Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    44s
  • max time network
    44s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2024, 23:28

General

  • Target

    Hone - Installer.exe

  • Size

    2.1MB

  • MD5

    cf2c7a8bcf7467729ac169f6b3835f74

  • SHA1

    79e9dbc0f7a2fa6bae6be4794dfa8548fd570a54

  • SHA256

    580d5b650b9197097b5f4ab51aa2cb0f6027701042397076a314be6867a868b6

  • SHA512

    9bdd0cea86c305271904d7e241951573ba03815af7848415ef9b13eeb3d307cf437306ea51861b355940bf0c793375dcf0ca4f00b31527ff2122982785d49f1a

  • SSDEEP

    49152:w4wxE87vxpsrFpIvgRfoDM0x4v2RshYs0NTXxicUA:wFPN+TIvg0MyU4bskMS

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4004
    • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\OWinstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\OWinstaller.exe" Sel=0&Extension=mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc&Name=Hone&Referer=hone.gg&Browser=firefox -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --eula-url=https://hone.gg/terms --privacy-url=https://hone.gg/privacy --silent-setup --app-name="Hone" --auto-close -exepath C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1364
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\SplitUnlock.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff97c2c46f8,0x7ff97c2c4708,0x7ff97c2c4718
      2⤵
        PID:3764
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,197985336515473767,12819724934326797855,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        2⤵
          PID:3200
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,197985336515473767,12819724934326797855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2288
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,197985336515473767,12819724934326797855,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
          2⤵
            PID:5096
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,197985336515473767,12819724934326797855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
            2⤵
              PID:1464
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,197985336515473767,12819724934326797855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
              2⤵
                PID:4528
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,197985336515473767,12819724934326797855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
                2⤵
                  PID:1452
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,197985336515473767,12819724934326797855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3344
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,197985336515473767,12819724934326797855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
                  2⤵
                    PID:228
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,197985336515473767,12819724934326797855,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
                    2⤵
                      PID:3164
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,197985336515473767,12819724934326797855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
                      2⤵
                        PID:3984
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,197985336515473767,12819724934326797855,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                        2⤵
                          PID:2372
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:1968
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:400

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            7de1bbdc1f9cf1a58ae1de4951ce8cb9

                            SHA1

                            010da169e15457c25bd80ef02d76a940c1210301

                            SHA256

                            6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

                            SHA512

                            e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            85ba073d7015b6ce7da19235a275f6da

                            SHA1

                            a23c8c2125e45a0788bac14423ae1f3eab92cf00

                            SHA256

                            5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

                            SHA512

                            eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            18f4eb869f845a2e46424d4c46c08856

                            SHA1

                            09e6f1e4912b5e2d6cdce6ed85839462f3838123

                            SHA256

                            826449c3c32ba816df7398c9738c0db619fdaf84a3457b84576aa8ddad73264f

                            SHA512

                            c42421ec114bf342d2bb93c3e9203f83190671bdf09ac88b18eefbd5729fd23a52036c7543d831dc6e72a0ac838cb470135e5be0ec117b4c256ecbad8af83453

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                          • C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml

                            Filesize

                            752B

                            MD5

                            f56d50f675314762dc1d783ff24617a8

                            SHA1

                            e46b1e024b2dc6e05287bb40d5a70c0adc4d1bcd

                            SHA256

                            3464a7117a30cd88b8f5b995363d19c526d1201aadb85d525ca4e1d86aaed769

                            SHA512

                            ef0156ec383452bce1c182db28765c39fdc0a7df628fe2fb8d76f201c6ca371c8cb95e97f5deac8774778faf88c8c9934540e94a55ddebb31739621ee861c2b4

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\CommandLine.dll

                            Filesize

                            71KB

                            MD5

                            84dcf802b8813a746374ab7c4cd1e37b

                            SHA1

                            93d6e6797dbbb7046e4fa8051a9b77a8c5e6ac2c

                            SHA256

                            65c2f0b197252a03b4cb3ba1242feba8a05aff2c684a29d8fb820d5ce57998de

                            SHA512

                            b40a6ebb7eddd6e2e558c112e679ba80ec77986a94052199717cfc05fa8df8b5d17f7e3b328116ac263d6dcc84cc11feeaad517fd7660471893d821f321bfa60

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\INetC.dll

                            Filesize

                            34KB

                            MD5

                            87050902acf23fa5aa6d6aa61703db97

                            SHA1

                            d5555e17151540095a8681cd892b79bce8246832

                            SHA256

                            0ecf8b76a413726d2a9c10213ad6e406211330e9e79cfde5024968eedc64a750

                            SHA512

                            d75d3fc84a61887ee63bad3e5e38f6df32446fd5c17bedce3edca785030b723b13134b09a9bbbbaca86d5ea07405b8c4afd524cc156a8c1d78f044a22dee9eab

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\Newtonsoft.Json.dll

                            Filesize

                            692KB

                            MD5

                            98cbb64f074dc600b23a2ee1a0f46448

                            SHA1

                            c5e5ec666eeb51ec15d69d27685fe50148893e34

                            SHA256

                            7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13

                            SHA512

                            eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\OWInstaller.exe

                            Filesize

                            310KB

                            MD5

                            cdbee041d73f8ddcc1ec6940862e8228

                            SHA1

                            c6e97e4e6299fa0987dcfdc52af341b75b5c4c15

                            SHA256

                            4e73171185764262385ddacbea5ee1565c4aff01b201d70a7fc434d1b0715550

                            SHA512

                            7afd894e2d5866c976184f9874a5e138b3bf78824221e488d249a6faf1ad378d6d44abac20f7ab0f8ef5c9133dd75fcf0215d9d0761782e842226245e184a110

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\OWinstaller.exe.config

                            Filesize

                            632B

                            MD5

                            82d22e4e19e27e306317513b9bfa70ff

                            SHA1

                            ff3c7dd06b7fff9c12b1beaf0ca32517710ac161

                            SHA256

                            272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827

                            SHA512

                            b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\OverWolf.Client.CommonUtils.dll

                            Filesize

                            652KB

                            MD5

                            7d584940a66aab5447efe1e902e22404

                            SHA1

                            eaf058ff6e72a13d16a6f5c0d716db6b89546b8c

                            SHA256

                            4f90e211c47c3c8849af671dcf13524f58839ac63cf4ab7ca3c4bb6f77bed246

                            SHA512

                            b8aa89c2bc7776a9b897be364239e57370a9cb5ecf6b486472aada2bdde7a5707f5f47b31ccff6ebd6c5dace2aeca0b74bbb358ceedad53fee70ccdff20e55a5

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\SharpRaven.dll

                            Filesize

                            82KB

                            MD5

                            db581a69376a9113521957d6f6ae9b98

                            SHA1

                            c673f743f8444db88324861d56096037f84da5a8

                            SHA256

                            acb50beb408ea0e83460625aed1b0f16366395a52833a658bf68e0c919feb191

                            SHA512

                            83632f1cd1035436efecf9ae28c1bd6df1a96bf3296160a47614de1bfb99e822ba2182c30c97cce51178e092d54de7f6aa5539d65057860b2923cf7a3d3f82b8

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\System.dll

                            Filesize

                            21KB

                            MD5

                            51bd16a2ea23ae1e7a92cedc6785c82e

                            SHA1

                            a9fbaeb9a695b9f2ba8a3ed8f0d95d2bf6a3d36c

                            SHA256

                            4dbc79d2b1c7987cc64bb5d014db81bb5108bdd6d8bf3a5f820fac1ded62be33

                            SHA512

                            66ffc18b2daf6c4cba01aef0e4af2f006a51aa218eab0f21dc66e47eea0389d2b1748ef0e30d2ec9f0123fd7f38ed3aee964dd6bde5779aaee19ebf55369af79

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\UserInfo.dll

                            Filesize

                            14KB

                            MD5

                            1dd4ca0f4a94155f8d46ec95a20ada4a

                            SHA1

                            5869f0d89e5422c5c4ad411e0a6a8d5b2321ff81

                            SHA256

                            a27dc3069793535cb64123c27dca8748983d133c8fa5aaddee8cdbc83f16986d

                            SHA512

                            f4914edc0357af44ed2855d5807c99c8168b305e6b7904dc865771ad0ee90756038612fe69c67b459c468396d1d39875395b1c8ec69e6da559fb92859204763e

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\assets\fonts\lato\LatoLatin-Regular.eot

                            Filesize

                            66KB

                            MD5

                            6cfad5881181ae658a6efdd68889a690

                            SHA1

                            5b54f6ccc20ed3a078fbdf94d7a68ac80002624d

                            SHA256

                            c6c970b103b3c3aa83f7a45172619a4451ea5f015f9f3ef4fd08c9a4aa895cbc

                            SHA512

                            ddd3d43540eb3d4eef48d0834136de1e7bf23a52f286d0a666cf57c7d685aadf1cea6d37c88f9d7ce5ad6143d7c3213f54b16a11f616b7dce154bba50997bbe7

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\images\icon.ico

                            Filesize

                            14KB

                            MD5

                            9a03fbfd56d8e501797359aac3d72ed1

                            SHA1

                            b31e87a87486c00f9266559707e2cae4831f9d44

                            SHA256

                            81c69b545c347e1708603fb912511d8eddf755cb27f37fdc6a6fd959c6cfb94e

                            SHA512

                            29eb96fe4bdded257f3330672b1f9f2086c28e1e863a093a6fb750b6e59210b47b5ed481e3828442f38c5c6d63ef37709716af1e3913afdf37bf8e574f976fb4

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\index.html

                            Filesize

                            20KB

                            MD5

                            6d8c9edde0ce101ce0abd73be45c684a

                            SHA1

                            ce6d94d2d1a7f4761438781affd3aa991018e4f5

                            SHA256

                            f15c54f4ac4f55bcfa281b668220eb144e63b9de2292e970095a4dc566209682

                            SHA512

                            06f35ece48e4e19174da18ecc5dcac3a7e4d7ffbb102c4859221c7c569027ca72e40c9ed945872bf4396bc02ced7ae46655c88e3ec40d0a2f2e3bd0fcec80203

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\app.js

                            Filesize

                            21KB

                            MD5

                            de88fce9253d26e0c61daa1783baa775

                            SHA1

                            07c5848354a247056baad369059aac9d3c940ecc

                            SHA256

                            993f140f9f4e5cdbdcc657a3c159328bf58b3483dbc27c451516a556763a79ba

                            SHA512

                            71ddd47ef7ed7c02fb31e8ffa2ea6d1b5178dbda2ab37bac208e088c8ba2127e0cf5eaa74ee7ad5809fa69e534853312c6c8775c68aeda63bf0e4a5caefa39b7

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\block_inputs.js

                            Filesize

                            789B

                            MD5

                            b5b52c92b90f4283a761cb8a40860c75

                            SHA1

                            7212e7e566795017e179e7b9c9bf223b0cdb9ec2

                            SHA256

                            f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544

                            SHA512

                            16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\libs\cmp.bundle.js

                            Filesize

                            347KB

                            MD5

                            deb60b40df89edecd35ea3d1410ef7a6

                            SHA1

                            9899f48d1b29c6a51e4b80ce0579ec4f51b72c74

                            SHA256

                            2eed337a035bfcba83bdf00686f236319bfdcdc5c5b4d57541cf855bfe4fd67a

                            SHA512

                            484daa9e6423c4aa90b310f7c957f850109afd4ef30ff0dc57e05d7ea30f9ae12dbed862197ac9f1ee99b26a7204ba14d1a95d8a8a6f5064a825e5d861fb8705

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\libs\jquery-1.10.2.min.js

                            Filesize

                            90KB

                            MD5

                            44e3f0db3e4ab6fedc5758c05cf27591

                            SHA1

                            2d408aa1d35661019c95adcc60b78c0727ed25b4

                            SHA256

                            bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144

                            SHA512

                            4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\models\notifications.js

                            Filesize

                            5KB

                            MD5

                            85afdf9897bb1236eff3afa40d15ece6

                            SHA1

                            4362bdd139458eaf4a2dcb34294b43e2d53f4a26

                            SHA256

                            9dd03dfc92bcb74f3725aae60e904c0a56cc84f299bbb8e863a869719f6fdd32

                            SHA512

                            4ab86c6bafba18f53f01ca913ceaa80f14900107069a1d5f65b108d35690bd8b50b1a6cdf1563fc5775909f69208dabebd139f3cf3d8576269d560d57cf9994c

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\utils\analytics.js

                            Filesize

                            4KB

                            MD5

                            525281e9959af4c1c0d11b9243c798a1

                            SHA1

                            237a84c5b57bd132f48446d718b20640cb28c263

                            SHA256

                            c37f0699cf8ba7d9e3e0f73f1b2af65f4bdc2a31f44594ffc8c73e98b6c2fd1d

                            SHA512

                            fe5bafda7773e69c65dd63270e0306abcd39cb2d886b675ab8c714ae0833efde963b69623d468551a1ab37f1db1a1d457f1568f7a29d9cf0bb23bb0edcab5fc4

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\utils\commands.js

                            Filesize

                            13KB

                            MD5

                            a25b49d085333ece9aadd1f285795925

                            SHA1

                            53341dcca297a969a8ff37265935488f1790307e

                            SHA256

                            acbf59ce6aa668880f65aab2bfe62305415c76301b40bc7f72777f0b08840b71

                            SHA512

                            0a2cb6f4e1af0c4205e38ba1e12c208e6ea4f8f8e3956c9d10b312aa9a6929b99ec967aee7aa1f54da97ca6ea354f8bd7f624359cfd05c6241a5f4bf59843b68

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\utils\cookies.js

                            Filesize

                            1KB

                            MD5

                            6c60e675f8c8c68c0174b644d3a63a2a

                            SHA1

                            3635a3fe07ccc4a6f33a986ddb690522d0611abb

                            SHA256

                            9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287

                            SHA512

                            1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\utils\modal-events-delegate.js

                            Filesize

                            1KB

                            MD5

                            117e4fdbdb0ecf211c8bd909efd337d1

                            SHA1

                            9f8684d856b7c95bdffb139217dfd89f41373187

                            SHA256

                            267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857

                            SHA512

                            f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\utils\strings-loader.js

                            Filesize

                            5KB

                            MD5

                            9c94eb933d8a43dd3825e67a7e30c980

                            SHA1

                            7ec7b16af6f399219209ba5967d377040486a11b

                            SHA256

                            96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf

                            SHA512

                            a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\utils\utils.js

                            Filesize

                            118B

                            MD5

                            a0952ebeab701c05c75710c33d725e7e

                            SHA1

                            1da8a2e889f1213d481ae3cd5571670c01e64adc

                            SHA256

                            b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246

                            SHA512

                            5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\cri\cri-controller.js

                            Filesize

                            3KB

                            MD5

                            4e4b4a9e2d86ae3c108105078db6d730

                            SHA1

                            826946be793c999316af6c1db10523950b18ea2c

                            SHA256

                            cee7fc5a36a01a439125be031923d7e7415ec56194255048098169a0108034b7

                            SHA512

                            1420065cd000ce9b9c39d27b5dc5f4055f67146e06573a03184649851c9745f0c0af2b5e35b41b5923703dd74e32f9ed95fc59a43db25f854584e319950beffe

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\cri\template.js

                            Filesize

                            1KB

                            MD5

                            76c1ef0cb437db144c2bed53a5a8a5d7

                            SHA1

                            aaab8fff649f8e46d1e9510018118ee9abe01498

                            SHA256

                            505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e

                            SHA512

                            822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js

                            Filesize

                            1KB

                            MD5

                            eb6d6bd7e05d4477e2704dd87b57ca35

                            SHA1

                            f42672ec1e23a3f4bcc2952746d87ba8deff44be

                            SHA256

                            5ca97132a258ed1f36e401d70ccb95be2c9e18395e6010c40f61172914477de5

                            SHA512

                            1402d611f910cf5078e804175fa4693b591348d3e7cf6d0a6bbe026c259eb9e0bc285233c80cb2f4690674c3e927bc72fbdcbe758826b98fd02ecb3ed82e339a

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\finish-with-recommended-app\template.js

                            Filesize

                            681B

                            MD5

                            d1cb34b57cef7e28b9286454b197b712

                            SHA1

                            f3a964b319bab82d4eda07e126bbfd6dec35c349

                            SHA256

                            b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42

                            SHA512

                            3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\finish\finish-controller.js

                            Filesize

                            1KB

                            MD5

                            138240ea22084428e9e25583e9156568

                            SHA1

                            e8bef7eab5b6e7040b996ec9504436e073444bd9

                            SHA256

                            4cb4e1aa25c15ae5f2e63fa4658a8acff0ce63e0f59cb6eb634df2dfe336e2ec

                            SHA512

                            e97b81b0ecd964e6e909019353efe4f5582f65763ac4197d754f1c4eea19cfc249900ae597fd33e29f531bb0d1c7e0f010793c59a2b0099fa75ad0b7d01ce8a7

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\finish\template.js

                            Filesize

                            1KB

                            MD5

                            f092de7ea66d8e920b345f38537fa35d

                            SHA1

                            82d107a409f18878307ae0cefe24074db64937c4

                            SHA256

                            b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f

                            SHA512

                            14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\main\main-controller.js

                            Filesize

                            11KB

                            MD5

                            15b665a5c915004e1aa7e9e11a710f7e

                            SHA1

                            7821924e42bb19d60c572ff80bbaaa04d7aaeefb

                            SHA256

                            84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653

                            SHA512

                            dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\main\template.js

                            Filesize

                            3KB

                            MD5

                            a118c7724c208f12083240cafccfd10b

                            SHA1

                            f89c676a215b869626737862a08c9eb07d440211

                            SHA256

                            63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc

                            SHA512

                            9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\modal\modal-controller.js

                            Filesize

                            2KB

                            MD5

                            b04bdfd1c7d09bdbdb94a2455fdd677b

                            SHA1

                            f000ba4866ff16d75bfd6cf446763498e19b12b1

                            SHA256

                            4565ee81ffe222b31982088b1c18850076e3acf59198ebce08118e12cbd87ea1

                            SHA512

                            3cb6ef0a16309046e7f407e7321eb12212b0eec09ec1a04b1d813f6c7a04546714865c3b398a93985041f598156ed905ebd23a64260801281b29ada9bc19ec5c

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\privacy\privacy-controller.js

                            Filesize

                            2KB

                            MD5

                            15bbec339f5046f525e3aa96d36c30ec

                            SHA1

                            f73d40bf06584737fe327f1eec6f4b0446545226

                            SHA256

                            14d9c60cd97f18e74fee2dd80b6a190eaccc526085991f356feb6b4d330a0fc3

                            SHA512

                            2b0edfd2d5efb3f739e56eb6f3bcfae4789af3e1639f5f8e5f7530f5af10eb1a61464d665c9d9b2f4eb3796f2445108599d8bea75f1709aa562feebee519da4e

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\privacy\template.js

                            Filesize

                            655B

                            MD5

                            cf8d2c26520d7c84e560dfa79e31dcd3

                            SHA1

                            716f2ec17480d5cc9c145bc147833fbfc39d36f0

                            SHA256

                            95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8

                            SHA512

                            d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\progress\progress-1-controller.js

                            Filesize

                            1KB

                            MD5

                            82f0b997ed552c52a510a9f2ab29dc3a

                            SHA1

                            92aec3a656053c71eccdde610130f5d8008fa96f

                            SHA256

                            838bab990ce38372dfedb50eb0a270db705811729630ab8557c08bd1e9e8e105

                            SHA512

                            ecf67f877002d746eff8af3a50155aa381513ddafd17b6bff0188c85f0765579fea0112e82e1371f962b1f5decc94b65e6120f21fb516533dac35a2d541065bf

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\progress\template.js

                            Filesize

                            242B

                            MD5

                            92b145e6649ba0add3dee9a69d3fa91e

                            SHA1

                            4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d

                            SHA256

                            a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab

                            SHA512

                            747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\settings\settings-controller.js

                            Filesize

                            6KB

                            MD5

                            378c18dd7d5cee6ca7c4ddd0396b535b

                            SHA1

                            d5f81d4fab29201fd1629dc4d8e6f918c0c30479

                            SHA256

                            b5c5dc5e0684fd97eb4c45896dc1c2de8a6a6fdc63b6aa83a99103c15787ef35

                            SHA512

                            c29416b3f0245f4826d857dc8c52c969071d2410c945bda96f38f59a9bc7137ee534d84865e5ac55a1e3cea6bb705c5d592725af709cd97e7f38ff05dbaafe5b

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\settings\template.js

                            Filesize

                            4KB

                            MD5

                            28513de0830383a516028e4a6e7585a0

                            SHA1

                            d31fc3a6f4a3ce6c4afb82ff2342a1ed718809e5

                            SHA256

                            8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f

                            SHA512

                            0f7321c2ae13145bb694368dae1b74e6fe20e6b09712da2178bc46e6aa65223ab84c38abbf0ed074c85b42dba1a238a5f3f8d1ae060a0af6df748c5befe11b61

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\welcome\template.js

                            Filesize

                            1KB

                            MD5

                            17f54fca6723b983875d940d931e0afb

                            SHA1

                            01774cd5cea36bd74c80a708d6f77567e8091024

                            SHA256

                            42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb

                            SHA512

                            401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\js\windows\welcome\welcome-controller.js

                            Filesize

                            2KB

                            MD5

                            50f676754862a2ab47a582dd4d79ecf3

                            SHA1

                            1cb2f4b11f9f8cfc8dc57ff29d0256dec4811158

                            SHA256

                            6155691dbdd66290109afb91617f9cf68af6bd912991d5d27b922f5faa7f530b

                            SHA512

                            ccfc89e08fd36f0a694fcda17efb84ca285b6c62afe2e3a794fdad19b6882a4b618645f4d9171673ba56fb4c55fce336d6b8d26dec3a5cc11293ae2b211f499f

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\app\manifest.json

                            Filesize

                            691B

                            MD5

                            ffd488977307f71e9444b598d3a22e07

                            SHA1

                            1e4b34b1ff3a838ccb765089d904f9c9076f91f7

                            SHA256

                            37e4f5ecaa49a064560abd3b4d6b680c42715287a0140a8920d2bfb147ff1f38

                            SHA512

                            ab9b93a76090665ab03002dd448bc6542e6fa647f92f64703a618d34b4fa845b80ffd93038c825373f85eabcf0b6beb6bf436ac0feb872e9025d39daf4b0e1f4

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\log4net.dll

                            Filesize

                            270KB

                            MD5

                            f15c8a9e2876568b3910189b2d493706

                            SHA1

                            32634db97e7c1705286cb1ac5ce20bc4e0ec17af

                            SHA256

                            ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309

                            SHA512

                            805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\uac.dll

                            Filesize

                            24KB

                            MD5

                            861f7e800bb28f68927e65719869409c

                            SHA1

                            a12bfcd2b9950e758ead281a9afbf1895bf10539

                            SHA256

                            10a0e8cf46038ab3b2c3cf5dce407b9a043a631cbde9a5c8bcf0a54b2566c010

                            SHA512

                            f2bf24a0da69bbe4b4a0f0b1bfc5af175a66b8bcc4f5cc379ed0b89166fa9ffe1e16206b41fca7260ac7f8b86f8695b76f016bb371d7642aa71e61e29a3976eb

                          • C:\Users\Admin\AppData\Local\Temp\nsn9982.tmp\utils.dll

                            Filesize

                            58KB

                            MD5

                            c6b46a5fcdccbf3aeff930b1e5b383d4

                            SHA1

                            6d5a8e08de862b283610bad2f6ce44936f439821

                            SHA256

                            251ab3e2690562dcfcd510642607f206e6dcf626d06d94b74e1fa8297b1050a0

                            SHA512

                            97616475ef425421959489b650810b185488fcb02a1e90406b3014e948e66e5101df583815fd2be26d9c4d293a46b02ba4025426f743e682ed15d228f027f55c

                          • memory/1364-179-0x000001CFF05F0000-0x000001CFF0612000-memory.dmp

                            Filesize

                            136KB

                          • memory/1364-142-0x000001CFEE180000-0x000001CFEE194000-memory.dmp

                            Filesize

                            80KB

                          • memory/1364-146-0x00007FF97BEB0000-0x00007FF97C971000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/1364-145-0x000001CFF01F0000-0x000001CFF0236000-memory.dmp

                            Filesize

                            280KB

                          • memory/1364-187-0x00007FF97BEB0000-0x00007FF97C971000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/1364-143-0x000001CFF0880000-0x000001CFF0DA8000-memory.dmp

                            Filesize

                            5.2MB

                          • memory/1364-219-0x000001D7F3EE0000-0x000001D7F4686000-memory.dmp

                            Filesize

                            7.6MB

                          • memory/1364-150-0x000001CFEFB00000-0x000001CFEFB18000-memory.dmp

                            Filesize

                            96KB

                          • memory/1364-221-0x000001CFF0720000-0x000001CFF0822000-memory.dmp

                            Filesize

                            1.0MB

                          • memory/1364-222-0x00007FF97BEB0000-0x00007FF97C971000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/1364-140-0x000001CFF02A0000-0x000001CFF0344000-memory.dmp

                            Filesize

                            656KB

                          • memory/1364-159-0x000001CFF0670000-0x000001CFF0720000-memory.dmp

                            Filesize

                            704KB

                          • memory/1364-136-0x000001CFEDD70000-0x000001CFEDDBE000-memory.dmp

                            Filesize

                            312KB

                          • memory/1364-134-0x00007FF97BEB3000-0x00007FF97BEB5000-memory.dmp

                            Filesize

                            8KB

                          • memory/1364-182-0x00007FF97BEB0000-0x00007FF97C971000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/1364-184-0x00007FF97BEB0000-0x00007FF97C971000-memory.dmp

                            Filesize

                            10.8MB