222a185bdade1c5f5af8dcfadc9fcb7fab73fa22894a67e61df8dee201aa4998

Analysis

max time kernel
37s
max time network
40s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
26/07/2024, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mantle - Installer.exe
Size 2.0MB
Sample240726-j7xarazeqa
SHA256 222a185bdade1c5f5af8dcfadc9fcb7fab73fa22894a67e61df8dee201aa4998
MD5 dc1ef4c4e8e9cfef592b7dd6380aaa71
SHA1 0df32a497afa09a72f16dbbbb5a0f10c5f7eaf7d
SHA512 b9fc6682803bbe49af4d9451a002137f509d49f3d3b0099865741e47bc4bd48d303d681e2e4979aecc7fd5538d335ff56ab0add0e9e3e3ac5ee4243daa5c22f1
SSDEEP 49152:37KNxE87vxpsrFpIv1t1fCufN6s3hQVfsYGYUNx/3Q1ca:3gPN+TIvX1auV53hQVfjtIv6
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5116	OWinstaller.exe

Loads dropped DLL 11 IoCs

pid	Process
888	Mantle - Installer.exe
888	Mantle - Installer.exe
888	Mantle - Installer.exe
888	Mantle - Installer.exe
888	Mantle - Installer.exe
888	Mantle - Installer.exe
888	Mantle - Installer.exe
5116	OWinstaller.exe
5116	OWinstaller.exe
5116	OWinstaller.exe
5116	OWinstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mantle - Installer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4204	msedge.exe
4204	msedge.exe
2856	identity_helper.exe
2856	identity_helper.exe
3688	msedge.exe
3688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	OWinstaller.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5116	OWinstaller.exe
5116	OWinstaller.exe
5116	OWinstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 5116	888	Mantle - Installer.exe	83
PID 888 wrote to memory of 5116	888	Mantle - Installer.exe	83
PID 4204 wrote to memory of 3204	4204	msedge.exe	90
PID 4204 wrote to memory of 3204	4204	msedge.exe	90
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4784	4204	msedge.exe	91
PID 4204 wrote to memory of 4832	4204	msedge.exe	92
PID 4204 wrote to memory of 4832	4204	msedge.exe	92
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93
PID 4204 wrote to memory of 832	4204	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\Mantle - Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Mantle - Installer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888
- C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\OWinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\OWinstaller.exe" Sel=0&Extension=pckhfjolgagaifpnbmddikafgamkijpjdjejannn&Name=Mantle&Referer=www.mantle.gg&Browser=microsoftedge -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/pckhfjolgagaifpnbmddikafgamkijpjdjejannn --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --silent-setup --app-name="Mantle" --auto-close -exepath C:\Users\Admin\AppData\Local\Temp\Mantle - Installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffd6303cb8,0x7fffd6303cc8,0x7fffd6303cd8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,17947344737129539612,13335983130533527701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a4e82ce07a482da1a3a3ba11fcceee197c6b2b42608320c4f3e67f1c6a6d6606
MD5 5478498cbfa587d1d55a9ca5598bf6b9
SHA1 82fedfb941371c42f041f891ea8eb9fe4cf7dcc8
SHA512 7641a2f3cc7321b1277c58a47dfd71be087f67f8b57dca6e72bd4e1b664f36151cd723e03ea348835581bcb773eb97911f985d5ee770d4d1b8b6f7849ce74b44
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7b7f02109a9d1f4b5b57ca376fcacd34f894d2c80584630c3733f2a41dddf063
MD5 bb87c05bdde5672940b661f7cf6c188e
SHA1 476f902e4743e846c500423fb7e195151f22f3b5
SHA512 c60d8b260d98ced6fe283ca6fed06e5f4640e9de2609bcfbfa176da1d0744b7f68acabfa66f35455e68cad8be1e2cfc9b5046463e13ae5f33bbbf87a005d1e0b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 f9a0910712e493ef01b41d6c3291657fbab6fc07f1ccf457a0592aa250cfb223
MD5 8d3e3a75e8fd490a379252cc31cdc517
SHA1 6308c60a35f227d4a86e6ccb75b0412a27996b3f
SHA512 f3172ac832d7e13a6b8afa259b56ad80ea45be12713087586d89b6dcf7f6e32b87974159d044654688ba9d73af4bb6a3b060cecd69721fe3f870782d39acbf66
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 9ae9a4936f2b795ce8eb86dd49d3f9d0118abdcc6408f3ec597b32c4d63baf94
MD5 417e8290d0e89bbdd2f6cf9e1a89f9d3
SHA1 8530484e4ac7c0a5ba83a8d86de33b5c0ab365d7
SHA512 6ad96d08c414eb13b7b23e46c29104bc8662177b9d2f1b35043f4884d81680229f2f730af49bae71ad5c422c00c0488147ec13e199bf3dee512cf90e283df741
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 29575935f1f5fe0601192039bfbb94e7861d9559e8bafb8cd83f66a5a302b83e
MD5 13116328f6a22e0d98b8472b0c132d14
SHA1 28eb5eec465f2c2f2ae7eef42e6987a0dc1653d1
SHA512 fc461e6b034e7532b38e751c9675e6c55304a7e399b07aa14a25f0288e76e6c4dab5534c62652fc7da58507a761ad539cc4f97e7aa472496fa8f34a59e1c7bd6
SSDEEP 96:nlxk3h1hxkylwSv0MoiVmdHIAJpt0WQyV+VpziX3wI3:nlxk3Thxkylv0MAI2ptLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ac5ccdf6ff6635cc7b7603004a3e993d8bddae99f0df2c8ca7c79fa512439783
MD5 db3a91c3d7fc2fc6fcbcda92ea20a7c9
SHA1 48f26fb06b9219865850c49270e20c02a4c21082
SHA512 eb48719ce8f3f0fbab120c72d421d103b761c9df3237945529d14e8b6fa342c511c6793a204cdcd34e96c37edd2cca2ab459c30a752a1b41a0543e2a3dbdcf3f
SSDEEP 96:nlxk3A1hxkyNwSv0MoiCR5mdgua1jI+Jdy0WQyV+VpAiX3wI3:nlxk3KhxkyNv0MCluahI8dyLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 56b8606df46fe4d9f5b55c964bcf13adb0ce7892e4005e288fb884e1761eaf6e
MD5 f2265f3d270326fbc3fa41116e633017
SHA1 a33955d433bda47d122f45bd28ce519870fd969b
SHA512 29fde594b11beff0a4a08196765ddefb55bafec0e7c6945724cd022d341d0b66d07b07dca6f28eefadb969b9268cf16bb66f3b404776ef961ae81b6d3cb4334d
SSDEEP 96:nlxk3D1hxkylwSv0MoiVmdgua1jIhJpt0WQyV+VpAiX3wI3:nlxk3xhxkylv0M7uahIjptLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 456823863bd6fc67426b6f0bb692ccc16572fa6323d6c4058534d07fe6043aa3
MD5 aa48c60159b371e8797b0df8b4bb4903
SHA1 299de0c2efbd441b231ff96a9752f63cd4e7d269
SHA512 366cfbf240924e70eba547c382d48b0c4f8069069e3474a7599edae5c541bcecf6084bf341185b34a769a43fed35e23dbb97fba0fbb09b16c2a387f3526eebfb
SSDEEP 96:nlxk3j1hxkyNwSv0MoiVmdgua1jIhJpt0WQyV+VpAiX3wI3:nlxk3RhxkyNv0M7uahIjptLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8259ea2508bb3db3651947aca8cd520827d2bb913cff199a24b9dbaee2b0fc10
MD5 c65e9fe362a912d82c092844f190cfe7
SHA1 d687f9522b6bfba1b14737d6ae36785335fab9a1
SHA512 0e9fa01fdb8193eaa798482f759e943c3cf238abdeaba29a45863454f5113d53519720e65fd179ae1c5ebbe6b3c1b6b3eab5b23c26c81c065874b388778ba24a
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGrUqde2RUfDt/Rk3ljhMWbrik:M9iIxuERzA83h09RZxASGf5IDtS3ljhh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 04d89e5723e1a0565d829f2f6d629568cb44e2b77ddbc91607e943451215f2aa
MD5 1545f16bd77a6c2f7bcdca27c49140d5
SHA1 08179e8bbb5649d2c6ec8015f5b32896e2456020
SHA512 5b82adb735fcf1f33588bbedf911586e310f38b849af795e808549d08fca3ac40e2b2f926c2cef88962d1df50adcae887143735813547b452077308bd541b4f0
SSDEEP 192:QoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGrUqde2RUyDO/Rk3lohMWbrik:I9iIxuERzA83h09RZxASGf5zDOS3lohh
MD5 SHA1 SHA512 SSDEEP

Submit Download

SettingsPageBasic.xml

Path C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml
Size 752B
SHA256 9d2552fd56da4b498f5af94999458df011312a2b4f7bce295d76b2abf6c328b4
MD5 8e3616383625c9c913e16f49eacc4b06
SHA1 8805d40a724917dc2ed4148ecd58cf8054fadf9d
SHA512 0789436a8d8f896a612c7e689ea5c266124067b6cef7831b336ef1792828ee7bba59c96b6fba7219d5d7cd0f58b2c2b492782f5f95a3bde905aa7b33abf1a3a1
MD5 SHA1 SHA512

Submit Download

CommandLine.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\CommandLine.dll
Size 68KB
SHA256 b69f8e16a39271ae247897cbe816ee1950f9f460e2e2b70a3a7538a8c0f31196
MD5 7949107875d0a5332ff10d8e24db65e4
SHA1 8f6b5a291f21a55c4d40f788349334a8fc4a6be1
SHA512 a965ed74014bcb1a9d2f2564e80b4ef708868ffc8bc45c7873b93a1e9c88e664d7640a2349c672b52e31677c4ff681e1bc50e749c29c3b3a8a40baa9f11d1cd0
SSDEEP 1536:MZj9JT17qpL/6ePMqBNzrstoJSkrjbgbwzis3hwb7P53h0q:Mx9JT17WPMqBNWAkbwzi7b4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\INetC.dll
Size 24KB
SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
MD5 640bff73a5f8e37b202d911e4749b2e9
SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\Newtonsoft.Json.dll
Size 692KB
SHA256 7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13
MD5 98cbb64f074dc600b23a2ee1a0f46448
SHA1 c5e5ec666eeb51ec15d69d27685fe50148893e34
SHA512 eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147
SSDEEP 12288:p9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3SH:p8m657w6ZBLmkitKqBCjC0PDgM5CH
MD5 SHA1 SHA512 SSDEEP

Submit Download

OWInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\OWInstaller.exe
Size 298KB
SHA256 1accdd2a7145e23d24387b3af7ce017dd4a9b554f506ac5c8d809a0e6df51d98
MD5 c0a84f3f4423a36c4c03a2ac8aff436f
SHA1 1b9b6fa43dfd9978f19783fa20331a54dac616f9
SHA512 fbb4ce4d50650f90efea664541549d3e69d81f84348a3ae8f7984ac0475a6801862740773a0c2f1d334918ff344ba8f2532cb7af9f50b0d1a390be8ca4b251bc
SSDEEP 6144:7pntLzy7dLKc/6XFGau09bFyoSIm900Tkq2dSxplHVcymz:7pntyL6X81FoSU0+SYy2
MD5 SHA1 SHA512 SSDEEP

Submit Download

OWinstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\OWinstaller.exe.config
Size 632B
SHA256 272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827
MD5 82d22e4e19e27e306317513b9bfa70ff
SHA1 ff3c7dd06b7fff9c12b1beaf0ca32517710ac161
SHA512 b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9
MD5 SHA1 SHA512

Submit Download

OverWolf.Client.CommonUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\OverWolf.Client.CommonUtils.dll
Size 646KB
SHA256 27859b8295c6bad6603457188b4a52a48d538bac0fc737971eb8a79ff92b06dd
MD5 c0da114ea41689686ed47d9aa14966ba
SHA1 8d24eedb617c09648c1d54bbd7968df5d1709964
SHA512 25aadb491c66281109ca28a392b54ae5384dff55fc38c9cc879c3157e363f8cc6a3503c77f2c46e16aaa42d58f5ac2414d2881717404118cdac68333bc3ad9a0
SSDEEP 12288:JIYt/qyA5cbXNSDAoIL5QFm6eLa/TFE5NI4:nCcDTtQFm63FYI4
MD5 SHA1 SHA512 SSDEEP

Submit Download

SharpRaven.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\SharpRaven.dll
Size 80KB
SHA256 6f95c71497dfc3d9b3bf22fa68917fe645b22bed8f0d3e1d55c969b538cc9208
MD5 c05cb33fbeea0399c1cf3202f7bd8249
SHA1 74bf0d88450e25173ed8d792b5a0e020e5eeb3f0
SHA512 0e336a718f8a57f91b6f2fcc86b38fcc809917f690753eafa6ca6f0a95d05b0e1319555245e8d8459dfbdff1e7a34c9f335e0473f623ad5ad955421cf65062e8
SSDEEP 1536:oa9qjviI1YjOrfRK9bvyyfpHbnzDwkN7Pv3hIC:oEuqI1lRKbvyyB7nlNSC
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\System.dll
Size 11KB
SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
MD5 7399323923e3946fe9140132ac388132
SHA1 728257d06c452449b1241769b459f091aabcffc5
SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\UserInfo.dll
Size 4KB
SHA256 090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc
MD5 9301577ff4d229347fe33259b43ef3b2
SHA1 5e39eb4f99920005a4b2303c8089d77f589c133d
SHA512 77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79
MD5 SHA1 SHA512

Submit Download

LatoLatin-Regular.eot

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\assets\fonts\lato\LatoLatin-Regular.eot
Size 66KB
SHA256 c6c970b103b3c3aa83f7a45172619a4451ea5f015f9f3ef4fd08c9a4aa895cbc
MD5 6cfad5881181ae658a6efdd68889a690
SHA1 5b54f6ccc20ed3a078fbdf94d7a68ac80002624d
SHA512 ddd3d43540eb3d4eef48d0834136de1e7bf23a52f286d0a666cf57c7d685aadf1cea6d37c88f9d7ce5ad6143d7c3213f54b16a11f616b7dce154bba50997bbe7
SSDEEP 1536:Y3UqIyK9PLLUbTiyEl4u9Iau0j6aEPmFm/MsE+Eas7AdCtkUq:EUqIyK9T4bTiF99f2PmFm/PpEL7A8tkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\images\icon.ico
Size 20KB
SHA256 29d99938f43ca267e73831531480b37d1922e003903947f92ced42854d816a5a
MD5 9a886c8a577343e5e5be0156d63fd555
SHA1 ca42ce37f5258b1833629954bd9a973299ecffa9
SHA512 a2e9c0dacf164bc447fa3b87ddab5d09c65c88523f17447a78654f7419e1c78d90641ba9cc65fe4bae102c0bb31967ec4d0442eeb87112a477391bc4f3121cbb
SSDEEP 192:aW2n95KPqEotJHQMLcVGzT5y1qVj1DN1YlYzUyvBiFJr9H:aW+gctRQoPT5y8j12YzUUuH
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\index.html
Size 20KB
SHA256 2e021cb3a05785a9ff37b7e242aa906885cb478fc1f432a60445818ce62ffa75
MD5 2527cffc045f9d6ee9963995bbb347f8
SHA1 2e9de521188aeef5b872db3817b7d7f5a56229fc
SHA512 976a378cf0161efcaba4d26aa436e0d0338a0c9661e2111dfe82a336daa7638f0701277bb17b7bc0e97011a3a3f1d7a6fd31f0b390a769c7e1de8b627bf33509
SSDEEP 192:DgNbWj9DeNPkvHmY740TqmtRCtmK8WbIEgHZMlxh8Br9LJNHab4SrgJnc50/930i:ENHwTaMSGnBJuy05SN1
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\app.js
Size 21KB
SHA256 a14fcaf11a16ad7d904960538ca35d5b05e1c1b6a916f228db6b319c6195acbb
MD5 f718bd3f18dd499612623852cd2a2135
SHA1 9432b7898f655fbbd8132f4b3f8822959ae3ff97
SHA512 90a697f93f239e8210ad47b6f012d3b40ea9c23a92ab909434d0e2d71bc3d9663d1aa73c64646e3dbf417f9636d1190b3d0cf20d349456dee6b6b8d5536d0338
SSDEEP 384:4X+acDQrcljKdZGb9plmt902wjI3A4nzwF52xxYRifG6wBEoR3FGHWdeLj8T:0+acDQYlOdEbdmXH3A4nzIAnGifG11RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

block_inputs.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\block_inputs.js
Size 789B
SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
MD5 b5b52c92b90f4283a761cb8a40860c75
SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
MD5 SHA1 SHA512

Submit Download

cmp.bundle.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\libs\cmp.bundle.js
Size 345KB
SHA256 72c175869741f5c0a8efab49cb07690188934c7399bd1495e5b7a6f2555ca7f5
MD5 0ebda2a1fd9d91e0aea085bbed473b98
SHA1 eb496b3e8d8c8c872b07a71649045a2c46065031
SHA512 444a2f0d331e576b907a3e59d918357468b6adcfad110b756a471e68911f4a5a392e12ce20d1eef13bcbbbca5776ce461b845679135ac1cf5f510cfe62fb3459
SSDEEP 3072:vSDSLzJgAxPFNRfMHT2kDkNAJOQSPXwGtkLxrtQ8OaxPyf:bxgAxPG28kNvwGtspi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jquery-1.10.2.min.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\libs\jquery-1.10.2.min.js
Size 90KB
SHA256 bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144
MD5 44e3f0db3e4ab6fedc5758c05cf27591
SHA1 2d408aa1d35661019c95adcc60b78c0727ed25b4
SHA512 4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc
SSDEEP 1536:O4mCgi8DyCuXXFiJ+L0kJQsJVPEKuQRZdC/RAfDknv+p0WzH/Io9Z7qABZnu0JFV:OGsKYAI2p0WP9bDrJ7fak
MD5 SHA1 SHA512 SSDEEP

Submit Download

notifications.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\models\notifications.js
Size 5KB
SHA256 9dd03dfc92bcb74f3725aae60e904c0a56cc84f299bbb8e863a869719f6fdd32
MD5 85afdf9897bb1236eff3afa40d15ece6
SHA1 4362bdd139458eaf4a2dcb34294b43e2d53f4a26
SHA512 4ab86c6bafba18f53f01ca913ceaa80f14900107069a1d5f65b108d35690bd8b50b1a6cdf1563fc5775909f69208dabebd139f3cf3d8576269d560d57cf9994c
SSDEEP 96:sOr8u1s9FvYYdfHsW/GZwzpJGf8mui+U8QrGjqTzoOxOYsdfHsW/GZwzpJGNjINU:sGu9yYl3rNQ8K+JQC+/5Lsl3rNOEYIo
MD5 SHA1 SHA512 SSDEEP

Submit Download

analytics.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\utils\analytics.js
Size 4KB
SHA256 c37f0699cf8ba7d9e3e0f73f1b2af65f4bdc2a31f44594ffc8c73e98b6c2fd1d
MD5 525281e9959af4c1c0d11b9243c798a1
SHA1 237a84c5b57bd132f48446d718b20640cb28c263
SHA512 fe5bafda7773e69c65dd63270e0306abcd39cb2d886b675ab8c714ae0833efde963b69623d468551a1ab37f1db1a1d457f1568f7a29d9cf0bb23bb0edcab5fc4
SSDEEP 96:LlYkmHqqVHlnZ4JGvt+QP2EvVVko3sO2LCgObNS1Tgzalh:AHq1GV+kcRObNSGza3
MD5 SHA1 SHA512 SSDEEP

Submit Download

commands.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\utils\commands.js
Size 12KB
SHA256 e874c959c7b8e4351d730d263231df7176b5062580a7d3e0a2684001b510f5d7
MD5 65015f2e2e490f6786abc0560e33e1d0
SHA1 47b5c2b3b1f9381e4d2b9d1f3d82ba62828ce28e
SHA512 a4ad579acfa6000fd8074893a6b45df74558c57afd5b957217491784fa25df370c59d9f92ff245abbdf3d26b42114cc22359ef95c4baa322e326c7e210f43edf
SSDEEP 384:7/W5HB8c36uUvJQ006W8tusv5qEWTwdSW:rFOs5
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\utils\cookies.js
Size 1KB
SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
MD5 6c60e675f8c8c68c0174b644d3a63a2a
SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
MD5 SHA1 SHA512

Submit Download

modal-events-delegate.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\utils\modal-events-delegate.js
Size 1KB
SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
MD5 117e4fdbdb0ecf211c8bd909efd337d1
SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
MD5 SHA1 SHA512

Submit Download

strings-loader.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\utils\strings-loader.js
Size 5KB
SHA256 96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf
MD5 9c94eb933d8a43dd3825e67a7e30c980
SHA1 7ec7b16af6f399219209ba5967d377040486a11b
SHA512 a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5
SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6WfwkUlx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6Wme0muXDK0W
MD5 SHA1 SHA512 SSDEEP

Submit Download

utils.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\utils\utils.js
Size 118B
SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
MD5 a0952ebeab701c05c75710c33d725e7e
SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
MD5 SHA1 SHA512

Submit Download

cri-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\cri\cri-controller.js
Size 3KB
SHA256 cee7fc5a36a01a439125be031923d7e7415ec56194255048098169a0108034b7
MD5 4e4b4a9e2d86ae3c108105078db6d730
SHA1 826946be793c999316af6c1db10523950b18ea2c
SHA512 1420065cd000ce9b9c39d27b5dc5f4055f67146e06573a03184649851c9745f0c0af2b5e35b41b5923703dd74e32f9ed95fc59a43db25f854584e319950beffe
MD5 SHA1 SHA512

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\cri\template.js
Size 1KB
SHA256 505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e
MD5 76c1ef0cb437db144c2bed53a5a8a5d7
SHA1 aaab8fff649f8e46d1e9510018118ee9abe01498
SHA512 822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e
MD5 SHA1 SHA512

Submit Download

finish-with-recommended-app-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js
Size 1KB
SHA256 5ca97132a258ed1f36e401d70ccb95be2c9e18395e6010c40f61172914477de5
MD5 eb6d6bd7e05d4477e2704dd87b57ca35
SHA1 f42672ec1e23a3f4bcc2952746d87ba8deff44be
SHA512 1402d611f910cf5078e804175fa4693b591348d3e7cf6d0a6bbe026c259eb9e0bc285233c80cb2f4690674c3e927bc72fbdcbe758826b98fd02ecb3ed82e339a
MD5 SHA1 SHA512

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\finish-with-recommended-app\template.js
Size 681B
SHA256 b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42
MD5 d1cb34b57cef7e28b9286454b197b712
SHA1 f3a964b319bab82d4eda07e126bbfd6dec35c349
SHA512 3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1
MD5 SHA1 SHA512

Submit Download

finish-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\finish\finish-controller.js
Size 1KB
SHA256 4cb4e1aa25c15ae5f2e63fa4658a8acff0ce63e0f59cb6eb634df2dfe336e2ec
MD5 138240ea22084428e9e25583e9156568
SHA1 e8bef7eab5b6e7040b996ec9504436e073444bd9
SHA512 e97b81b0ecd964e6e909019353efe4f5582f65763ac4197d754f1c4eea19cfc249900ae597fd33e29f531bb0d1c7e0f010793c59a2b0099fa75ad0b7d01ce8a7
MD5 SHA1 SHA512

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\finish\template.js
Size 1KB
SHA256 b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f
MD5 f092de7ea66d8e920b345f38537fa35d
SHA1 82d107a409f18878307ae0cefe24074db64937c4
SHA512 14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23
MD5 SHA1 SHA512

Submit Download

main-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\main\main-controller.js
Size 11KB
SHA256 84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653
MD5 15b665a5c915004e1aa7e9e11a710f7e
SHA1 7821924e42bb19d60c572ff80bbaaa04d7aaeefb
SHA512 dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02
SSDEEP 192:28RRXC9xThFzkzLZ1ksEIA6li5djpACga0U2FxVgMKV59GsZydwOVTzdfj5UEdwV:2sCHTTzkzLZhJit+y3ZydwKf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\main\template.js
Size 3KB
SHA256 63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc
MD5 a118c7724c208f12083240cafccfd10b
SHA1 f89c676a215b869626737862a08c9eb07d440211
SHA512 9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3
MD5 SHA1 SHA512

Submit Download

modal-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\modal\modal-controller.js
Size 2KB
SHA256 4565ee81ffe222b31982088b1c18850076e3acf59198ebce08118e12cbd87ea1
MD5 b04bdfd1c7d09bdbdb94a2455fdd677b
SHA1 f000ba4866ff16d75bfd6cf446763498e19b12b1
SHA512 3cb6ef0a16309046e7f407e7321eb12212b0eec09ec1a04b1d813f6c7a04546714865c3b398a93985041f598156ed905ebd23a64260801281b29ada9bc19ec5c
MD5 SHA1 SHA512

Submit Download

privacy-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\privacy\privacy-controller.js
Size 2KB
SHA256 14d9c60cd97f18e74fee2dd80b6a190eaccc526085991f356feb6b4d330a0fc3
MD5 15bbec339f5046f525e3aa96d36c30ec
SHA1 f73d40bf06584737fe327f1eec6f4b0446545226
SHA512 2b0edfd2d5efb3f739e56eb6f3bcfae4789af3e1639f5f8e5f7530f5af10eb1a61464d665c9d9b2f4eb3796f2445108599d8bea75f1709aa562feebee519da4e
MD5 SHA1 SHA512

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\privacy\template.js
Size 655B
SHA256 95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8
MD5 cf8d2c26520d7c84e560dfa79e31dcd3
SHA1 716f2ec17480d5cc9c145bc147833fbfc39d36f0
SHA512 d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b
MD5 SHA1 SHA512

Submit Download

progress-1-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\progress\progress-1-controller.js
Size 1KB
SHA256 838bab990ce38372dfedb50eb0a270db705811729630ab8557c08bd1e9e8e105
MD5 82f0b997ed552c52a510a9f2ab29dc3a
SHA1 92aec3a656053c71eccdde610130f5d8008fa96f
SHA512 ecf67f877002d746eff8af3a50155aa381513ddafd17b6bff0188c85f0765579fea0112e82e1371f962b1f5decc94b65e6120f21fb516533dac35a2d541065bf
MD5 SHA1 SHA512

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\progress\template.js
Size 242B
SHA256 a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab
MD5 92b145e6649ba0add3dee9a69d3fa91e
SHA1 4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d
SHA512 747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751
MD5 SHA1 SHA512

Submit Download

settings-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\settings\settings-controller.js
Size 6KB
SHA256 b5c5dc5e0684fd97eb4c45896dc1c2de8a6a6fdc63b6aa83a99103c15787ef35
MD5 378c18dd7d5cee6ca7c4ddd0396b535b
SHA1 d5f81d4fab29201fd1629dc4d8e6f918c0c30479
SHA512 c29416b3f0245f4826d857dc8c52c969071d2410c945bda96f38f59a9bc7137ee534d84865e5ac55a1e3cea6bb705c5d592725af709cd97e7f38ff05dbaafe5b
SSDEEP 96:5RFTr5TvuTlpwWXs/t2V9OqIJ6OFGR+4V6RjTmoSrOlidbtmfPNVC8V/pGHmI4Rj:5RFBjugWX8YV9UAf+4CeoSrGWmNh
MD5 SHA1 SHA512 SSDEEP

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\settings\template.js
Size 4KB
SHA256 8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f
MD5 28513de0830383a516028e4a6e7585a0
SHA1 d31fc3a6f4a3ce6c4afb82ff2342a1ed718809e5
SHA512 0f7321c2ae13145bb694368dae1b74e6fe20e6b09712da2178bc46e6aa65223ab84c38abbf0ed074c85b42dba1a238a5f3f8d1ae060a0af6df748c5befe11b61
SSDEEP 48:Zx8LQmDdbaoFRpm4+0A2AEeQmDdbaoFCpm4+0A2AW:wpm4+5nHym4+5nW
MD5 SHA1 SHA512 SSDEEP

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\welcome\template.js
Size 1KB
SHA256 42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb
MD5 17f54fca6723b983875d940d931e0afb
SHA1 01774cd5cea36bd74c80a708d6f77567e8091024
SHA512 401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038
MD5 SHA1 SHA512

Submit Download

welcome-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\js\windows\welcome\welcome-controller.js
Size 2KB
SHA256 6155691dbdd66290109afb91617f9cf68af6bd912991d5d27b922f5faa7f530b
MD5 50f676754862a2ab47a582dd4d79ecf3
SHA1 1cb2f4b11f9f8cfc8dc57ff29d0256dec4811158
SHA512 ccfc89e08fd36f0a694fcda17efb84ca285b6c62afe2e3a794fdad19b6882a4b618645f4d9171673ba56fb4c55fce336d6b8d26dec3a5cc11293ae2b211f499f
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\app\manifest.json
Size 691B
SHA256 2ea1bbad7a491a75f3dc6b1e11660e7c10dc7eea980fe72459bd45e0cab39f26
MD5 5cea9bbe1d94bc488fbf65a1e58079c3
SHA1 59a5b9cf9c460b260f52c60a736b17d342469b2a
SHA512 6e28dfda565b2293d743a2269a6d65fa6ee1c1dbaec8785b068c51d79ea8a87a827b052a73d1405555911dc0cfbfb9d8da0ac3932ab7aed29a5785a35565c339
MD5 SHA1 SHA512

Submit Download

log4net.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\log4net.dll
Size 270KB
SHA256 ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309
MD5 f15c8a9e2876568b3910189b2d493706
SHA1 32634db97e7c1705286cb1ac5ce20bc4e0ec17af
SHA512 805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e
SSDEEP 3072:F+8gmdoxSO7ZbQFroo7RVir/dtnK0sgdnogtHcU5qFG1RSGCkE9kKn7GCcaLoWnS:I1N8LLI/PK0scnodG1RS1T93caLQD
MD5 SHA1 SHA512 SSDEEP

Submit Download

uac.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\uac.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nso8EF3.tmp\utils.dll
Size 55KB
SHA256 1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8
MD5 aad3f2ecc74ddf65e84dcb62cf6a77cd
SHA1 1e153e0f4d7258cae75847dba32d0321864cf089
SHA512 8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2
SSDEEP 768:SmLFb5dc9LS+8dayUhaPxYkkLE53UEDNnxqWLb1pA26Mbdv03whn:SmLFtd9+O0fkV7xpD6wd0ghn
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallerTrace_2024-07-26_08-19_5116.log

Path C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2024-07-26_08-19_5116.log
Size 951B
SHA256 d849dc3e163e691543b8eb07726b94d831d5e179b08224105782f438fd241f5f
MD5 6e3327dc253a443d8af9d862ee8935b2
SHA1 b8a4264a1c78a0371b23304711878f204f32e3ae
SHA512 2c4f735ca0fe9bd76870ae59113846ccda5d0806d3caae69b4419c573dbd0e7926fe97174b2855b71072f1cacb8fd3cab4d1099189bfb113c7122c728d789088
MD5 SHA1 SHA512

Submit Download

memory/5116-219-0x0000018B74AB0000-0x0000018B75256000-memory.dmp

Download

memory/5116-160-0x00000183719B0000-0x0000018371A60000-memory.dmp

Download

memory/5116-221-0x0000018372510000-0x00000183726C3000-memory.dmp

Download

memory/5116-222-0x00007FFFC4540000-0x00007FFFC5002000-memory.dmp

Download

memory/5116-150-0x0000018358E60000-0x0000018358E78000-memory.dmp

Download

memory/5116-179-0x0000018371930000-0x0000018371952000-memory.dmp

Download

memory/5116-182-0x00007FFFC4540000-0x00007FFFC5002000-memory.dmp

Download

memory/5116-146-0x0000018358E90000-0x0000018358ED6000-memory.dmp

Download

memory/5116-144-0x00007FFFC4540000-0x00007FFFC5002000-memory.dmp

Download

memory/5116-143-0x0000018371BA0000-0x00000183720C8000-memory.dmp

Download

memory/5116-142-0x0000018358C90000-0x0000018358CA4000-memory.dmp

Download

memory/5116-140-0x00000183715C0000-0x0000018371664000-memory.dmp

Download

memory/5116-136-0x0000018357060000-0x00000183570AC000-memory.dmp

Download

memory/5116-135-0x00007FFFC4543000-0x00007FFFC4545000-memory.dmp

Download

memory/5116-186-0x00007FFFC4540000-0x00007FFFC5002000-memory.dmp

Download

memory/5116-204-0x00007FFFC4540000-0x00007FFFC5002000-memory.dmp

Download