purelogs | 37044180de03a20a82febcefb0e7b346564517c65b2a8bd5167349a5647b2434

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2023 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hone - Installer.exe
Size

2.0MB
MD5

0bef54a9bfdac04a97dad2bda1520643
SHA1

8ad78071027781bf7433a42cfdf12bf5cd802f33
SHA256

37044180de03a20a82febcefb0e7b346564517c65b2a8bd5167349a5647b2434
SHA512

ce2cce709c1f5ff49a5ec1ddf314340c567af5b11a1dac96b665817913f559170732bb3696e58776ff00888c6471255beedc6fc5b3ecbadd4a453e01fd93c78b
SSDEEP

49152:ROQIxE87vxpsrFpIvxqMsaMwgs3W/VsNY+IaA0c3:RBqPN+TIvxqMshwv3W/VRlaA0

Score

10^/10

purelogs stealer

Malware Config

Signatures

Detect PureLogs payload 3 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023242-138.dat	family_purelogs
behavioral2/memory/5036-139-0x000001E2D1FB0000-0x000001E2D1FF6000-memory.dmp	family_purelogs
behavioral2/files/0x000800000002329b-587.dat	family_purelogs

PureLogs
PureLogs is an infostealer written in C#.
stealer purelogs

Executes dropped EXE 3 IoCs

pid	Process
5036	OWinstaller.exe
980	Hone - Installer.exe
4668	OWinstaller.exe

Loads dropped DLL 18 IoCs

pid	Process
2028	Hone - Installer.exe
2028	Hone - Installer.exe
2028	Hone - Installer.exe
2028	Hone - Installer.exe
2028	Hone - Installer.exe
5036	OWinstaller.exe
5036	OWinstaller.exe
5036	OWinstaller.exe
5036	OWinstaller.exe
980	Hone - Installer.exe
980	Hone - Installer.exe
980	Hone - Installer.exe
980	Hone - Installer.exe
980	Hone - Installer.exe
4668	OWinstaller.exe
4668	OWinstaller.exe
4668	OWinstaller.exe
4668	OWinstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 236560.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2180	msedge.exe
2180	msedge.exe
2216	taskmgr.exe
2216	taskmgr.exe
2308	msedge.exe
2308	msedge.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2660	identity_helper.exe
2660	identity_helper.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
4108	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2216	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	OWinstaller.exe
Token: SeDebugPrivilege	2216	taskmgr.exe
Token: SeSystemProfilePrivilege	2216	taskmgr.exe
Token: SeCreateGlobalPrivilege	2216	taskmgr.exe
Token: SeDebugPrivilege	4668	OWinstaller.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2216	taskmgr.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2216	taskmgr.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe
2216	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5036	OWinstaller.exe
5036	OWinstaller.exe
5036	OWinstaller.exe
4668	OWinstaller.exe
4668	OWinstaller.exe
4668	OWinstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 5036	2028	Hone - Installer.exe	88
PID 2028 wrote to memory of 5036	2028	Hone - Installer.exe	88
PID 2308 wrote to memory of 3992	2308	msedge.exe	99
PID 2308 wrote to memory of 3992	2308	msedge.exe	99
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 4976	2308	msedge.exe	101
PID 2308 wrote to memory of 2180	2308	msedge.exe	102
PID 2308 wrote to memory of 2180	2308	msedge.exe	102
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103
PID 2308 wrote to memory of 212	2308	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\OWinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\OWinstaller.exe" Sel=0&Extension=mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc&Name=Hone&Referer=hone.gg&Browser=chrome -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc -AllowWindowsInsider --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --auto-close --silent-setup --app-name="Hone" -exepath C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5036

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x100,0x128,0x7ffc98c146f8,0x7ffc98c14708,0x7ffc98c14718
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,11507705074651819733,179666406373729193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Users\Admin\Downloads\Hone - Installer.exe
  "C:\Users\Admin\Downloads\Hone - Installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:980
- - C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\OWinstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\OWinstaller.exe" Sel=0&Extension=mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc&Name=Hone&Referer=hone.gg&Browser=microsoftedge -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc -AllowWindowsInsider --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --auto-close --silent-setup --app-name="Hone" -exepath C:\Users\Admin\Downloads\Hone - Installer.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
7717991a9603ba33d1ed70c8024f41c3

SHA1
6a2b5ae7887115c4a63c34fb2b128fa311edb6a9

SHA256
2388b11c8d0bd3d8f5781af42184286fa4b47fa0483de3be334f1cc3ac8fc40f

SHA512
1c9f69b306f4b2b86794604bdd327de9280bbb1fea2e73387aef4cf5b496b63ead2c4f63743f10c0507637f38e63cfb5adaed7401f824cb693e969f7ac07ea19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fe8750d715006cf4de9b764b78bf0838

SHA1
a967abb78d3955b9080902dfe6feed894ac2bff7

SHA256
ffc77c9b249690ea0e586d31e99cb106e10ec124ae0354c697dc472953af7786

SHA512
73ed945b4d1e15d94f9d6552341cc9dea1e48b18f7b4067521e7bcff2d9335613faa426fab819f2a4d3fad6af67342e6ce7826e402a134a9b99bf9ce323e6b12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
030b576c95718f7b2d6434534b8250e2

SHA1
37d51985255fca50f00074e681f47a71eb34526c

SHA256
9250ecbf1081e9e95583f56f3d699c1918590475753043df04b43b407e2025e8

SHA512
6c6995533ec13e34190be63fc583379e5cd7eae14ca59ee2a62eb7991b9c9dd2b163973453c8112591a4c9c1d020277e0f06d8bcfba4b2709f956170c3af2a95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1911175714ae99810ddc052465b80202

SHA1
c6e79b073889208c31c2abe06eaf25f52567c78a

SHA256
e2a00583cdcc0bcf4a4c7db32b2257f6e5a358ee3c6b9afb17d9b1497f732b5a

SHA512
8107792671f36a2489c83fc1b4696dd020c64f04171903befebfe894a87d456e71e15dfb994a119bce2ac727c610306396bc62f01a1f5680527156506cfa71c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7fda4ddb452ff6404f9129383f8a3e3

SHA1
ff223f305ea6d753989115e71ec0473510f278ca

SHA256
5449560c46850c9a93e69cf889f314247a821335d81adda6772fd98973f1e36b

SHA512
c6f9416d7af2457402ad5977953a7cb44b07ebdf13fce5d05e8762f8ac37331f434f0dd98d1f4b713fcfe284cbc6588c990972f8183b19e9adc8807c96f92048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
999edc5a73b29c8a5980ccc19ebe5d40

SHA1
e40248a1ee386258769b9e8d3eb985b9cb81e756

SHA256
404883c0b6c34888df7a23ecfad5df6350a9ab2e1615bfe4a1b5e614d0857461

SHA512
8f37ee46a6b2bd3e4cc9f1515f242c22242bab0a0b7f0a4e99ec2b64f8156f158053f4657c4dbc06b82d203ff7ed86db2a205539c70091e28a0d88dd6245a847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e7f2d797ed45a088677320c9ae0e83c3

SHA1
e2c21ba24f61e06cf71fd4fd835f50a451a80cbd

SHA256
15bae6f07ddd29fef482398bb4644df8fa549fa84d5f75ba1c3bbdbfd4507a63

SHA512
57d5b03eeb43a03016d30f4e111e324ad10846239e0f427409c004d6fa9e7531d1639110c9d32c8987a8d8bd1ecea8521c3db1bf5c9ca9b5f35e73694ec6bef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
aa3db81e5ed16930c40f0a83dd947008

SHA1
594657b7812f4eb6b515b885f6004c366f38d1cf

SHA256
becaf8dcc2fd6c3fade9787edc3848cc901fd0690a4b9e1dd29ca24e1449bd71

SHA512
faef7417672e0919285c95e480226b82d7272a5057ed8342557bd995631d5332f497b82ffd1f5577d37e8972ef4b30c6441974b2197df1dc19bb1a4cf907e4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
602ae8c83c9a29f2d5ef00b0a8cdc313

SHA1
70569c67e2e3d637b4cdaa316592a825b18aa248

SHA256
9eda3db489c609f2174e1c9a8089ed0a4c6a81155aae055af6a7f9822eedca8d

SHA512
74e8b082411a3fc561b8d66a94d1d0101bdc075178204d3ce7c195a3c9573b9fb8bd16024553c92725b9df3126685ad088c65c17831c09d83d3a799cf7ffc3a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b4eda239e05174c40f9c05d6365f41cf

SHA1
5913b8a824d74e140238ddd01ca2b34bf4f4ad35

SHA256
ec7f391211942a13c7c33a77e895b2be9f8d5be750c552ace0f33acc5c798a2b

SHA512
7433580a51d2aa33d4dfa3a2de389992cc5f8fa0faad2f5abe65f3e1a1663163679539e234e30618fed3f2914e73157a91ff8802fdb0bf0d75a39a4f06571f1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d4328a2aa456614facf1e414d88b7d87

SHA1
74d44e374f2b37e8eb72e5ed688a56018b494264

SHA256
79d752c2c2eed870e4f27488567e24524b79fccb91df60ca5ee6f4bcdee62863

SHA512
bfb0afc0da1f1fb4709721275295afe05c6ff427623e70f25f476a4bdcaa6b80a61af34e0e1c76bd144c248a51991039079ca35e42c37501e96b5f663eb6da0f

Download Submit
C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml

Filesize
752B

MD5
c0954b25426f039c365a4c6b61b01a67

SHA1
b65fb1b2b83db14cda8bd951b7e61bf83612e345

SHA256
881b0b516c9406907fbf05bb3c5113565b00a93890d7fcdc73d3e520eed96149

SHA512
eaac5567e2525bbbf6598f5fb5aafcf28d0d5617a29dd923cfae61a4d711bbed29edf0e2fb8a2b060ea3ff2d0f51e9848c4b88bde5ba1f2bf4afb767499bddef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\CommandLine.dll

Filesize
68KB

MD5
63771ea69fb18f3c872c18bfab994425

SHA1
114371b91bb3b62a2fc3608acd5e457f9f351903

SHA256
23239fd97b9da64055f408a0b4ae006de7ca689aa809fb14ba3e8961419d8ade

SHA512
38ff2811b78c036d336ebfb48085116df782c0dc7165d2d7910471a4e7d654c39e11fde060fdc1347e19588d795ea5a915ad018e4dee05a0e9589f6be6d98203

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\Newtonsoft.Json.dll

Filesize
692KB

MD5
98cbb64f074dc600b23a2ee1a0f46448

SHA1
c5e5ec666eeb51ec15d69d27685fe50148893e34

SHA256
7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13

SHA512
eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\OWInstaller.exe

Filesize
295KB

MD5
40d982d38f165dc15552a4fc356a7023

SHA1
b3bc6f533dcf68c785d8c2d6c5cef8c015c0cb8f

SHA256
164bb8681f7a01a7e5f12057bfe4cc1c1c299679a07e96788b4f59026ff0cc55

SHA512
f4f158e74b50b0e278c3f206f0943a1e98755e45d716e7412436adbbd068db2bb2ff47e3c6b2419f8dfea12b0ada674ad6b16d59e2928e6af4b324060cd30fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\OWInstaller.exe

Filesize
295KB

MD5
40d982d38f165dc15552a4fc356a7023

SHA1
b3bc6f533dcf68c785d8c2d6c5cef8c015c0cb8f

SHA256
164bb8681f7a01a7e5f12057bfe4cc1c1c299679a07e96788b4f59026ff0cc55

SHA512
f4f158e74b50b0e278c3f206f0943a1e98755e45d716e7412436adbbd068db2bb2ff47e3c6b2419f8dfea12b0ada674ad6b16d59e2928e6af4b324060cd30fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\OWInstaller.exe

Filesize
295KB

MD5
40d982d38f165dc15552a4fc356a7023

SHA1
b3bc6f533dcf68c785d8c2d6c5cef8c015c0cb8f

SHA256
164bb8681f7a01a7e5f12057bfe4cc1c1c299679a07e96788b4f59026ff0cc55

SHA512
f4f158e74b50b0e278c3f206f0943a1e98755e45d716e7412436adbbd068db2bb2ff47e3c6b2419f8dfea12b0ada674ad6b16d59e2928e6af4b324060cd30fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\OWinstaller.exe

Filesize
295KB

MD5
40d982d38f165dc15552a4fc356a7023

SHA1
b3bc6f533dcf68c785d8c2d6c5cef8c015c0cb8f

SHA256
164bb8681f7a01a7e5f12057bfe4cc1c1c299679a07e96788b4f59026ff0cc55

SHA512
f4f158e74b50b0e278c3f206f0943a1e98755e45d716e7412436adbbd068db2bb2ff47e3c6b2419f8dfea12b0ada674ad6b16d59e2928e6af4b324060cd30fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\OWinstaller.exe.config

Filesize
632B

MD5
82d22e4e19e27e306317513b9bfa70ff

SHA1
ff3c7dd06b7fff9c12b1beaf0ca32517710ac161

SHA256
272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827

SHA512
b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\OverWolf.Client.CommonUtils.dll

Filesize
620KB

MD5
dfb11acf32b36a7cf5da505b105fe710

SHA1
5df9d0747607fed0c0b90d5359a181ea0eb8abfd

SHA256
2150cd744e490469842d9d7087e0bba5ba3d5eb534358fd645a6331933b6acf5

SHA512
a769a9289c4609bc124296235bb7eb94f029243aae2466d33ada5c771342c7ca64bf8427f2f7473bdeb246b1814df694d6caa918d9f964512e661e6b24d0ba9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\OverWolf.Client.CommonUtils.dll

Filesize
620KB

MD5
dfb11acf32b36a7cf5da505b105fe710

SHA1
5df9d0747607fed0c0b90d5359a181ea0eb8abfd

SHA256
2150cd744e490469842d9d7087e0bba5ba3d5eb534358fd645a6331933b6acf5

SHA512
a769a9289c4609bc124296235bb7eb94f029243aae2466d33ada5c771342c7ca64bf8427f2f7473bdeb246b1814df694d6caa918d9f964512e661e6b24d0ba9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\OverWolf.Client.CommonUtils.dll

Filesize
620KB

MD5
dfb11acf32b36a7cf5da505b105fe710

SHA1
5df9d0747607fed0c0b90d5359a181ea0eb8abfd

SHA256
2150cd744e490469842d9d7087e0bba5ba3d5eb534358fd645a6331933b6acf5

SHA512
a769a9289c4609bc124296235bb7eb94f029243aae2466d33ada5c771342c7ca64bf8427f2f7473bdeb246b1814df694d6caa918d9f964512e661e6b24d0ba9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\SharpRaven.dll

Filesize
80KB

MD5
0eb30d22448e520d2deac31105263907

SHA1
056ecc0804c4c2d0cd80fac23f946747fc809c02

SHA256
f09e2797c0b98ea248e01330e0c77fb23189a18f2a6d7f22842087bbbb39f3ae

SHA512
c0264a0c5598b9a250dd281e7cf22bd880aa3882c63f9a07c590a27818108aec8b5909d2402e49ca9936a8bb8f4993e549ff011ca473ea1c8a760eb0bf249866

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\UserInfo.dll

Filesize
4KB

MD5
9301577ff4d229347fe33259b43ef3b2

SHA1
5e39eb4f99920005a4b2303c8089d77f589c133d

SHA256
090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc

SHA512
77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\images\icon.ico

Filesize
14KB

MD5
9a03fbfd56d8e501797359aac3d72ed1

SHA1
b31e87a87486c00f9266559707e2cae4831f9d44

SHA256
81c69b545c347e1708603fb912511d8eddf755cb27f37fdc6a6fd959c6cfb94e

SHA512
29eb96fe4bdded257f3330672b1f9f2086c28e1e863a093a6fb750b6e59210b47b5ed481e3828442f38c5c6d63ef37709716af1e3913afdf37bf8e574f976fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\index.html

Filesize
20KB

MD5
7afb3bf732af9ac2dcccd36f9c2a27b0

SHA1
6d445defdbee2080c610bbd88d4831f5952bbeac

SHA256
f859e096d14a095c67031a82c7ee58502ba1645c749b7b6b4ed74f2712698aeb

SHA512
263ae754b62e4fe2b045c6086e473d851e5e31980582bcd9d995118f3a5c826852529ded21a43c3ee1698e38038de23901669e294f6fdb673d7a8418c818fda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\app.js

Filesize
22KB

MD5
715d53e963a034a3721aee76d1c4e8f6

SHA1
4643837ab7d2249fbda6ed23d025ef738cfa6317

SHA256
5b8ab6d562e131159c89eebfc2f665a4a496c8621ef34efcabf7b0a9e1e85b1c

SHA512
15018563724d17dd22c38daa51c8208286f81e8eea6784ff70f46d81cb3385635b688ccd775734f0e4bfd086189c5db721f2bb76daee4e6d6aad02075e44dee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\block_inputs.js

Filesize
789B

MD5
b5b52c92b90f4283a761cb8a40860c75

SHA1
7212e7e566795017e179e7b9c9bf223b0cdb9ec2

SHA256
f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544

SHA512
16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\libs\cmp.bundle.js

Filesize
315KB

MD5
8c333e3c64d273fd5874a11907511850

SHA1
b6fe83cbf589e1a3c69d7a64e1ec8044abfb8bd9

SHA256
e75eed625035a09df3e1f1145ea44818176eaf66e357f86e44d9c8c7152eb8be

SHA512
7c1b1cfc29a2c5538f0f887671c80e7927d6f52a93c711c60a5e678be4e31ce50a7886877a45def4503b60699c0d328379c476caa88c298164073120f9ec4c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\libs\jquery-1.10.2.min.js

Filesize
90KB

MD5
44e3f0db3e4ab6fedc5758c05cf27591

SHA1
2d408aa1d35661019c95adcc60b78c0727ed25b4

SHA256
bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144

SHA512
4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\libs\mixpanel.js

Filesize
1KB

MD5
344e4265b3d4e1fecfd81c561293edab

SHA1
51dbcac23b839e64362d11763bbe64538ad80bb8

SHA256
88872b5b01a8d1dfee124333aba630ceb8535390130833dd2a312c461ac52217

SHA512
dcda17cb89861c4cd0be4b7cd93b58283cd1acc3c7a4a2176add3ea6403079c8567bcf88d878aa2e91e96c43b15a7ce668299c3d015c6dc4db5b15cddbe4ea7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\models\notifications.js

Filesize
5KB

MD5
85afdf9897bb1236eff3afa40d15ece6

SHA1
4362bdd139458eaf4a2dcb34294b43e2d53f4a26

SHA256
9dd03dfc92bcb74f3725aae60e904c0a56cc84f299bbb8e863a869719f6fdd32

SHA512
4ab86c6bafba18f53f01ca913ceaa80f14900107069a1d5f65b108d35690bd8b50b1a6cdf1563fc5775909f69208dabebd139f3cf3d8576269d560d57cf9994c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\utils\analytics.js

Filesize
4KB

MD5
f288498a7ad1ef51bcd3f3272a1809f7

SHA1
0a7bc52a557ae5cacb5ae7bddebefe0c1aec1ccf

SHA256
c76e5be6cf6513f988e69977a0fedea42fbc700a2e4ef7d136fdf72534ee8519

SHA512
7b2195ce7b6ff8f414ce43ee8cdbfc0660560b6802a2a6271b6a8eefd19d02810c200a51ea1e43269c18f70e5b749e7a515a6db7b8b8ffa7aeeca0a1cd32f057

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\utils\commands.js

Filesize
12KB

MD5
65015f2e2e490f6786abc0560e33e1d0

SHA1
47b5c2b3b1f9381e4d2b9d1f3d82ba62828ce28e

SHA256
e874c959c7b8e4351d730d263231df7176b5062580a7d3e0a2684001b510f5d7

SHA512
a4ad579acfa6000fd8074893a6b45df74558c57afd5b957217491784fa25df370c59d9f92ff245abbdf3d26b42114cc22359ef95c4baa322e326c7e210f43edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\utils\cookies.js

Filesize
1KB

MD5
6c60e675f8c8c68c0174b644d3a63a2a

SHA1
3635a3fe07ccc4a6f33a986ddb690522d0611abb

SHA256
9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287

SHA512
1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\utils\modal-events-delegate.js

Filesize
1KB

MD5
117e4fdbdb0ecf211c8bd909efd337d1

SHA1
9f8684d856b7c95bdffb139217dfd89f41373187

SHA256
267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857

SHA512
f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\utils\strings-loader.js

Filesize
5KB

MD5
9c94eb933d8a43dd3825e67a7e30c980

SHA1
7ec7b16af6f399219209ba5967d377040486a11b

SHA256
96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf

SHA512
a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\utils\utils.js

Filesize
118B

MD5
a0952ebeab701c05c75710c33d725e7e

SHA1
1da8a2e889f1213d481ae3cd5571670c01e64adc

SHA256
b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246

SHA512
5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\cri\cri-controller.js

Filesize
5KB

MD5
d222c95a2ef0b75ad6c96a3abe20fdc5

SHA1
641c39f92a169f0ca435ed12d2a4d276eb415642

SHA256
aafb56625ec30b24035baafff7bc20215e8ec7e4be4ea58a90aa5b46bdd14a6e

SHA512
e9e66abf6d95fc15a6ffe46cf85c3c9d3b80f3884ca4c8cbb5d2b024fa1dcc46a5e2f39041a4a120a8b8b881d07b3d70b18b552332180aa08c4a67577ea6242b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\cri\template.js

Filesize
1KB

MD5
76c1ef0cb437db144c2bed53a5a8a5d7

SHA1
aaab8fff649f8e46d1e9510018118ee9abe01498

SHA256
505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e

SHA512
822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js

Filesize
1KB

MD5
01878b1f0f27ba2af34f89c648f3e16f

SHA1
b45e04411d06052772b4645d1feb7a594b722067

SHA256
4c96454e5b0493676af666aa5716ba12209aa72fb30e8dbde8e85ab000a4350a

SHA512
5a7860c8df74ad9dd2eea3bd0927dbfa1fff1de7b9a093a6d727ecc2abb7139d721cbf76c55a7ade24ade5e08e6547321a62e3a1440eb202b7a8569305dfa782

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\finish-with-recommended-app\template.js

Filesize
681B

MD5
d1cb34b57cef7e28b9286454b197b712

SHA1
f3a964b319bab82d4eda07e126bbfd6dec35c349

SHA256
b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42

SHA512
3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\finish\finish-controller.js

Filesize
2KB

MD5
cbdfd75bb47bda0ae536b3d45958b615

SHA1
9a69d440e1d8ba1976b2880964f7041c46e8bdf9

SHA256
b4221b80fbbc4ef93b3a1f668d8a3445353db9f3e1ec77c9b6520a7312ac46f9

SHA512
e78272fcd6af8656cd054c91b97508603792dcc75c4f7a123880671ff6ed126e03cd19ec13d005f655e8281a1e90f6b190be650ddf07522fa613a940148dd475

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\finish\template.js

Filesize
1KB

MD5
f092de7ea66d8e920b345f38537fa35d

SHA1
82d107a409f18878307ae0cefe24074db64937c4

SHA256
b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f

SHA512
14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\main\main-controller.js

Filesize
11KB

MD5
15b665a5c915004e1aa7e9e11a710f7e

SHA1
7821924e42bb19d60c572ff80bbaaa04d7aaeefb

SHA256
84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653

SHA512
dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\main\template.js

Filesize
3KB

MD5
a118c7724c208f12083240cafccfd10b

SHA1
f89c676a215b869626737862a08c9eb07d440211

SHA256
63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc

SHA512
9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\modal\modal-controller.js

Filesize
2KB

MD5
995aa365976d4166ec6de5fe212b0255

SHA1
0d0e8c6aabfc8c967d5af224f66045314c0564b1

SHA256
cff5f7519eb05899df67ae1d79c9318ea344b068d95b565ae8dafacb70a1c52b

SHA512
71a51e34e92e2c478397e70ade9b33e39f4fb9a6da14f04a27997dfd9149978f4d90f0cb6d35e9ede116a2f6ed7f3c6f291383ef84d10994050893c1741f3de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\privacy\privacy-controller.js

Filesize
2KB

MD5
72aac0b210f16da255c03c34aac0085f

SHA1
29c8520309a209185f0e7b864fa240aaf8a0c441

SHA256
bdfa1535aecb73ea1de7c9443c5fcaea621cdd7b7f904e91df9bfff28c7f0939

SHA512
6c549011d3607a26697eaac6761650e9d47e126e2b96c8d563df539f1e9651b62ed7fec6de515dabf889fb354d0830ea4b5598f658788bf97420b7058d88a7a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\privacy\template.js

Filesize
655B

MD5
cf8d2c26520d7c84e560dfa79e31dcd3

SHA1
716f2ec17480d5cc9c145bc147833fbfc39d36f0

SHA256
95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8

SHA512
d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\progress\progress-1-controller.js

Filesize
2KB

MD5
4bc723bda9cc718301f2533ca3196768

SHA1
7f78b74746762fd5007ea3fbce45349bb0ef7901

SHA256
164bbdea64ca671a04b91747191227a89992a34159f1578a2cbf0e16398af1ec

SHA512
920f898d1592ae8d713410ac3fb43e9d490d567f2bb70b8f8d2958a0899fb8bf6a0a735db63a8eb3e1bf2cb02be70354a0f7b92d12584b1ecbde2d5ec19f9a53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\progress\template.js

Filesize
242B

MD5
92b145e6649ba0add3dee9a69d3fa91e

SHA1
4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d

SHA256
a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab

SHA512
747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\settings\settings-controller.js

Filesize
7KB

MD5
d5b078d14441970b9dc9c692039ec4f3

SHA1
053370e440da1bf11d8704bbe2ebea20f2968d6c

SHA256
b236b9276dcc8efe75c2e6118f2acac73bd231df729581d6360462b007ddf295

SHA512
eb67d7a4ad34efd2955cb9d26895e553f7f035a7a506bf952e70e44b66f8419fa9a404563c0464bcd13bbe06dbcf5d99505931d9fadeb43840fce36bcb282f1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\settings\template.js

Filesize
4KB

MD5
28513de0830383a516028e4a6e7585a0

SHA1
d31fc3a6f4a3ce6c4afb82ff2342a1ed718809e5

SHA256
8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f

SHA512
0f7321c2ae13145bb694368dae1b74e6fe20e6b09712da2178bc46e6aa65223ab84c38abbf0ed074c85b42dba1a238a5f3f8d1ae060a0af6df748c5befe11b61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\welcome\template.js

Filesize
1KB

MD5
17f54fca6723b983875d940d931e0afb

SHA1
01774cd5cea36bd74c80a708d6f77567e8091024

SHA256
42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb

SHA512
401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\js\windows\welcome\welcome-controller.js

Filesize
2KB

MD5
6127f0a4ee214776271ea6fce1fb58e9

SHA1
378cd32ccf043889de731fce6d96b6c21632a165

SHA256
aa42af897b154c05a5a5bdf5c9420e698bc943cf1a6fcd830aae7c5b8317f654

SHA512
f2b35ced730fb95b64dd72be81345788d1fb66d38f26f2ddeb205cbecfc767703a12c455d2bb8ba1dbada1a409e123aaf020a822321b8ad80947e67c53e83a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\app\manifest.json

Filesize
691B

MD5
ea73cd3a4b796023c0354084fb322af6

SHA1
b525722be86b5fb722e870c310e884d5f711098a

SHA256
3ecc4987f6f3217a8bddc5f2441eb8d5e52edd75c99f23c811bf50017acfd07c

SHA512
19b7811903492a0b36851b0e7e303bf086b0d588a7034b7716e958a60b60f01dbf602dabfee4acdf94ba5d3600ccc87a7414f105250a80126bff4b5829043053

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\log4net.dll

Filesize
270KB

MD5
f15c8a9e2876568b3910189b2d493706

SHA1
32634db97e7c1705286cb1ac5ce20bc4e0ec17af

SHA256
ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309

SHA512
805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\uac.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\uac.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\uac.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\utils.dll

Filesize
55KB

MD5
aad3f2ecc74ddf65e84dcb62cf6a77cd

SHA1
1e153e0f4d7258cae75847dba32d0321864cf089

SHA256
1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8

SHA512
8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883C.tmp\utils.dll

Filesize
55KB

MD5
aad3f2ecc74ddf65e84dcb62cf6a77cd

SHA1
1e153e0f4d7258cae75847dba32d0321864cf089

SHA256
1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8

SHA512
8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\CommandLine.dll

Filesize
68KB

MD5
63771ea69fb18f3c872c18bfab994425

SHA1
114371b91bb3b62a2fc3608acd5e457f9f351903

SHA256
23239fd97b9da64055f408a0b4ae006de7ca689aa809fb14ba3e8961419d8ade

SHA512
38ff2811b78c036d336ebfb48085116df782c0dc7165d2d7910471a4e7d654c39e11fde060fdc1347e19588d795ea5a915ad018e4dee05a0e9589f6be6d98203

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\DotNetZip.dll

Filesize
64KB

MD5
1457a0dbb9b0d0783f80e942c04802a5

SHA1
acf1f544e22d3d2d702e85ad514464e244338917

SHA256
e95de904fef85fb5b492989faa1760a5bf6f690c27ebb70953e4f6c37fd3c6d6

SHA512
4ac5e9b202cc07a13444ff01e9cf0cdeba92bedd76907fb22c6a43313c075dc3ea2b79e38b437a4c815e146137f3399045e6f1167a6efbf7f28904480ca119e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\Microsoft.Win32.TaskScheduler.dll

Filesize
124KB

MD5
aa5ebff82cef6ef1a15c468e6055356f

SHA1
d7d106c0488707d4ffd52f5d07c3936031f670f9

SHA256
7f47038a76ee0d39498299decabd203a45991a0d8d03b63ec588108dd50678aa

SHA512
d576dc6eabc373f9f47b162becef4843f6f98747c7323edfa36e92aa4f134ca31971d6e8c0ea43d1e0be6dbf58d4e04ae40315c341846fc46ff8a4b559f81629

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\Newtonsoft.Json.dll

Filesize
233KB

MD5
f3dc6221941daf5b01bd7fc8be45d337

SHA1
48b4fdbf4e14719d5e99de1dee1afe6b54aebf7f

SHA256
65e01c4feb1852ad0b2f9e12958fb708bf6d4da58f01ca71620b43ea6549edfd

SHA512
9b80e9a6580ee34ceaded694deb4d4e5e9339eb28144bf262e04a8fd75a864236438c33d9c8a3c3719083f3c7480a460dea1cef1ec8bfd74ede995f35d9dd793

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\OverWolf.Client.CommonUtils.dll

Filesize
620KB

MD5
dfb11acf32b36a7cf5da505b105fe710

SHA1
5df9d0747607fed0c0b90d5359a181ea0eb8abfd

SHA256
2150cd744e490469842d9d7087e0bba5ba3d5eb534358fd645a6331933b6acf5

SHA512
a769a9289c4609bc124296235bb7eb94f029243aae2466d33ada5c771342c7ca64bf8427f2f7473bdeb246b1814df694d6caa918d9f964512e661e6b24d0ba9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\SharpRaven.dll

Filesize
80KB

MD5
0eb30d22448e520d2deac31105263907

SHA1
056ecc0804c4c2d0cd80fac23f946747fc809c02

SHA256
f09e2797c0b98ea248e01330e0c77fb23189a18f2a6d7f22842087bbbb39f3ae

SHA512
c0264a0c5598b9a250dd281e7cf22bd880aa3882c63f9a07c590a27818108aec8b5909d2402e49ca9936a8bb8f4993e549ff011ca473ea1c8a760eb0bf249866

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\UserInfo.dll

Filesize
4KB

MD5
9301577ff4d229347fe33259b43ef3b2

SHA1
5e39eb4f99920005a4b2303c8089d77f589c133d

SHA256
090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc

SHA512
77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\log4net.dll

Filesize
270KB

MD5
f15c8a9e2876568b3910189b2d493706

SHA1
32634db97e7c1705286cb1ac5ce20bc4e0ec17af

SHA256
ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309

SHA512
805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\nsis7z64.dll

Filesize
514KB

MD5
284c46af1fd2ec3a60ee0c28f276f2a4

SHA1
4d4d41c0af12d928e4e553ab6b80e6b4ab8007bc

SHA256
2368be6d8b21e0047146d3f61f90966a71d0737eed0146bc692b59f3cac97793

SHA512
ca9e4ef79c9c7c5f2282ddeee34ec39a51cddf26dcad4e9f2e42230499b0b898ac2dfd33f25438aa995741d23037fa01a0269823c283b234ecec0f155d3c05ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmC80F.tmp\websocket-sharp.dll

Filesize
267KB

MD5
185124e74ea79b3f17c88a64c8a4bf3f

SHA1
1ba175ffaebc756e85afcc628e95dda820c64063

SHA256
a5414e1865f092496509477d2adf12268c52716786839eb90ab778dc99019324

SHA512
614196942b433c051baeeec7dc5cd99ec45879efc4792869c68315d026139408ad1c0a0c7a5f6557c82a2dbf0e886435780f69b18554734dbf23eeef530a0e4a

Download Submit
C:\Users\Admin\Downloads\Hone - Installer.exe

Filesize
2.0MB

MD5
7416db3fea4feab2f105e4ebe57f8285

SHA1
68b3ca1f87aac9cba1c390839bb036ec58219ce9

SHA256
3dc62303151c1ab0e119816749c902bd3c0af2f9f54a5134c675ee9ff912f90b

SHA512
ed7e23535bf057e95d4dc71419785e2fe5a2b227754073fdf770abdf19c22bee51cbc3bf42fe046417187760cc56bd730ed9bde5bc473a84afc46c5a71462679

Download Submit
memory/2216-331-0x000001FDB3250000-0x000001FDB3251000-memory.dmp

Filesize
4KB

Download
memory/2216-321-0x000001FDB3250000-0x000001FDB3251000-memory.dmp

Filesize
4KB

Download
memory/2216-323-0x000001FDB3250000-0x000001FDB3251000-memory.dmp

Filesize
4KB

Download
memory/2216-322-0x000001FDB3250000-0x000001FDB3251000-memory.dmp

Filesize
4KB

Download
memory/2216-333-0x000001FDB3250000-0x000001FDB3251000-memory.dmp

Filesize
4KB

Download
memory/2216-332-0x000001FDB3250000-0x000001FDB3251000-memory.dmp

Filesize
4KB

Download
memory/2216-330-0x000001FDB3250000-0x000001FDB3251000-memory.dmp

Filesize
4KB

Download
memory/2216-329-0x000001FDB3250000-0x000001FDB3251000-memory.dmp

Filesize
4KB

Download
memory/2216-328-0x000001FDB3250000-0x000001FDB3251000-memory.dmp

Filesize
4KB

Download
memory/2216-327-0x000001FDB3250000-0x000001FDB3251000-memory.dmp

Filesize
4KB

Download
memory/4668-681-0x00007FFC95C10000-0x00007FFC966D1000-memory.dmp

Filesize
10.8MB

Download
memory/4668-682-0x00000274EFED0000-0x00000274EFEE0000-memory.dmp

Filesize
64KB

Download
memory/4668-709-0x00007FFC95C10000-0x00007FFC966D1000-memory.dmp

Filesize
10.8MB

Download
memory/4668-702-0x00000274EFED0000-0x00000274EFEE0000-memory.dmp

Filesize
64KB

Download
memory/4668-704-0x00000274EFED0000-0x00000274EFEE0000-memory.dmp

Filesize
64KB

Download
memory/4668-701-0x00000274EFED0000-0x00000274EFEE0000-memory.dmp

Filesize
64KB

Download
memory/5036-136-0x000001E2EAD20000-0x000001E2EB248000-memory.dmp

Filesize
5.2MB

Download
memory/5036-135-0x00007FFC98530000-0x00007FFC98FF1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-143-0x000001E2EA7B0000-0x000001E2EA7C8000-memory.dmp

Filesize
96KB

Download
memory/5036-153-0x000001E2EAB90000-0x000001E2EAC40000-memory.dmp

Filesize
704KB

Download
memory/5036-137-0x000001E2EA9B0000-0x000001E2EA9C0000-memory.dmp

Filesize
64KB

Download
memory/5036-132-0x000001E2EA710000-0x000001E2EA7AE000-memory.dmp

Filesize
632KB

Download
memory/5036-213-0x00007FFC98530000-0x00007FFC98FF1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-139-0x000001E2D1FB0000-0x000001E2D1FF6000-memory.dmp

Filesize
280KB

Download
memory/5036-134-0x000001E2D0660000-0x000001E2D0674000-memory.dmp

Filesize
80KB

Download
memory/5036-212-0x000001EAEF0E0000-0x000001EAEF886000-memory.dmp

Filesize
7.6MB

Download
memory/5036-128-0x000001E2D0250000-0x000001E2D029C000-memory.dmp

Filesize
304KB

Download
memory/5036-172-0x000001E2EAAE0000-0x000001E2EAB02000-memory.dmp

Filesize
136KB

Download
memory/5036-175-0x000001E2EA9B0000-0x000001E2EA9C0000-memory.dmp

Filesize
64KB

Download
memory/5036-176-0x000001E2EA9B0000-0x000001E2EA9C0000-memory.dmp

Filesize
64KB

Download