494B

                                              MD5

                                              e0582c5c1d9a78c5bb67fe86473ed543

                                              SHA1

                                              075dcfd4ceb5646d2cb445fd7ec907a53479b917

                                              SHA256

                                              40044111c66871c2bc442ad37487626c46a4e14858424cd56765213f818d0a66

                                              SHA512

                                              035f1b5fb3bd5977597fc38ed2c70a6eaf43c0e520c9dc5c09bab7befcc094cb97a19a5ee495a7bd30d921dbf125c2af42b63f164ea007841143083bb9990a19

                                            • C:\Users\Admin\AppData\Local\Temp\f38d3c87-4118-4abe-a775-9af70a18b777.vbs

                                              Filesize

                                              718B

                                              MD5

                                              96217c0e59322738a115f1a8092fb6ba

                                              SHA1

                                              f3fedccec2383a532757f4ce6a0616e03c69c375

                                              SHA256

                                              e91838279a1b4d25332537f4e293bd5d5febfb3d81f5d8de204122d0f0aa7769

                                              SHA512

                                              36f9c398ace337611d546d2c48e139ab15097913ca995686f12e679ad337ea53d2a5c158b8bd6f9be4a4d8a070d9549dbe7d60d1495d73f5e76911c9fec9ada5

                                            • C:\Users\Admin\AppData\Local\Temp\f6665eb4-bd2b-4cf2-894f-16be7eb5636a.vbs

                                              Filesize

                                              718B

                                              MD5

                                              a228a2b0f43a16f439358c2ca246843b

                                              SHA1

                                              9a2e1240b40834b835384565522050986570d2cc

                                              SHA256

                                              a72eb972937ebb470225cc4f1612210580c849768fc84699a81b95f8da1882a1

                                              SHA512

                                              5b63b29d3d0189ae813ef6094432d2246946cba638d21373452741e6a1905eb6fec584f855d116a96143f9faff095d6c7ed658ac790b80a0a9ef07b07f7f0c07

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\CommandLine.dll

                                              Filesize

                                              68KB

                                              MD5

                                              aa4c7e669dfc9c9285a8e779967f9a50

                                              SHA1

                                              fd712e38610cefa9bb2c359c6d1d16b2baf4fb71

                                              SHA256

                                              80294ac18fb7a5db75c389d1bd8c5aeda3074890bc77faab6e253731ba00d8f3

                                              SHA512

                                              f339dd14914beb62c33a15379c5cd186c71b3d927895bc40e52ae60137f3afdef371db04f170f1e9a68fb20cb19552ac472f59c773b9b28b731419b6cbd12fc5

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\Newtonsoft.Json.dll

                                              Filesize

                                              692KB

                                              MD5

                                              98cbb64f074dc600b23a2ee1a0f46448

                                              SHA1

                                              c5e5ec666eeb51ec15d69d27685fe50148893e34

                                              SHA256

                                              7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13

                                              SHA512

                                              eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\OWInstaller.exe

                                              Filesize

                                              326KB

                                              MD5

                                              6107a3d125a6867a4e6e411c1b78440a

                                              SHA1

                                              491aea922d4babee86edeafd2d9f914179780c9a

                                              SHA256

                                              f70f8a5011baf8a7f62c9161f5e8b5f71906fb9c87b983248ebb6d40ccd87b02

                                              SHA512

                                              f84fa1f7040166b49c787d3f2e55e1db102a9f66024ec6546dcac0d3b1f6df6aff2f927df3fd8a94c72e94e4b022f85f4c2337c5e725f363c3163ddd2112d12a

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\OWInstaller.exe

                                              Filesize

                                              326KB

                                              MD5

                                              6107a3d125a6867a4e6e411c1b78440a

                                              SHA1

                                              491aea922d4babee86edeafd2d9f914179780c9a

                                              SHA256

                                              f70f8a5011baf8a7f62c9161f5e8b5f71906fb9c87b983248ebb6d40ccd87b02

                                              SHA512

                                              f84fa1f7040166b49c787d3f2e55e1db102a9f66024ec6546dcac0d3b1f6df6aff2f927df3fd8a94c72e94e4b022f85f4c2337c5e725f363c3163ddd2112d12a

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\OWInstaller.exe

                                              Filesize

                                              326KB

                                              MD5

                                              6107a3d125a6867a4e6e411c1b78440a

                                              SHA1

                                              491aea922d4babee86edeafd2d9f914179780c9a

                                              SHA256

                                              f70f8a5011baf8a7f62c9161f5e8b5f71906fb9c87b983248ebb6d40ccd87b02

                                              SHA512

                                              f84fa1f7040166b49c787d3f2e55e1db102a9f66024ec6546dcac0d3b1f6df6aff2f927df3fd8a94c72e94e4b022f85f4c2337c5e725f363c3163ddd2112d12a

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\OWinstaller.exe

                                              Filesize

                                              326KB

                                              MD5

                                              6107a3d125a6867a4e6e411c1b78440a

                                              SHA1

                                              491aea922d4babee86edeafd2d9f914179780c9a

                                              SHA256

                                              f70f8a5011baf8a7f62c9161f5e8b5f71906fb9c87b983248ebb6d40ccd87b02

                                              SHA512

                                              f84fa1f7040166b49c787d3f2e55e1db102a9f66024ec6546dcac0d3b1f6df6aff2f927df3fd8a94c72e94e4b022f85f4c2337c5e725f363c3163ddd2112d12a

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\OWinstaller.exe.config

                                              Filesize

                                              632B

                                              MD5

                                              82d22e4e19e27e306317513b9bfa70ff

                                              SHA1

                                              ff3c7dd06b7fff9c12b1beaf0ca32517710ac161

                                              SHA256

                                              272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827

                                              SHA512

                                              b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\OverWolf.Client.CommonUtils.dll

                                              Filesize

                                              579KB

                                              MD5

                                              95c1a39be054c68568bb1ce7ddfb4504

                                              SHA1

                                              28dea40e47a2bec5c4ee6fe88008200270b80c45

                                              SHA256

                                              65d2077fbbf02eb0412836975e1fc31f825e5ea4042a5a41a564f8dab045a591

                                              SHA512

                                              7fd55ae85d61b752b49c9a2c0297398ff4c353d2dbcee86153537ce8da3df3ecf4a5c5707527ace65576c5ef334976932792ed4c78869d08364a5229a6a63a73

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\OverWolf.Client.CommonUtils.dll

                                              Filesize

                                              579KB

                                              MD5

                                              95c1a39be054c68568bb1ce7ddfb4504

                                              SHA1

                                              28dea40e47a2bec5c4ee6fe88008200270b80c45

                                              SHA256

                                              65d2077fbbf02eb0412836975e1fc31f825e5ea4042a5a41a564f8dab045a591

                                              SHA512

                                              7fd55ae85d61b752b49c9a2c0297398ff4c353d2dbcee86153537ce8da3df3ecf4a5c5707527ace65576c5ef334976932792ed4c78869d08364a5229a6a63a73

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\OverWolf.Client.CommonUtils.dll

                                              Filesize

                                              579KB

                                              MD5

                                              95c1a39be054c68568bb1ce7ddfb4504

                                              SHA1

                                              28dea40e47a2bec5c4ee6fe88008200270b80c45

                                              SHA256

                                              65d2077fbbf02eb0412836975e1fc31f825e5ea4042a5a41a564f8dab045a591

                                              SHA512

                                              7fd55ae85d61b752b49c9a2c0297398ff4c353d2dbcee86153537ce8da3df3ecf4a5c5707527ace65576c5ef334976932792ed4c78869d08364a5229a6a63a73

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\SharpRaven.dll

                                              Filesize

                                              80KB

                                              MD5

                                              66ee601c0e4cf3b76419638d8395ec1f

                                              SHA1

                                              e0c8ba84b40731cbb5e1b57e275d2e292a90f7e5

                                              SHA256

                                              853154abcf404fff813cdbedf1ff183c298628bc77f52a9e350b06b3d6479ad4

                                              SHA512

                                              da3b5b88fa79430ddb6a60ad3fe94f24d0b7d12d794dbf1d9a9410932d9f1f308aacbde6a4c532ce9d2f9d3ef3be7e61dbd8531d471f06070d9454e3f77552c4

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\System.dll

                                              Filesize

                                              11KB

                                              MD5

                                              7399323923e3946fe9140132ac388132

                                              SHA1

                                              728257d06c452449b1241769b459f091aabcffc5

                                              SHA256

                                              5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

                                              SHA512

                                              d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\UserInfo.dll

                                              Filesize

                                              4KB

                                              MD5

                                              9301577ff4d229347fe33259b43ef3b2

                                              SHA1

                                              5e39eb4f99920005a4b2303c8089d77f589c133d

                                              SHA256

                                              090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc

                                              SHA512

                                              77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\assets\fonts\lato\LatoLatin-Regular.eot

                                              Filesize

                                              66KB

                                              MD5

                                              6cfad5881181ae658a6efdd68889a690

                                              SHA1

                                              5b54f6ccc20ed3a078fbdf94d7a68ac80002624d

                                              SHA256

                                              c6c970b103b3c3aa83f7a45172619a4451ea5f015f9f3ef4fd08c9a4aa895cbc

                                              SHA512

                                              ddd3d43540eb3d4eef48d0834136de1e7bf23a52f286d0a666cf57c7d685aadf1cea6d37c88f9d7ce5ad6143d7c3213f54b16a11f616b7dce154bba50997bbe7

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\images\icon.ico

                                              Filesize

                                              14KB

                                              MD5

                                              9a03fbfd56d8e501797359aac3d72ed1

                                              SHA1

                                              b31e87a87486c00f9266559707e2cae4831f9d44

                                              SHA256

                                              81c69b545c347e1708603fb912511d8eddf755cb27f37fdc6a6fd959c6cfb94e

                                              SHA512

                                              29eb96fe4bdded257f3330672b1f9f2086c28e1e863a093a6fb750b6e59210b47b5ed481e3828442f38c5c6d63ef37709716af1e3913afdf37bf8e574f976fb4

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\index.html

                                              Filesize

                                              19KB

                                              MD5

                                              e9cf3fc4a324553c091ec478f8b01d22

                                              SHA1

                                              e7d230e0ec316c93e9bc8e150b1d61f51da68b67

                                              SHA256

                                              0b175eaa4cf0eb54bc1acbb5a77c51767f996dc49dcf3c13a66e5bd0c4b5580f

                                              SHA512

                                              851c9a35111ab5c94ba0e9117c66382f0fd1034050cb12b51bd3f96abb4ef8d8f73a0c2c7303abeba00b8dea19a787f65763300c857feece1629757760149d8b

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\app.js

                                              Filesize

                                              22KB

                                              MD5

                                              721c1af4b3d7019a97a62332061e3bce

                                              SHA1

                                              fbfc5abd340af76face22c1fafee2dc48a5cb3ed

                                              SHA256

                                              75afcf8bfc7a4ac876bd2c12243f479c744535578e6422a33493db5a51656b91

                                              SHA512

                                              7c0afb7469b678bed138e8d1111ad7ed88a0ac9270ffe2a66661786d4f6d0cd32fc38360f58cc976c6a60ab0914f305e4f762aa1bd871ee86acf5d226a65ecaf

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\block_inputs.js

                                              Filesize

                                              789B

                                              MD5

                                              b5b52c92b90f4283a761cb8a40860c75

                                              SHA1

                                              7212e7e566795017e179e7b9c9bf223b0cdb9ec2

                                              SHA256

                                              f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544

                                              SHA512

                                              16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\libs\cmp.bundle.js

                                              Filesize

                                              299KB

                                              MD5

                                              7364950940fee1134c989c64c5cd93a2

                                              SHA1

                                              8a3e94e9bcac0e29143a86e29615233ca3c1a56d

                                              SHA256

                                              b9ec65e242a1209ecff20b538940c151b1066a727d49fb0b5238da7fa4c5a302

                                              SHA512

                                              da6cabf660efaf6a46d6a73245b8cdb3918144dc7857600bd13ac8c42f1ee9ddd8b0de04dd746876a4851f15e73e4345465195b1b1abd08769fbcc2ca3ebbc6a

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\libs\jquery-1.10.2.min.js

                                              Filesize

                                              90KB

                                              MD5

                                              44e3f0db3e4ab6fedc5758c05cf27591

                                              SHA1

                                              2d408aa1d35661019c95adcc60b78c0727ed25b4

                                              SHA256

                                              bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144

                                              SHA512

                                              4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\libs\mixpanel.js

                                              Filesize

                                              1KB

                                              MD5

                                              344e4265b3d4e1fecfd81c561293edab

                                              SHA1

                                              51dbcac23b839e64362d11763bbe64538ad80bb8

                                              SHA256

                                              88872b5b01a8d1dfee124333aba630ceb8535390130833dd2a312c461ac52217

                                              SHA512

                                              dcda17cb89861c4cd0be4b7cd93b58283cd1acc3c7a4a2176add3ea6403079c8567bcf88d878aa2e91e96c43b15a7ce668299c3d015c6dc4db5b15cddbe4ea7d

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\models\notifications.js

                                              Filesize

                                              5KB

                                              MD5

                                              85afdf9897bb1236eff3afa40d15ece6

                                              SHA1

                                              4362bdd139458eaf4a2dcb34294b43e2d53f4a26

                                              SHA256

                                              9dd03dfc92bcb74f3725aae60e904c0a56cc84f299bbb8e863a869719f6fdd32

                                              SHA512

                                              4ab86c6bafba18f53f01ca913ceaa80f14900107069a1d5f65b108d35690bd8b50b1a6cdf1563fc5775909f69208dabebd139f3cf3d8576269d560d57cf9994c

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\utils\analytics.js

                                              Filesize

                                              4KB

                                              MD5

                                              f288498a7ad1ef51bcd3f3272a1809f7

                                              SHA1

                                              0a7bc52a557ae5cacb5ae7bddebefe0c1aec1ccf

                                              SHA256

                                              c76e5be6cf6513f988e69977a0fedea42fbc700a2e4ef7d136fdf72534ee8519

                                              SHA512

                                              7b2195ce7b6ff8f414ce43ee8cdbfc0660560b6802a2a6271b6a8eefd19d02810c200a51ea1e43269c18f70e5b749e7a515a6db7b8b8ffa7aeeca0a1cd32f057

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\utils\commands.js

                                              Filesize

                                              12KB

                                              MD5

                                              bfbe09f587c3457a7856775e56a4b043

                                              SHA1

                                              e33a70de9405c1f775b51d253812c5e9b57476be

                                              SHA256

                                              97ebe7b0880c38c707ee4f9b4a7a1e0cdc99dae8f16a4b4a4e6996f26dded675

                                              SHA512

                                              5820882e6185b6d4d10c41d862cd97382607e22de14abb6db6f79bd23bdebd5b52659b736ebfe09f91b387fd20e0b06440dbd573f4d64498a01a1b3f24b001b3

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\utils\cookies.js

                                              Filesize

                                              1KB

                                              MD5

                                              6c60e675f8c8c68c0174b644d3a63a2a

                                              SHA1

                                              3635a3fe07ccc4a6f33a986ddb690522d0611abb

                                              SHA256

                                              9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287

                                              SHA512

                                              1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\utils\modal-events-delegate.js

                                              Filesize

                                              1KB

                                              MD5

                                              117e4fdbdb0ecf211c8bd909efd337d1

                                              SHA1

                                              9f8684d856b7c95bdffb139217dfd89f41373187

                                              SHA256

                                              267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857

                                              SHA512

                                              f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\utils\strings-loader.js

                                              Filesize

                                              5KB

                                              MD5

                                              9c94eb933d8a43dd3825e67a7e30c980

                                              SHA1

                                              7ec7b16af6f399219209ba5967d377040486a11b

                                              SHA256

                                              96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf

                                              SHA512

                                              a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\utils\utils.js

                                              Filesize

                                              118B

                                              MD5

                                              a0952ebeab701c05c75710c33d725e7e

                                              SHA1

                                              1da8a2e889f1213d481ae3cd5571670c01e64adc

                                              SHA256

                                              b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246

                                              SHA512

                                              5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\cri\cri-controller.js

                                              Filesize

                                              5KB

                                              MD5

                                              d222c95a2ef0b75ad6c96a3abe20fdc5

                                              SHA1

                                              641c39f92a169f0ca435ed12d2a4d276eb415642

                                              SHA256

                                              aafb56625ec30b24035baafff7bc20215e8ec7e4be4ea58a90aa5b46bdd14a6e

                                              SHA512

                                              e9e66abf6d95fc15a6ffe46cf85c3c9d3b80f3884ca4c8cbb5d2b024fa1dcc46a5e2f39041a4a120a8b8b881d07b3d70b18b552332180aa08c4a67577ea6242b

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\cri\template.js

                                              Filesize

                                              1KB

                                              MD5

                                              76c1ef0cb437db144c2bed53a5a8a5d7

                                              SHA1

                                              aaab8fff649f8e46d1e9510018118ee9abe01498

                                              SHA256

                                              505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e

                                              SHA512

                                              822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js

                                              Filesize

                                              1KB

                                              MD5

                                              01878b1f0f27ba2af34f89c648f3e16f

                                              SHA1

                                              b45e04411d06052772b4645d1feb7a594b722067

                                              SHA256

                                              4c96454e5b0493676af666aa5716ba12209aa72fb30e8dbde8e85ab000a4350a

                                              SHA512

                                              5a7860c8df74ad9dd2eea3bd0927dbfa1fff1de7b9a093a6d727ecc2abb7139d721cbf76c55a7ade24ade5e08e6547321a62e3a1440eb202b7a8569305dfa782

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\finish-with-recommended-app\template.js

                                              Filesize

                                              681B

                                              MD5

                                              d1cb34b57cef7e28b9286454b197b712

                                              SHA1

                                              f3a964b319bab82d4eda07e126bbfd6dec35c349

                                              SHA256

                                              b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42

                                              SHA512

                                              3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\finish\finish-controller.js

                                              Filesize

                                              2KB

                                              MD5

                                              cbdfd75bb47bda0ae536b3d45958b615

                                              SHA1

                                              9a69d440e1d8ba1976b2880964f7041c46e8bdf9

                                              SHA256

                                              b4221b80fbbc4ef93b3a1f668d8a3445353db9f3e1ec77c9b6520a7312ac46f9

                                              SHA512

                                              e78272fcd6af8656cd054c91b97508603792dcc75c4f7a123880671ff6ed126e03cd19ec13d005f655e8281a1e90f6b190be650ddf07522fa613a940148dd475

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\finish\template.js

                                              Filesize

                                              1KB

                                              MD5

                                              f092de7ea66d8e920b345f38537fa35d

                                              SHA1

                                              82d107a409f18878307ae0cefe24074db64937c4

                                              SHA256

                                              b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f

                                              SHA512

                                              14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\main\main-controller.js

                                              Filesize

                                              11KB

                                              MD5

                                              15b665a5c915004e1aa7e9e11a710f7e

                                              SHA1

                                              7821924e42bb19d60c572ff80bbaaa04d7aaeefb

                                              SHA256

                                              84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653

                                              SHA512

                                              dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\main\template.js

                                              Filesize

                                              3KB

                                              MD5

                                              a118c7724c208f12083240cafccfd10b

                                              SHA1

                                              f89c676a215b869626737862a08c9eb07d440211

                                              SHA256

                                              63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc

                                              SHA512

                                              9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\modal\modal-controller.js

                                              Filesize

                                              2KB

                                              MD5

                                              995aa365976d4166ec6de5fe212b0255

                                              SHA1

                                              0d0e8c6aabfc8c967d5af224f66045314c0564b1

                                              SHA256

                                              cff5f7519eb05899df67ae1d79c9318ea344b068d95b565ae8dafacb70a1c52b

                                              SHA512

                                              71a51e34e92e2c478397e70ade9b33e39f4fb9a6da14f04a27997dfd9149978f4d90f0cb6d35e9ede116a2f6ed7f3c6f291383ef84d10994050893c1741f3de6

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\privacy\privacy-controller.js

                                              Filesize

                                              2KB

                                              MD5

                                              72aac0b210f16da255c03c34aac0085f

                                              SHA1

                                              29c8520309a209185f0e7b864fa240aaf8a0c441

                                              SHA256

                                              bdfa1535aecb73ea1de7c9443c5fcaea621cdd7b7f904e91df9bfff28c7f0939

                                              SHA512

                                              6c549011d3607a26697eaac6761650e9d47e126e2b96c8d563df539f1e9651b62ed7fec6de515dabf889fb354d0830ea4b5598f658788bf97420b7058d88a7a9

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\privacy\template.js

                                              Filesize

                                              655B

                                              MD5

                                              cf8d2c26520d7c84e560dfa79e31dcd3

                                              SHA1

                                              716f2ec17480d5cc9c145bc147833fbfc39d36f0

                                              SHA256

                                              95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8

                                              SHA512

                                              d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\progress\progress-1-controller.js

                                              Filesize

                                              2KB

                                              MD5

                                              4bc723bda9cc718301f2533ca3196768

                                              SHA1

                                              7f78b74746762fd5007ea3fbce45349bb0ef7901

                                              SHA256

                                              164bbdea64ca671a04b91747191227a89992a34159f1578a2cbf0e16398af1ec

                                              SHA512

                                              920f898d1592ae8d713410ac3fb43e9d490d567f2bb70b8f8d2958a0899fb8bf6a0a735db63a8eb3e1bf2cb02be70354a0f7b92d12584b1ecbde2d5ec19f9a53

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\progress\template.js

                                              Filesize

                                              242B

                                              MD5

                                              92b145e6649ba0add3dee9a69d3fa91e

                                              SHA1

                                              4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d

                                              SHA256

                                              a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab

                                              SHA512

                                              747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\settings\settings-controller.js

                                              Filesize

                                              6KB

                                              MD5

                                              6c97ca3f9c8186b95dab738f8ad6e2ce

                                              SHA1

                                              f4f8f5d02251338d7d4e29e0f0a90e2e8a77d619

                                              SHA256

                                              5111245d806f02dfa4f4814638eb79ff6a55d6a028c46f2001d55b512e58ad2f

                                              SHA512

                                              e0055727e530f294b0b5878b3f4fb2ff8f63dfce03beb0d25483bc6ebe93c43f4bcd0a9f7ba7e71455d40d0503f0db3bc9d4844656409a11078bdb4b92dbdd0e

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\settings\template.js

                                              Filesize

                                              2KB

                                              MD5

                                              aee08bbe8994d59ce5b0fd4611968394

                                              SHA1

                                              3533ee4e288625aefdf5b2cd2a17494e340fa097

                                              SHA256

                                              91bdc29c6bee6de168cec29912e46d8bfb53a2a7c3d5082e3933eff8db887ecf

                                              SHA512

                                              13462812b482f5bad79260ca1ae9f11db38d32c9ca01204f5b1fb5c512e11b963d070fc2c5ab88d40e0069144d9a96eec86990e4d05b3032085607dca3bc9b51

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\welcome\template.js

                                              Filesize

                                              1KB

                                              MD5

                                              17f54fca6723b983875d940d931e0afb

                                              SHA1

                                              01774cd5cea36bd74c80a708d6f77567e8091024

                                              SHA256

                                              42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb

                                              SHA512

                                              401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\js\windows\welcome\welcome-controller.js

                                              Filesize

                                              2KB

                                              MD5

                                              6127f0a4ee214776271ea6fce1fb58e9

                                              SHA1

                                              378cd32ccf043889de731fce6d96b6c21632a165

                                              SHA256

                                              aa42af897b154c05a5a5bdf5c9420e698bc943cf1a6fcd830aae7c5b8317f654

                                              SHA512

                                              f2b35ced730fb95b64dd72be81345788d1fb66d38f26f2ddeb205cbecfc767703a12c455d2bb8ba1dbada1a409e123aaf020a822321b8ad80947e67c53e83a9e

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\app\manifest.json

                                              Filesize

                                              691B

                                              MD5

                                              526a62540280743fc0696e17c072b26f

                                              SHA1

                                              8a70dc1b4bc973ca4bcb84bfccba154324110fdd

                                              SHA256

                                              a1324546dd6467eb1e5892879f175f82a69a1eaa7cbbcadfa73a9f9012b72ae8

                                              SHA512

                                              b957741bf2335a54150a66b65100a99205f86264294d4765e60e4a1152387a543138b50875a02038da3f0a73089c4a00d7d7eb4955480d2ba7522a563ea63d76

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\log4net.dll

                                              Filesize

                                              270KB

                                              MD5

                                              f15c8a9e2876568b3910189b2d493706

                                              SHA1

                                              32634db97e7c1705286cb1ac5ce20bc4e0ec17af

                                              SHA256

                                              ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309

                                              SHA512

                                              805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\uac.dll

                                              Filesize

                                              14KB

                                              MD5

                                              adb29e6b186daa765dc750128649b63d

                                              SHA1

                                              160cbdc4cb0ac2c142d361df138c537aa7e708c9

                                              SHA256

                                              2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

                                              SHA512

                                              b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\uac.dll

                                              Filesize

                                              14KB

                                              MD5

                                              adb29e6b186daa765dc750128649b63d

                                              SHA1

                                              160cbdc4cb0ac2c142d361df138c537aa7e708c9

                                              SHA256

                                              2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

                                              SHA512

                                              b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\uac.dll

                                              Filesize

                                              14KB

                                              MD5

                                              adb29e6b186daa765dc750128649b63d

                                              SHA1

                                              160cbdc4cb0ac2c142d361df138c537aa7e708c9

                                              SHA256

                                              2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

                                              SHA512

                                              b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\utils.dll

                                              Filesize

                                              55KB

                                              MD5

                                              aad3f2ecc74ddf65e84dcb62cf6a77cd

                                              SHA1

                                              1e153e0f4d7258cae75847dba32d0321864cf089

                                              SHA256

                                              1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8

                                              SHA512

                                              8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

                                            • C:\Users\Admin\AppData\Local\Temp\nsj4DDE.tmp\utils.dll

                                              Filesize

                                              55KB

                                              MD5

                                              aad3f2ecc74ddf65e84dcb62cf6a77cd

                                              SHA1

                                              1e153e0f4d7258cae75847dba32d0321864cf089

                                              SHA256

                                              1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8

                                              SHA512

                                              8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

                                            • memory/560-448-0x00007FFAE29B0000-0x00007FFAE3471000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/560-449-0x0000000002430000-0x0000000002440000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/560-457-0x00007FFAE29B0000-0x00007FFAE3471000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/1212-458-0x00007FFAE29B0000-0x00007FFAE3471000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/1212-459-0x000000001BAE0000-0x000000001BAF0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/1212-467-0x00007FFAE29B0000-0x00007FFAE3471000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/1740-446-0x00007FFAE29B0000-0x00007FFAE3471000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/1740-430-0x00007FFAE29B0000-0x00007FFAE3471000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/1788-14-0x0000000000400000-0x00000000007C9000-memory.dmp

                                              Filesize

                                              3.8MB

                                            • memory/2092-363-0x0000000002850000-0x000000000285C000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/2092-364-0x0000000002860000-0x000000000286A000-memory.dmp

                                              Filesize

                                              40KB

                                            • memory/2092-357-0x00000000028A0000-0x00000000028BC000-memory.dmp

                                              Filesize

                                              112KB

                                            • memory/2092-358-0x000000001B420000-0x000000001B470000-memory.dmp

                                              Filesize

                                              320KB

                                            • memory/2092-359-0x00000000028C0000-0x00000000028D0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2092-360-0x00000000028D0000-0x00000000028E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/2092-361-0x00000000028F0000-0x00000000028FC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/2092-362-0x0000000002840000-0x000000000284A000-memory.dmp

                                              Filesize

                                              40KB

                                            • memory/2092-248-0x0000000000600000-0x0000000000774000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/2092-250-0x0000000000F30000-0x0000000000F40000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2092-365-0x0000000002870000-0x000000000287E000-memory.dmp

                                              Filesize

                                              56KB

                                            • memory/2092-366-0x0000000002900000-0x0000000002908000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/2092-249-0x00007FFAE2870000-0x00007FFAE3331000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/2092-377-0x00007FFAE2870000-0x00007FFAE3331000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/2136-468-0x00007FFAE29B0000-0x00007FFAE3471000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/2136-469-0x0000000000D40000-0x0000000000D50000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2136-477-0x00007FFAE29B0000-0x00007FFAE3471000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/2472-411-0x00007FFAE2890000-0x00007FFAE3351000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/2472-403-0x00007FFAE2890000-0x00007FFAE3351000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/2652-412-0x00007FFAE2890000-0x00007FFAE3351000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/2652-420-0x00007FFAE2890000-0x00007FFAE3351000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/3164-150-0x0000024B878D0000-0x0000024B878E4000-memory.dmp

                                              Filesize

                                              80KB

                                            • memory/3164-167-0x0000024B87960000-0x0000024B87978000-memory.dmp

                                              Filesize

                                              96KB

                                            • memory/3164-200-0x0000024BA01F0000-0x0000024BA0200000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/3164-199-0x0000024BA01F0000-0x0000024BA0200000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/3164-196-0x0000024BA01C0000-0x0000024BA01E2000-memory.dmp

                                              Filesize

                                              136KB

                                            • memory/3164-178-0x0000024BA04B0000-0x0000024BA0560000-memory.dmp

                                              Filesize

                                              704KB

                                            • memory/3164-148-0x0000024B87990000-0x0000024B87A24000-memory.dmp

                                              Filesize

                                              592KB

                                            • memory/3164-162-0x0000024BA0110000-0x0000024BA0156000-memory.dmp

                                              Filesize

                                              280KB

                                            • memory/3164-144-0x0000024B85BD0000-0x0000024B85C22000-memory.dmp

                                              Filesize

                                              328KB

                                            • memory/3164-151-0x00007FFAE2870000-0x00007FFAE3331000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/3164-243-0x0000024BA05A0000-0x0000024BA05F4000-memory.dmp

                                              Filesize

                                              336KB

                                            • memory/3164-236-0x00000253A3D70000-0x00000253A4516000-memory.dmp

                                              Filesize

                                              7.6MB

                                            • memory/3164-253-0x00007FFAE2870000-0x00007FFAE3331000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/3164-153-0x0000024BA01F0000-0x0000024BA0200000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/3164-152-0x0000024BA0640000-0x0000024BA0B68000-memory.dmp

                                              Filesize

                                              5.2MB

                                            • memory/4248-447-0x00007FFAE29B0000-0x00007FFAE3471000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4248-438-0x00007FFAE29B0000-0x00007FFAE3471000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4380-478-0x00007FFAE29B0000-0x00007FFAE3471000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4800-429-0x00007FFAE2890000-0x00007FFAE3351000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4800-421-0x00007FFAE2890000-0x00007FFAE3351000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4860-401-0x00007FFAE2740000-0x00007FFAE3201000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4860-393-0x000000001AC60000-0x000000001AC70000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4860-392-0x00007FFAE2740000-0x00007FFAE3201000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4980-381-0x0000000002470000-0x0000000002480000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4980-391-0x00007FFAE2890000-0x00007FFAE3351000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4980-380-0x00007FFAE2890000-0x00007FFAE3351000-memory.dmp

                                              Filesize

                                              10.8MB