Resubmissions

22/10/2024, 19:51

241022-yk8gtstckl 7

22/10/2024, 19:48

241022-yjkpdatbnk 7

21/10/2024, 21:25

241021-z9xx3axema 7

Analysis

  • max time kernel
    143s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/10/2024, 19:51

General

  • Target

    Lunar Client - Installer.exe

  • Size

    2.3MB

  • MD5

    5dae543a90c57b5441f4c2995f2b5436

  • SHA1

    066629ae4d2f56e054a4479288d6c9fd43ee2a7e

  • SHA256

    b38150ba19809c027431ec9ac11e3f560d2bed0708c5f7332167c40032e9632b

  • SHA512

    769473317ddb413bb47719910fc477bd2ede23c13b37f9eb4d4c14f49b421672382782325080b97342f8487788929a97334ae4436a743004ef9c331643c1267b

  • SSDEEP

    49152:ImAhWNzxE87vxpsrFpIvZRW/z4GEfOM6HsFWB3YONkhWocU/:IhAPN+TIvZI/z9NRHyTd

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3520
    • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\OWinstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\OWinstaller.exe" Sel=0&Extension=jilehohlakeokncafogkgnicgndeecdiengddbcc&UtmSource=client-site&UtmMedium=download-page&UtmCampaign=direct&Referer=www.lunarclient.com&Browser=chrome -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://launcherupdates.lunarclientcdn.com/latest-ow.yml -AllowWindowsInsider --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --eula-url=https://www.lunarclient.com/terms --privacy-url=https://www.lunarclient.com/privacy --silent-setup --app-name="Lunar Client" --auto-close -exepath C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1216

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml

          Filesize

          752B

          MD5

          429b7b6661a5f41f5895151857b25d01

          SHA1

          c56e839d76206a7b18ac21d17189261bd942bde7

          SHA256

          6d6b9f385cc162e4890ce7147cbea508f872d591dda84e008e7edbbbefc5a928

          SHA512

          add7140b8a72670e2192ef8a860858cbd65f646cb8976124da8bcbd223ef76f5725a8c22712db51362eaa24369fdbe75a84e6745101e81d28d1037d2df5d0dfb

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\CommandLine.dll

          Filesize

          71KB

          MD5

          42b8558275c6838bf25616b05f5b1cc2

          SHA1

          352cb161808e3cc360ef5ef67d3559d258f23448

          SHA256

          d98011873f275393db4810ca9ffe5a066c66cd157fa1c2d46a312824e86fa6f6

          SHA512

          38266c98b3a86ef373298479c8b585ebbb66f52099812e29faf25a7e6e2d12b3896d69db72a9f65becbf8e2b643c2664a3c09275265a1e15622076de70d0afc7

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\Newtonsoft.Json.dll

          Filesize

          692KB

          MD5

          98cbb64f074dc600b23a2ee1a0f46448

          SHA1

          c5e5ec666eeb51ec15d69d27685fe50148893e34

          SHA256

          7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13

          SHA512

          eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\OWInstaller.exe

          Filesize

          305KB

          MD5

          26ec6fdabe608b621f85d22b1985319d

          SHA1

          0b7dcc560ed2d7d2d0a614e88796b11aeea05311

          SHA256

          cb4fa684a847fcb467a738b5f50c0a385d76b91e711e0ce4b72d41cc597b9714

          SHA512

          4818cae9887478afd432fe6c8b12c8baf184e93734a943fe00e552cf5875c97d96c819c7ebadf20a8cd43b3dbd1f3e559ee613da8a3d55b2b176b143e825d125

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\OWinstaller.exe.config

          Filesize

          632B

          MD5

          82d22e4e19e27e306317513b9bfa70ff

          SHA1

          ff3c7dd06b7fff9c12b1beaf0ca32517710ac161

          SHA256

          272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827

          SHA512

          b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\OverWolf.Client.CommonUtils.dll

          Filesize

          650KB

          MD5

          cc208a83fdf244bf8bd73c163dac39f0

          SHA1

          5ffdd23728051c20850cdce7cc4d5970b5321323

          SHA256

          6bb4b0ec3d131f212d0f0ded7788feefa1dce1c312ae1aaceaa0db3e73acac79

          SHA512

          6cb09449120bcf76e144dce74efd54f88fda7c1f7c25ed61e1bf4127607bb312bc020c0ba29fc70ab001a886949e0faa67bdd609fd38bba8e119e218e9fba46a

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\SharpRaven.dll

          Filesize

          82KB

          MD5

          96e7c0177c15bc7a157c51612f3369bf

          SHA1

          1e89f4bc3fdb3cb1724ab0c283195b6aebb1532e

          SHA256

          50532b392723aeff6f3e20c5196a8c4bb5865d1ff7d537fc9c27af6aa24d6e2e

          SHA512

          929b0b6b60bc0734a9858943af4645bb1bcf95a3f00fad01434997f89c7a2e816d5d8b612744dcb62fff354e5253abfe4c11c252e1fa825cef4a764559c0d432

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\System.dll

          Filesize

          21KB

          MD5

          51bd16a2ea23ae1e7a92cedc6785c82e

          SHA1

          a9fbaeb9a695b9f2ba8a3ed8f0d95d2bf6a3d36c

          SHA256

          4dbc79d2b1c7987cc64bb5d014db81bb5108bdd6d8bf3a5f820fac1ded62be33

          SHA512

          66ffc18b2daf6c4cba01aef0e4af2f006a51aa218eab0f21dc66e47eea0389d2b1748ef0e30d2ec9f0123fd7f38ed3aee964dd6bde5779aaee19ebf55369af79

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\UserInfo.dll

          Filesize

          14KB

          MD5

          1dd4ca0f4a94155f8d46ec95a20ada4a

          SHA1

          5869f0d89e5422c5c4ad411e0a6a8d5b2321ff81

          SHA256

          a27dc3069793535cb64123c27dca8748983d133c8fa5aaddee8cdbc83f16986d

          SHA512

          f4914edc0357af44ed2855d5807c99c8168b305e6b7904dc865771ad0ee90756038612fe69c67b459c468396d1d39875395b1c8ec69e6da559fb92859204763e

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\assets\fonts\lato\LatoLatin-Regular.eot

          Filesize

          66KB

          MD5

          6cfad5881181ae658a6efdd68889a690

          SHA1

          5b54f6ccc20ed3a078fbdf94d7a68ac80002624d

          SHA256

          c6c970b103b3c3aa83f7a45172619a4451ea5f015f9f3ef4fd08c9a4aa895cbc

          SHA512

          ddd3d43540eb3d4eef48d0834136de1e7bf23a52f286d0a666cf57c7d685aadf1cea6d37c88f9d7ce5ad6143d7c3213f54b16a11f616b7dce154bba50997bbe7

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\images\icon.ico

          Filesize

          149KB

          MD5

          af5a51fc5d3cf1861f2a470711355265

          SHA1

          bb6ef7a49986f46b1347f007a327b7b35d28e4c3

          SHA256

          70e7e734171c8c32bcfe8967bb3d91fbe259952ec9c92b6562095614ff465a1b

          SHA512

          c3de8de1db9177521e87cb099a15ab4897e5d3a9b8b4086a555689743d9945fc23bc5c9a2409f26b2d120031e355ec6949ead3017c3b44cff7b701ad72073b8b

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\index.html

          Filesize

          20KB

          MD5

          423d2e2f7e21b856cb5f3ee3dcbfa5a0

          SHA1

          eda0e357387913daf57a0c683c34b4b8a5d7baf7

          SHA256

          cd59efa2fe7cbe222d03a946c34eaacdb3761e922763952d7be4555addf8572c

          SHA512

          c403307549af9bf7cfd34295a8b1020e7b7489d104b5fdaf4320b495f85977134796774dbf4f20f8fd0b2d1f2188b881a1cc35cec56aa64a3dc84bf1c2d21b4b

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\app.js

          Filesize

          21KB

          MD5

          de88fce9253d26e0c61daa1783baa775

          SHA1

          07c5848354a247056baad369059aac9d3c940ecc

          SHA256

          993f140f9f4e5cdbdcc657a3c159328bf58b3483dbc27c451516a556763a79ba

          SHA512

          71ddd47ef7ed7c02fb31e8ffa2ea6d1b5178dbda2ab37bac208e088c8ba2127e0cf5eaa74ee7ad5809fa69e534853312c6c8775c68aeda63bf0e4a5caefa39b7

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\block_inputs.js

          Filesize

          789B

          MD5

          b5b52c92b90f4283a761cb8a40860c75

          SHA1

          7212e7e566795017e179e7b9c9bf223b0cdb9ec2

          SHA256

          f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544

          SHA512

          16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\libs\cmp.bundle.js

          Filesize

          348KB

          MD5

          16fc087f1323fce759abc94f985f9dc0

          SHA1

          4f9fcb398d19077ac5b39c107a9934d3d41c8d71

          SHA256

          304f8a03efd2a1e65f08b0606dca97c66f4875a4d71a9e4ad7a83fbb36731ded

          SHA512

          37696e22931829c05f53b6a5fee734dd4631836e20eeff7186aa8a5b0a1b8bc765c7ed42af0ade2d403cb7020c6c9913be2caf25db6388524b48a773c4e334bb

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\libs\jquery-1.10.2.min.js

          Filesize

          90KB

          MD5

          44e3f0db3e4ab6fedc5758c05cf27591

          SHA1

          2d408aa1d35661019c95adcc60b78c0727ed25b4

          SHA256

          bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144

          SHA512

          4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\models\notifications.js

          Filesize

          5KB

          MD5

          85afdf9897bb1236eff3afa40d15ece6

          SHA1

          4362bdd139458eaf4a2dcb34294b43e2d53f4a26

          SHA256

          9dd03dfc92bcb74f3725aae60e904c0a56cc84f299bbb8e863a869719f6fdd32

          SHA512

          4ab86c6bafba18f53f01ca913ceaa80f14900107069a1d5f65b108d35690bd8b50b1a6cdf1563fc5775909f69208dabebd139f3cf3d8576269d560d57cf9994c

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\utils\analytics.js

          Filesize

          4KB

          MD5

          525281e9959af4c1c0d11b9243c798a1

          SHA1

          237a84c5b57bd132f48446d718b20640cb28c263

          SHA256

          c37f0699cf8ba7d9e3e0f73f1b2af65f4bdc2a31f44594ffc8c73e98b6c2fd1d

          SHA512

          fe5bafda7773e69c65dd63270e0306abcd39cb2d886b675ab8c714ae0833efde963b69623d468551a1ab37f1db1a1d457f1568f7a29d9cf0bb23bb0edcab5fc4

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\utils\commands.js

          Filesize

          13KB

          MD5

          a25b49d085333ece9aadd1f285795925

          SHA1

          53341dcca297a969a8ff37265935488f1790307e

          SHA256

          acbf59ce6aa668880f65aab2bfe62305415c76301b40bc7f72777f0b08840b71

          SHA512

          0a2cb6f4e1af0c4205e38ba1e12c208e6ea4f8f8e3956c9d10b312aa9a6929b99ec967aee7aa1f54da97ca6ea354f8bd7f624359cfd05c6241a5f4bf59843b68

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\utils\cookies.js

          Filesize

          1KB

          MD5

          6c60e675f8c8c68c0174b644d3a63a2a

          SHA1

          3635a3fe07ccc4a6f33a986ddb690522d0611abb

          SHA256

          9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287

          SHA512

          1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\utils\modal-events-delegate.js

          Filesize

          1KB

          MD5

          117e4fdbdb0ecf211c8bd909efd337d1

          SHA1

          9f8684d856b7c95bdffb139217dfd89f41373187

          SHA256

          267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857

          SHA512

          f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\utils\strings-loader.js

          Filesize

          5KB

          MD5

          9c94eb933d8a43dd3825e67a7e30c980

          SHA1

          7ec7b16af6f399219209ba5967d377040486a11b

          SHA256

          96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf

          SHA512

          a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\utils\utils.js

          Filesize

          118B

          MD5

          a0952ebeab701c05c75710c33d725e7e

          SHA1

          1da8a2e889f1213d481ae3cd5571670c01e64adc

          SHA256

          b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246

          SHA512

          5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\cri\cri-controller.js

          Filesize

          3KB

          MD5

          4e4b4a9e2d86ae3c108105078db6d730

          SHA1

          826946be793c999316af6c1db10523950b18ea2c

          SHA256

          cee7fc5a36a01a439125be031923d7e7415ec56194255048098169a0108034b7

          SHA512

          1420065cd000ce9b9c39d27b5dc5f4055f67146e06573a03184649851c9745f0c0af2b5e35b41b5923703dd74e32f9ed95fc59a43db25f854584e319950beffe

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\cri\template.js

          Filesize

          1KB

          MD5

          76c1ef0cb437db144c2bed53a5a8a5d7

          SHA1

          aaab8fff649f8e46d1e9510018118ee9abe01498

          SHA256

          505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e

          SHA512

          822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js

          Filesize

          1KB

          MD5

          eb6d6bd7e05d4477e2704dd87b57ca35

          SHA1

          f42672ec1e23a3f4bcc2952746d87ba8deff44be

          SHA256

          5ca97132a258ed1f36e401d70ccb95be2c9e18395e6010c40f61172914477de5

          SHA512

          1402d611f910cf5078e804175fa4693b591348d3e7cf6d0a6bbe026c259eb9e0bc285233c80cb2f4690674c3e927bc72fbdcbe758826b98fd02ecb3ed82e339a

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\finish-with-recommended-app\template.js

          Filesize

          681B

          MD5

          d1cb34b57cef7e28b9286454b197b712

          SHA1

          f3a964b319bab82d4eda07e126bbfd6dec35c349

          SHA256

          b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42

          SHA512

          3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\finish\finish-controller.js

          Filesize

          1KB

          MD5

          138240ea22084428e9e25583e9156568

          SHA1

          e8bef7eab5b6e7040b996ec9504436e073444bd9

          SHA256

          4cb4e1aa25c15ae5f2e63fa4658a8acff0ce63e0f59cb6eb634df2dfe336e2ec

          SHA512

          e97b81b0ecd964e6e909019353efe4f5582f65763ac4197d754f1c4eea19cfc249900ae597fd33e29f531bb0d1c7e0f010793c59a2b0099fa75ad0b7d01ce8a7

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\finish\template.js

          Filesize

          1KB

          MD5

          f092de7ea66d8e920b345f38537fa35d

          SHA1

          82d107a409f18878307ae0cefe24074db64937c4

          SHA256

          b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f

          SHA512

          14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\main\main-controller.js

          Filesize

          11KB

          MD5

          15b665a5c915004e1aa7e9e11a710f7e

          SHA1

          7821924e42bb19d60c572ff80bbaaa04d7aaeefb

          SHA256

          84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653

          SHA512

          dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\main\template.js

          Filesize

          3KB

          MD5

          a118c7724c208f12083240cafccfd10b

          SHA1

          f89c676a215b869626737862a08c9eb07d440211

          SHA256

          63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc

          SHA512

          9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\modal\modal-controller.js

          Filesize

          2KB

          MD5

          b04bdfd1c7d09bdbdb94a2455fdd677b

          SHA1

          f000ba4866ff16d75bfd6cf446763498e19b12b1

          SHA256

          4565ee81ffe222b31982088b1c18850076e3acf59198ebce08118e12cbd87ea1

          SHA512

          3cb6ef0a16309046e7f407e7321eb12212b0eec09ec1a04b1d813f6c7a04546714865c3b398a93985041f598156ed905ebd23a64260801281b29ada9bc19ec5c

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\privacy\privacy-controller.js

          Filesize

          2KB

          MD5

          10897b8f8e410b128258fd4fcb183bb3

          SHA1

          e8dbd5a9018a2183a43f30da503d10a91f104763

          SHA256

          67556e333a57f50c62bb68f7bb08fbc619d7cb5342e05a75d5023d376c56d306

          SHA512

          307bfdec5d5a1495be300f61f2c3a8477a9b08da607244f6f72de3238fdff6d6d095e9d05f5ccf2780b8e56d2b48835da82ce4519d329fdbd6aad28a2ee82d39

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\privacy\template.js

          Filesize

          655B

          MD5

          cf8d2c26520d7c84e560dfa79e31dcd3

          SHA1

          716f2ec17480d5cc9c145bc147833fbfc39d36f0

          SHA256

          95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8

          SHA512

          d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\progress\progress-1-controller.js

          Filesize

          1KB

          MD5

          82f0b997ed552c52a510a9f2ab29dc3a

          SHA1

          92aec3a656053c71eccdde610130f5d8008fa96f

          SHA256

          838bab990ce38372dfedb50eb0a270db705811729630ab8557c08bd1e9e8e105

          SHA512

          ecf67f877002d746eff8af3a50155aa381513ddafd17b6bff0188c85f0765579fea0112e82e1371f962b1f5decc94b65e6120f21fb516533dac35a2d541065bf

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\progress\template.js

          Filesize

          242B

          MD5

          92b145e6649ba0add3dee9a69d3fa91e

          SHA1

          4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d

          SHA256

          a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab

          SHA512

          747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\settings\settings-controller.js

          Filesize

          6KB

          MD5

          378c18dd7d5cee6ca7c4ddd0396b535b

          SHA1

          d5f81d4fab29201fd1629dc4d8e6f918c0c30479

          SHA256

          b5c5dc5e0684fd97eb4c45896dc1c2de8a6a6fdc63b6aa83a99103c15787ef35

          SHA512

          c29416b3f0245f4826d857dc8c52c969071d2410c945bda96f38f59a9bc7137ee534d84865e5ac55a1e3cea6bb705c5d592725af709cd97e7f38ff05dbaafe5b

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\settings\template.js

          Filesize

          4KB

          MD5

          28513de0830383a516028e4a6e7585a0

          SHA1

          d31fc3a6f4a3ce6c4afb82ff2342a1ed718809e5

          SHA256

          8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f

          SHA512

          0f7321c2ae13145bb694368dae1b74e6fe20e6b09712da2178bc46e6aa65223ab84c38abbf0ed074c85b42dba1a238a5f3f8d1ae060a0af6df748c5befe11b61

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\welcome\template.js

          Filesize

          1KB

          MD5

          17f54fca6723b983875d940d931e0afb

          SHA1

          01774cd5cea36bd74c80a708d6f77567e8091024

          SHA256

          42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb

          SHA512

          401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\js\windows\welcome\welcome-controller.js

          Filesize

          2KB

          MD5

          50f676754862a2ab47a582dd4d79ecf3

          SHA1

          1cb2f4b11f9f8cfc8dc57ff29d0256dec4811158

          SHA256

          6155691dbdd66290109afb91617f9cf68af6bd912991d5d27b922f5faa7f530b

          SHA512

          ccfc89e08fd36f0a694fcda17efb84ca285b6c62afe2e3a794fdad19b6882a4b618645f4d9171673ba56fb4c55fce336d6b8d26dec3a5cc11293ae2b211f499f

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\app\manifest.json

          Filesize

          691B

          MD5

          bd268881845661738233611c5abaa301

          SHA1

          038b46a10a4af115c038d8474fe4080343985d65

          SHA256

          398b7082f2aa42bba54fe2559e18e6b8f924413733e37dd6808ccc81b1d36a99

          SHA512

          2b3650fd5a8061a84605ee5553a216094eaf7d9ac9404b012f4ce99482adf25dc18d40d207f4a7f9617abecae455be322d463666e4d92cbe5cc96dfbd2d6d693

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\log4net.dll

          Filesize

          270KB

          MD5

          f15c8a9e2876568b3910189b2d493706

          SHA1

          32634db97e7c1705286cb1ac5ce20bc4e0ec17af

          SHA256

          ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309

          SHA512

          805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\uac.dll

          Filesize

          24KB

          MD5

          861f7e800bb28f68927e65719869409c

          SHA1

          a12bfcd2b9950e758ead281a9afbf1895bf10539

          SHA256

          10a0e8cf46038ab3b2c3cf5dce407b9a043a631cbde9a5c8bcf0a54b2566c010

          SHA512

          f2bf24a0da69bbe4b4a0f0b1bfc5af175a66b8bcc4f5cc379ed0b89166fa9ffe1e16206b41fca7260ac7f8b86f8695b76f016bb371d7642aa71e61e29a3976eb

        • C:\Users\Admin\AppData\Local\Temp\nss9AE9.tmp\utils.dll

          Filesize

          58KB

          MD5

          c6b46a5fcdccbf3aeff930b1e5b383d4

          SHA1

          6d5a8e08de862b283610bad2f6ce44936f439821

          SHA256

          251ab3e2690562dcfcd510642607f206e6dcf626d06d94b74e1fa8297b1050a0

          SHA512

          97616475ef425421959489b650810b185488fcb02a1e90406b3014e948e66e5101df583815fd2be26d9c4d293a46b02ba4025426f743e682ed15d228f027f55c

        • memory/1216-175-0x00007FF8148A0000-0x00007FF815361000-memory.dmp

          Filesize

          10.8MB

        • memory/1216-135-0x000001A6BFDE0000-0x000001A6BFDF4000-memory.dmp

          Filesize

          80KB

        • memory/1216-177-0x00007FF8148A0000-0x00007FF815361000-memory.dmp

          Filesize

          10.8MB

        • memory/1216-181-0x00007FF8148A0000-0x00007FF815361000-memory.dmp

          Filesize

          10.8MB

        • memory/1216-138-0x000001A6D87A0000-0x000001A6D87E6000-memory.dmp

          Filesize

          280KB

        • memory/1216-172-0x000001A6D89B0000-0x000001A6D89D2000-memory.dmp

          Filesize

          136KB

        • memory/1216-136-0x000001A6D8BD0000-0x000001A6D90F8000-memory.dmp

          Filesize

          5.2MB

        • memory/1216-154-0x000001A6D8A30000-0x000001A6D8AE0000-memory.dmp

          Filesize

          704KB

        • memory/1216-133-0x000001A6BFED0000-0x000001A6BFF74000-memory.dmp

          Filesize

          656KB

        • memory/1216-129-0x000001A6BE0F0000-0x000001A6BE13C000-memory.dmp

          Filesize

          304KB

        • memory/1216-127-0x00007FF8148A3000-0x00007FF8148A5000-memory.dmp

          Filesize

          8KB

        • memory/1216-139-0x00007FF8148A0000-0x00007FF815361000-memory.dmp

          Filesize

          10.8MB

        • memory/1216-212-0x000001AEDD1E0000-0x000001AEDD986000-memory.dmp

          Filesize

          7.6MB

        • memory/1216-143-0x000001A6BFE90000-0x000001A6BFEA8000-memory.dmp

          Filesize

          96KB

        • memory/1216-214-0x00007FF8148A0000-0x00007FF815361000-memory.dmp

          Filesize

          10.8MB