a4d49f0687639aab8115e190e2284857e4a0f7541f79dc215fc1c9c2b1ecde2c

Resubmissions

28/03/2025, 16:42

250328-t7vr2ayvhv 7

28/03/2025, 16:40

250328-t61lwszrs5 7

Analysis

max time kernel
118s
max time network
121s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
28/03/2025, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lunar Client - Installer(1).exe
Size

2.3MB
MD5

376931f67f09f909a4888c0f299cb1ba
SHA1

0513fbdfae3fc163ea23068ce99a4d19d40ec9dc
SHA256

a4d49f0687639aab8115e190e2284857e4a0f7541f79dc215fc1c9c2b1ecde2c
SHA512

fcc272ec3ad120cfd5734b8e91d9c7da13ea85919f1896621234e1f6b84e27ab8abd224bf72468a73862ea1736007e9429aa6edb5d53c619b655772a644c1e91
SSDEEP

49152:ymAV14xE87vxpsrFpIvQUZ7DibcYhkOs6RYjcNkhWocbz:yhT6PN+TIv7ud1+jD+

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000200000002707a-1721.dat	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000200000002707a-1721.dat	upx

Executes dropped EXE 5 IoCs

pid	Process
2360	OWinstaller.exe
5528	Lunar Client - Installer.exe
5108	OWinstaller.exe
1796	Lunar Client - Installer.exe
5204	OWinstaller.exe

Loads dropped DLL 29 IoCs

pid	Process
2100	Lunar Client - Installer(1).exe
2100	Lunar Client - Installer(1).exe
2100	Lunar Client - Installer(1).exe
2100	Lunar Client - Installer(1).exe
2100	Lunar Client - Installer(1).exe
2360	OWinstaller.exe
2360	OWinstaller.exe
2360	OWinstaller.exe
2360	OWinstaller.exe
5528	Lunar Client - Installer.exe
5528	Lunar Client - Installer.exe
5528	Lunar Client - Installer.exe
5528	Lunar Client - Installer.exe
5528	Lunar Client - Installer.exe
5528	Lunar Client - Installer.exe
5528	Lunar Client - Installer.exe
5108	OWinstaller.exe
5108	OWinstaller.exe
5108	OWinstaller.exe
5108	OWinstaller.exe
1796	Lunar Client - Installer.exe
1796	Lunar Client - Installer.exe
1796	Lunar Client - Installer.exe
1796	Lunar Client - Installer.exe
1796	Lunar Client - Installer.exe
5204	OWinstaller.exe
5204	OWinstaller.exe
5204	OWinstaller.exe
5204	OWinstaller.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Lunar Client - Installer.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunar Client - Installer(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunar Client - Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunar Client - Installer.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Lunar Client - Installer.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5528	Lunar Client - Installer.exe
5528	Lunar Client - Installer.exe
5528	Lunar Client - Installer.exe
5528	Lunar Client - Installer.exe
5528	Lunar Client - Installer.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	OWinstaller.exe
Token: SeDebugPrivilege	2808	firefox.exe
Token: SeDebugPrivilege	2808	firefox.exe
Token: SeDebugPrivilege	5108	OWinstaller.exe
Token: SeDebugPrivilege	5204	OWinstaller.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
2360	OWinstaller.exe
2360	OWinstaller.exe
2360	OWinstaller.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
2808	firefox.exe
5108	OWinstaller.exe
5108	OWinstaller.exe
5108	OWinstaller.exe
5204	OWinstaller.exe
5204	OWinstaller.exe
5204	OWinstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2360	2100	Lunar Client - Installer(1).exe	82
PID 2100 wrote to memory of 2360	2100	Lunar Client - Installer(1).exe	82
PID 4272 wrote to memory of 2808	4272	firefox.exe	100
PID 4272 wrote to memory of 2808	4272	firefox.exe	100
PID 4272 wrote to memory of 2808	4272	firefox.exe	100
PID 4272 wrote to memory of 2808	4272	firefox.exe	100
PID 4272 wrote to memory of 2808	4272	firefox.exe	100
PID 4272 wrote to memory of 2808	4272	firefox.exe	100
PID 4272 wrote to memory of 2808	4272	firefox.exe	100
PID 4272 wrote to memory of 2808	4272	firefox.exe	100
PID 4272 wrote to memory of 2808	4272	firefox.exe	100
PID 4272 wrote to memory of 2808	4272	firefox.exe	100
PID 4272 wrote to memory of 2808	4272	firefox.exe	100
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6040	2808	firefox.exe	101
PID 2808 wrote to memory of 6088	2808	firefox.exe	102
PID 2808 wrote to memory of 6088	2808	firefox.exe	102
PID 2808 wrote to memory of 6088	2808	firefox.exe	102
PID 2808 wrote to memory of 6088	2808	firefox.exe	102
PID 2808 wrote to memory of 6088	2808	firefox.exe	102
PID 2808 wrote to memory of 6088	2808	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer(1).exe
"C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer(1).exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\OWinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\OWinstaller.exe" Sel=0&Extension=jilehohlakeokncafogkgnicgndeecdiengddbcc&UtmSource=client-site&UtmMedium=download-page&UtmCampaign=direct&Referer=www.lunarclient.com&Browser=firefox -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://launcherupdates.lunarclientcdn.com/latest-ow.yml -AllowWindowsInsider --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --eula-url=https://www.lunarclient.com/terms --privacy-url=https://www.lunarclient.com/privacy --silent-setup --app-name="Lunar Client" --auto-close -exepath C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer(1).exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2360

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27100 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {6546c64e-0239-43b0-a8f3-082477f96073} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27136 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2484 -initialChannelId {d01f4858-a2d4-47e1-9491-036172412c1a} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:6088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3932 -prefsLen 27277 -prefMapHandle 3936 -prefMapSize 270279 -jsInitHandle 3940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3948 -initialChannelId {68c62947-b6f4-4795-b870-193f2e9a6c9b} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4120 -prefsLen 27277 -prefMapHandle 4124 -prefMapSize 270279 -ipcHandle 4140 -initialChannelId {fd537b8c-b116-4387-a232-c2f5e9d2241b} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3276 -prefsLen 34776 -prefMapHandle 1624 -prefMapSize 270279 -jsInitHandle 1700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3128 -initialChannelId {415aae06-63b5-4927-8cac-bcd5d9a9e4fd} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5056 -prefsLen 35013 -prefMapHandle 5096 -prefMapSize 270279 -ipcHandle 5116 -initialChannelId {fd7af8e4-6a97-4486-8fdb-caa9173f985a} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 32900 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5284 -initialChannelId {32d8b23f-ffce-4cdc-8e47-dbf3789fd65c} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 32900 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {1d450b3a-960f-4678-8460-f0456d3b9206} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {4d148850-a594-40eb-8654-3335b892afd3} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6408 -prefsLen 33071 -prefMapHandle 6412 -prefMapSize 270279 -jsInitHandle 6416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6388 -initialChannelId {bc53307b-0ee3-42ea-8fe9-fd21c1aa5da2} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7004 -prefsLen 36543 -prefMapHandle 7028 -prefMapSize 270279 -jsInitHandle 7016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4980 -initialChannelId {334de765-945b-4cca-82fa-3ca5b614eb33} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:1704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 36543 -prefMapHandle 6664 -prefMapSize 270279 -jsInitHandle 6840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5344 -initialChannelId {85f5b0db-05c6-46da-82f3-522f9f3a6d6d} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4768 -prefsLen 36543 -prefMapHandle 4524 -prefMapSize 270279 -jsInitHandle 4884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6900 -initialChannelId {1d0cfba4-5466-441f-85a0-200538bec53a} -parentPid 2808 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2808" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:1040
- - C:\Users\Admin\Downloads\Lunar Client - Installer.exe
    "C:\Users\Admin\Downloads\Lunar Client - Installer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\nsh4998.tmp\OWinstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\nsh4998.tmp\OWinstaller.exe" Sel=0&Extension=jilehohlakeokncafogkgnicgndeecdiengddbcc&UtmSource=client-site&UtmMedium=download-page&UtmCampaign=direct&Referer=www.lunarclient.com&Browser=firefox -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://launcherupdates.lunarclientcdn.com/latest-ow.yml -AllowWindowsInsider --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --eula-url=https://www.lunarclient.com/terms --privacy-url=https://www.lunarclient.com/privacy --silent-setup --app-name="Lunar Client" --auto-close -exepath C:\Users\Admin\Downloads\Lunar Client - Installer.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5200

C:\Users\Admin\Downloads\Lunar Client - Installer.exe
"C:\Users\Admin\Downloads\Lunar Client - Installer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1796
- C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\OWinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\OWinstaller.exe" Sel=0&Extension=jilehohlakeokncafogkgnicgndeecdiengddbcc&UtmSource=client-site&UtmMedium=download-page&UtmCampaign=direct&Referer=www.lunarclient.com&Browser=firefox -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://launcherupdates.lunarclientcdn.com/latest-ow.yml -AllowWindowsInsider --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --eula-url=https://www.lunarclient.com/terms --privacy-url=https://www.lunarclient.com/privacy --silent-setup --app-name="Lunar Client" --auto-close -exepath C:\Users\Admin\Downloads\Lunar Client - Installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
d62ba979c03967aaa5a1765a2fddd314

SHA1
b92f421303c919bc07e992d892f0a14c56ae9299

SHA256
74d15184a3ab86c0e4532cdcfab959843ee7a397fe0e0bba4dc1d23b8e24ec39

SHA512
148cd4cb27bdc9247602944be67054306cc1a4f6c0ea33a92dd975185dfb944cbb7dafd8def9a94b0ddeeedf5eb27c5c03f6f615a77c3a3cda5ecf73f3d69f48

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD

Filesize
13KB

MD5
0cf246a4291ca7bd9132edc011d361f1

SHA1
68a6a2ae7ff9631eb3e26189cb69840c8de81517

SHA256
8df6943fc986bc1791ebe1da77825f7a5057aed0447c68f97e5957b352defc1c

SHA512
55da959e1d057583160a6403a916b20b788dad12d90c27064c8809d5ddac53ae495eebd7049587d07c904fb6da45e68adac6feb3ece585557de35dbd447360be

Download Submit
C:\Users\Admin\AppData\Local\Overwolf\OWInstall.log

Filesize
18B

MD5
07e605d2d7609cf336ea1708e86b5a0c

SHA1
e7454461893e305ecdb72556e16e001617d718f9

SHA256
c69ad6c6a1d6d89336e18db86a6c852ab60c0ceb367c79922807e55de7be49dd

SHA512
5a8933d0b2e3441b6cc6e1881bd513d0f5fec939f0108b46d3578a6315283d44af65b60329e5cd528bac308dd21f1ea71daa618a9553a06b77ccba278d23496d

Download Submit
C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml

Filesize
752B

MD5
31122fd55e4ecfa6592382c99701663c

SHA1
cf13aead94611d525c5719cccf485f113bcc5bfa

SHA256
bf916523dd0dc1c208ddb6ae1eb70b56e66edb10090900120162e81e446a0bb4

SHA512
2d1a17421518833e5b484d624800f247fe18fda370438a8986bd3beec707dc510da5179766fce48ff726d3c7a4a73c7fe53847d4f6a01764e0e9c60e589abba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\CommandLine.dll

Filesize
60KB

MD5
210472e9e333d3329072c9ea3ef06326

SHA1
298c5473a79ab2c34d1ef05a75cbdd04905c822a

SHA256
569307401b949368527b128155b4e16b349803ec7d65c1052cc23c7b7a1336d8

SHA512
c0f41486e8e7a8178322bd1fcd37fe645e4a23041e0aa84d3571b8031e2d1881029aeac1b4a554aa2f6a4f1b57d23a063872fcc72a04984fbaec2bfd12fd4b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\Newtonsoft.Json.dll

Filesize
692KB

MD5
98cbb64f074dc600b23a2ee1a0f46448

SHA1
c5e5ec666eeb51ec15d69d27685fe50148893e34

SHA256
7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13

SHA512
eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\OWInstaller.exe

Filesize
308KB

MD5
27c706761068486af01d6e13671b7857

SHA1
5b481cfcea194de45d15ae333996df39d3ff8b88

SHA256
51ac84dc46530556989d52fa4862f570216999a6b4c28f015d736b40bb2d8e53

SHA512
a74c6f24cee5ea0cf63e11490b781e9be84b5cec06112201f79eca4fae3a3e626d0a49123a7b531373a175b202b7b0421db56d5c8854d318a3c3b649283c9a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\OWinstaller.exe.config

Filesize
632B

MD5
82d22e4e19e27e306317513b9bfa70ff

SHA1
ff3c7dd06b7fff9c12b1beaf0ca32517710ac161

SHA256
272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827

SHA512
b0fb708f6bcab923f5b381b7f03b3220793eff69559e895d7cf0e33781358ec2159f9c8276bf8ba81302feda8721327d43607868de5caaa9015d7bb82060a0b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\OverWolf.Client.CommonUtils.dll

Filesize
658KB

MD5
4b85d50c14f6fc3318144cbfc50c7919

SHA1
ea33e4f4ef446ee85d574e869fae11270e9fa2c3

SHA256
2ff838143f0a8267836552d21f58f74d532663d8b3e3a9b806d1a55a900c5266

SHA512
5c9421702b42565e7947b015fcf53b7c13fac12ba4862987e0b6b6c75561b43b619f9911383921337d24ec1667b3cd7b003f186d6cc3ba7ba84a8661e397865c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\SharpRaven.dll

Filesize
82KB

MD5
271251960bf1d6a491803e15bd562e45

SHA1
1a305315dec8b44b4d80ef8c23452880b7e90380

SHA256
776c6b0642f7a3f3f3ad3cc6bb5f1d528e90c6029b671d8f82b0320b185b92a7

SHA512
d5fe5c76f2074a05d32785945ee9f088fb4293786968a1c84389233d83e9bf0480d04d5fa9676c70fd0fed47213f434ec0e0cb2e38379f720919d680336aed4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\System.dll

Filesize
21KB

MD5
51bd16a2ea23ae1e7a92cedc6785c82e

SHA1
a9fbaeb9a695b9f2ba8a3ed8f0d95d2bf6a3d36c

SHA256
4dbc79d2b1c7987cc64bb5d014db81bb5108bdd6d8bf3a5f820fac1ded62be33

SHA512
66ffc18b2daf6c4cba01aef0e4af2f006a51aa218eab0f21dc66e47eea0389d2b1748ef0e30d2ec9f0123fd7f38ed3aee964dd6bde5779aaee19ebf55369af79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\UserInfo.dll

Filesize
14KB

MD5
1dd4ca0f4a94155f8d46ec95a20ada4a

SHA1
5869f0d89e5422c5c4ad411e0a6a8d5b2321ff81

SHA256
a27dc3069793535cb64123c27dca8748983d133c8fa5aaddee8cdbc83f16986d

SHA512
f4914edc0357af44ed2855d5807c99c8168b305e6b7904dc865771ad0ee90756038612fe69c67b459c468396d1d39875395b1c8ec69e6da559fb92859204763e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\assets\fonts\lato\LatoLatin-Regular.eot

Filesize
66KB

MD5
6cfad5881181ae658a6efdd68889a690

SHA1
5b54f6ccc20ed3a078fbdf94d7a68ac80002624d

SHA256
c6c970b103b3c3aa83f7a45172619a4451ea5f015f9f3ef4fd08c9a4aa895cbc

SHA512
ddd3d43540eb3d4eef48d0834136de1e7bf23a52f286d0a666cf57c7d685aadf1cea6d37c88f9d7ce5ad6143d7c3213f54b16a11f616b7dce154bba50997bbe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\images\icon.ico

Filesize
149KB

MD5
af5a51fc5d3cf1861f2a470711355265

SHA1
bb6ef7a49986f46b1347f007a327b7b35d28e4c3

SHA256
70e7e734171c8c32bcfe8967bb3d91fbe259952ec9c92b6562095614ff465a1b

SHA512
c3de8de1db9177521e87cb099a15ab4897e5d3a9b8b4086a555689743d9945fc23bc5c9a2409f26b2d120031e355ec6949ead3017c3b44cff7b701ad72073b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\index.html

Filesize
20KB

MD5
423d2e2f7e21b856cb5f3ee3dcbfa5a0

SHA1
eda0e357387913daf57a0c683c34b4b8a5d7baf7

SHA256
cd59efa2fe7cbe222d03a946c34eaacdb3761e922763952d7be4555addf8572c

SHA512
c403307549af9bf7cfd34295a8b1020e7b7489d104b5fdaf4320b495f85977134796774dbf4f20f8fd0b2d1f2188b881a1cc35cec56aa64a3dc84bf1c2d21b4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\app.js

Filesize
21KB

MD5
de88fce9253d26e0c61daa1783baa775

SHA1
07c5848354a247056baad369059aac9d3c940ecc

SHA256
993f140f9f4e5cdbdcc657a3c159328bf58b3483dbc27c451516a556763a79ba

SHA512
71ddd47ef7ed7c02fb31e8ffa2ea6d1b5178dbda2ab37bac208e088c8ba2127e0cf5eaa74ee7ad5809fa69e534853312c6c8775c68aeda63bf0e4a5caefa39b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\block_inputs.js

Filesize
789B

MD5
b5b52c92b90f4283a761cb8a40860c75

SHA1
7212e7e566795017e179e7b9c9bf223b0cdb9ec2

SHA256
f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544

SHA512
16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\libs\cmp.bundle.js

Filesize
348KB

MD5
16fc087f1323fce759abc94f985f9dc0

SHA1
4f9fcb398d19077ac5b39c107a9934d3d41c8d71

SHA256
304f8a03efd2a1e65f08b0606dca97c66f4875a4d71a9e4ad7a83fbb36731ded

SHA512
37696e22931829c05f53b6a5fee734dd4631836e20eeff7186aa8a5b0a1b8bc765c7ed42af0ade2d403cb7020c6c9913be2caf25db6388524b48a773c4e334bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\libs\jquery-1.10.2.min.js

Filesize
90KB

MD5
44e3f0db3e4ab6fedc5758c05cf27591

SHA1
2d408aa1d35661019c95adcc60b78c0727ed25b4

SHA256
bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144

SHA512
4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\models\notifications.js

Filesize
5KB

MD5
911451f65b2503d23bc27c6a6aa6af72

SHA1
01d3654b23ef7f5adeb4097bd851e8c100a7b2ab

SHA256
c32495d55eed52f47dc7268eeccb90fb6bdc5686135ed089416c6bb8f703a578

SHA512
06edaebb0bb2980a7b6d6baa31a9c0894a9bb5f14a91468ffb8f182d98f04bb811df2a4c37f0b56d612603528aa21f390eaa7cf885874ae770a24dce2f9b249c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\utils\analytics.js

Filesize
4KB

MD5
525281e9959af4c1c0d11b9243c798a1

SHA1
237a84c5b57bd132f48446d718b20640cb28c263

SHA256
c37f0699cf8ba7d9e3e0f73f1b2af65f4bdc2a31f44594ffc8c73e98b6c2fd1d

SHA512
fe5bafda7773e69c65dd63270e0306abcd39cb2d886b675ab8c714ae0833efde963b69623d468551a1ab37f1db1a1d457f1568f7a29d9cf0bb23bb0edcab5fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\utils\commands.js

Filesize
13KB

MD5
186f2a801c3d12b8b53e4b8f0510bd35

SHA1
567932df79e60d27d62752b1a1d72d6bf386c6b0

SHA256
bd6e86d0e6b33a44a1617458f0adff34a5cb0fc52568e03e5d74b8c72b5f379e

SHA512
eb87666e8fb40f81d9f14f61a6cffdba57edce1ab9b62c1df3ea3ffb0f96747f90465b2bee956c096f3762d25e90f5f130537046d8deba388d183cee1cc473c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\utils\cookies.js

Filesize
1KB

MD5
6c60e675f8c8c68c0174b644d3a63a2a

SHA1
3635a3fe07ccc4a6f33a986ddb690522d0611abb

SHA256
9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287

SHA512
1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\utils\modal-events-delegate.js

Filesize
1KB

MD5
117e4fdbdb0ecf211c8bd909efd337d1

SHA1
9f8684d856b7c95bdffb139217dfd89f41373187

SHA256
267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857

SHA512
f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\utils\strings-loader.js

Filesize
5KB

MD5
9c94eb933d8a43dd3825e67a7e30c980

SHA1
7ec7b16af6f399219209ba5967d377040486a11b

SHA256
96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf

SHA512
a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\utils\utils.js

Filesize
118B

MD5
a0952ebeab701c05c75710c33d725e7e

SHA1
1da8a2e889f1213d481ae3cd5571670c01e64adc

SHA256
b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246

SHA512
5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\cri\cri-controller.js

Filesize
3KB

MD5
4e4b4a9e2d86ae3c108105078db6d730

SHA1
826946be793c999316af6c1db10523950b18ea2c

SHA256
cee7fc5a36a01a439125be031923d7e7415ec56194255048098169a0108034b7

SHA512
1420065cd000ce9b9c39d27b5dc5f4055f67146e06573a03184649851c9745f0c0af2b5e35b41b5923703dd74e32f9ed95fc59a43db25f854584e319950beffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\cri\template.js

Filesize
1KB

MD5
76c1ef0cb437db144c2bed53a5a8a5d7

SHA1
aaab8fff649f8e46d1e9510018118ee9abe01498

SHA256
505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e

SHA512
822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js

Filesize
1KB

MD5
eb6d6bd7e05d4477e2704dd87b57ca35

SHA1
f42672ec1e23a3f4bcc2952746d87ba8deff44be

SHA256
5ca97132a258ed1f36e401d70ccb95be2c9e18395e6010c40f61172914477de5

SHA512
1402d611f910cf5078e804175fa4693b591348d3e7cf6d0a6bbe026c259eb9e0bc285233c80cb2f4690674c3e927bc72fbdcbe758826b98fd02ecb3ed82e339a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\finish-with-recommended-app\template.js

Filesize
681B

MD5
d1cb34b57cef7e28b9286454b197b712

SHA1
f3a964b319bab82d4eda07e126bbfd6dec35c349

SHA256
b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42

SHA512
3a07de9c58134edbb7998f85e6d037a0cd066e32c4daa07594a949a7574f5693153bbcdb59739e1a92e847ab1128e2369fb30ba76a7b9cdfa9a37a409db691c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\finish\finish-controller.js

Filesize
1KB

MD5
138240ea22084428e9e25583e9156568

SHA1
e8bef7eab5b6e7040b996ec9504436e073444bd9

SHA256
4cb4e1aa25c15ae5f2e63fa4658a8acff0ce63e0f59cb6eb634df2dfe336e2ec

SHA512
e97b81b0ecd964e6e909019353efe4f5582f65763ac4197d754f1c4eea19cfc249900ae597fd33e29f531bb0d1c7e0f010793c59a2b0099fa75ad0b7d01ce8a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\finish\template.js

Filesize
1KB

MD5
f092de7ea66d8e920b345f38537fa35d

SHA1
82d107a409f18878307ae0cefe24074db64937c4

SHA256
b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f

SHA512
14942c0122f216c07595cbaae498f9c4d37a2d0fd95f262c332502befdf4566c7a042c4d85702c1d82a111123dde677096195e9efeb1d74eb1dfd4df84d01a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\main\main-controller.js

Filesize
11KB

MD5
15b665a5c915004e1aa7e9e11a710f7e

SHA1
7821924e42bb19d60c572ff80bbaaa04d7aaeefb

SHA256
84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653

SHA512
dd47f7bac0dbaac714e6d2fc91b4c24756ca4acb70bdbc4b54cd5216552d6bb85ba2e1c3c8445c5fb40d116dfab6569945cd74730bb7c8f3cf46e8d08f8afa02

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\main\template.js

Filesize
3KB

MD5
a118c7724c208f12083240cafccfd10b

SHA1
f89c676a215b869626737862a08c9eb07d440211

SHA256
63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc

SHA512
9fede79044ae5de7baf5bfba0d5a515ce462a25420026ff45bcf1751e57510023cb40df42d08e880114f62b38ddb218355d5357b725df32a41ae4e6a18414cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\modal\modal-controller.js

Filesize
2KB

MD5
b04bdfd1c7d09bdbdb94a2455fdd677b

SHA1
f000ba4866ff16d75bfd6cf446763498e19b12b1

SHA256
4565ee81ffe222b31982088b1c18850076e3acf59198ebce08118e12cbd87ea1

SHA512
3cb6ef0a16309046e7f407e7321eb12212b0eec09ec1a04b1d813f6c7a04546714865c3b398a93985041f598156ed905ebd23a64260801281b29ada9bc19ec5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\privacy\privacy-controller.js

Filesize
2KB

MD5
10897b8f8e410b128258fd4fcb183bb3

SHA1
e8dbd5a9018a2183a43f30da503d10a91f104763

SHA256
67556e333a57f50c62bb68f7bb08fbc619d7cb5342e05a75d5023d376c56d306

SHA512
307bfdec5d5a1495be300f61f2c3a8477a9b08da607244f6f72de3238fdff6d6d095e9d05f5ccf2780b8e56d2b48835da82ce4519d329fdbd6aad28a2ee82d39

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\privacy\template.js

Filesize
655B

MD5
cf8d2c26520d7c84e560dfa79e31dcd3

SHA1
716f2ec17480d5cc9c145bc147833fbfc39d36f0

SHA256
95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8

SHA512
d466dcf7e86a4295857020feea281fc89f519f6bf1e79c3b5e1046d0745c9c9010377b1941e06c9a9b2c78a4173ed9909332d5d6c39b05f460e8a863086c895b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\progress\progress-1-controller.js

Filesize
1KB

MD5
82f0b997ed552c52a510a9f2ab29dc3a

SHA1
92aec3a656053c71eccdde610130f5d8008fa96f

SHA256
838bab990ce38372dfedb50eb0a270db705811729630ab8557c08bd1e9e8e105

SHA512
ecf67f877002d746eff8af3a50155aa381513ddafd17b6bff0188c85f0765579fea0112e82e1371f962b1f5decc94b65e6120f21fb516533dac35a2d541065bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\progress\template.js

Filesize
242B

MD5
92b145e6649ba0add3dee9a69d3fa91e

SHA1
4db1a45392ec973cc8a7eecf3a30a9a7ecc7a64d

SHA256
a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab

SHA512
747a087dffdba5c92d9f4c8923615d388b9c4c79d3b71d3cb90487aa37c132290a4f5107eef3055c03eadcb9614e20d4655393dc9251fab7e0ee2438f0d95751

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\settings\settings-controller.js

Filesize
6KB

MD5
378c18dd7d5cee6ca7c4ddd0396b535b

SHA1
d5f81d4fab29201fd1629dc4d8e6f918c0c30479

SHA256
b5c5dc5e0684fd97eb4c45896dc1c2de8a6a6fdc63b6aa83a99103c15787ef35

SHA512
c29416b3f0245f4826d857dc8c52c969071d2410c945bda96f38f59a9bc7137ee534d84865e5ac55a1e3cea6bb705c5d592725af709cd97e7f38ff05dbaafe5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\settings\template.js

Filesize
4KB

MD5
28513de0830383a516028e4a6e7585a0

SHA1
d31fc3a6f4a3ce6c4afb82ff2342a1ed718809e5

SHA256
8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f

SHA512
0f7321c2ae13145bb694368dae1b74e6fe20e6b09712da2178bc46e6aa65223ab84c38abbf0ed074c85b42dba1a238a5f3f8d1ae060a0af6df748c5befe11b61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\welcome\template.js

Filesize
1KB

MD5
17f54fca6723b983875d940d931e0afb

SHA1
01774cd5cea36bd74c80a708d6f77567e8091024

SHA256
42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb

SHA512
401df9a54cd14c19227d91bd08b4775a7b437644b4ca0d1d636d3e07b04591f9c5516e80040ae6a79ba400457d15e3d80aa148a63de870a64664fc5a02f7a038

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\js\windows\welcome\welcome-controller.js

Filesize
2KB

MD5
50f676754862a2ab47a582dd4d79ecf3

SHA1
1cb2f4b11f9f8cfc8dc57ff29d0256dec4811158

SHA256
6155691dbdd66290109afb91617f9cf68af6bd912991d5d27b922f5faa7f530b

SHA512
ccfc89e08fd36f0a694fcda17efb84ca285b6c62afe2e3a794fdad19b6882a4b618645f4d9171673ba56fb4c55fce336d6b8d26dec3a5cc11293ae2b211f499f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\app\manifest.json

Filesize
691B

MD5
3a2e161c343d64ead2349db9da8148a9

SHA1
fa5381920345dc8a4f7bac220600cba135e3a533

SHA256
e786453b20b063dd7e46f43886dfd9337c3e4bae45660d02860b6ae6ca7d2488

SHA512
855ac0a61934478883084dd6a94af0757a33fb4fdcb63f2b96ff15059977170a0e8842ee810990c0529b710d34a1a5d7319f5062e826b1d146114303bc1117e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\log4net.dll

Filesize
270KB

MD5
f15c8a9e2876568b3910189b2d493706

SHA1
32634db97e7c1705286cb1ac5ce20bc4e0ec17af

SHA256
ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309

SHA512
805cd0a70aba2f1cf66e557d51ad30d42b32fbafcfbc6685ec204bc69847619479f653f4f33a4e466055707880d982eb1574ddab8edfa3c641e51cda950e2a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\uac.dll

Filesize
24KB

MD5
861f7e800bb28f68927e65719869409c

SHA1
a12bfcd2b9950e758ead281a9afbf1895bf10539

SHA256
10a0e8cf46038ab3b2c3cf5dce407b9a043a631cbde9a5c8bcf0a54b2566c010

SHA512
f2bf24a0da69bbe4b4a0f0b1bfc5af175a66b8bcc4f5cc379ed0b89166fa9ffe1e16206b41fca7260ac7f8b86f8695b76f016bb371d7642aa71e61e29a3976eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5D25.tmp\utils.dll

Filesize
58KB

MD5
c6b46a5fcdccbf3aeff930b1e5b383d4

SHA1
6d5a8e08de862b283610bad2f6ce44936f439821

SHA256
251ab3e2690562dcfcd510642607f206e6dcf626d06d94b74e1fa8297b1050a0

SHA512
97616475ef425421959489b650810b185488fcb02a1e90406b3014e948e66e5101df583815fd2be26d9c4d293a46b02ba4025426f743e682ed15d228f027f55c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh4998.tmp\DotNetZip.dll

Filesize
64KB

MD5
1457a0dbb9b0d0783f80e942c04802a5

SHA1
acf1f544e22d3d2d702e85ad514464e244338917

SHA256
e95de904fef85fb5b492989faa1760a5bf6f690c27ebb70953e4f6c37fd3c6d6

SHA512
4ac5e9b202cc07a13444ff01e9cf0cdeba92bedd76907fb22c6a43313c075dc3ea2b79e38b437a4c815e146137f3399045e6f1167a6efbf7f28904480ca119e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh4998.tmp\Microsoft.Win32.TaskScheduler.dll

Filesize
116KB

MD5
198949a4c3e67b9eb916140dff75c114

SHA1
a05d674e3ca569c68b5810c9ed1b7111992c4f00

SHA256
0bdad6deb1b651e0a52bab4db2c7883c9332884aa37300b3439c69d85b054c7c

SHA512
0dba2df28ca76a7b8a2ae8996aafdcea47e3f652b7441caefa3860cb74e9e659ac61b9c4670f1e8919173eb43c9672dfdf4d4ea827de345bbb18502cc695667d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh4998.tmp\nsProcess.dll

Filesize
14KB

MD5
10e47e822b85d2a12fa4727001612182

SHA1
12826a0cc7103e13f9be20a00ecc2c0fc995d2d5

SHA256
d530589a90918334b8e08d7355630892dd62f41333d948a860735d5becfcb391

SHA512
1ca0fa5d3727c23bdf5cf3123bc784070a93982e11e3fd1a875712ee3422730c0fba54a121aa814585466ba837f8122bc72b39c08de07d8ad369ced5155955f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh4998.tmp\nsis7z64.dll

Filesize
514KB

MD5
284c46af1fd2ec3a60ee0c28f276f2a4

SHA1
4d4d41c0af12d928e4e553ab6b80e6b4ab8007bc

SHA256
2368be6d8b21e0047146d3f61f90966a71d0737eed0146bc692b59f3cac97793

SHA512
ca9e4ef79c9c7c5f2282ddeee34ec39a51cddf26dcad4e9f2e42230499b0b898ac2dfd33f25438aa995741d23037fa01a0269823c283b234ecec0f155d3c05ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh4998.tmp\websocket-sharp.dll

Filesize
259KB

MD5
1b4fcde3554ed9ca14e8e7c3a1706fb3

SHA1
78070a29fc2943f49e896fb16e681431596bc613

SHA256
b152284fd1ef5cebee56802f13b46def7c136f0c50fb173ae29cf0648bb4cb1f

SHA512
091940363d0f4873bf169721082ac63e1f6208fa79c42da6255aac8b43aa7e01879e8ae9f1475df68e77a50fb157d298a5a480ea94d6c0a57b03b47d69a1bfe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\de\messages.json

Filesize
12KB

MD5
01d6d6ffec6df04d9aa20db38f8fff37

SHA1
bbcc61624b83278fd51dfd1efe2dab4848cc5c4a

SHA256
2fadb00ad366f03c039e9b4f3943a268aa08b52da301817d977cae9a3b1db337

SHA512
41bd55e34c95b00a762a60c5931c3cfbfd462a9082fced376327cbfc0a7182290a10b33b158732a9a4a3db28dd20a9af9a834fe8aa8112b2f5efedf094169c8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\en\messages.json

Filesize
12KB

MD5
a990f4160b741a42758ad224075c383c

SHA1
c64ec61fe4dfb271adcae9e21a0173e213eec34b

SHA256
eb45e2e89dcefc5d7fd83825f0e9ee7c2866542924894611495ee46a0b7f0cf1

SHA512
fa9ce9d3502832e2df8444b947e050bc08fbbd0611650b53722c3d5deaa6fb374823647842d8aee1e8e97bea96902111e7386d176540977e95bde87dca13c702

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\es\messages.json

Filesize
12KB

MD5
b8e35320edf365e901070e7f128f3846

SHA1
a91976704b4cc6d699a2e3019ce9aa63f6080290

SHA256
4af1ad22fdb9c4ca3b2e5d7ad0152fe1133501408b75a22e4540de91b8c8066c

SHA512
5556069bc1a9aaaef6720299b1146f9ea0068ae888e290248a1485768912864f4e36816eb6a37249f502e5d5a3250dcc0835625e03c7c2d1d6ee8cb23c616e16

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\fr\messages.json

Filesize
12KB

MD5
ae00b07fb78dd6c0a0288dee9889c51b

SHA1
7e7ae729c2695cdc0cbebed7961fd8b572e846ee

SHA256
cda2fdf66408fcc0572086dbd1d4ad849a0f1fc8d106b7dd321f4e0ffeb715d5

SHA512
eeb78c7d3c8a497bb4812fd4f6410bf71820fc5d997ce635fad31dab557935f8141e804c6980ee892f704f43ff72db1bfd2e4c59f1793531f8c113836b36ed5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\it\messages.json

Filesize
12KB

MD5
fb7fb01a3394f202856ee3bfb517cb85

SHA1
dbbf1c3154c05c6b621141974f80406724c0961c

SHA256
43b4dbf9eadbfd67f15a4274eb879263fc0ee33b2373c0e494cc51f5f535e15e

SHA512
f67d4271c5a4678c064dec4433259dfa55e7aa55f58b3c60a75da549a7c1a4e89112ee72e1fceb14eb64505f6c476efda6dad0d343e9934c0d937fe784bc361f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\ja\messages.json

Filesize
13KB

MD5
e67d80fd6575f9baa639f30b02c5e381

SHA1
05b5362e86c278050b4e3f71e129b4bd501fed85

SHA256
6eef2f8eeb3162fa9c84aad624f84fb49560a03831beb2a452351e43f09290f4

SHA512
1d87edfa2462faf28ec539e16c3df3cd0cd7b5e4d07ae8a0b6309452bb1914a457e58790fc528673bed51d47727eac94bd547bbd98d01490f8c8b1c450a4cac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\ko\messages.json

Filesize
12KB

MD5
1d0c0d1d0e0db8d11d9638fcadf40eda

SHA1
1cfb61812066014a667f93adad4da97753fa6cf9

SHA256
1c3d772dffd9f5aee2caf1f4cc41eaa047718a1e3b1a001eea682c6b2d671f62

SHA512
2f76efdd17ed44e99dbfe7c848c383629466f6135fc707440be72adc902c5d9211129364f72863ea04adbef22930ee2042854ecc17c7d4dc04b879ec55454b6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\pl\messages.json

Filesize
12KB

MD5
727f8ef308ab15eb134a50f12796bebc

SHA1
fd51735305ace46fec9b2f2b13e46f63735af7bc

SHA256
5a72ea2093b78802d0086606174afa66ed574ac6c8ea888f851a0797a5c1179d

SHA512
77063242f996d4171be1cea00a256031e2bbfad1f2b0da45e750a931cfe3f2e9dee3469e307da64deb6586c3b60f2e59eb623eadb0be8ebfd830e16bf6f39149

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\pt\messages.json

Filesize
12KB

MD5
00df432fac4927e42d6d094d7cfb8ae0

SHA1
a9fbc71223134270033bb24d3454229af9b497b1

SHA256
5091f122e60714f35dbcbb37f983af2fafbd52fe404c77aa78e69abdce1a0c45

SHA512
4e17f63d6d5a416eda8a53c5e90e45b657edf5ebc8d4aed37e3b3ffcf4beb26568ad6a45af703fb56229afc5918785e301196be55a54cdf8e2e9738e5a4b6039

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\ru\messages.json

Filesize
15KB

MD5
d4915408dd2f7596a51cfe8b42f28735

SHA1
c2fed4ca228073de14acc028f4c59730f67870b9

SHA256
fd4545ae7c47a6e807bc74bf0e3579811ddf9b14fab4e4743205afa2eaa1682e

SHA512
7ef043ef009d836f237f00804d80125a622cf9a0ad2c514ca04abb2e2476ddd5a8c64c2db9a15eae79130d521c03a8697fffec82e3e0fd3e2fa1cde59b55ddfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\tr\messages.json

Filesize
12KB

MD5
bf0b3290d7b2589d9c508a17c5244a9b

SHA1
31f6aac4ac49dcba742621d7111e621004d46ba0

SHA256
557ad0a237f2a0e65468a00259bdf185540909dd6c21caf4ec01e61679e48e84

SHA512
555db28e912f7a1eb0bdc77f2ec120012fde3775c9811cc4be22af0909d25c1f61c9338062f3a84fa208989a7aa108866c92a06962c7a36d42ae1caae857fd47

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\vi\messages.json

Filesize
13KB

MD5
a794a3b13aca25db94a6f53843adb370

SHA1
bd439ca29d0b3255f00757d4406056c0b40ec3bb

SHA256
b01e8e59c4590ccaeadfbffcf5b042fa857eff1f8bbdf9858091523122b06638

SHA512
778ddf3a750bf7dae8dc1b371c39a9a73b8536f86b237505556cc52f22941c6138f285e110a5e9050ddb73f7c756f23158e38d0f7a9bb2a4b63c6282b77bc4af

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\zh-tw\messages.json

Filesize
11KB

MD5
348051345b75fa1f8d49015ca5b5302f

SHA1
5854388eca2bc878218c8c7e62045c3e19cc9487

SHA256
477f0b1b154f4bd07cea22b4285167ee5985b3dcc7285341f738c8eae5662138

SHA512
facf58a22085ea6cce5fc98d1c2501dc97db52f3d76d610737bba0ddcbdee35ac31bc4d8011f6457bf1d07b55109494e8d25e0b936b6b25a38eaea3597bf8ef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\_locales\zh\messages.json

Filesize
11KB

MD5
ada2db2ff9691b5cea7072f674417a8e

SHA1
32a579feeff4948dd90a79763c9ef22210953200

SHA256
882d4b1976dd5da8cf82700f0eaabe8a7197358bff20ce5b8f78e6c8454f7d05

SHA512
28bdfb16f22cac5ca226a1d80f9582b3bb6ccd39798fb168613538e3fd0a3543bef2becdf136125b229ca06d73a912bacf08ce2ce2601de9a7b24ece5c6481b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\assets\fonts\klavika\KlavikaWebBasicMedium.eot

Filesize
27KB

MD5
ddd851603ecdbf74a113ae2e741fb487

SHA1
36449c0d56578c22df9c6918840d808aebd3e97e

SHA256
41146279fcb503008ab14c89e3e9a1737dc92499b07e36f9bbbd40b82dc3a793

SHA512
67b84413462158a114018c413bc8a32731d00f439d6998ec1577fb7d27df4316edd9acf9c94dededb918fc7ce6fb8523af85e03dae0b94e5a2b505e6998e0053

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\assets\fonts\klavika\KlavikaWebBasicRegular.eot

Filesize
30KB

MD5
8c176ec2a2ccf48958f8cbfc5114818f

SHA1
dd93db072bfb8ade37da99c8e56bda5c4259feb8

SHA256
83f615ecdb758eb2fd5357b89a9e0424bba9ce66ba2f8ccd93986f7d03998b5b

SHA512
c2ea009102f1a47313ed3d85f391ea23a9bed3378f965f4450befc5347b086f752fdb5b41ef0f2f6dab674f3095e7dda2837294b4d21ea9268551bffbcac5c4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\cmp.html

Filesize
5KB

MD5
d7b8b31b190e552677589cfd4cbb5d8e

SHA1
09ffb3c63991d5c932c819393de489268bd3ab88

SHA256
6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f

SHA512
32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\css\styles.min.css

Filesize
14KB

MD5
a205363a8b123d65909896daf16a2eb2

SHA1
17d99f7889d61b56a44509e45465fe413ace29d0

SHA256
ef423e07b8a0ce201d438ffb8501899c6ae9d20fee079707b03b32bce8857591

SHA512
c65cd1f376838ef700a1826117c61d10151c06a8d1e869a2c5c2f0f282cf00a8dde4d6ee74df01a34824e6f84d9c694217af23354f490eafd5814493e4837521

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\game_detection_database.json

Filesize
27KB

MD5
336d26d3e0ab31e8dc102ea86c48fa26

SHA1
aa0a6a940ffcf7cdd9cfcc86a382890e18fff5c4

SHA256
f30b571b8bb396aa0bca9aa9b80638416ec638de5c4788bc281ac67d3d54ccaf

SHA512
ee1d4ae3236964e0e2aea7c33aa82f44b2b25d9fded16452e00ec09f867031df0539be19fe52c4d638332dc50698b526a7cb11056f5fbf765eb7e0cf832fb49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\big-icon-fallback.png

Filesize
413B

MD5
435663128120e807ec9c33d5b277198a

SHA1
6de278d5f8850da54405fc3a444cfdf8054f6a05

SHA256
46b318ffab431aa7f0559560632c0eca28a0527fe9ec766e947d3b49708e3de5

SHA512
97cd952ab6833cea217ea6b5f5a83624f4ae1311ac0c4d66f2bb7d61a6c224b7cfb6205074e008ea33aaa7b82474fed4230ec3f4f8f085e884b716ee992624e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\bottom-arrow-hover.png

Filesize
294B

MD5
f5d76b21fcab6cc89fd0ebc1089c2c26

SHA1
160645c02dcfdcd4d6d6a8339557a62b80493e40

SHA256
3b8043e64994a53126afe1250b80fa2934196c3305bf93fd3e7a6963867a6eb9

SHA512
4c4fd737cd771e8e0c025295c598aeb4ffb2d20df10658f7cb992aa49b4817be5d291c0c6530b4e9aaa241ab76df3c52e01a40a505e7b60d1d968a96fd4de991

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\bottom-arrow.png

Filesize
279B

MD5
847fab99890ddd7460e758ad8d463ba9

SHA1
bdf8c1e45993ee33ee0bf9a2e43d6048df71cb8a

SHA256
46bfb08af2269108c681b78373c98e899b4234adce39394322c7dfd6d40dcdac

SHA512
0bd2075c61eafc2946a9431bd4fbbbb141f3743144782376874640e4aae1ee97a05844589661b3a0912b23dacdf57e0a667d8ffa8ccd0f4358e5802e653aef1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\checkbox-checked.png

Filesize
161B

MD5
cb392a851c11a74c80c9a6b7a2804cba

SHA1
750b03afd6f6da79ae81164b5a64dd2c3f4937f1

SHA256
b0718ebac6a1666f75492e0807166ea1b257bbbeed87d64d574e45adaa768173

SHA512
ca3baf5ac8cc1008c3886d68501c49a750efea4c891d85615a8881ae604f1c9205ee71861a8bb615b5978b239aa4e3b8619a56a646ec4d812e0ee7c1dfe05af6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\close-hover.png

Filesize
185B

MD5
d07493ccaf895ba1e5a1b230789b06a8

SHA1
c62f9f464db25969516ad57a706b222e100667a1

SHA256
5c95ffffdef5de89cc7b04ddacba9fa4c1280a192fda4138460c72433f0d0230

SHA512
ec5640f9b97ee9d22f8dbc1d685048acc6c67338eb701c42522a0e72edd3b180677405d458c49cd73ee23b8ebef85beabd66909a6572665abc1b25cb6d0f074a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\close-normal.png

Filesize
330B

MD5
1acb62ec3fa5a82347c330512f2259d6

SHA1
c81389f19687e791bc4ada896620b17471371c04

SHA256
e8bd82cb680ae552f587a3f0bdc1df18fc7624dffec501840cc508d327baeec3

SHA512
a6693f68c41f8a7c137f3129403b14144329c132b99956ff2c1cc5317b046eaec70aef82c7c05b9220c3c3a7f2a417718fb65bbbe486250c05191778456f602a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\header-logo.png

Filesize
1KB

MD5
b51f37fbd94cb7d7f45dab73fa5bcfb9

SHA1
2c3aae0f065216cfec01339da2c60282312079c0

SHA256
e83b38f1f699ed4df739fa632d55a422e6d35b19261081a5bfccd2bc4669c5de

SHA512
4a7c0a654c3d4da9b9b77aad46d68d2da370b8b54fef325e6ea8972b202541c134ee937db6d71dd549d405241fb15a043d2dce0734312f72222cf5a21e5827bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\icon-fallback.png

Filesize
213B

MD5
3880ad80fd07870118b0aeb8fff308d4

SHA1
37b30e87d89d3bc56eb5ca3f8ec6c7f22e5ee6a1

SHA256
772fe7450824cb84dbcbc9cdb401278dec1a511ca3ae2cceb073e8bf4dc8fa61

SHA512
3917e7b6623f284a0378702e489a5131c3ad328827a87e1332d24a89d6e54d68e7dca3e5bfeb0bb22fe54da1572d2d8a9107eec8f36b9ba7db1f50c0a5205d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\large-logo.png

Filesize
486B

MD5
91c31a155e202e8ad2c033e61d0bf948

SHA1
3fc81f5f368f90e7104b65adf6b8780d71005f99

SHA256
1bfe389c41dc9897a4b1b5a0e495570a0f3671fad73d42307cbde1a82ae1be17

SHA512
ef89b9edabd3e1f3e9cb8e2ce919b4d29a31ab112297fa6b9c3be2cdd0df548307e3f800de2e027b907422ce87a5edf638d0a410e9afb6de85318ac0173f1e69

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\minimize-hover.png

Filesize
171B

MD5
f4b8851b9ef5a55b0d45392baceb31fb

SHA1
03a87a04dc75579a8568543d40db963b6e9f4051

SHA256
d84b877f7a2d601b1d71cf878b33ff78c94c2d144a0f4d72436a7dcf64e712c2

SHA512
a849659d4ba4e40b924108cd567a58f4b1569afc5c7517a10c26fd6d64422fa61812683292da1c3b19dbe91c63aacd5cd1c5b342ccce98b6815e94b55767ce4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\minimize-normal.png

Filesize
150B

MD5
1bcfd10e50ab56ac335a463ec19b8d33

SHA1
b5054dd1cdd714a6771bc11e43291df361a16ccc

SHA256
aa2b021cd0dd9563705503dad48866eac926c7ace608ff8d00f755afc509f39b

SHA512
7257c401db826ed1f4a549b1b899d0fb4a5bcc3c599ced49b07a64fc308b08fb208dc378a32d9c3cd193b4d603ae76f82bb297334998ca6abb790081a5467edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\more-info.png

Filesize
539B

MD5
c6911391ca719b6ece307854f40d02be

SHA1
451936edbab150559e38a81ec88c75de052bb14b

SHA256
b110d583d920fb1065fc7eb587e4f2a256f99d55eb8a562924e088d9b7a971aa

SHA512
9728920dd81f2554a37119aae1755751e08ce8d22be5df21ad1b8205d3e37f027cbcb32c25193faa6fa6e270574c7d4eff529ca08bf57565b764b338ea8b1c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\plus.png

Filesize
178B

MD5
28a150c80834701792d39b58fe16e741

SHA1
f7fa88204163ee7a0df768eb6759bc02b8e1c030

SHA256
d25235a308d7b16b6a8694a3eb8935393d124dd3c58380a6c67d4e4f3382e47f

SHA512
8222a493bae3316a851b66573886b3c63f8d63b68e4da56ba25f37fb46cdc27ac7dc4e10ca1c3912352812eae5ce4492591fbce09ff7ba1a228ecfb2a49f0c32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\progress-01-overwolf.png

Filesize
12KB

MD5
3d98876bb3f09090568aa3ef90a84dc0

SHA1
5f98121ef031920b8c8ecab21435cc64bd531c19

SHA256
4da28ba55f43cc1d03d5cf1eeb040985d3bb5fd2a7230667c871254f006c512e

SHA512
2bfb612a6aa0061f123e8d342ab4d049e2f38b2c111f2662d4da8c8a22a73893c5d9743a337766ff2e6346cb04ef2b4c63ea72e5e749b34593fd372889033d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\progress-02.png

Filesize
9KB

MD5
3781b597e18900a6b779ab588d8a8e21

SHA1
0fd2084a62f507ec802646f7423c9714ba547d7f

SHA256
130eafc5dc7ef993134d0bcff40bfbf11b99d41c63a5c6ad1d70c7ad4db2a5e7

SHA512
22f2cdc6cdd81503d48f8f23c84abbd23c6c9e3a137b7e4e91846823d957abeee348f4e3cff88667a263503ca310d80253187d699f733975133d08b5729e647d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\progress-app-image-01.png

Filesize
2KB

MD5
6276c4f73df3a91718a12878c63dcf24

SHA1
a86fe5338c78dc396f680e489766f8186e6cbe81

SHA256
032335dca37195df73cef1fc5f019bc8705284c3226dbdd54f81d61b714c4915

SHA512
11a4e465614e65a04e72b5d6b80f0c5643d51757a06595168894d3e0a419bd68ad31152221a22ec1fd6db03c5c159d31aa5054f1f4d8c633099477afd6f92607

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\progress-app-image-02.png

Filesize
2KB

MD5
9626ec7a1330f4fa65abb37f08ff6421

SHA1
914801589106fec21ff3d7f5673aa035bb5bf129

SHA256
9363bf7bf35a32278d95b8410bda989c63d9cd09fa17fdcb04d93aef1d433b3c

SHA512
f43caa916f385158cb3a3fb20193a80ce8ee84f1063e6497fa0a9265dd28b8983750d0c44006936aefb9d6b16230d92105bd344707bda8d55e3283b344ec792f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\progress-app-image-03.png

Filesize
1KB

MD5
38ead88ccac4d4f8077e265aafc186bc

SHA1
eb3c2de5065ab597c8e9799a3c31487545ce4828

SHA256
827f9bd53d624da1397e0f8d3a68fa96bbe7146b74f6ea8af5cd6acfc3839cd5

SHA512
a473af7f5d1dd87a670b1d7f1c9e34d66d7bbc77647dc72d540acf97e1d296bbaa59469663354ae4223423688142d6d828e35f571d37bd7ae813274ccfcec519

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\small-logo.png

Filesize
523B

MD5
ef0803e881fe7bba90e5e9ec1678d950

SHA1
43e9ac35b2f4bc22e404bb2362eaa7bfef24f9bf

SHA256
0ee19b8f79232886f6234cc6dc21c0327e90df94a189c5effe1d8a6444543726

SHA512
11c6126429f4fc3ea32edf6132dbad840a1df35f58237c8730f5171c491588425190897f4370545bcc4ed4d42838dd95a2789a3b6ca20cf8cbc7bef78472f253

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\tile-fallback.png

Filesize
935B

MD5
0148cc4040f730247ce079e723fc030b

SHA1
ee316fdbaa54a7cb5cd350adc4919787e7edb63c

SHA256
d173d88df0d31e3d4f83b299cba4ec031dd286dff2f963e58d747617649108a2

SHA512
a441046265ccbc2e8e25bba5e10a46d65f28d2a9100ee12742e0ef5da943461996cc036f57031ef6c21fb0929ebb941e27874a08e53677e46ea28c097136cc75

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\v-check.png

Filesize
885B

MD5
cdd7415f59e5c003dd5956b971a3cde1

SHA1
89a3cd6591cd66fde5fe389a216272cf11d7696f

SHA256
af10225db6ff7d4b67d00b12f37b211c1f368bb99ae900856b023ce5999dc9ae

SHA512
bf36f6ed5f9a5bd9da0bdcb0baa03ad73e12e4d30ef64752e14c307280825e994deee50c5436f683048711104634f0410684188d47f5698dfe5309ae4f55b2a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\images\welcome-logo.png

Filesize
995B

MD5
860785e1633b7a170ec443f4d36551c7

SHA1
f5a3401fdb22bffabbaae7f912f93cddbb7ea148

SHA256
2e3dced384fe419468973dcb074794b1444f48bce8f96217aa5e3a98c34e4c01

SHA512
217b2177b9f990ee27d1e169dca9f99da18e9bd41fc6d7a5ce7d01cf9e35a23f343763835424125b3fa73de196579054e56542e5885327c6922deeb34fd78e16

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\app\progress.html

Filesize
20KB

MD5
3cf16292a3b2b0a8e8be4d5dec3fe7fe

SHA1
aea7bb7dcd69e29bfd176e4eb13e820ce3a6f008

SHA256
9a074fc3a4e2b98ee4855e9ae491d0c004659bc2db623f90fdacf3f2e4b07761

SHA512
0464aab09429e9c5c09b757a4d588fa1714cc9fe100e41559659a2aea1afeb5a10c292182e1784c40a09557222200a2dc2010007f64678e5de7178616a38086c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\nsis7z.dll

Filesize
96KB

MD5
21a09f96b9457a16f511471b87f59c51

SHA1
1ca59e391dcd679497f40b4e192101a3e335bdab

SHA256
376c4dde25193b10d16e17b88243940553e35d3c2f7219c19d5948ecb2233850

SHA512
44684024a16dc0ad3edc79b095cdac2890808f5153648944acdfd8e6b41fce27bfd0db2f004a05d30be30627f9cf843d994d730784b087720bcb760d298eb922

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB61.tmp\partner-custom-asset.png

Filesize
2KB

MD5
2705d292e2fb7609447714554c57a585

SHA1
68e385c6b314a3783aec8bb9de69aceab7b9fe36

SHA256
f9a654c702d0bd821de7a7f14bba34d0b6f7d85dcb004484e242e889aa90d77d

SHA512
0a3285189ead35b013ae8f3f2ea646be1e5a77efc154a264f266359a1ccde0b71c395db23687d6eb1f65477b80c569f9691cf2df0ee84c553509cb364c7531dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2025-03-28_16-42_2360.log

Filesize
1KB

MD5
dd790b3f53252b187257a52229a2aaaf

SHA1
3818380c03c197ddc895b36dc772f8061fac7dca

SHA256
42b335fe734e743b712e7a183e2a03bef01fe18448b4411a5d5480a64d9fc1fd

SHA512
cc285b9ca94ac6d0df565c6c7a4bf8462a806e41ea39b1cde31632f0580175b1a86e724c933e16cd2d79c313c49d24edaf1db316a97ca426263dedc41d269d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2025-03-28_16-43_5108.log

Filesize
1KB

MD5
081841b66b7c56ebe1f9e9eeba9e4fbd

SHA1
3eb48c89a6ede03f82b08084d4dcb1926f09ea88

SHA256
6f83a0c2925c0f4f402f18456a0f87ca816721b7d4f75238defd66b091a3507a

SHA512
3423d07324e30918650f09e83b3bf28addf1ef24452df06ed4ed60a1d9574de491c774f202b67392a1891c91c2302704a07b40d42fb84d399c3c709ee8c85cc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ow-electron\InstallerTrace_2025-03-28_16-44_5204.log

Filesize
1KB

MD5
72e4397a89f62ceea923aba9b4664cfa

SHA1
8d6a862b986ec7184ea877214fecb63e2d45a81e

SHA256
00d87634b0b8dd37cfebae1d92fc6faac203f16bf3beac86fc31693cd259448d

SHA512
dfc812423431b0c22408adb7d02de31bff0e5c7af6cb2b0629f4c31b9a60429e2e0336650ce972cc7a480872688d06577c542fbf3f9add971f57a0180eab83f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\AlternateServices.bin

Filesize
6KB

MD5
5799158c8b77f9a3c2752513b8b8f04d

SHA1
bd599a22550dcf047c0fbe9d0a5b12359b9231dd

SHA256
bd04e47b42142ca7678bb72296a8824089c3ad776725cc50f78cf4f18d3bf60c

SHA512
ce40a407f5950b429cee3b19889045ac10429f103f6748ff5cb8da69103ca7855202dfcb35601ca380030765542d2f800faa5b156b35bfcabceae85386a02248

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\AlternateServices.bin

Filesize
11KB

MD5
132a4baf104ad958d989c36010abcb55

SHA1
ea8ca7aa256ddfdb9a192f1698fd8149736f22c2

SHA256
a96e93aa5bcd44ddd86c713dc4d4c6eb062006c0988eb20daa44a7754f8f0e28

SHA512
498c2ba19d6690e6e9d22e0181a0426f0168a90aba367bf3c48ef5f2f49dd45b5b685a9bc463a1e6bb77d05864da5d93e102f720f33b448b698b745f2a490bf7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
9b45bd9fa0386ba38621048490aacca5

SHA1
9658351b45b675276ee7b9c36dc065c0ad2441cf

SHA256
3c02002026ab574145cdc494b52c1da93a30f3ec2fcac24236e383e350965f45

SHA512
49cf5ae624f58c8675c53285895a1b40cbf5c610083e6038b22330e166f2123dc0f70e0779dafbe623c2c03ce18c071f889bbbd0a73762e8b9645c660ccf17c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
dbf5ff59078cb0a7340447991cac3834

SHA1
bf8d4326c179eec520c760416faf4103ac932837

SHA256
6fda2829def080f757688d7bcc84f03cec48b18e4ac9d7f995870287e68ebb19

SHA512
1880e3e6c2ddf11e58a553d09c00f95cfdf377f62b6b6e18dfca5c2b89ba3d15891faf245944601fb13f04fea814d73eb9c4af5a4992d7cad5e73c5967c59a2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\events\events

Filesize
4KB

MD5
875626602ae21dd8ceb38ffaaeb69733

SHA1
0089fadecb524eeb49b7299840ae3ecaf541e787

SHA256
bfb0ed54b2624896372129ec30959813a58032c0067970f22396327745441dcf

SHA512
e88d70baebcd4518d0bf10def5d8ec5634e651b4ef1b38b6fb442699b32b5ccc512e4e4a3cbf50be32944a2f5ab33e042c7e18438817c9dc1353e85b3753d31a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
bd054a99e80bfe8e19898a6b5d2735e5

SHA1
d21b17b7d3d5796be2ebc5bee5f9cd21cd892ced

SHA256
4e0eb46a098343191bc5b3f208dc0337aac7d4007c7526f719971d8822f3a9f8

SHA512
9d03b1e491c9ef01db3c623342bdce36b76beffa9fc2f4ec7a415f33e241f1e5ad568e1d20dd86a1ed5026880168ae38ee09a1e81dabd02c84748d996e0d7128

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\1da1524d-b359-4749-afb0-8cf7552a6053

Filesize
886B

MD5
ccc3ecbd55317407287c25fccf70eee7

SHA1
9b6237cbe366e324a2d95a4f6ffd6689094523ea

SHA256
dc5d56fc859dec6d33c8a12d0ffe04e01e06fd264c06a96a307f4b4a0ab0021a

SHA512
e57175c4e9e2258470d19d86983798bf42a4ad81f6f5b5717d7956e8b379739883e95ebedfb1356b60e3a66294fccbe6991d2cbfdeec32c044aa58a5385eec87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\5bc78e15-639d-410e-826e-a40fac9ff86c

Filesize
235B

MD5
5a4d47186323b9a00a6318a539683d4b

SHA1
8542c390cb43eeab2b9337ba5afeefe3341442bf

SHA256
64dc3627b6dec948e99a482ab9a623aa2e3f3b1107af5335981f2cbaa22e410a

SHA512
3117236f87ce5b52b02feb2c414dadcce6c79548ea12c8d79ccdbda79828b70f05f6abea207bc10c9264aa3a83e494de504c310a38b9fe15ef4b2fbfac201343

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\9a482e50-6647-4e96-910d-e00cc2794b20

Filesize
16KB

MD5
30037d5b0d391ff932221127233de113

SHA1
f5b2716c97f18d4304d4ba49f236cbbba5ba9140

SHA256
4c6baa2a020836b203a027852e9c700f5fc4cd5f077869b8486f71e9ed4e750b

SHA512
7560837419eadcfa63b7ccbbe42287fbab0a3524333fd2f03f86fbe853c47c3f0171f696693e81b9ba755be4b44c3caa5d239eb1e8d81bb9a3476dacedf9eb8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\9f4ab3e2-0db2-4dec-afde-55a400d6da4c

Filesize
883B

MD5
3df759b040ecbb841840e9b271314f34

SHA1
4a1852b0f78e1ca83ccce8f6d0d3cf764a6983d2

SHA256
80c820dabd3725ca95b057e6367363f0930edbc66d165ea24bf92b0b6e432f79

SHA512
ec024d6e8cb422bcec8d5655c08830d6d1ef920e651f92fefb780ae4c2b83081a13d387337efd1fc8c8bbae00ead507c5a6a652d232d380f78ebdd75923a20de

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\a23ca15f-61b9-469f-89d4-866257703ae3

Filesize
235B

MD5
3e43bcea955d3d4e86c4d661813490ab

SHA1
f3e9c06b13ab904ff408833a8fbbddd53b7cbc1e

SHA256
454049304a53debae446dafacf88ba85ffc109d2b1c4f44f58cccd92f0b11ee3

SHA512
e4c2b0fcca0143cc2fa116afb6ce83ab6c8226f3bc92de7e997ec856984fa0446f6a84d69cda09f11735f6ba852905a854cdfc8648f9942ba8f12a3c31b7173b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\adafaa29-3fe1-4a54-a65c-e98ad3adfb77

Filesize
2KB

MD5
b3af94e5017ace8b5d21fac369fd6405

SHA1
aeeb7c7300288b7f677fb5bedcb73018a7bf8367

SHA256
b8d39bdafff9871d75e51c730df6238e0bc3235fe28b7bbfe3d186ab3148ba99

SHA512
00a1870adb2714682643dc90900418954bb599646e7597a641645bfb552c77467ac8f247d7826d7de73015277f6f4dcf792708cce0dd805713b3b45969e7c8a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\extensions.json

Filesize
16KB

MD5
191fdf43dfea7b2701f8454235f8cc02

SHA1
95833cda9421f60d0c50a689c07be5fe306b4db7

SHA256
7a8aef0ef70597f5bc5e0f87fbb0b3672145c9decfa0e6f09e2e480df169c30e

SHA512
175ae2392ab74b2e7f3c37fe929489bf269ab90b78495dd754fb3fa1acb063596fbaa8c9dd4947d0bb73430647540980a3b83f4d7aef68c0a3e71aa5783ab85d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs-1.js

Filesize
8KB

MD5
6c054b73cbd6e44e109ffa723284472c

SHA1
d88c1dcaa35f8e4b5faf9abfd370cb0ca635257d

SHA256
dec5059790e22a5abbec5badb3713e02e24be19953a6233a49f3a029fadde583

SHA512
19205162a401322d4e6ce8781a34a1514b0442b411c08424a9f7961aa2331ed7785417d94ffa60d33252317a5f6ffc34a82c00626c13e6c79fed8afa29d6fb00

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
6KB

MD5
20f9d484dc56ff2aae3390be7128e4b4

SHA1
a83947f5934ac421f678d6e61c8fb5dda1eac76c

SHA256
db2af6ea05a5e89c00093d888bcb04657282e2df3821f9a3dd72791b7cdf3cee

SHA512
69b7921151797b8724cb85d3bfa352b5cc78e68171733d7a4b7b84fa68b09f3e2620f59f72bc0dad29a68114b3c1b112395489b03ec3a5e47977e03d1f92d327

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
7KB

MD5
019194e442d37243b9cb9a5e03524bdc

SHA1
10e3f7503b0f80673a8f95a23d469fe1d795716f

SHA256
44c70c1753f5b71522db5418bba1abfd67b11a282a34de73520fe3dcbdbf857f

SHA512
f5464b9adb247b4872caea3c50cd6834f21c60a0263883bba94f27f923fb269ea3b2304d2119ab8407445cf0082862d6ba7b004ae3340b07dbb287973de4aebe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
6KB

MD5
bb327ff8efd79a70b03c9f0ad14d5e00

SHA1
5dd4764606863e25fc8cd2df99c19e74c9de593f

SHA256
b82f11c36726d803d61c738cb2ade4b3e272a180ff4ca85590ad207d57a4d171

SHA512
e30b63c7b7b3b132efbc5621066cf34bba6500d5e2b20554bcb2d5fd9d85f528b67283616b5256efede979ee64c86aa33f3cb0b16c0d525b5a2942edfbbe2140

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
291efd45ec266da4e4361ab3c5096526

SHA1
9f64427796f7c817205a9d4db5aaaac7e35ed91d

SHA256
2d081b8dabd385852abd735d779e3da44957d4701efb4ccde5cd89d88d6b0448

SHA512
b1095ce6885bebccdc0b8255899ada2fddb7c42caedce6831db080373e0c1b0a83ec431d2f485656bc335900eb281426fb06902179392946ae23f2b51c2d4d5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
604101a09f17de6afb0352580fdb2574

SHA1
d07f06cf005b7e558fb5e1ecffc7c8b052e33beb

SHA256
7e40dd7eb07d641007aad373cd7417bb338d15e4b1ff50e5c50568ab7a48a160

SHA512
5b9042d60f5796e15add5d02b4e208ad0c0b333e9114b802328ba243fb97e0faa5d707840735497cfbad651c9a663ea9168a98e13f942695c607290b7049c89e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\storage\default\https+++www.googletagmanager.com^partitionKey=%28https%2Clunarclient.com%29\cache\morgue\206\{8f9a2d40-0907-4f0e-9ae8-40729f4952ce}.final

Filesize
10KB

MD5
be4b8d06204faba090b711ee174418e4

SHA1
8b60f0834f1576a131c10514e10f7508db287153

SHA256
1f38853b4f515c0aa982835b112cd20e62e9ced63ee6d3ac80bb0a6b08c24cc6

SHA512
745f17334e1b89d6227068f926cc7f2ad518a84460575029fa3314fbee86bdd77a3fdec81475f3a5b6f52a7fedb516e0d3ccdd72fd8a30357ff22b759328ef0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.4MB

MD5
ce63bc9e131ffa79852a6b9d10f20d0a

SHA1
171216d6fc78a984f14030c4dbd14c45e615a0ba

SHA256
e03cc524ad7150a5b33fad168cc5397dda258cd57f89b46c2fc4acad9e303150

SHA512
6a3fd24ff0a3f3238c67211ccadfed62a1f6fcdf13bfb778162274bfddfb66b6e166418176d618ce20fb10f167b0c157d1f8558ba737d0ea009fcb9ce64b840a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.4MB

MD5
6beb4868150e2f6a51e046bee8d95f98

SHA1
9a6462415b162994ea7bd992b934fde54d5fa7cc

SHA256
41cc0ecbc36ea7f7e048949efaa333c4056f8b4b308aa627e58b49e7faf92427

SHA512
01c2dfc857e9df7618535be63a2ae2887eddd66313ccc4f56a3fa71462f8574bcae38769ca4ab257a59900a97e83f4a776760cd1ca6022a09b5cf7ea8f579024

Download Submit
C:\Users\Admin\Downloads\Lunar Client - Installer.exe

Filesize
2.3MB

MD5
b6550baddb546325c6e79ae7423ccec2

SHA1
13175ba6ae24e15d231478ed209bf71dd14b64a2

SHA256
6b980bc707227a9d6f472f6e447336a8f472ccf83c2d0747e7540461dbddea36

SHA512
c68910bc05eb0ab7caa9b125e3b5f5e377a6af4c94580cb0a57fafa7b5ebe55ffb6d6a2bfdb46e1f5219b252cf6f518a6f9f6a941481283d6da6d228020170fb

Download Submit
memory/2360-178-0x00007FF9E25C0000-0x00007FF9E3082000-memory.dmp

Filesize
10.8MB

Download
memory/2360-149-0x0000026CA2890000-0x0000026CA28A8000-memory.dmp

Filesize
96KB

Download
memory/2360-155-0x0000026CBB2C0000-0x0000026CBB370000-memory.dmp

Filesize
704KB

Download
memory/2360-152-0x00007FF9E25C0000-0x00007FF9E3082000-memory.dmp

Filesize
10.8MB

Download
memory/2360-211-0x00000274BFDB0000-0x00000274C0556000-memory.dmp

Filesize
7.6MB

Download
memory/2360-213-0x00007FF9E25C0000-0x00007FF9E3082000-memory.dmp

Filesize
10.8MB

Download
memory/2360-174-0x00007FF9E25C0000-0x00007FF9E3082000-memory.dmp

Filesize
10.8MB

Download
memory/2360-176-0x00007FF9E25C0000-0x00007FF9E3082000-memory.dmp

Filesize
10.8MB

Download
memory/2360-138-0x0000026CA0F60000-0x0000026CA0FA6000-memory.dmp

Filesize
280KB

Download
memory/2360-136-0x0000026CBB5F0000-0x0000026CBBB18000-memory.dmp

Filesize
5.2MB

Download
memory/2360-135-0x0000026CA0EC0000-0x0000026CA0ED4000-memory.dmp

Filesize
80KB

Download
memory/2360-133-0x0000026CBAFC0000-0x0000026CBB066000-memory.dmp

Filesize
664KB

Download
memory/2360-129-0x0000026CA0AC0000-0x0000026CA0B0E000-memory.dmp

Filesize
312KB

Download
memory/2360-127-0x00007FF9E25C3000-0x00007FF9E25C5000-memory.dmp

Filesize
8KB

Download
memory/2360-171-0x0000026CBB240000-0x0000026CBB262000-memory.dmp

Filesize
136KB

Download