hxxps://thunderstore[.]io/

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://thunderstore.io/

Score

7^/10

persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00090000000234d7-1093.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	OWinstaller.exe

Executes dropped EXE 6 IoCs

pid	Process
5820	Thunderstore Mod Manager - Installer.exe
3340	OWinstaller.exe
2556	Thunderstore Mod Manager - Installer.exe
5936	OWinstaller.exe
5776	Thunderstore Mod Manager - Installer.exe
5112	OWinstaller.exe

Loads dropped DLL 33 IoCs

pid	Process
5820	Thunderstore Mod Manager - Installer.exe
5820	Thunderstore Mod Manager - Installer.exe
5820	Thunderstore Mod Manager - Installer.exe
5820	Thunderstore Mod Manager - Installer.exe
5820	Thunderstore Mod Manager - Installer.exe
5820	Thunderstore Mod Manager - Installer.exe
5820	Thunderstore Mod Manager - Installer.exe
3340	OWinstaller.exe
3340	OWinstaller.exe
3340	OWinstaller.exe
3340	OWinstaller.exe
2556	Thunderstore Mod Manager - Installer.exe
2556	Thunderstore Mod Manager - Installer.exe
2556	Thunderstore Mod Manager - Installer.exe
2556	Thunderstore Mod Manager - Installer.exe
2556	Thunderstore Mod Manager - Installer.exe
2556	Thunderstore Mod Manager - Installer.exe
2556	Thunderstore Mod Manager - Installer.exe
5936	OWinstaller.exe
5936	OWinstaller.exe
5936	OWinstaller.exe
5936	OWinstaller.exe
5776	Thunderstore Mod Manager - Installer.exe
5776	Thunderstore Mod Manager - Installer.exe
5776	Thunderstore Mod Manager - Installer.exe
5776	Thunderstore Mod Manager - Installer.exe
5776	Thunderstore Mod Manager - Installer.exe
5776	Thunderstore Mod Manager - Installer.exe
5776	Thunderstore Mod Manager - Installer.exe
5112	OWinstaller.exe
5112	OWinstaller.exe
5112	OWinstaller.exe
5112	OWinstaller.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\System32\\dxdiagn.dll"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	DxDiag.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000234d7-1093.dat	upx

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DxDiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DxDiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DxDiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	DxDiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2080292272-204036150-2159171770-1000\{F3504F10-0A9B-4967-BDD9-F310C658BA63}	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\System32\\dxdiagn.dll"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	DxDiag.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 856126.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4796	msedge.exe
4796	msedge.exe
3228	identity_helper.exe
3228	identity_helper.exe
5616	msedge.exe
5616	msedge.exe
3340	OWinstaller.exe
3340	OWinstaller.exe
1016	DxDiag.exe
1016	DxDiag.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	OWinstaller.exe
Token: SeDebugPrivilege	3452	taskmgr.exe
Token: SeSystemProfilePrivilege	3452	taskmgr.exe
Token: SeCreateGlobalPrivilege	3452	taskmgr.exe
Token: SeDebugPrivilege	5936	OWinstaller.exe
Token: SeDebugPrivilege	5112	OWinstaller.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe
3452	taskmgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3340	OWinstaller.exe
3340	OWinstaller.exe
3340	OWinstaller.exe
1016	DxDiag.exe
5936	OWinstaller.exe
5936	OWinstaller.exe
5936	OWinstaller.exe
5112	OWinstaller.exe
5112	OWinstaller.exe
5112	OWinstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4068	4796	msedge.exe	81
PID 4796 wrote to memory of 4068	4796	msedge.exe	81
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4412	4796	msedge.exe	83
PID 4796 wrote to memory of 4736	4796	msedge.exe	84
PID 4796 wrote to memory of 4736	4796	msedge.exe	84
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85
PID 4796 wrote to memory of 3540	4796	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://thunderstore.io/
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd15c846f8,0x7ffd15c84708,0x7ffd15c84718
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,7314684747832071143,5472415731199183744,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:5668
- C:\Users\Admin\Downloads\Thunderstore Mod Manager - Installer.exe
  "C:\Users\Admin\Downloads\Thunderstore Mod Manager - Installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5820
- - C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\OWinstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\OWinstaller.exe" Sel=1&Extension=ahpflogoookodlegojjphcjpjaejgghjnfcdjdmi&Name=Thunderstore%20Mod%20Manager&UtmSource=web_app_store&Referer=www.overwolf.com&Browser=microsoftedge -partnerCustomizationLevel 0 -exepath C:\Users\Admin\Downloads\Thunderstore Mod Manager - Installer.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3340
  - - C:\Windows\System32\DxDiag.exe
      "C:\Windows\System32\DxDiag.exe" /tC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.txt
      4⤵
      Registers COM server for autorun
      Drops file in System32 directory
      Checks SCSI registry key(s)
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5640

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3452

C:\Users\Admin\Downloads\Thunderstore Mod Manager - Installer.exe
"C:\Users\Admin\Downloads\Thunderstore Mod Manager - Installer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556
- C:\Users\Admin\AppData\Local\Temp\nsoE5B9.tmp\OWinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsoE5B9.tmp\OWinstaller.exe" Sel=1&Extension=ahpflogoookodlegojjphcjpjaejgghjnfcdjdmi&Name=Thunderstore%20Mod%20Manager&UtmSource=web_app_store&Referer=www.overwolf.com&Browser=microsoftedge -partnerCustomizationLevel 0 -exepath C:\Users\Admin\Downloads\Thunderstore Mod Manager - Installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5936

C:\Users\Admin\Downloads\Thunderstore Mod Manager - Installer.exe
"C:\Users\Admin\Downloads\Thunderstore Mod Manager - Installer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5776
- C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\OWinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\OWinstaller.exe" Sel=1&Extension=ahpflogoookodlegojjphcjpjaejgghjnfcdjdmi&Name=Thunderstore%20Mod%20Manager&UtmSource=web_app_store&Referer=www.overwolf.com&Browser=microsoftedge -partnerCustomizationLevel 0 -exepath C:\Users\Admin\Downloads\Thunderstore Mod Manager - Installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14bd152a-49e6-4815-97cb-6244f1356ea7.tmp

Filesize
6KB

MD5
0ec3c67ccf2b363b454756409eb2e6e0

SHA1
150545b11e100789d81a37d72801ec3db56e8496

SHA256
e55c530d28da127bdebfeac317b7092379232179791ff3731f29447e0bed64cf

SHA512
6bc7fcfa8ee23663366d07d3ae929114935087844a69a5e70459497368a5844a7c7116e6de3dfca4cacfe2619d587eddc87bd8f00b856dab40f073eb3efc58f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
0fa780a480b5fcd3cdf2fc1722452c21

SHA1
9db85ff771e1e4b47186f65f26824bb529987253

SHA256
6633548dc7513ef7185506a61f751e70a58fe39ffedebc2d274455ad1cdb06b0

SHA512
b2bae856ab93599af57d72606d9e948f4329ae2ff6c60439f7c8a8276060d7b202776a2b1a934987fdd902fd15e5218f6fda153767e9160fcd3599d116c419b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
1d2a29cd370a5520afa268eb8947086f

SHA1
077bdef5b251696af1c7a335737ce3ad54514d13

SHA256
19a7ffb4b8b0d20d632f5d50a0114155b1176e2151884d1efc52684b626ae7be

SHA512
cf5bb417e25462cd4a051f28b1f1de012e6c8d5c99835a34c762d7a6e32ed52dcb14b10f89340e20e3c24452afae4d817cbcba98dffae7939cb58406d5f80734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
358e4ae28b29ee4a0434684d2cf36f86

SHA1
fc16b939c4ab4da8b0787ea97e2fd53a1bb072e6

SHA256
f02c891f132d4aeaf49c2040995a64a4f6c24562c79fc48f57a8aa78c062005c

SHA512
819f89f8beb828b26b61af02cd87f9398a4481488f07e0a565f6442dcd2077faf17b3e2211174d7bf50973252ea7da93c0d1e5ca42402c7bda79c783b60abc87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
25240301f2545e648f2c06c3228e7236

SHA1
4708fc7b4d5bc508c6949cb10ccc78ad69fbb512

SHA256
b6b2754e161556bd95a02587c4f94caaf1782155aed196e2ef16c865ddba46bd

SHA512
07b83899019b7b40083339b0507f61724215d6b2e32c2d83db560474cdc0c5abbf9e39c4f317c80c57b18ea287b6765f76db1988bd122baed1b7fb1ba2e6ccbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
68a8bc6aeb5bc59e00ceca6069dacc2e

SHA1
0c2c6eb72b3b37e00302959969f7404aa4664e1f

SHA256
fea87bf4bcaea49b81b03777231a6632e7e2a2fa8f6e2f62434a08317e6425f0

SHA512
2c2924e8d771218bae5e9efc25c70679010f9a109bd14e711a37bb5ab2a338d3b515ca312d10eba36e782324f1cbbadd8f6cd2a25f46c1691cdf596dcd4d0c62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
09f7720dd60e23a4e9933316e6409c4c

SHA1
6a53c1d1d35937718a74145404c54133ae1f1a6b

SHA256
585a2dec3026b46aeb47a9e8848d6e90e77a84021eea9201806a50ac6f363532

SHA512
2b89cfb858fc79437a1fd6e97ab84c9fc81499d10028b533a065c8fb6fe2e08d94e32853a50bf248ace5169c760f14b553205be3e869545f5c845ce788d82dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b695dcdbcf38aa03b0a3cb3760ad02f8

SHA1
42ad63b8a8789ba9db8d7668aaca5c93d24ca7ea

SHA256
38f9dec85108c55af02c50cbce36ef9830ba683c4bd0f4612e75d8896787c099

SHA512
ed94e600afd6ae6de35b884f9cae4cc51fbad6f6cf7b69924f7bdba353f04ca2e23842831c0048da7ca6d03205d64fd10f8bc424d1938cda3a20895c6d55cefc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
97ab4cc1c298b8cb7d67f29557260d9c

SHA1
03b470e13aece5ab32376be3489ff43e800e4b0b

SHA256
7964ddbb50a4b914af01e3f3bd54c8a0513dd935c86cee090862bb3221baa5e7

SHA512
a822073ceec0e6b360ac1f80ea5d925fb21899ee707d700023d8e0fd22d4eb5481e430be24e446c12cceaad495a49a51c657e0a3223f9f084a738f30e0afdb0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c246.TMP

Filesize
705B

MD5
e025b2388df5069c190496f2365f197b

SHA1
e148d629d8e0e2f2cc2ee13811df550296e3b315

SHA256
293b8ca7605c432d968f82c889bc89a75a7b0b9114e8ad807ef737f3bc259024

SHA512
bfe33652f7a114157c0e42b54c8fc240774cb77d1a0238a2588e7ba3614ea433b3b3f43d0f1a96318a85671590cbf2e229f056dfca4ae4478f550a451df18413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b23eed90b23f2497a09358b6b1916c96

SHA1
75b91b9dd3e24c66112032e227beccf47b1c552d

SHA256
303613bdedfd0060d122c069fbfeef6704d6dd7ee4fa91e6e8c7f011cd4bf0e0

SHA512
d5901bfa2df9d7e462bd30217d436dfe60627525334603637663c1739be0b99960ab47d542d90a2b31f59abe548a989ee5290e91cf1df9e247b7cbc944ff626d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1487fe947f0cb455505d81f931fd336

SHA1
e470e745fe7d0a80643e871bd1ac630601aa4652

SHA256
c94d2f7fde4188d881465746254bb3ec23b29db30a0ff9ccb0673d4b74a13d85

SHA512
3f1fbd4cc72e23d5dad9a471c0cd298c21595697f582af6e209378ac7303277aec8759cad671dfe2e7f14c392d9e4698a3256f0cdfec79ee28b54cbb1b76a4ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
00980766374b8ac65808ab14fb7b03e5

SHA1
38a87ffda7332bf884720ed23233f3b89bb467ae

SHA256
85e23d531bf739d36f0ae5aefd1e9df7627bf84cb1bbfe7803e371b2ecf43d4f

SHA512
6ba135f9435b37c3944a82df575cc64786d2e1c63bfc5aa38f980727f43347902575207530d25256010fcdbc7489f2a5f51b46a21a1f78cb9f4677de10f1d084

Download Submit
C:\Users\Admin\AppData\Local\Overwolf\Log\InstallerTrace_2024-06-12_05-03_3340.log

Filesize
737B

MD5
3e455535f0d2cc79019df4fe975dd09e

SHA1
72e07f4a80e666c6e683b6b647a79dd835b8408c

SHA256
e0eb78034959e7855d00fcbb4d113de09cd30fc3c15fe89e6a6716f937cd80e3

SHA512
e434e5e5185f0f39f27ca46c176dd4c508ce7e997308faccb5be4e64956898a4ae683a9fffb973996b391fe22e12dfb952f441367126822aa7300a716b04968e

Download Submit
C:\Users\Admin\AppData\Local\Overwolf\Log\InstallerTrace_2024-06-12_05-04_5112.log

Filesize
737B

MD5
8866f9c811a91d0e7fe89ae0a96f5136

SHA1
5fb8fe51cd3d3927538475f54ccb2e333289f9a2

SHA256
f30e36d08e059e95b45ded161093cabbd7960152ee399c4799d5918e455799c4

SHA512
3940941be4a546ace21da00f45de880639bc20ba71ffe9e76af6132f4cabf6b8471d20f610960f9511eb6e4e55c950c6f71d4d02830432fa389eb6c07471ba94

Download Submit
C:\Users\Admin\AppData\Local\Overwolf\OWInstall.log

Filesize
18B

MD5
07e605d2d7609cf336ea1708e86b5a0c

SHA1
e7454461893e305ecdb72556e16e001617d718f9

SHA256
c69ad6c6a1d6d89336e18db86a6c852ab60c0ceb367c79922807e55de7be49dd

SHA512
5a8933d0b2e3441b6cc6e1881bd513d0f5fec939f0108b46d3578a6315283d44af65b60329e5cd528bac308dd21f1ea71daa618a9553a06b77ccba278d23496d

Download Submit
C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml

Filesize
752B

MD5
d0818f77eb44e6dcd1a4ba2ecad07558

SHA1
8c827b1691eb57facf0af5e0eaf1a91d44e1197c

SHA256
9a980715ba48c89b8350ea26483ad98e52d488a2ea907495561cee8483a886e1

SHA512
0ef0b2ccc901a7e5fccba48be7b023749cd874884bb2c3e495a0e8e103e175b71b83f076c81f9a260efc5eafb642e25fe737edb164fa46c409dc169823fa6a40

Download Submit
C:\Users\Admin\AppData\Local\Overwolf\Settings\bak\SettingsPageBasic.xml.bak

Filesize
807B

MD5
5bfece34f30e17591b9ae650c1f8b1c6

SHA1
fbfa37a54cdcbd60a7b3181d5c9f5fe201eba1dc

SHA256
0d16af9adbc843b92a4eef31171cfa8f0d4c64741ec8e5aff99c35a0bed68886

SHA512
d3df0e47f0183cf52d018d9ca802a18bbabfb19441f8928b1e50795a2c5aa4078440589638b6ab5d70064bca5db50e78cd3ee77a72cae3235b9a9dd08b5dc0a2

Download Submit
C:\Users\Admin\AppData\Local\Overwolf\Temp\7cf5ec8bd7e74fffbee43f0799d84575

Filesize
86KB

MD5
831efc4a0b53d83856fbf897e8ab33c7

SHA1
ea700f8352411aa7457219f92df0a430d15bfcc1

SHA256
1918a1200822161edf04301bd58acbf3d40f46c8490d68c8a526d415ddfba4a8

SHA512
4defae328db9e62d397e484bd0763f64335c90ec3164e17eea9f53804bd48d5fd89d44fc898baf64dd1b49d9a2c7bb72a4d5b80506e2cf24576e2353c92cade8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\CommandLine.dll

Filesize
68KB

MD5
1d859391711a062c5f48212686505a6a

SHA1
06db312b20ebfd24e1dd1f729d8ee8dba761c8f6

SHA256
cee8683c16cc43a542cfa1490894f555857eaf031fcdfb1ed7059e1538e21c8a

SHA512
340224199c171c3d5b9f06d4a9e6159bc7dab79a58324cffbe7f86857b1eef49e5f9d022b4ec907f9475aba334029ccdf06b8b05ec67b197a9c15809cd8ff7a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\INetC.dll

Filesize
24KB

MD5
640bff73a5f8e37b202d911e4749b2e9

SHA1
9588dd7561ab7de3bca392b084bec91f3521c879

SHA256
c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

SHA512
39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\Newtonsoft.Json.dll

Filesize
692KB

MD5
98cbb64f074dc600b23a2ee1a0f46448

SHA1
c5e5ec666eeb51ec15d69d27685fe50148893e34

SHA256
7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13

SHA512
eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\OWInstaller.exe

Filesize
298KB

MD5
ae8104779326bcdcd3351ccd909ef70f

SHA1
589cfd614e2ff8340769251d7edcb62b39735d63

SHA256
c1b2f28d8391fd1424a4c54b77e20cfe72fb0443dc495060f313d1d550ff3c81

SHA512
252ccf95e6eb787dfe5672f8a1494096582f33060c1bee2312a701de0d908cf93ec9bbb225e80dbe2679cf0e8f48f68401b9f252399d9dd2ea389dfd85fe0b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\OWinstaller.exe.config

Filesize
632B

MD5
82d22e4e19e27e306317513b9bfa70ff

SHA1
ff3c7dd06b7fff9c12b1beaf0ca32517710ac161

SHA256
272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827

SHA512
b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\OverWolf.Client.CommonUtils.dll

Filesize
645KB

MD5
6a45b1f51b619ba08761fc91567bf0a7

SHA1
4c29b1915dbc859ec462d13bfca7f77a9985133c

SHA256
4ad3ecd0591f8dad217d5d99e11d809cc699c28f55296845148254f6fce69828

SHA512
8fd3c507338bee22af8a74922e1deb28e928734f208cea667bd12e434ec23636c77ccc4d33e9d7c9fefb87715dbe6dfaf75011c3a01619a5050656aad85a3419

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\SharpRaven.dll

Filesize
80KB

MD5
8f6ff3176e7f0b58b033b3d3f1303db3

SHA1
dc21231170a74f459e45d81fa7dba15e0c6fe2c9

SHA256
0ea20361a01f8fc8eab21ab5613e77d36a3506793d4487438c314daf86e90630

SHA512
a0a3b3548983d15936b8517c2b5d5fa624b902522ab067ad552bedbd361c3192fc2cae889da0f8c986cfd295cccbbaa91596f478154c42f1a1cafbbc7eff86b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\UserInfo.dll

Filesize
4KB

MD5
9301577ff4d229347fe33259b43ef3b2

SHA1
5e39eb4f99920005a4b2303c8089d77f589c133d

SHA256
090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc

SHA512
77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\images\icon.ico

Filesize
10KB

MD5
b48ea7b5eab0cb7d27b0441ffee2eba2

SHA1
2d457a40e376b73dc332c74b3a1b9af920b06a4e

SHA256
ab6c2f416a0a8f5a23d43c7d1e58c00fab46c039ab29192b80c90633e2746b2e

SHA512
94f1e3e6e616d184b757b35f4d68619da3127c1ae387947c8436988de58f70f08aa299f5c42cb087c5761c9df92703889b44f88d4d96aac004ca696190af46c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\index.html

Filesize
20KB

MD5
c7b752acf6d1e10f3aca2c67b1ccf4d3

SHA1
ab793cb43e0c2b5af0fdcbf90d0d29d5d3e164f7

SHA256
69b9f99f6611f953d94984ac35bdaf9e9817f689e1e3614976bebe3465c613fc

SHA512
120addd79b7ade4f35b426c02631c8167d81080fde30a01b989453113f7547784e525d53bede41ede0c9b3caca8513060753ba51f75bf6936d32ee597d642576

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\block_inputs.js

Filesize
789B

MD5
b5b52c92b90f4283a761cb8a40860c75

SHA1
7212e7e566795017e179e7b9c9bf223b0cdb9ec2

SHA256
f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544

SHA512
16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\libs\cmp.bundle.js

Filesize
324KB

MD5
1de143ca1babd3c02744f478c8c05c5f

SHA1
ac918b3d2d5f9cbd9e3b3f5e075ce3c96eec16b3

SHA256
7fbc3a088ec303143109e0c1b2c04f4c5a6e450a2d6f3071fefb66e92f643ea0

SHA512
6e419e11f35a3258124127970961907ed8fe0619f618a4c15542ee7f8a01a9f4a7af4d290b634444d21b823ca1afea65f97d5788fff6665d55c2231214edff24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\libs\jquery-1.10.2.min.js

Filesize
90KB

MD5
44e3f0db3e4ab6fedc5758c05cf27591

SHA1
2d408aa1d35661019c95adcc60b78c0727ed25b4

SHA256
bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144

SHA512
4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\models\notifications.js

Filesize
5KB

MD5
85afdf9897bb1236eff3afa40d15ece6

SHA1
4362bdd139458eaf4a2dcb34294b43e2d53f4a26

SHA256
9dd03dfc92bcb74f3725aae60e904c0a56cc84f299bbb8e863a869719f6fdd32

SHA512
4ab86c6bafba18f53f01ca913ceaa80f14900107069a1d5f65b108d35690bd8b50b1a6cdf1563fc5775909f69208dabebd139f3cf3d8576269d560d57cf9994c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\utils\analytics.js

Filesize
4KB

MD5
525281e9959af4c1c0d11b9243c798a1

SHA1
237a84c5b57bd132f48446d718b20640cb28c263

SHA256
c37f0699cf8ba7d9e3e0f73f1b2af65f4bdc2a31f44594ffc8c73e98b6c2fd1d

SHA512
fe5bafda7773e69c65dd63270e0306abcd39cb2d886b675ab8c714ae0833efde963b69623d468551a1ab37f1db1a1d457f1568f7a29d9cf0bb23bb0edcab5fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\utils\commands.js

Filesize
12KB

MD5
65015f2e2e490f6786abc0560e33e1d0

SHA1
47b5c2b3b1f9381e4d2b9d1f3d82ba62828ce28e

SHA256
e874c959c7b8e4351d730d263231df7176b5062580a7d3e0a2684001b510f5d7

SHA512
a4ad579acfa6000fd8074893a6b45df74558c57afd5b957217491784fa25df370c59d9f92ff245abbdf3d26b42114cc22359ef95c4baa322e326c7e210f43edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\utils\cookies.js

Filesize
1KB

MD5
6c60e675f8c8c68c0174b644d3a63a2a

SHA1
3635a3fe07ccc4a6f33a986ddb690522d0611abb

SHA256
9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287

SHA512
1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\utils\modal-events-delegate.js

Filesize
1KB

MD5
117e4fdbdb0ecf211c8bd909efd337d1

SHA1
9f8684d856b7c95bdffb139217dfd89f41373187

SHA256
267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857

SHA512
f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\utils\strings-loader.js

Filesize
5KB

MD5
9c94eb933d8a43dd3825e67a7e30c980

SHA1
7ec7b16af6f399219209ba5967d377040486a11b

SHA256
96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf

SHA512
a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\utils\utils.js

Filesize
118B

MD5
a0952ebeab701c05c75710c33d725e7e

SHA1
1da8a2e889f1213d481ae3cd5571670c01e64adc

SHA256
b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246

SHA512
5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\cri\cri-controller.js

Filesize
3KB

MD5
4e4b4a9e2d86ae3c108105078db6d730

SHA1
826946be793c999316af6c1db10523950b18ea2c

SHA256
cee7fc5a36a01a439125be031923d7e7415ec56194255048098169a0108034b7

SHA512
1420065cd000ce9b9c39d27b5dc5f4055f67146e06573a03184649851c9745f0c0af2b5e35b41b5923703dd74e32f9ed95fc59a43db25f854584e319950beffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\cri\template.js

Filesize
1KB

MD5
76c1ef0cb437db144c2bed53a5a8a5d7

SHA1
aaab8fff649f8e46d1e9510018118ee9abe01498

SHA256
505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e

SHA512
822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\finish\finish-controller.js

Filesize
1KB

MD5
138240ea22084428e9e25583e9156568

SHA1
e8bef7eab5b6e7040b996ec9504436e073444bd9

SHA256
4cb4e1aa25c15ae5f2e63fa4658a8acff0ce63e0f59cb6eb634df2dfe336e2ec

SHA512
e97b81b0ecd964e6e909019353efe4f5582f65763ac4197d754f1c4eea19cfc249900ae597fd33e29f531bb0d1c7e0f010793c59a2b0099fa75ad0b7d01ce8a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\finish\template.js

Filesize
1KB

MD5
f092de7ea66d8e920b345f38537fa35d

SHA1
82d107a409f18878307ae0cefe24074db64937c4

SHA256
b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f

SHA512
14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\modal\modal-controller.js

Filesize
2KB

MD5
b04bdfd1c7d09bdbdb94a2455fdd677b

SHA1
f000ba4866ff16d75bfd6cf446763498e19b12b1

SHA256
4565ee81ffe222b31982088b1c18850076e3acf59198ebce08118e12cbd87ea1

SHA512
3cb6ef0a16309046e7f407e7321eb12212b0eec09ec1a04b1d813f6c7a04546714865c3b398a93985041f598156ed905ebd23a64260801281b29ada9bc19ec5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\privacy\privacy-controller.js

Filesize
2KB

MD5
15bbec339f5046f525e3aa96d36c30ec

SHA1
f73d40bf06584737fe327f1eec6f4b0446545226

SHA256
14d9c60cd97f18e74fee2dd80b6a190eaccc526085991f356feb6b4d330a0fc3

SHA512
2b0edfd2d5efb3f739e56eb6f3bcfae4789af3e1639f5f8e5f7530f5af10eb1a61464d665c9d9b2f4eb3796f2445108599d8bea75f1709aa562feebee519da4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\privacy\template.js

Filesize
655B

MD5
cf8d2c26520d7c84e560dfa79e31dcd3

SHA1
716f2ec17480d5cc9c145bc147833fbfc39d36f0

SHA256
95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8

SHA512
d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\progress\progress-1-controller.js

Filesize
1KB

MD5
82f0b997ed552c52a510a9f2ab29dc3a

SHA1
92aec3a656053c71eccdde610130f5d8008fa96f

SHA256
838bab990ce38372dfedb50eb0a270db705811729630ab8557c08bd1e9e8e105

SHA512
ecf67f877002d746eff8af3a50155aa381513ddafd17b6bff0188c85f0765579fea0112e82e1371f962b1f5decc94b65e6120f21fb516533dac35a2d541065bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\progress\template.js

Filesize
242B

MD5
92b145e6649ba0add3dee9a69d3fa91e

SHA1
4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d

SHA256
a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab

SHA512
747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\settings\settings-controller.js

Filesize
6KB

MD5
378c18dd7d5cee6ca7c4ddd0396b535b

SHA1
d5f81d4fab29201fd1629dc4d8e6f918c0c30479

SHA256
b5c5dc5e0684fd97eb4c45896dc1c2de8a6a6fdc63b6aa83a99103c15787ef35

SHA512
c29416b3f0245f4826d857dc8c52c969071d2410c945bda96f38f59a9bc7137ee534d84865e5ac55a1e3cea6bb705c5d592725af709cd97e7f38ff05dbaafe5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\settings\template.js

Filesize
4KB

MD5
28513de0830383a516028e4a6e7585a0

SHA1
d31fc3a6f4a3ce6c4afb82ff2342a1ed718809e5

SHA256
8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f

SHA512
0f7321c2ae13145bb694368dae1b74e6fe20e6b09712da2178bc46e6aa65223ab84c38abbf0ed074c85b42dba1a238a5f3f8d1ae060a0af6df748c5befe11b61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\welcome\template.js

Filesize
1KB

MD5
17f54fca6723b983875d940d931e0afb

SHA1
01774cd5cea36bd74c80a708d6f77567e8091024

SHA256
42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb

SHA512
401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\js\windows\welcome\welcome-controller.js

Filesize
2KB

MD5
50f676754862a2ab47a582dd4d79ecf3

SHA1
1cb2f4b11f9f8cfc8dc57ff29d0256dec4811158

SHA256
6155691dbdd66290109afb91617f9cf68af6bd912991d5d27b922f5faa7f530b

SHA512
ccfc89e08fd36f0a694fcda17efb84ca285b6c62afe2e3a794fdad19b6882a4b618645f4d9171673ba56fb4c55fce336d6b8d26dec3a5cc11293ae2b211f499f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\app\manifest.json

Filesize
691B

MD5
8ec82f5fe45a3bf97b1a76d1af7f0dfe

SHA1
0c1734a56bbfce6ce8d6e7aa20c4c91b5ea3a798

SHA256
1e618037de63d764383bbe368c3b377ce1dde85fefe73ce8050e48663877f019

SHA512
28d3f53344150a5580dadddd8219b4b0ed7f9c1e4fb7d2d22d6766b64435c6314f57f93e773d02e15a61e29e345be6e543de9858d0523a2e9c2e3360aa69477f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\log4net.dll

Filesize
270KB

MD5
f15c8a9e2876568b3910189b2d493706

SHA1
32634db97e7c1705286cb1ac5ce20bc4e0ec17af

SHA256
ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309

SHA512
805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\uac.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl81A.tmp\utils.dll

Filesize
55KB

MD5
aad3f2ecc74ddf65e84dcb62cf6a77cd

SHA1
1e153e0f4d7258cae75847dba32d0321864cf089

SHA256
1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8

SHA512
8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoE5B9.tmp\DotNetZip.dll

Filesize
467KB

MD5
190e712f2e3b065ba3d5f63cb9b7725e

SHA1
75c1c8dd93c7c8a4b3719bb77c6e1d1a1620ae12

SHA256
6c512d9943a225d686b26fc832589e4c8bef7c4dd0a8bdfd557d5d27fe5bba0f

SHA512
2b4898d2d6982917612d04442807bd58c37739b2e4b302c94f41e03e685e24b9183b12de2057b3b303483698ad95e3a37795e6eb6d2d3b71e332b59deeca7d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoE5B9.tmp\Microsoft.Win32.TaskScheduler.dll

Filesize
124KB

MD5
9f725ba6eb84f97a3a10d064ecab70e3

SHA1
ec9636538aea8a0c9f4516478c1d3c232cb490ed

SHA256
94961a4d686fa65b85b9e56a2a47aa87122c7b4f4ff8a9e7ef881c2a142283eb

SHA512
3e36dc4f38abb3e92b325616f2ee7aef321f9fe125e38ecc0a0302b10706528d8265046fb18f2f12b65493773ce5345f9b0123c27dcc16707c0b64bb87a68b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoE5B9.tmp\nsis7z64.dll

Filesize
514KB

MD5
284c46af1fd2ec3a60ee0c28f276f2a4

SHA1
4d4d41c0af12d928e4e553ab6b80e6b4ab8007bc

SHA256
2368be6d8b21e0047146d3f61f90966a71d0737eed0146bc692b59f3cac97793

SHA512
ca9e4ef79c9c7c5f2282ddeee34ec39a51cddf26dcad4e9f2e42230499b0b898ac2dfd33f25438aa995741d23037fa01a0269823c283b234ecec0f155d3c05ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoE5B9.tmp\websocket-sharp.dll

Filesize
267KB

MD5
cb39cb181de7d36c82d2dfd178802f38

SHA1
0b1aab54f84926118314bd252ec923c6840f43b3

SHA256
8b7230e7cd859ddeeb5fb48346e9576e47098c1009620c2e5d585bef4b108fbc

SHA512
f6e963dc0e7fb6b024b2ff03e1c9f552eaf809c5897910089955bc5c881f49f1f9ac7756f3cca1e2e90982e9c8d40960fdeb6a211becb0fa7d823c55818949e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\de\messages.json

Filesize
12KB

MD5
9ad7bb13a28acd7b7be3d35adf80de99

SHA1
0fabddcfd82faed51bb071fcfaa213db2583cb37

SHA256
4442ce287dfadf8d2019e4e975ee1c876d57d847c04715fd215ce03b24d36225

SHA512
9af9d5a66c4d9f39027eec20288bfac7170b43944fc58d6a05359624827a3847c4d90b232d3f1f621eaf3f5dd35172efcc96e763b1ca733dfedf02d4df084951

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\en\messages.json

Filesize
11KB

MD5
02b3d4da2acbe118b1c7752cbc73c563

SHA1
f4dea02036c91100d1d8b641259bf1c261ba795d

SHA256
dad27dea69e2e18dad4489ca8ad16c2dffa6448919ad857375f54463740ffae4

SHA512
bd37a83255fedbaff54e2bc9abcf220e8daf0ba7e76f7874e0415420b6ed3543f29f7e1c3370048af10400fabfe6c061ddddf726ab4ec906793c02ebf852690d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\es\messages.json

Filesize
12KB

MD5
424b1b7afc6cea984341e80a1d5ee07c

SHA1
af56baa273442a6336acf7ef873a1f64423534f3

SHA256
382e9709edcbe0faa5509ec6891beb1063840ff0a6cbbd04c9aa94a376ba4503

SHA512
2347b5e2d5b1f95be3c59461c01b6a3f9d52741510d790a812d61ddbeea5b05f01a67e918862790cf1697a106f9aad65d8035626880c7cba1e1c87456ed473f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\fr\messages.json

Filesize
11KB

MD5
418a72fba9141b5fad2daa67eac89ee9

SHA1
c0e931a1e76543dde2350b2a93fb7adcef49b194

SHA256
d10d6f0c35af598decd2bddb3945ad5987cc8da310446b16a63e9856fb635999

SHA512
1e756322ae19c9a82d66ff74fb48daaad3ec8d873aaaa63103cefc51e4db0c3de4f593f067606641e6027c4b5c256c7e558d4fb1684dc8241ce96c8696fbf000

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\it\messages.json

Filesize
12KB

MD5
14684a817dabf05025d1a8b33b0ec04e

SHA1
fa838b38356c26a345292786df9d868331dd5aae

SHA256
71df04a26c171ee7ed4e13ce7b8d0a7a8e50fe1d554d2297ea96f7371e4179c7

SHA512
194aa1dcec2c50fdfd7431699da3080977bf59198b404e6ffc96f06628fee01d0db127ce041a4be0fe22568760b9fd2da517cb67ed5efc283ac28838f5e7bd23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\ja\messages.json

Filesize
13KB

MD5
d9dd8119873d6e831fbfd768343805f6

SHA1
c4b2c24b8bba9238c10616ac9c01cef088cab092

SHA256
20467128e0afab919e9874dcd7e2d5dd94fcc16f33aa50d0d8243e81d6c089f2

SHA512
b5c456f7655bc3ec23aa733e91940f25cd5f42284e97fb51a95b96b927c75a96ea163628486cb4b890b24ebd6277295fedc79bcd14a2ce7b19471490d9b32a38

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\ko\messages.json

Filesize
12KB

MD5
17387fe103d0789991d057984b130284

SHA1
1a847b2f82a002a3e3567f4dacf39632b1e2ba35

SHA256
0d483128b1714e8df8d61a3396ea4ffa6e1f6865ad7b5306214d811a2028ea0a

SHA512
123a84497ac56dfde0cb4d52c7c778b1210132662164e1553be98fba06d4b49941b8e11c105749aac1b140b6886a33bd2647d0fcfd7bacbbbfd136ea4ab2cfd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\pl\messages.json

Filesize
12KB

MD5
5ba0db597f102d2b7560631095128f1f

SHA1
10de6855b2c26d00bce493ad5049d030eb7c22f9

SHA256
b8c9eec03aac551f33de55f0be7d5b915d64730b11f0574fed1666e656f2118b

SHA512
e74fd3ad2853f4cffe3bc188d535b86ee5ce81b3a884ddf0c51ee823fb91b30b3d62dc3bd4d38db080d97bee73fbd48102896d76c3153e307461aa82d5e0017a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\pt\messages.json

Filesize
11KB

MD5
3159b26555d81ef9c9d0d153e775c708

SHA1
b855ba4a1f25e6dff65da71b407df1a91180435a

SHA256
7c09f5f4f909d30e1a45b92a517432d296859825876d4e9852a8f509f96d2480

SHA512
ad1c74542a4177fc8e200d2e7943308025a2d691b0b421ffcb580c88cbdc925ef50c43d17bb665a2a59c168e1fd21897d8fb000a71695036533bec4d907c7184

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\ru\messages.json

Filesize
15KB

MD5
c22702df74eb2c41ed92cd3f1fc46cff

SHA1
ba8b25078d053f44c5bf58f8b761baf7984de527

SHA256
764419019b8da2bc3fd0af5ec8ce8899b3a24d90c1abf69087b71fb55acc0515

SHA512
facc5db35301ef8e405561d09dd1e4353ffd665d0577678d63d33a45362277556fcf2ffd930377bbf7631fcb6a32371dd658b45916d990fff3abacf2856632c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\tr\messages.json

Filesize
11KB

MD5
b7695e795776ecf9ac9299c0f30f87f9

SHA1
00361bc0899720beeff341282f2aff5ac43899f5

SHA256
7840b3b78294030927731f914a64e17a2010cb0699447339c2fcd47e909e7d4d

SHA512
a8574f7cc659694ed585580a135baec7faca82162e6fc9c19a88ebde15cb952878d74e43b32012f7f7dcf63b67b097fe62d68db8eb6753ebf353bff8ed07315e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\vi\messages.json

Filesize
13KB

MD5
ff03f3797fcdc074fd32a57f8ab36d4f

SHA1
07d382fa4558607d502aa6a6d2de797a0269b4e6

SHA256
231a647e4ac1fcc53c008c7a07af4ddbf6e7faad38cf6eb593974ad9cda444b4

SHA512
7e85fccec49f0e3df37c410a49f689293abadfebc55b9ac3f5a47b7a868503175c0efe957e7ea422bb0d58eb6a200422a394f530724d0fcb6e5d7b5643a12df8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\zh-tw\messages.json

Filesize
11KB

MD5
363616514628c643de23e2b9b596c2a9

SHA1
4cd78e19d704d3eb470ebe0b4789bce6cdee64ec

SHA256
d10b26d1cb08ba5b4c9ac17439a641f82b7404823f4ab8bc3d793c0c4bf01117

SHA512
d1609f3a4ffc45b3003056e6a66ea39be43ee73aaf1d6488b4fa86f37e176388191d3cbdb30506c0472c3d98d3c1c5b3f62de028dc495b23abfa57f84015614d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\_locales\zh\messages.json

Filesize
10KB

MD5
6bfb7e28c38ce417f9ae53b9282a3e90

SHA1
5e7723fc7e5e965fe84a1fb8fc22fc07eb19bea7

SHA256
28ec01002632aa8e3a46078d590c4cd707faf2a2f0e4071d6f8572d4b90a4ea2

SHA512
126ad8f28af186b9a7868497ec1789b85031373c0ab3e9f7df84d7a6773064e490ab1fdbb94c3bec19626080bb455a2231ec4a45de2a24e041d4478a52bb4055

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\assets\fonts\klavika\KlavikaWebBasicMedium.eot

Filesize
27KB

MD5
ddd851603ecdbf74a113ae2e741fb487

SHA1
36449c0d56578c22df9c6918840d808aebd3e97e

SHA256
41146279fcb503008ab14c89e3e9a1737dc92499b07e36f9bbbd40b82dc3a793

SHA512
67b84413462158a114018c413bc8a32731d00f439d6998ec1577fb7d27df4316edd9acf9c94dededb918fc7ce6fb8523af85e03dae0b94e5a2b505e6998e0053

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\assets\fonts\klavika\KlavikaWebBasicRegular.eot

Filesize
30KB

MD5
8c176ec2a2ccf48958f8cbfc5114818f

SHA1
dd93db072bfb8ade37da99c8e56bda5c4259feb8

SHA256
83f615ecdb758eb2fd5357b89a9e0424bba9ce66ba2f8ccd93986f7d03998b5b

SHA512
c2ea009102f1a47313ed3d85f391ea23a9bed3378f965f4450befc5347b086f752fdb5b41ef0f2f6dab674f3095e7dda2837294b4d21ea9268551bffbcac5c4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\cmp.html

Filesize
5KB

MD5
d7b8b31b190e552677589cfd4cbb5d8e

SHA1
09ffb3c63991d5c932c819393de489268bd3ab88

SHA256
6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f

SHA512
32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\css\styles.min.css

Filesize
14KB

MD5
a205363a8b123d65909896daf16a2eb2

SHA1
17d99f7889d61b56a44509e45465fe413ace29d0

SHA256
ef423e07b8a0ce201d438ffb8501899c6ae9d20fee079707b03b32bce8857591

SHA512
c65cd1f376838ef700a1826117c61d10151c06a8d1e869a2c5c2f0f282cf00a8dde4d6ee74df01a34824e6f84d9c694217af23354f490eafd5814493e4837521

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\game_detection_database.json

Filesize
27KB

MD5
336d26d3e0ab31e8dc102ea86c48fa26

SHA1
aa0a6a940ffcf7cdd9cfcc86a382890e18fff5c4

SHA256
f30b571b8bb396aa0bca9aa9b80638416ec638de5c4788bc281ac67d3d54ccaf

SHA512
ee1d4ae3236964e0e2aea7c33aa82f44b2b25d9fded16452e00ec09f867031df0539be19fe52c4d638332dc50698b526a7cb11056f5fbf765eb7e0cf832fb49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\big-icon-fallback.png

Filesize
413B

MD5
435663128120e807ec9c33d5b277198a

SHA1
6de278d5f8850da54405fc3a444cfdf8054f6a05

SHA256
46b318ffab431aa7f0559560632c0eca28a0527fe9ec766e947d3b49708e3de5

SHA512
97cd952ab6833cea217ea6b5f5a83624f4ae1311ac0c4d66f2bb7d61a6c224b7cfb6205074e008ea33aaa7b82474fed4230ec3f4f8f085e884b716ee992624e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\bottom-arrow-hover.png

Filesize
294B

MD5
f5d76b21fcab6cc89fd0ebc1089c2c26

SHA1
160645c02dcfdcd4d6d6a8339557a62b80493e40

SHA256
3b8043e64994a53126afe1250b80fa2934196c3305bf93fd3e7a6963867a6eb9

SHA512
4c4fd737cd771e8e0c025295c598aeb4ffb2d20df10658f7cb992aa49b4817be5d291c0c6530b4e9aaa241ab76df3c52e01a40a505e7b60d1d968a96fd4de991

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\bottom-arrow.png

Filesize
279B

MD5
847fab99890ddd7460e758ad8d463ba9

SHA1
bdf8c1e45993ee33ee0bf9a2e43d6048df71cb8a

SHA256
46bfb08af2269108c681b78373c98e899b4234adce39394322c7dfd6d40dcdac

SHA512
0bd2075c61eafc2946a9431bd4fbbbb141f3743144782376874640e4aae1ee97a05844589661b3a0912b23dacdf57e0a667d8ffa8ccd0f4358e5802e653aef1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\checkbox-checked.png

Filesize
161B

MD5
cb392a851c11a74c80c9a6b7a2804cba

SHA1
750b03afd6f6da79ae81164b5a64dd2c3f4937f1

SHA256
b0718ebac6a1666f75492e0807166ea1b257bbbeed87d64d574e45adaa768173

SHA512
ca3baf5ac8cc1008c3886d68501c49a750efea4c891d85615a8881ae604f1c9205ee71861a8bb615b5978b239aa4e3b8619a56a646ec4d812e0ee7c1dfe05af6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\close-hover.png

Filesize
185B

MD5
d07493ccaf895ba1e5a1b230789b06a8

SHA1
c62f9f464db25969516ad57a706b222e100667a1

SHA256
5c95ffffdef5de89cc7b04ddacba9fa4c1280a192fda4138460c72433f0d0230

SHA512
ec5640f9b97ee9d22f8dbc1d685048acc6c67338eb701c42522a0e72edd3b180677405d458c49cd73ee23b8ebef85beabd66909a6572665abc1b25cb6d0f074a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\close-normal.png

Filesize
330B

MD5
1acb62ec3fa5a82347c330512f2259d6

SHA1
c81389f19687e791bc4ada896620b17471371c04

SHA256
e8bd82cb680ae552f587a3f0bdc1df18fc7624dffec501840cc508d327baeec3

SHA512
a6693f68c41f8a7c137f3129403b14144329c132b99956ff2c1cc5317b046eaec70aef82c7c05b9220c3c3a7f2a417718fb65bbbe486250c05191778456f602a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\header-logo.png

Filesize
1KB

MD5
b51f37fbd94cb7d7f45dab73fa5bcfb9

SHA1
2c3aae0f065216cfec01339da2c60282312079c0

SHA256
e83b38f1f699ed4df739fa632d55a422e6d35b19261081a5bfccd2bc4669c5de

SHA512
4a7c0a654c3d4da9b9b77aad46d68d2da370b8b54fef325e6ea8972b202541c134ee937db6d71dd549d405241fb15a043d2dce0734312f72222cf5a21e5827bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\icon-fallback.png

Filesize
213B

MD5
3880ad80fd07870118b0aeb8fff308d4

SHA1
37b30e87d89d3bc56eb5ca3f8ec6c7f22e5ee6a1

SHA256
772fe7450824cb84dbcbc9cdb401278dec1a511ca3ae2cceb073e8bf4dc8fa61

SHA512
3917e7b6623f284a0378702e489a5131c3ad328827a87e1332d24a89d6e54d68e7dca3e5bfeb0bb22fe54da1572d2d8a9107eec8f36b9ba7db1f50c0a5205d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\large-logo.png

Filesize
486B

MD5
91c31a155e202e8ad2c033e61d0bf948

SHA1
3fc81f5f368f90e7104b65adf6b8780d71005f99

SHA256
1bfe389c41dc9897a4b1b5a0e495570a0f3671fad73d42307cbde1a82ae1be17

SHA512
ef89b9edabd3e1f3e9cb8e2ce919b4d29a31ab112297fa6b9c3be2cdd0df548307e3f800de2e027b907422ce87a5edf638d0a410e9afb6de85318ac0173f1e69

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\minimize-hover.png

Filesize
171B

MD5
f4b8851b9ef5a55b0d45392baceb31fb

SHA1
03a87a04dc75579a8568543d40db963b6e9f4051

SHA256
d84b877f7a2d601b1d71cf878b33ff78c94c2d144a0f4d72436a7dcf64e712c2

SHA512
a849659d4ba4e40b924108cd567a58f4b1569afc5c7517a10c26fd6d64422fa61812683292da1c3b19dbe91c63aacd5cd1c5b342ccce98b6815e94b55767ce4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\minimize-normal.png

Filesize
150B

MD5
1bcfd10e50ab56ac335a463ec19b8d33

SHA1
b5054dd1cdd714a6771bc11e43291df361a16ccc

SHA256
aa2b021cd0dd9563705503dad48866eac926c7ace608ff8d00f755afc509f39b

SHA512
7257c401db826ed1f4a549b1b899d0fb4a5bcc3c599ced49b07a64fc308b08fb208dc378a32d9c3cd193b4d603ae76f82bb297334998ca6abb790081a5467edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\more-info.png

Filesize
539B

MD5
c6911391ca719b6ece307854f40d02be

SHA1
451936edbab150559e38a81ec88c75de052bb14b

SHA256
b110d583d920fb1065fc7eb587e4f2a256f99d55eb8a562924e088d9b7a971aa

SHA512
9728920dd81f2554a37119aae1755751e08ce8d22be5df21ad1b8205d3e37f027cbcb32c25193faa6fa6e270574c7d4eff529ca08bf57565b764b338ea8b1c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\plus.png

Filesize
178B

MD5
28a150c80834701792d39b58fe16e741

SHA1
f7fa88204163ee7a0df768eb6759bc02b8e1c030

SHA256
d25235a308d7b16b6a8694a3eb8935393d124dd3c58380a6c67d4e4f3382e47f

SHA512
8222a493bae3316a851b66573886b3c63f8d63b68e4da56ba25f37fb46cdc27ac7dc4e10ca1c3912352812eae5ce4492591fbce09ff7ba1a228ecfb2a49f0c32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\progress-01-overwolf.png

Filesize
12KB

MD5
3d98876bb3f09090568aa3ef90a84dc0

SHA1
5f98121ef031920b8c8ecab21435cc64bd531c19

SHA256
4da28ba55f43cc1d03d5cf1eeb040985d3bb5fd2a7230667c871254f006c512e

SHA512
2bfb612a6aa0061f123e8d342ab4d049e2f38b2c111f2662d4da8c8a22a73893c5d9743a337766ff2e6346cb04ef2b4c63ea72e5e749b34593fd372889033d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\progress-02.png

Filesize
9KB

MD5
3781b597e18900a6b779ab588d8a8e21

SHA1
0fd2084a62f507ec802646f7423c9714ba547d7f

SHA256
130eafc5dc7ef993134d0bcff40bfbf11b99d41c63a5c6ad1d70c7ad4db2a5e7

SHA512
22f2cdc6cdd81503d48f8f23c84abbd23c6c9e3a137b7e4e91846823d957abeee348f4e3cff88667a263503ca310d80253187d699f733975133d08b5729e647d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\progress-app-image-01.png

Filesize
2KB

MD5
6276c4f73df3a91718a12878c63dcf24

SHA1
a86fe5338c78dc396f680e489766f8186e6cbe81

SHA256
032335dca37195df73cef1fc5f019bc8705284c3226dbdd54f81d61b714c4915

SHA512
11a4e465614e65a04e72b5d6b80f0c5643d51757a06595168894d3e0a419bd68ad31152221a22ec1fd6db03c5c159d31aa5054f1f4d8c633099477afd6f92607

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\progress-app-image-02.png

Filesize
2KB

MD5
9626ec7a1330f4fa65abb37f08ff6421

SHA1
914801589106fec21ff3d7f5673aa035bb5bf129

SHA256
9363bf7bf35a32278d95b8410bda989c63d9cd09fa17fdcb04d93aef1d433b3c

SHA512
f43caa916f385158cb3a3fb20193a80ce8ee84f1063e6497fa0a9265dd28b8983750d0c44006936aefb9d6b16230d92105bd344707bda8d55e3283b344ec792f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\progress-app-image-03.png

Filesize
1KB

MD5
38ead88ccac4d4f8077e265aafc186bc

SHA1
eb3c2de5065ab597c8e9799a3c31487545ce4828

SHA256
827f9bd53d624da1397e0f8d3a68fa96bbe7146b74f6ea8af5cd6acfc3839cd5

SHA512
a473af7f5d1dd87a670b1d7f1c9e34d66d7bbc77647dc72d540acf97e1d296bbaa59469663354ae4223423688142d6d828e35f571d37bd7ae813274ccfcec519

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\small-logo.png

Filesize
523B

MD5
ef0803e881fe7bba90e5e9ec1678d950

SHA1
43e9ac35b2f4bc22e404bb2362eaa7bfef24f9bf

SHA256
0ee19b8f79232886f6234cc6dc21c0327e90df94a189c5effe1d8a6444543726

SHA512
11c6126429f4fc3ea32edf6132dbad840a1df35f58237c8730f5171c491588425190897f4370545bcc4ed4d42838dd95a2789a3b6ca20cf8cbc7bef78472f253

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\tile-fallback.png

Filesize
935B

MD5
0148cc4040f730247ce079e723fc030b

SHA1
ee316fdbaa54a7cb5cd350adc4919787e7edb63c

SHA256
d173d88df0d31e3d4f83b299cba4ec031dd286dff2f963e58d747617649108a2

SHA512
a441046265ccbc2e8e25bba5e10a46d65f28d2a9100ee12742e0ef5da943461996cc036f57031ef6c21fb0929ebb941e27874a08e53677e46ea28c097136cc75

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\v-check.png

Filesize
885B

MD5
cdd7415f59e5c003dd5956b971a3cde1

SHA1
89a3cd6591cd66fde5fe389a216272cf11d7696f

SHA256
af10225db6ff7d4b67d00b12f37b211c1f368bb99ae900856b023ce5999dc9ae

SHA512
bf36f6ed5f9a5bd9da0bdcb0baa03ad73e12e4d30ef64752e14c307280825e994deee50c5436f683048711104634f0410684188d47f5698dfe5309ae4f55b2a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\images\welcome-logo.png

Filesize
995B

MD5
860785e1633b7a170ec443f4d36551c7

SHA1
f5a3401fdb22bffabbaae7f912f93cddbb7ea148

SHA256
2e3dced384fe419468973dcb074794b1444f48bce8f96217aa5e3a98c34e4c01

SHA512
217b2177b9f990ee27d1e169dca9f99da18e9bd41fc6d7a5ce7d01cf9e35a23f343763835424125b3fa73de196579054e56542e5885327c6922deeb34fd78e16

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\app\progress.html

Filesize
20KB

MD5
359ae05967ebe29e7f7a3564f0fa3f53

SHA1
3c1a454e8f5445ec890c5c2c11fa9e24bbb8e4bc

SHA256
f2182497ffe118349d8a462cf0eef55f22798a17e91846b194b7298d860ae38b

SHA512
0b61dd5af6feef3e1361a9ddc32dfca2200af44507f8f4e2c0f73ebdcb79e690d1f7561d86bbcace1ba16c37f18d6d40670de2d3e16b88d710180665de51675f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz2830.tmp\nsis7z.dll

Filesize
90KB

MD5
98e916bafaeae6f0b5c0d100d6d7a26a

SHA1
858b0a478e83abc35b943e41ef0bdf5e323075bf

SHA256
29a176a470bebca6d71966b0b8a396d245a77dfc2965acac1fcf84bd239e5701

SHA512
b1498715f3277f24506c1a7eea52fdd2201902ddb19d20707e704fe65368cff2fe8af8ffc76901e07ef6bb280f5147a8505d6c6f4fca985f2d198cf21c0f61cc

Download Submit
C:\Users\Admin\Downloads\Thunderstore Mod Manager - Installer.exe

Filesize
2.0MB

MD5
5f99d28ad324c5ced13c497a00f27b4f

SHA1
f20e5ead561a9e5f4ef6efbfa845ac4cf81f07b6

SHA256
5ba301ac5363fb13a7e1e649373717e941e45ce7138672c4f2759b17a36c1152

SHA512
f230d1f00438342a6c8647cb4ce6a3116f04976541b881fd0ac87eae9ee9ec876e7c5a13c3da2ff35e13f6561d7869ce656c1df03e1047e0607e1f6d2460055f

Download Submit
memory/1016-666-0x000001ADF0E90000-0x000001ADF0E91000-memory.dmp

Filesize
4KB

Download
memory/1016-674-0x000001ADF0E90000-0x000001ADF0E91000-memory.dmp

Filesize
4KB

Download
memory/1016-668-0x000001ADF0E90000-0x000001ADF0E91000-memory.dmp

Filesize
4KB

Download
memory/1016-667-0x000001ADF0E90000-0x000001ADF0E91000-memory.dmp

Filesize
4KB

Download
memory/1016-672-0x000001ADF0E90000-0x000001ADF0E91000-memory.dmp

Filesize
4KB

Download
memory/1016-675-0x000001ADF0E90000-0x000001ADF0E91000-memory.dmp

Filesize
4KB

Download
memory/1016-678-0x000001ADF0E90000-0x000001ADF0E91000-memory.dmp

Filesize
4KB

Download
memory/1016-677-0x000001ADF0E90000-0x000001ADF0E91000-memory.dmp

Filesize
4KB

Download
memory/1016-676-0x000001ADF0E90000-0x000001ADF0E91000-memory.dmp

Filesize
4KB

Download
memory/1016-673-0x000001ADF0E90000-0x000001ADF0E91000-memory.dmp

Filesize
4KB

Download
memory/3340-665-0x00000296B1350000-0x00000296B1AF6000-memory.dmp

Filesize
7.6MB

Download
memory/3340-516-0x0000028EAE9D0000-0x0000028EAE9F2000-memory.dmp

Filesize
136KB

Download
memory/3340-468-0x0000028E937D0000-0x0000028E9381C000-memory.dmp

Filesize
304KB

Download
memory/3340-472-0x0000028EADCC0000-0x0000028EADD64000-memory.dmp

Filesize
656KB

Download
memory/3340-474-0x0000028E954B0000-0x0000028E954C4000-memory.dmp

Filesize
80KB

Download
memory/3340-475-0x0000028EAE2A0000-0x0000028EAE7C8000-memory.dmp

Filesize
5.2MB

Download
memory/3340-477-0x0000028E955A0000-0x0000028E955E6000-memory.dmp

Filesize
280KB

Download
memory/3340-483-0x0000028EADE70000-0x0000028EADE88000-memory.dmp

Filesize
96KB

Download
memory/3340-493-0x0000028EAE1D0000-0x0000028EAE280000-memory.dmp

Filesize
704KB

Download
memory/3452-810-0x000001A9B0DC0000-0x000001A9B0DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-806-0x000001A9B0DC0000-0x000001A9B0DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-807-0x000001A9B0DC0000-0x000001A9B0DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-808-0x000001A9B0DC0000-0x000001A9B0DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-809-0x000001A9B0DC0000-0x000001A9B0DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-802-0x000001A9B0DC0000-0x000001A9B0DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-811-0x000001A9B0DC0000-0x000001A9B0DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-800-0x000001A9B0DC0000-0x000001A9B0DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-801-0x000001A9B0DC0000-0x000001A9B0DC1000-memory.dmp

Filesize
4KB

Download