bdd9118a40c55650c4414cf9148dee9de9ee60d421be7e8732b6c3585dea5a58

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hone - Installer.exe
Size 2.1MB
Sample240919-fxkmessgkl
SHA256 bdd9118a40c55650c4414cf9148dee9de9ee60d421be7e8732b6c3585dea5a58
MD5 abff89d4f7d262cfa2ce6afedf2bfdf6
SHA1 4c8955a96e6fd4bb2c613b566bdc0ca60f6f469c
SHA512 de80708cf9e15710a4645024e98da90c6e511995c4de6e39b8e690b01d26111f187df09908ae63768334baca51dbbd418cff5c6a6466730be82dd90631816dae
SSDEEP 49152:m/s8bxE87vxpsrFpIvjRy1up/g1fs+YgNTPxr1cUq:mk8VPN+TIvj81upGf6wTI
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3132	OWinstaller.exe

Loads dropped DLL 11 IoCs

pid	Process
1052	Hone - Installer.exe
1052	Hone - Installer.exe
1052	Hone - Installer.exe
1052	Hone - Installer.exe
1052	Hone - Installer.exe
1052	Hone - Installer.exe
1052	Hone - Installer.exe
3132	OWinstaller.exe
3132	OWinstaller.exe
3132	OWinstaller.exe
3132	OWinstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hone - Installer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3132	OWinstaller.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3132	OWinstaller.exe
3132	OWinstaller.exe
3132	OWinstaller.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 3132	1052	Hone - Installer.exe	84
PID 1052 wrote to memory of 3132	1052	Hone - Installer.exe	84

C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\OWinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\OWinstaller.exe" Sel=0&Extension=mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc&Name=Hone&Referer=hone.gg&Browser=firefox -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --eula-url=https://hone.gg/terms --privacy-url=https://hone.gg/privacy --silent-setup --app-name="Hone" --auto-close -exepath C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SettingsPageBasic.xml

Path C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml
Size 752B
SHA256 1f7a614162798caa77970105765c2618ccd4cbc1b32d6e850bc52951cca3f919
MD5 e7774cc17dad9ddaf47a7d74c0a083fe
SHA1 3d691054aaa533e3f57c0f23f03baf67580e3cd0
SHA512 e779fa3c52f5bc4b0e30b9a56fb576a2e7661727ef0bb6fa55b827381189cbc647fd9cb0874772d2c7903b7b4bad7eed795337a7b342464a1f1cba42159d9e73
MD5 SHA1 SHA512

Submit Download

CommandLine.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\CommandLine.dll
Size 71KB
SHA256 dd954bc5c2f8ead7580ee492a242ea3f09dc07b601bfadd1ab5ac804fc54da01
MD5 29d9046304542e1ce30eba022c49dfcc
SHA1 b93d5a7adae25e6a0bdbb53cc86e39684effa70b
SHA512 ecb1c1317e2c8b7681944b0ebc289da68564166c9b4d4a90897b5788893f03406977265ce4c745315d73562bd5523d02195b095ac055b791ff4a39da81edebb0
SSDEEP 1536:vZj9JT17qpL/6ePMqBNzrstoJSkrjbgbwziN3hwg7P9xv:vx9JT17WPMqBNWAkbwziUgX
MD5 SHA1 SHA512 SSDEEP

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\INetC.dll
Size 34KB
SHA256 0ecf8b76a413726d2a9c10213ad6e406211330e9e79cfde5024968eedc64a750
MD5 87050902acf23fa5aa6d6aa61703db97
SHA1 d5555e17151540095a8681cd892b79bce8246832
SHA512 d75d3fc84a61887ee63bad3e5e38f6df32446fd5c17bedce3edca785030b723b13134b09a9bbbbaca86d5ea07405b8c4afd524cc156a8c1d78f044a22dee9eab
SSDEEP 384:5v1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJbIYiPWMirgAM+o/o:51AvEs3HBLzYn29vYhkYiPoEAMxkE1e
MD5 SHA1 SHA512 SSDEEP

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\Newtonsoft.Json.dll
Size 692KB
SHA256 7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13
MD5 98cbb64f074dc600b23a2ee1a0f46448
SHA1 c5e5ec666eeb51ec15d69d27685fe50148893e34
SHA512 eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147
SSDEEP 12288:p9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3SH:p8m657w6ZBLmkitKqBCjC0PDgM5CH
MD5 SHA1 SHA512 SSDEEP

Submit Download

OWInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\OWInstaller.exe
Size 304KB
SHA256 d6fa8cb9a2a82fa6bc2b344d5d2708f1b3a3145a8054e26f50e9454182f431e4
MD5 dea51bccf2e3866ec42047819e19fb59
SHA1 ee857cfd60ee52e8c49a446b9aee64014eb0b0d4
SHA512 0ff726c81b88231466a831a0cce6d679cb2584a120aa3f641851104a013aab089b6967a490aa7c7b3ce3d3d97349e92bec187f24feae26c34b780a84a42b5b69
SSDEEP 6144:qJ61PK8mmRY3Z1LdfxO9bKnoSIm9U0WqGq2Vfplnxc/:qE5K3/LdZXoS00uK/
MD5 SHA1 SHA512 SSDEEP

Submit Download

OWinstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\OWinstaller.exe.config
Size 632B
SHA256 272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827
MD5 82d22e4e19e27e306317513b9bfa70ff
SHA1 ff3c7dd06b7fff9c12b1beaf0ca32517710ac161
SHA512 b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9
MD5 SHA1 SHA512

Submit Download

OverWolf.Client.CommonUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\OverWolf.Client.CommonUtils.dll
Size 650KB
SHA256 ac480a104d0ec21bb96ec6e5ea3418a3118ea80a07426dcd2e1e01ff41147f40
MD5 f927b95203a3d1d253938ead1f8143c6
SHA1 271c063b1d5aaf64ae05677ed765781a4a43e8e7
SHA512 c71e6870b5f9a381e896d870efe2cb0226f02624d62e180a3878e4d1353727da08044eee44ef7ec4ebd692eb5bd4639b0b7d48ff174ff50f51cf32c585d9a8c2
SSDEEP 12288:vIdIkrU4WLWY5smdHlAdHBcb1nB0LFYxTl7Rj938:xzlOVM1nBoFylB938
MD5 SHA1 SHA512 SSDEEP

Submit Download

SharpRaven.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\SharpRaven.dll
Size 82KB
SHA256 cd53520a046058fd26cf0051bff47051948d3b7932234a90a60e3e59e57d6361
MD5 551a0903c6598fb93777fb10fcd11e3e
SHA1 2970874eebf32677338f619e77ce8901b4ef96a8
SHA512 1186e6c3ae3ff9d392fda5b517d3962357c78af872a7a457b553cd2b84ccf8a399fdaebbb3d3ca60e130b04825e1a1663dc6931644b0a7f1de5fba6b07ec5e5d
SSDEEP 1536:Ma9qjviI1YjOrfRK9bvyyfpHbnzDwkH7PNx+:MEuqI1lRKbvyyB7nlHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\System.dll
Size 21KB
SHA256 4dbc79d2b1c7987cc64bb5d014db81bb5108bdd6d8bf3a5f820fac1ded62be33
MD5 51bd16a2ea23ae1e7a92cedc6785c82e
SHA1 a9fbaeb9a695b9f2ba8a3ed8f0d95d2bf6a3d36c
SHA512 66ffc18b2daf6c4cba01aef0e4af2f006a51aa218eab0f21dc66e47eea0389d2b1748ef0e30d2ec9f0123fd7f38ed3aee964dd6bde5779aaee19ebf55369af79
SSDEEP 384:ASUmlw9T7DmnI5+N273FPlIYiPWfPJsaAM+o/8E9VF0NySk/bF:ASYTrINE3cYiPmvAMxkEt/Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\UserInfo.dll
Size 14KB
SHA256 a27dc3069793535cb64123c27dca8748983d133c8fa5aaddee8cdbc83f16986d
MD5 1dd4ca0f4a94155f8d46ec95a20ada4a
SHA1 5869f0d89e5422c5c4ad411e0a6a8d5b2321ff81
SHA512 f4914edc0357af44ed2855d5807c99c8168b305e6b7904dc865771ad0ee90756038612fe69c67b459c468396d1d39875395b1c8ec69e6da559fb92859204763e
SSDEEP 192:9xvcecVMIYiYF8tO7zhjjWvp9A5K+o/y2sE9jBF0Ny+aiQE7:kruIYiPWhjjWvHAM+o/8E9VF0Nyp6
MD5 SHA1 SHA512 SSDEEP

Submit Download

LatoLatin-Regular.eot

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\assets\fonts\lato\LatoLatin-Regular.eot
Size 66KB
SHA256 c6c970b103b3c3aa83f7a45172619a4451ea5f015f9f3ef4fd08c9a4aa895cbc
MD5 6cfad5881181ae658a6efdd68889a690
SHA1 5b54f6ccc20ed3a078fbdf94d7a68ac80002624d
SHA512 ddd3d43540eb3d4eef48d0834136de1e7bf23a52f286d0a666cf57c7d685aadf1cea6d37c88f9d7ce5ad6143d7c3213f54b16a11f616b7dce154bba50997bbe7
SSDEEP 1536:Y3UqIyK9PLLUbTiyEl4u9Iau0j6aEPmFm/MsE+Eas7AdCtkUq:EUqIyK9T4bTiF99f2PmFm/PpEL7A8tkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\images\icon.ico
Size 14KB
SHA256 81c69b545c347e1708603fb912511d8eddf755cb27f37fdc6a6fd959c6cfb94e
MD5 9a03fbfd56d8e501797359aac3d72ed1
SHA1 b31e87a87486c00f9266559707e2cae4831f9d44
SHA512 29eb96fe4bdded257f3330672b1f9f2086c28e1e863a093a6fb750b6e59210b47b5ed481e3828442f38c5c6d63ef37709716af1e3913afdf37bf8e574f976fb4
SSDEEP 96:HFyYSp0Iv2Zmb4sMqEDj/lHVECA07bOMmsAwG6cS:lNSp0Iv2ZmbZMqEf/lyCJ+JB/6cS
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\index.html
Size 20KB
SHA256 f15c54f4ac4f55bcfa281b668220eb144e63b9de2292e970095a4dc566209682
MD5 6d8c9edde0ce101ce0abd73be45c684a
SHA1 ce6d94d2d1a7f4761438781affd3aa991018e4f5
SHA512 06f35ece48e4e19174da18ecc5dcac3a7e4d7ffbb102c4859221c7c569027ca72e40c9ed945872bf4396bc02ced7ae46655c88e3ec40d0a2f2e3bd0fcec80203
SSDEEP 192:DgNbdqnDNlPkZHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ1Hab4OJgJnc5w/93gb:ENMO3aMOUnbCky05SN1
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\app.js
Size 21KB
SHA256 993f140f9f4e5cdbdcc657a3c159328bf58b3483dbc27c451516a556763a79ba
MD5 de88fce9253d26e0c61daa1783baa775
SHA1 07c5848354a247056baad369059aac9d3c940ecc
SHA512 71ddd47ef7ed7c02fb31e8ffa2ea6d1b5178dbda2ab37bac208e088c8ba2127e0cf5eaa74ee7ad5809fa69e534853312c6c8775c68aeda63bf0e4a5caefa39b7
SSDEEP 384:4X+ycDQrcljKdZGb9plmt902wjI3A4nzwF52xxYRifG6wBEoR3FGHWdeLj8T:0+ycDQYlOdEbdmXH3A4nzIAnGifG11RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

block_inputs.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\block_inputs.js
Size 789B
SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
MD5 b5b52c92b90f4283a761cb8a40860c75
SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
MD5 SHA1 SHA512

Submit Download

cmp.bundle.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\libs\cmp.bundle.js
Size 346KB
SHA256 630a2295e409485e27a06aac96a49f04d553f3ba299799e26a496776d3583325
MD5 931c0aea91b1daf5c4936edac6a4ca1a
SHA1 78c35061126c76a97a42df7b8ca0639ae52712a8
SHA512 a237db9a0d973d5a07d36b98586d099b4a9277ff125f8cdda52f515bd5d1ce0fe82bc0ca8e3f9396a7eea625e8d8da0b5c39963b580320ca7a6eb5f461e017f4
SSDEEP 3072:vSDSLzJgixPFNRISHo2kDkNAJOQSPXwGtkLxrtQ8OaxPyf:bxgixP+28kNvwGtspi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jquery-1.10.2.min.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\libs\jquery-1.10.2.min.js
Size 90KB
SHA256 bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144
MD5 44e3f0db3e4ab6fedc5758c05cf27591
SHA1 2d408aa1d35661019c95adcc60b78c0727ed25b4
SHA512 4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc
SSDEEP 1536:O4mCgi8DyCuXXFiJ+L0kJQsJVPEKuQRZdC/RAfDknv+p0WzH/Io9Z7qABZnu0JFV:OGsKYAI2p0WP9bDrJ7fak
MD5 SHA1 SHA512 SSDEEP

Submit Download

notifications.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\models\notifications.js
Size 5KB
SHA256 9dd03dfc92bcb74f3725aae60e904c0a56cc84f299bbb8e863a869719f6fdd32
MD5 85afdf9897bb1236eff3afa40d15ece6
SHA1 4362bdd139458eaf4a2dcb34294b43e2d53f4a26
SHA512 4ab86c6bafba18f53f01ca913ceaa80f14900107069a1d5f65b108d35690bd8b50b1a6cdf1563fc5775909f69208dabebd139f3cf3d8576269d560d57cf9994c
SSDEEP 96:sOr8u1s9FvYYdfHsW/GZwzpJGf8mui+U8QrGjqTzoOxOYsdfHsW/GZwzpJGNjINU:sGu9yYl3rNQ8K+JQC+/5Lsl3rNOEYIo
MD5 SHA1 SHA512 SSDEEP

Submit Download

analytics.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\utils\analytics.js
Size 4KB
SHA256 c37f0699cf8ba7d9e3e0f73f1b2af65f4bdc2a31f44594ffc8c73e98b6c2fd1d
MD5 525281e9959af4c1c0d11b9243c798a1
SHA1 237a84c5b57bd132f48446d718b20640cb28c263
SHA512 fe5bafda7773e69c65dd63270e0306abcd39cb2d886b675ab8c714ae0833efde963b69623d468551a1ab37f1db1a1d457f1568f7a29d9cf0bb23bb0edcab5fc4
SSDEEP 96:LlYkmHqqVHlnZ4JGvt+QP2EvVVko3sO2LCgObNS1Tgzalh:AHq1GV+kcRObNSGza3
MD5 SHA1 SHA512 SSDEEP

Submit Download

commands.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\utils\commands.js
Size 13KB
SHA256 acbf59ce6aa668880f65aab2bfe62305415c76301b40bc7f72777f0b08840b71
MD5 a25b49d085333ece9aadd1f285795925
SHA1 53341dcca297a969a8ff37265935488f1790307e
SHA512 0a2cb6f4e1af0c4205e38ba1e12c208e6ea4f8f8e3956c9d10b312aa9a6929b99ec967aee7aa1f54da97ca6ea354f8bd7f624359cfd05c6241a5f4bf59843b68
SSDEEP 384:PUr5HB8c31uUvJQ006W8tusv5qEWOddSd:PVhs0
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\utils\cookies.js
Size 1KB
SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
MD5 6c60e675f8c8c68c0174b644d3a63a2a
SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
MD5 SHA1 SHA512

Submit Download

modal-events-delegate.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\utils\modal-events-delegate.js
Size 1KB
SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
MD5 117e4fdbdb0ecf211c8bd909efd337d1
SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
MD5 SHA1 SHA512

Submit Download

strings-loader.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\utils\strings-loader.js
Size 5KB
SHA256 96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf
MD5 9c94eb933d8a43dd3825e67a7e30c980
SHA1 7ec7b16af6f399219209ba5967d377040486a11b
SHA512 a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5
SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6WfwkUlx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6Wme0muXDK0W
MD5 SHA1 SHA512 SSDEEP

Submit Download

utils.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\utils\utils.js
Size 118B
SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
MD5 a0952ebeab701c05c75710c33d725e7e
SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
MD5 SHA1 SHA512

Submit Download

cri-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\cri\cri-controller.js
Size 3KB
SHA256 cee7fc5a36a01a439125be031923d7e7415ec56194255048098169a0108034b7
MD5 4e4b4a9e2d86ae3c108105078db6d730
SHA1 826946be793c999316af6c1db10523950b18ea2c
SHA512 1420065cd000ce9b9c39d27b5dc5f4055f67146e06573a03184649851c9745f0c0af2b5e35b41b5923703dd74e32f9ed95fc59a43db25f854584e319950beffe
MD5 SHA1 SHA512

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\cri\template.js
Size 1KB
SHA256 505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e
MD5 76c1ef0cb437db144c2bed53a5a8a5d7
SHA1 aaab8fff649f8e46d1e9510018118ee9abe01498
SHA512 822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e
MD5 SHA1 SHA512

Submit Download

finish-with-recommended-app-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js
Size 1KB
SHA256 5ca97132a258ed1f36e401d70ccb95be2c9e18395e6010c40f61172914477de5
MD5 eb6d6bd7e05d4477e2704dd87b57ca35
SHA1 f42672ec1e23a3f4bcc2952746d87ba8deff44be
SHA512 1402d611f910cf5078e804175fa4693b591348d3e7cf6d0a6bbe026c259eb9e0bc285233c80cb2f4690674c3e927bc72fbdcbe758826b98fd02ecb3ed82e339a
MD5 SHA1 SHA512

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\finish-with-recommended-app\template.js
Size 681B
SHA256 b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42
MD5 d1cb34b57cef7e28b9286454b197b712
SHA1 f3a964b319bab82d4eda07e126bbfd6dec35c349
SHA512 3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1
MD5 SHA1 SHA512

Submit Download

finish-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\finish\finish-controller.js
Size 1KB
SHA256 4cb4e1aa25c15ae5f2e63fa4658a8acff0ce63e0f59cb6eb634df2dfe336e2ec
MD5 138240ea22084428e9e25583e9156568
SHA1 e8bef7eab5b6e7040b996ec9504436e073444bd9
SHA512 e97b81b0ecd964e6e909019353efe4f5582f65763ac4197d754f1c4eea19cfc249900ae597fd33e29f531bb0d1c7e0f010793c59a2b0099fa75ad0b7d01ce8a7
MD5 SHA1 SHA512

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\finish\template.js
Size 1KB
SHA256 b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f
MD5 f092de7ea66d8e920b345f38537fa35d
SHA1 82d107a409f18878307ae0cefe24074db64937c4
SHA512 14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23
MD5 SHA1 SHA512

Submit Download

main-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\main\main-controller.js
Size 11KB
SHA256 84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653
MD5 15b665a5c915004e1aa7e9e11a710f7e
SHA1 7821924e42bb19d60c572ff80bbaaa04d7aaeefb
SHA512 dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02
SSDEEP 192:28RRXC9xThFzkzLZ1ksEIA6li5djpACga0U2FxVgMKV59GsZydwOVTzdfj5UEdwV:2sCHTTzkzLZhJit+y3ZydwKf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\main\template.js
Size 3KB
SHA256 63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc
MD5 a118c7724c208f12083240cafccfd10b
SHA1 f89c676a215b869626737862a08c9eb07d440211
SHA512 9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3
MD5 SHA1 SHA512

Submit Download

modal-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\modal\modal-controller.js
Size 2KB
SHA256 4565ee81ffe222b31982088b1c18850076e3acf59198ebce08118e12cbd87ea1
MD5 b04bdfd1c7d09bdbdb94a2455fdd677b
SHA1 f000ba4866ff16d75bfd6cf446763498e19b12b1
SHA512 3cb6ef0a16309046e7f407e7321eb12212b0eec09ec1a04b1d813f6c7a04546714865c3b398a93985041f598156ed905ebd23a64260801281b29ada9bc19ec5c
MD5 SHA1 SHA512

Submit Download

privacy-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\privacy\privacy-controller.js
Size 2KB
SHA256 14d9c60cd97f18e74fee2dd80b6a190eaccc526085991f356feb6b4d330a0fc3
MD5 15bbec339f5046f525e3aa96d36c30ec
SHA1 f73d40bf06584737fe327f1eec6f4b0446545226
SHA512 2b0edfd2d5efb3f739e56eb6f3bcfae4789af3e1639f5f8e5f7530f5af10eb1a61464d665c9d9b2f4eb3796f2445108599d8bea75f1709aa562feebee519da4e
MD5 SHA1 SHA512

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\privacy\template.js
Size 655B
SHA256 95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8
MD5 cf8d2c26520d7c84e560dfa79e31dcd3
SHA1 716f2ec17480d5cc9c145bc147833fbfc39d36f0
SHA512 d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b
MD5 SHA1 SHA512

Submit Download

progress-1-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\progress\progress-1-controller.js
Size 1KB
SHA256 838bab990ce38372dfedb50eb0a270db705811729630ab8557c08bd1e9e8e105
MD5 82f0b997ed552c52a510a9f2ab29dc3a
SHA1 92aec3a656053c71eccdde610130f5d8008fa96f
SHA512 ecf67f877002d746eff8af3a50155aa381513ddafd17b6bff0188c85f0765579fea0112e82e1371f962b1f5decc94b65e6120f21fb516533dac35a2d541065bf
MD5 SHA1 SHA512

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\progress\template.js
Size 242B
SHA256 a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab
MD5 92b145e6649ba0add3dee9a69d3fa91e
SHA1 4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d
SHA512 747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751
MD5 SHA1 SHA512

Submit Download

settings-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\settings\settings-controller.js
Size 6KB
SHA256 b5c5dc5e0684fd97eb4c45896dc1c2de8a6a6fdc63b6aa83a99103c15787ef35
MD5 378c18dd7d5cee6ca7c4ddd0396b535b
SHA1 d5f81d4fab29201fd1629dc4d8e6f918c0c30479
SHA512 c29416b3f0245f4826d857dc8c52c969071d2410c945bda96f38f59a9bc7137ee534d84865e5ac55a1e3cea6bb705c5d592725af709cd97e7f38ff05dbaafe5b
SSDEEP 96:5RFTr5TvuTlpwWXs/t2V9OqIJ6OFGR+4V6RjTmoSrOlidbtmfPNVC8V/pGHmI4Rj:5RFBjugWX8YV9UAf+4CeoSrGWmNh
MD5 SHA1 SHA512 SSDEEP

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\settings\template.js
Size 4KB
SHA256 8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f
MD5 28513de0830383a516028e4a6e7585a0
SHA1 d31fc3a6f4a3ce6c4afb82ff2342a1ed718809e5
SHA512 0f7321c2ae13145bb694368dae1b74e6fe20e6b09712da2178bc46e6aa65223ab84c38abbf0ed074c85b42dba1a238a5f3f8d1ae060a0af6df748c5befe11b61
SSDEEP 48:Zx8LQmDdbaoFRpm4+0A2AEeQmDdbaoFCpm4+0A2AW:wpm4+5nHym4+5nW
MD5 SHA1 SHA512 SSDEEP

Submit Download

template.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\welcome\template.js
Size 1KB
SHA256 42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb
MD5 17f54fca6723b983875d940d931e0afb
SHA1 01774cd5cea36bd74c80a708d6f77567e8091024
SHA512 401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038
MD5 SHA1 SHA512

Submit Download

welcome-controller.js

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\js\windows\welcome\welcome-controller.js
Size 2KB
SHA256 6155691dbdd66290109afb91617f9cf68af6bd912991d5d27b922f5faa7f530b
MD5 50f676754862a2ab47a582dd4d79ecf3
SHA1 1cb2f4b11f9f8cfc8dc57ff29d0256dec4811158
SHA512 ccfc89e08fd36f0a694fcda17efb84ca285b6c62afe2e3a794fdad19b6882a4b618645f4d9171673ba56fb4c55fce336d6b8d26dec3a5cc11293ae2b211f499f
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\app\manifest.json
Size 691B
SHA256 4af83e9f905d9ea7b1aa89ad49a39c2f63005e3b06a8191880853fcef490fa17
MD5 cac2b68f5629dbb79f65b63f4e106094
SHA1 ccad7e63342172d7a96035f1004e3722409688c0
SHA512 61e7a8b4a1b73b309cde27b023dfc6ddc7ae8aedfb7f5bfed3a2ba785e01a569dfb7cfef4d2a5700dfcf23be50b14e4bc62343d2038ca93c6a9c2b517d51fff5
MD5 SHA1 SHA512

Submit Download

log4net.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\log4net.dll
Size 270KB
SHA256 ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309
MD5 f15c8a9e2876568b3910189b2d493706
SHA1 32634db97e7c1705286cb1ac5ce20bc4e0ec17af
SHA512 805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e
SSDEEP 3072:F+8gmdoxSO7ZbQFroo7RVir/dtnK0sgdnogtHcU5qFG1RSGCkE9kKn7GCcaLoWnS:I1N8LLI/PK0scnodG1RS1T93caLQD
MD5 SHA1 SHA512 SSDEEP

Submit Download

uac.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\uac.dll
Size 24KB
SHA256 10a0e8cf46038ab3b2c3cf5dce407b9a043a631cbde9a5c8bcf0a54b2566c010
MD5 861f7e800bb28f68927e65719869409c
SHA1 a12bfcd2b9950e758ead281a9afbf1895bf10539
SHA512 f2bf24a0da69bbe4b4a0f0b1bfc5af175a66b8bcc4f5cc379ed0b89166fa9ffe1e16206b41fca7260ac7f8b86f8695b76f016bb371d7642aa71e61e29a3976eb
SSDEEP 384:5GVY6ClGoWxXH75T1WVl83lLsFIYiPWc+6AM+o/8E9VF0NyOk:tBWxXH9TYqlAyYiPjAMxkEH
MD5 SHA1 SHA512 SSDEEP

Submit Download

utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6AA2.tmp\utils.dll
Size 58KB
SHA256 251ab3e2690562dcfcd510642607f206e6dcf626d06d94b74e1fa8297b1050a0
MD5 c6b46a5fcdccbf3aeff930b1e5b383d4
SHA1 6d5a8e08de862b283610bad2f6ce44936f439821
SHA512 97616475ef425421959489b650810b185488fcb02a1e90406b3014e948e66e5101df583815fd2be26d9c4d293a46b02ba4025426f743e682ed15d228f027f55c
SSDEEP 768:cmLFb5dc9LS+8dayUhaPxYkkLE53UEDNnxqWLb1pA26MbwYiPbAMxkEu:cmLFtd9+O0fkV7xpD6ww7Pbxy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3132-146-0x00000203EDC60000-0x00000203EDCA6000-memory.dmp

Download

memory/3132-142-0x00000203ED4E0000-0x00000203ED4F4000-memory.dmp

Download

memory/3132-150-0x00000203EDCD0000-0x00000203EDCE8000-memory.dmp

Download

memory/3132-188-0x00007FFEC3A50000-0x00007FFEC4511000-memory.dmp

Download

memory/3132-145-0x00007FFEC3A50000-0x00007FFEC4511000-memory.dmp

Download

memory/3132-179-0x00000203EE0A0000-0x00000203EE0C2000-memory.dmp

Download

memory/3132-143-0x00000203EE310000-0x00000203EE838000-memory.dmp

Download

memory/3132-161-0x00000203EE150000-0x00000203EE200000-memory.dmp

Download

memory/3132-140-0x00000203EDD10000-0x00000203EDDB4000-memory.dmp

Download

memory/3132-136-0x00000203EB800000-0x00000203EB84C000-memory.dmp

Download

memory/3132-134-0x00007FFEC3A53000-0x00007FFEC3A55000-memory.dmp

Download

memory/3132-182-0x00007FFEC3A50000-0x00007FFEC4511000-memory.dmp

Download

memory/3132-219-0x0000020BF21B0000-0x0000020BF2956000-memory.dmp

Download

memory/3132-185-0x00007FFEC3A50000-0x00007FFEC4511000-memory.dmp

Download

memory/3132-221-0x00007FFEC3A50000-0x00007FFEC4511000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads