Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    76s
  • max time network
    71s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 22:01

General

  • Target

    Mauqes.exe

  • Size

    67.0MB

  • MD5

    1aa63aac406c417dba03e91aac5f77ed

  • SHA1

    ec510d315f5cf1ca915ae5b73641864a4af10670

  • SHA256

    1b008326fb732e0cf4a92a813ade819179d65d04a2461e888b9182f33bbe3d40

  • SHA512

    c0880091041b42a76263d568155b800f26e7191ff56a4eaaaab3ea0bc073be3857f8fda43373e97827f4152250f2a980c7d1788a5e204cf6e1993e657e1c301b

  • SSDEEP

    1572864:J2shceP6l2sye0RrYynh1KmDOD7Fz9aqfV9DAkyTuEiKZAWWXoLLT2x7:J2shPu3yLRkOrKlPB9l/EFSfKZAjcL47

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mauqes.exe
    "C:\Users\Admin\AppData\Local\Temp\Mauqes.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ADASD.exe
      C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ADASD.exe
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4672
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3520
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:116
      • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ADASD.exe
        "C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ADASD.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1736,i,18260398451181820399,17034188324062051967,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1176
      • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ADASD.exe
        "C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ADASD.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --mojo-platform-channel-handle=2056 --field-trial-handle=1736,i,18260398451181820399,17034188324062051967,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1580
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1468
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1016
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3728
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
          PID:4040
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          3⤵
            PID:2284
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "tasklist"
            3⤵
              PID:2004
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "tasklist"
              3⤵
                PID:5104
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                3⤵
                  PID:5048
            • C:\Windows\system32\tasklist.exe
              tasklist
              1⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:4980
            • C:\Windows\system32\tasklist.exe
              tasklist
              1⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:956
            • C:\Windows\system32\tasklist.exe
              tasklist
              1⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:3236
            • C:\Windows\system32\tasklist.exe
              tasklist
              1⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2720
            • C:\Windows\system32\tasklist.exe
              tasklist
              1⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2172
            • C:\Windows\system32\tasklist.exe
              tasklist
              1⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:1636
            • C:\Windows\system32\tasklist.exe
              tasklist
              1⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2160

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ADASD.exe

              Filesize

              3.1MB

              MD5

              d491e2f5b8c52981caa1e1bf4e542583

              SHA1

              ecd5abd79590ed52b02201cde723fbfa012eb064

              SHA256

              c8600bee20dd14962a1b5a8f4002118a9bf7215acedd5d848c423ea95099736c

              SHA512

              520107b094e0b69f798592d1d506fc15e46c30248a08a093e535cddfcac64213aa1cdf0822da9ad9d6eb929c6a1cdb0788f9ff406c41b52b0f486f9ffdfc3368

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ADASD.exe

              Filesize

              232KB

              MD5

              01d7a3107071ea12c0a78b272c6e6cbb

              SHA1

              0425c2357838e07ca880fc16cd1e3f7aa1c421c7

              SHA256

              0f3b40ebb449608e01ebe7cf04c4d2fd81cf3ed540523a1348d6647d2ee8ad7c

              SHA512

              650cb3ae3736f60edd8bc4f0091e2c5352cb55272761af6e45629c94f2dea94412d5f75334380d0222ce14cfed3c5ec4a57fa748c5c50379b2a2c896e6154321

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ADASD.exe

              Filesize

              1.1MB

              MD5

              c59ba7ad359da8f006ab8538f81ee5a7

              SHA1

              941a8cb83af7222c02189609085b931c543e12c9

              SHA256

              8fd139e2dae1ec39d8dbd8f6c34d0e3899d7c8e5e2febcc8835b6bbaefd0a1d6

              SHA512

              78cba51aacd0de1852b7f310d5fa02f27aa271a03ee2563c44825c5dd89d7be673034b588126a335ced8d5e237bfd8197ab8de3cfc3753718a1916d34a57929f

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ADASD.exe

              Filesize

              809KB

              MD5

              96b26b0d8e05d83dc22d70658c73bc4c

              SHA1

              8bb8e7a27f02d88d0d7016690109e1885c3ab0f1

              SHA256

              ff9edf3fdc81e4501c2eac1fb56134bd1cda9a41e81815fda7696c8408e3f4db

              SHA512

              5a5b45264b29ba39bfcfed0ed94dacf0c7723e42fcb9af4f6e03f2c2f28afe88425caca0fb12cf74fd0808657ee889ad6fba5593d4ed7a8b84b240973457235a

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ADASD.exe

              Filesize

              260KB

              MD5

              29d8c462b8cd6139e38fd2bad6474691

              SHA1

              fa1f6025f7d427806d36eb23fdcd09ffaecc824e

              SHA256

              4ef99b17ebacb0359a00b55db56a255f1e12dc6a003653a44790d8d72e4d3da7

              SHA512

              c76c22f6ca6cdffaa63d97f40fccbb53054f7a02b0da345cb41c11e628d9c9e457646a1be7ac27276e287960232a14e8b47c1decd36f64c0492b5b113424e4bb

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\D3DCompiler_47.dll

              Filesize

              967KB

              MD5

              b49b35a322da7b0fb3c3d56fb693f715

              SHA1

              c7d2294d049fe8c53e7cccf7d055ec7710ff9840

              SHA256

              48013bbf3e161e1ec9f40cf955580126f2f877f6549b6128245cafe0e1eb6534

              SHA512

              68c77a8ca3cc3bcbf380c5f4fb28ec33a6b7deca880a6b61a4d9e0982a7e815e423ca8f3015186ae426b64f841863863b67dc80fae724ca03b35f4dbdbaead6a

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\d3dcompiler_47.dll

              Filesize

              526KB

              MD5

              2a0511dc7cf6d3c743322336c6d1bbb4

              SHA1

              c3ef27347ff8ab104c47160082565f7fa76ec0d9

              SHA256

              b4acc1977b81a9e6d09ccb42aaf439cee794cea14e1f05d8fd243937d6b27631

              SHA512

              9f1dc6b3eb66371165125b3688a63649e7bd0a394d9f45e003d5258552bb46be95b0cd6184befc2280f91f7f2d9967916f9f5350a12c16967423d88bd7b3eef4

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ffmpeg.dll

              Filesize

              859KB

              MD5

              1d7bfd5bd7a524b01d0f5ec8e8b4b1e7

              SHA1

              58f2e79311d89b6b84167472f31026d30bdbee25

              SHA256

              a9bdaf75a4c6b04e27b7eec414710529f356922af2622c199a8646c38de3ee14

              SHA512

              d28b6922b24b5e70b46ac159ceb6e9f7e3d45be91dea14e753750359860038713138b4c02db3bb46f12a2301cd0d0ec292d373c3fb0bcd241d0c85bd391dae7e

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ffmpeg.dll

              Filesize

              1.4MB

              MD5

              a1442a3aa023f9e9a124afb3fa95eb18

              SHA1

              80ef709ebd955a1324c1133995696d066cc2c96b

              SHA256

              2abed7cb59940627e467ff3b16ff2f7050535883b1ec05803b55384dce9d8918

              SHA512

              0025723a7aef988e05047dff171252f3d08831f5763befb3e91bb264c8183a9e6291b11d34ca9ce3858957d2bb0b6363ae4d634c557d442f95056e6844472b1f

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ffmpeg.dll

              Filesize

              738KB

              MD5

              f3f4be297454afd4a24a371e2e8d07db

              SHA1

              30046bc126cb7f7b01782377ae25d2420e77aba0

              SHA256

              f78c70cf5069e5afa376c1de41a15c7991620d78edc82e0fbfdba05fbe2e82ca

              SHA512

              119c318911275938687aafa55dcfca459cc126cd59dc4f6ac23bab5c188df34b5decd2371b0f3fa77be653862a2725981a821984e4219730a708f22d55f13c19

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\ffmpeg.dll

              Filesize

              147KB

              MD5

              80633536ce7552e53e51a935bb32fbaa

              SHA1

              3f839d7f1fafef91dc6f961928bed82395b4ea30

              SHA256

              e72eec60ac6abea1896b2b006b1284067e1a886cec28ec9be2a78b0314729051

              SHA512

              2647cd870ed8d0eca675040b68a3e40e2259a13cc2bbcfdb4a9167cbc141f49fdc9fb44e212f22b5893179d99e66d45a6665285ac53b3bf757ee430940a6b857

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\icudtl.dat

              Filesize

              224KB

              MD5

              de21e0e0fc319e35807a5f3e9779b995

              SHA1

              d3bb39e8e6470828fd6655275eefb057178f644b

              SHA256

              8f351a2769268b46347b9ffb40da441183aa385d1d6aee3332ea14d7cf44ff37

              SHA512

              6c9a4e27234012c2a2065492123b3559c3583cd9177329b2c5db80460ae2ec340fe01970c5962837b56303639223ab445ea82d621f3fb95ce8c01e2892d4ac49

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\libGLESv2.dll

              Filesize

              832KB

              MD5

              27a211501c4f3677b308433817dc2b8e

              SHA1

              4abf0af01fa61893fe5e884db83aa9cbcbdc7a1f

              SHA256

              ddab0adcf46c2831b65ab0fbba66b537f991478951158374bdd1866d3aa838cb

              SHA512

              5f8a6165275567b2a3637337a9b13c9217a473b04b436744750611ac474325232a57ac6679c14da328580251ec717e96f7ceeb3c8fe3e73651b00b2bd50513b8

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\libglesv2.dll

              Filesize

              798KB

              MD5

              869a987ed7c537326619de659482c0f7

              SHA1

              2a0afdda4b7989300330f917a4ce03b8b842cf16

              SHA256

              bb0b6c2e74ceb159dba0fe442d7f6abce6b459fc55456ccc5e0bdb24c03e80ce

              SHA512

              758f994dafe7f78c3fad6e54739205c4e1a285814f235cd7ded21c8e17c2a6eb808f2fbbd5407c086736c73b43f183a69281c12a9f58cee10040559f1d535741

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\resources.pak

              Filesize

              1.2MB

              MD5

              102479f820d9118e80c5208ad102acb1

              SHA1

              59508e4186d7a9feec59ac2a435a45cd04575b09

              SHA256

              87f01a010f0782ac9c7d409d71dced17e3236c03a451bdf11ed2f4c8024a7286

              SHA512

              d2a42706a292b43d47d43ca24b5b970c3cc539367e758d838eb91a24eb2794035b96be85a44adb60d18800d5a94c09ecfce5f6571d33b5a4056d2c43a537c397

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\resources\app.asar

              Filesize

              1.0MB

              MD5

              9f411e5c45e2f7fa0bd9a59add8f2fe1

              SHA1

              5d6eeed74fef89d028fcbb9625cebf27595bff2c

              SHA256

              0b675378dc3bc3d31cd921f831e0d6a2989843d66538e17e171d491f936e836c

              SHA512

              a49ee08021145827588aedf96889c554eda1ea68a8d96ca989fa3bae83486230ec941d642d1fa716db56e323fd27ce51097ad940f78ec0e991455d3bd3bf6915

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\v8_context_snapshot.bin

              Filesize

              163KB

              MD5

              4c8b72c6efb8124f3bb133ba84c62e6d

              SHA1

              f4a96bcf79ead1c7196c5e914d8ad98164b6ca0a

              SHA256

              a1d9c595fb62a7ba92aad25d9f2448385342717bff80ff1ea7b856222c2a4643

              SHA512

              56172bbd1ab791bface29ebd707d230660a9e046bc3d3b3f540712a2159ed2d60dc79edcf728429d76b181aaddd81190612d562838ad74b14d38ec3eeda94d12

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\vk_swiftshader.dll

              Filesize

              1.1MB

              MD5

              ed376784d3b5a9a481dce1270e833e33

              SHA1

              07a9e68cab6ffba58d79124715ec970be53bd28a

              SHA256

              a4e21d5b335c536b11ed18d69ef05199010fac4fdb2d4cb0d0da2b69806bb569

              SHA512

              85227b6eef29ef8c268970d0a04c61f8e7c52ac2224c404f9a6954ca7821c3943bb18484a9c2f079965517813c695029dd644f649a5fb74c303a46beb4754636

            • C:\Users\Admin\AppData\Local\Temp\2cKG9AQGHq0Gthu85SzjFugyIxg\vk_swiftshader.dll

              Filesize

              536KB

              MD5

              02a5eeccaa75347b2611341a2e534b27

              SHA1

              7f25a71e4bf92e6b7d740d846413fc224164d0f7

              SHA256

              66e4342d65a0925b4db84ebedfd9d10277c549f5ad337fe2cd721def323c77ef

              SHA512

              8b18b02d67e050dbed456ff18b48f18afb91456e9d119f52ada5bc146cf2f02b17c917422284dfcab7a84c95cef07479a4087dda4d0261a0b3885d895c772d6c

            • C:\Users\Admin\AppData\Local\Temp\355b4b98-9b19-4902-a15d-0abeadacb654.tmp.node

              Filesize

              1024KB

              MD5

              6123cc938d484cce7bede95bfb9c6b1d

              SHA1

              c6b3617121b2ccec1ae2dafa4f6ce7c84a7a69c6

              SHA256

              21afe88a840b26f4232cd5bb0a1bd1f1a4496b87451ab272e71767c413d76621

              SHA512

              fd1ef92214c675412b4a4c78095bd76b51094a20fcc5521a4d9faa5477d14a3432bad3717d6a818ff7c8ef65f86b4bdddb449cc8fb00a6b61261984aa73679f2

            • C:\Users\Admin\AppData\Local\Temp\abdfe100-b400-4ed6-afb1-eb38e14e63f8.tmp.node

              Filesize

              155KB

              MD5

              9fd99d762f8500195cbe74b461bd73af

              SHA1

              559970382918cd9529902b855e2b6dfd155e4870

              SHA256

              c3f7df0a61fb658075ea937518b6734958f25c48f30b44345c02cde9fa1fb6ad

              SHA512

              4ee68d633a258234f2a383489d6b9f1b73715cb4c8a3018caaf584c8646ce6316a908458a0bea5d2a6515a3ed7d276f2c4a958bcc545e7ef477e4081ef3705d2

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\LICENSE.electron.txt

              Filesize

              1KB

              MD5

              4d42118d35941e0f664dddbd83f633c5

              SHA1

              2b21ec5f20fe961d15f2b58efb1368e66d202e5c

              SHA256

              5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

              SHA512

              3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\LICENSES.chromium.html

              Filesize

              1.9MB

              MD5

              0a130e8679ef88e2ac5f8b4284878da5

              SHA1

              64f18bcbce4c45b09b1d356619589666e7a2283f

              SHA256

              f22e0e4cbf963983bb3c1a9315f57fadced5e67091d93d472e25272d4e8d6c31

              SHA512

              c533fc4bfd126552da80aee8ae5dedfe07edd85e76566caf63f9231a74e3230d47c20ef53f1cb2c27a923b5b6554e257601c0543c8fe7992f06c298fa830656f

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\chrome_100_percent.pak

              Filesize

              126KB

              MD5

              d31f3439e2a3f7bee4ddd26f46a2b83f

              SHA1

              c5a26f86eb119ae364c5bf707bebed7e871fc214

              SHA256

              9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e

              SHA512

              aa27c97bf5581eb3f5e88f112df8bfb6a5283ce44eb13fbc41855008f84fb5b111dfe0616c310c3642b7f8ac99623d7c217aecc353f54f4d8f7042840099abc5

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\chrome_200_percent.pak

              Filesize

              175KB

              MD5

              5604b67e3f03ab2741f910a250c91137

              SHA1

              a4bb15ac7914c22575f1051a29c448f215fe027f

              SHA256

              1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c

              SHA512

              5e6f875068792e862b1fc8bb7b340ac0f1f4c51e53e50be81a5af8575ca3591f4e7eb9239890178b17c5a8ff4ebb23719190d7db0bd8a9aa6dcb4308ffa9a34d

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\d3dcompiler_47.dll

              Filesize

              1.8MB

              MD5

              3610aff0d15c06a8ddf97330a9ee356a

              SHA1

              beab1583760c2cf3af9f664ed66cbc15bf19b9ba

              SHA256

              c3c57a4361345eb3153ece1357137c81237e433a148f494755487d1de47f313b

              SHA512

              93c9a66162f866b09f4d9ace53d47c982431a7c27d2b4d4a52ac1919de1c19f8221a96a530e8759468104ede2e97feb0e8679667af2fe90f919bc65eb0e9592f

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\ffmpeg.dll

              Filesize

              1.8MB

              MD5

              a8678bb9c97d8161973c0f6b97777f34

              SHA1

              7b0451edeb0733934a25bc662484dd838e2fa4d4

              SHA256

              43833b4da74245fb8e4ea19ffc66e7882bc8ea38f661d3f0ef880fb6b0a7908a

              SHA512

              12d4aebad756e0bd523afa8a37ea2a49fc040890790a98d02f52194dcbb06d68294deae0f8dd39eedfdcfc2610160c1e06b8d12dae77ce340b67af6cd550ce23

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\icudtl.dat

              Filesize

              1.8MB

              MD5

              f0d0423c1c6eff6969b475c84a854308

              SHA1

              77918b625839dccbd115c6e7729e3f0ec96be269

              SHA256

              6aba08208d3bd39b281c27f3e94784ec2550c74a4331db7daedb266194ddc5ff

              SHA512

              4aaa844faa13117317ec1d90866808c86b98d93014edc7c9f981cb271490d6be0e000bbbf6ee3e3ee43718fcb72a3dce6f6edcde1c738d3221e2eb6b3f885295

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\libEGL.dll

              Filesize

              473KB

              MD5

              6c8cc2de57da91e152101a971c837749

              SHA1

              e998b35bde03b9a947e554786cd839b73e5c7a31

              SHA256

              f6e5f1bfea5a2a22ccd9a534558c9f3f9539e6ff80dd88093347f4880db8e8a6

              SHA512

              37e928a3b7be0144c404c73c385f58e13e6201df3710b42b441073cedb018da2eb6bcc14a5486eff759ed8ab5e610a90741b25eeb2ce71d853ce7d9f23e9477f

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\libGLESv2.dll

              Filesize

              1.8MB

              MD5

              9f77b5326a8ebd7ac05b551b2e653e24

              SHA1

              72a46a396b91eac767e7678c829dedf948032815

              SHA256

              a8a5eaf6ea1c51498a7800619d5e60f69a84cc4a0552fe252caaa9414ae569d4

              SHA512

              f394ecf8cb36b11ec270764d841f5c22b98c8cb3ee29e863183411fce8887dd127b3c4b6f53a8de9aff8d94ba693085ba1e763ef3538cab7281a210cbe10662d

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\af.pak

              Filesize

              340KB

              MD5

              198092a7a82efced4d59715bd3e41703

              SHA1

              ac3cdfba133330fce825816b2f9579ac240dc176

              SHA256

              d63222c4a20fa9741f5262634cf9751f22fbb4fcd9d3138d7c8d49e0efb57fba

              SHA512

              590dcc02bc3411fa585321a09f2033ca1839dd67b083622be412d60683c2c086aac81a27bc56029101f6158515cc6ae4def39d3f246b7499b30d02690904af0d

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\am.pak

              Filesize

              483KB

              MD5

              1f078d7e4dd3b4d19faca0a28f2bcc9e

              SHA1

              71d997e202597077aa200b5ade653e15d4354eba

              SHA256

              13a4a2affeaefaf3b02e11de99d2d6263db28135545e30baef48bc8da1a383f1

              SHA512

              8a667e8d2adb4f8aae77804d6883d0e10e7f294decbe3826cf66b2fe9e2109d385c1c48189c136928c224401aa410321fc9dcae3257491cfab9f4f1d55c78675

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\ar.pak

              Filesize

              602KB

              MD5

              98f8a48892b41e64bef135b86f3d4a6c

              SHA1

              32f8d57ec505332f711b9203aed969704bd97bc9

              SHA256

              e34d5cabaed4634c672591074057c12947bc9e728004228a9e75f87829f4a48a

              SHA512

              6ed3fe415b2f6de24136917da870b47c653d15c7a561baae55a285946a6f75e5141aba3bc064982f99baef0a893266693864c2d603c5c22c2b95627b2035f7a4

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\bg.pak

              Filesize

              631KB

              MD5

              9dc95c3b9b47cc9fe5a34b2aab2d4d01

              SHA1

              bc19494d160e4af6abd0a10c5adbc8114d50a714

              SHA256

              fc4a59ea60d04b224765be4916090e97ed8ddda6b136a92a3827ed0fcc64bb0e

              SHA512

              a05a506a13ac4566ecbfe7961ace091295967ea4e72a2865e647b5fa9adac9f7cf5e80b53fae0e3917dfb0b9a3f469189cd595cc4ae9239d3a849f5cedd60e46

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\bn.pak

              Filesize

              406KB

              MD5

              fd14d5f773875aa80eb736a7bd14c868

              SHA1

              543e93f0fd343d5ce6677651fdbba8b20325fe37

              SHA256

              a2dd0951d7807caa9bcfeb213cfbd6c32311230136b5916a84b287521776c308

              SHA512

              d9ce0d7ca05a91592e21101ff68d642d99de28b65afb8fcf3f74cc247cbac2fd7edbb795e63fa283827df641dd787d62df821b3e80433117bfe960923cf335bd

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\ca.pak

              Filesize

              384KB

              MD5

              2f8d050c228583559cda181291b76e5a

              SHA1

              b047f1cfb30b1162b1dd79f7e424a83fd807eec7

              SHA256

              e1d6b5fd0bc411f2895eaaa1409916f5ffe39a5c6bd1bafe8af7ce33da5be17d

              SHA512

              e4f150cd9942ef5105e72376835da6edc31ef91783e41cd2fc04600c04f342bbc96e08e23c8af1c0c1e563bb8a7d3840a2289767525c30d08c2f23d0e837801f

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\cs.pak

              Filesize

              215KB

              MD5

              6bd561e3d0f60f704cec7a9be7126295

              SHA1

              5382e7675b143bfc55df1c2dabbffaf47e35f537

              SHA256

              0b1fdc26d7784d9fe1ff9ccc7e32dd48270e99c42783673886aec9983aeccd56

              SHA512

              2a029ae184ac938e2bd4ba389aaef68a868e966379adbda622bd51dfc49c17f770c5e7dbfc04adfbbad02d6884fcc7e3c800cc7278606db09531f7bb44f29590

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\da.pak

              Filesize

              356KB

              MD5

              fecabf71853bab84eacdd95699c49f69

              SHA1

              8519afc13e100a550ca3d756518a0bc33674e0d3

              SHA256

              1b0793b1cbeb6a56ff1e64523c37ba753457320aa29f9718022caa07b4981d8f

              SHA512

              e932d382d41a79ece172349e916221a67d97f5fd4b2dc1325d6bd2f7c6757cbc01d6fbc8d9846f6ec462eb637210f7c650f6944418edbd3f8614ef99030d9392

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\de.pak

              Filesize

              381KB

              MD5

              ec069f60c9825080b9d18ff6492e816d

              SHA1

              34ce5101c9646f9c2deb9820a3b26eb91c525ebc

              SHA256

              e0f632ce324951002c80e019dd0169be9f6b0640533fa434cd6ca80f28a1d3f7

              SHA512

              95a88ac98f0957e5f200af76c1a743b976228f7da1bb6c6b3b88a54adcff05e1172d7cf2e6f0a82cbc8ad0aa79974a1bc046516250a3a5889fd7b2e4d7c0b804

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\el.pak

              Filesize

              430KB

              MD5

              e8d13f833b86ca356c5945c3bf978ada

              SHA1

              6722173dd9e00b890a66fbf2699aa83ac37ead47

              SHA256

              658afd8dd939c2260a4caa4a5f5e4e5b7aba9ddd7731162f2c1eb8b00bb0a783

              SHA512

              cbe14ca2a8a57fb192fce814864a2039e06a2b2e1f58d92ab050baea9cc71fdc67f1fc6648a49b012c08ed45e59233e3572981158df212761a2afc71108421cc

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\en-GB.pak

              Filesize

              310KB

              MD5

              502260e74b65b96cd93f5e7bf0391157

              SHA1

              b66d72b02ff46b89ee8245c4dd9c5b319fc2abf7

              SHA256

              463af7da8418d7fb374ebf690e2aa79ee7cb2acc11c28a67f3ba837cf7a0937b

              SHA512

              0f0f9aac8e6b28c1e116377ab8ee0ffadbf0802a4026e57aedb42d21c38fbf70159be9e0314799c1de1f7638fbbd25d289dff7cd2c9eb7c82e1b62b6c4e87690

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\en-US.pak

              Filesize

              313KB

              MD5

              3f6f4b2c2f24e3893882cdaa1ccfe1a3

              SHA1

              b021cca30e774e0b91ee21b5beb030fea646098f

              SHA256

              bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f

              SHA512

              bd80ddaa87f41cde20527ff34817d98605f11b30a291e129478712ebebe47956dbd49a317d3eeb223adf736c34750b59b68ad9d646c661474ad69866d5a53c5c

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\es-419.pak

              Filesize

              380KB

              MD5

              774ced79da2fd32bd1ba52a0f16e0a19

              SHA1

              ff36dcf8b62046871f441f301dd7af51cb9ce7ee

              SHA256

              5aff3762747a6e8c6df9f2a3b470bf231b44163006b17ce87e2a03694be27b81

              SHA512

              7763c15fa97efa9a5af73dcdedd4fe260139bd8ff782ca3aa0937d9355b2d14c3e482e570844ac33d22d7b016c7b9097d727c1dd585f421dccd59ca7bbc24269

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\es.pak

              Filesize

              149KB

              MD5

              32dc34f90cc5074883e3fdc012292d9d

              SHA1

              42b4dac42ee4846a8cd82e190e575687e422d7a8

              SHA256

              60af95b9c04576ed4414934dcc58b8e33bd75dad94e8c3f340eca2b2577ed63f

              SHA512

              5eba65a33928ce0e43755b12403b147c53d02f611881592b565288c1fb1edb142bf33182d8b585a66306ed04e587092e5af132877a10aa2e3a41bccdee7a4fc9

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\et.pak

              Filesize

              189KB

              MD5

              c90cc2bde93f919f27ea585208bdb51a

              SHA1

              1662d6c23186980bc8636f341f2e879e5204cc31

              SHA256

              8ec4de1d19ce9a35f6c35d87be1fc54aed7cf8c963b0e657b37d72bb18635a59

              SHA512

              4aaacf9cbd384c03821d2904f4af62068276a987f9eebe969263389ce446984bba49a275d61ce8afb509ffa1a6065d8aee3e7003dd6ae65052e16253922a5bed

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\fa.pak

              Filesize

              557KB

              MD5

              d55f65c6fda6ed6f549d2c9f0a4ce874

              SHA1

              952792f2da5ed9cb1cfed14e5afb8abf5cf29cb3

              SHA256

              221bbbde078d135f6daca4978a31cc6a82f8f46536467ebc9a0cd322c58a7785

              SHA512

              d0bb83467182d8b3a8f8371d749e682cf05f89daefe28764f2c263e7cfbfc3f86cb388061b48dadda26c3dd246dd6f7a57af58ca9344c2f6b90de87af1e91c69

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\fi.pak

              Filesize

              351KB

              MD5

              fa7dbd2ee35587ff31fde3c7107e4603

              SHA1

              baaa093dcb7eccf77ce599c8ff09df203e434b60

              SHA256

              5339b8ca52500bd0082e0ba5a5f440c5f04733803da47963280479760c7fff2c

              SHA512

              587f6d0e216d1688227345a8a75b94848ee710ec633fe6805db66bb0e8cad1b8d24a1e6a7e234061516770d881571166c78d8fa1c40e6335f3dcb1339fbffc14

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\fil.pak

              Filesize

              269KB

              MD5

              28548e8469a343da7f3db175b6c4aeb1

              SHA1

              cab3e42dd55f590db9dd9c51a8c699a9853598d0

              SHA256

              a52af841efb3e2b7b2000d6ad5d49b9b58033854b14ba2ee3db12ee75e8f53aa

              SHA512

              2a89a2c8a3b052504c95ec3620a53ecafa778ad0de87a1db71c93f21370dfe391de6a0c85abf123ffdbc6234dbe2f695eee16fe7312a3f980f20aa8fe85ceacb

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\fr.pak

              Filesize

              410KB

              MD5

              51ee1ed54fec49effd103c29677885b5

              SHA1

              ced6fd3354007d1ef3ea7b6689aae5213c20cc69

              SHA256

              1f6bc09499ee37456968a28b67b81bbf5b9df4f0c6035a388242d2037a3b65a1

              SHA512

              dfd50ad99b89345940afead11c3a6940d4408a0e6265cddda1d71ad92527ea00d8057ac77ceb2ffe137a3f0d2f321c210bc7cf97ed821f01e538dc08d07149a4

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\gu.pak

              Filesize

              697KB

              MD5

              ea10d851c5f27a538b0e2c59ceced465

              SHA1

              b72eaf2fa1f1bede5e20d9b83f456cbd1c7ed8ab

              SHA256

              0020811f22200a9896d697dc7a294e200d656b817e7b4d296592caf93a5c140f

              SHA512

              67c3d8d98fa1e803b722e26e56ef8364cded9250b667fb095084ccb7fc53b26a5511f4f626d184b212c5503546e49c6e12c2b7e8b76e89f5a48a63bcf5206ebe

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\he.pak

              Filesize

              488KB

              MD5

              6376d0a5f4273b76b1f4aabade194e0c

              SHA1

              337ba39f09454c0779ab64872b9fa11f866d6adc

              SHA256

              875712bb852c698f677c0c74e088f62d31adb2bce65648fc390607aad8705c45

              SHA512

              00347f16b5abbaf47fb08663d5efde26ab7de0c7a2fa42e6b5f03c41a83cecbd8e78cc3aef41d5f08658cf346e0ade732774485e8a10008a43fa41ffaf73b2be

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\hi.pak

              Filesize

              821KB

              MD5

              ede7fa471c5eebc1fa55b9b3b6f92d00

              SHA1

              1d1f529c615799bb3a3319ddd1357cb5dc71464e

              SHA256

              1e9623c7407ae8b8a88df3f69a47ae8117f74c4dcb56897bb794a9c38ee5805b

              SHA512

              0f51ea54e828700080effa6c728230c523ff8e26fb350e6f337028d18614d5dfc4a2792cb92b5e606bd0702067f55fea546029cddd1ebf7fa74ef5521ff08338

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\hr.pak

              Filesize

              381KB

              MD5

              7095ef4caf6bd39174487002a4e09300

              SHA1

              1efe686bd0b7f035aee7ab4c52be6133121cd0f3

              SHA256

              3d7685163c5eb6a11e745ff934312b8681c5f85dfa8d9ea701e9dcaee1e7a285

              SHA512

              45488d46dfe7a31a007932917f7baf4c195da899de5dc56d98e555336668af3edb77996487649b86f56beac688374ce77f8feadc01e3f84d30d83bd67631f9c1

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\hu.pak

              Filesize

              313KB

              MD5

              06d76e541e9cea8f59fd8305948151a7

              SHA1

              95302369037a5101e5572a8e0db47a5f904138f9

              SHA256

              02727cb7228ab700bebd20abe57f77dcbf6fc1c6ea2d78506b06ac1535ba2513

              SHA512

              bd9e4be11d9a8681c9ffe23d3012c7d435253a17bb268c656c47e5f47361068ba18a00448fd1f23bcaa2f5dec82cdef943c50d60e24e8510065e67bc1cab9516

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\id.pak

              Filesize

              336KB

              MD5

              881ff04e220aa8c6ed9d0d76bfa07cb8

              SHA1

              cacf3620d1bf85648329902216e6cdc6f588a5ba

              SHA256

              9210c4c4c33e7ceb5f70005a92a4fd36ca4facdd41701fdc1d2ce638db8adf22

              SHA512

              9134102928aa80c49bbf2b862e8079b2ee23636ce63412a4c3813f234d623ff563f5ca1ac407ddb77cecf1224896ed59ae979dcf63435d35a4f13de9c22755d5

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\it.pak

              Filesize

              373KB

              MD5

              91391f388b4b6c12a72710c35f4c355d

              SHA1

              f89e6ea977a10a9f050395489285ce8c041c2c05

              SHA256

              c0dc0a4a87f7bb054a30eb1174c3228ea2014bd94668a7d22995b99c4937d817

              SHA512

              8796d69d1a8bdbc7690ded45404174b7fa0b5bec8453d79a3c85bf4707c3f32caf634c792c72ce7bda3522eceb5fc6761b696471586397064d9f1f1988ceee88

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\ja.pak

              Filesize

              456KB

              MD5

              8209dd8cf4e416416e015ff239b7c483

              SHA1

              7affd1707b9eec52c26a4c17708c8471c369e2f6

              SHA256

              3accfd9a1833ddeedb2082fb94101beb59b555c60f42e3070e9e04a372eba84a

              SHA512

              6a58a1ea8a46c325cac0629f2e3b571532a9a2a342ed61ca47bd1dcee20ce0b0350e4f6d3e8e4c6903c7ba4a4592a6382bf0fcb5437febd1673b3c2ce8cd7499

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\kn.pak

              Filesize

              493KB

              MD5

              28b4e80229180bfe17f46957426c8a2b

              SHA1

              e1ae56acd2178cdfd9b40fc06fd30a3e98ff4303

              SHA256

              b7bc47a6f2a4bf939a9deee3052e790131668d196a2183b1a0b475282ae99812

              SHA512

              1706e39412d2471dd9af54064e4c8884b0da4b64745fcf5d085bc629f2ec576bd75482893b72f1ff74d829e2250cff842c893c45f502c5324bb1678e9c03e0a5

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\ko.pak

              Filesize

              237KB

              MD5

              28e1370da581814cc50e7be386a85863

              SHA1

              7c770bfe14b0c6b6f0609336b26ae5f39fc9d5e0

              SHA256

              9c93680ae3f2b03924856376470ea26b232f97474cb70b26906f2d3c2ac47b4e

              SHA512

              c03a2599eaa750c427f0963b21bde12c77df8eb5e50d2571dfd3e851936a8073e4507cbc39aa188eff6095a81e1e89600d4528c9df0c9ff8953323e92b257b4a

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\lt.pak

              Filesize

              355KB

              MD5

              2f458a50d7cb02d6ec296e7e5f0af802

              SHA1

              6520b15deaf30d3f1ece2d31ba4bb63eb6f2e627

              SHA256

              326c0a6d2d90b020c7f5f82f6b3b21e852a66520cc58414910856949366e70eb

              SHA512

              294fc04153165282cfece8b07ab0956959c15e3c130b4716f9dea93d9a0a4d987d61474388c63de952150d91064c715ee325f8aa2df9eb270e89b105fe350c66

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\lv.pak

              Filesize

              410KB

              MD5

              e664eb35f1284e9fc615e1bb4fab892b

              SHA1

              e777653abec377a394170b04f79e78acbe4b6a3b

              SHA256

              b5a31cbfcb40ad8d911de1618c4eb7e8cc67b97eb8878220f15d40eb014d8ac8

              SHA512

              c3232997e8d306e91ded72e9d81ffae2018af3e6c32fe620532e03bccd2883fce59b2a2290a1580d7080c468c02bcd24c1bc90051f06bfa9a4e17857d4aa583f

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\ml.pak

              Filesize

              358KB

              MD5

              6e21f443a83403312ed3d93dea9488be

              SHA1

              293ccf8abe04181c73fd71b5584ba5b60ab78138

              SHA256

              e17fdf41d7fb923cb8dc69afbfe8b2b73833d8503b8ce4831196196a72f4e890

              SHA512

              14df29485becdcc074ac7ed9672703542c3e737ff1dff97cac64ce2bca22d53b68d19cfbb1ff7109b1898d36f4803e617496b09cf5c574ee20423a226d80357d

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\mr.pak

              Filesize

              260KB

              MD5

              0e3b3dc7924e9980f8d407a383b6ddce

              SHA1

              f3e218da6a04887798e39c63e56ac85bead1961d

              SHA256

              b3e3f8f45e95783cf148b6d7f98ef58bd7f0a0aa849ba51cc43e65498c72f8cc

              SHA512

              56fe1902b011621a257b2b1e3d664471a19128e5b06a4a3c3ee02126bb787618c34c6d2ed646b532fc5383fb54337f99a585c9fe46d0a787948bae96b752f4f7

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\ms.pak

              Filesize

              25KB

              MD5

              ce4db038d831a07c123c77f93b6135f8

              SHA1

              174ff7c190c91304b05ebe08fb2f363e86fc4184

              SHA256

              30f9968b323f2aac618e57a38b7b5c709fa960f56ddba024ad62ee6c7e4434db

              SHA512

              ebd0309d9600007e8e5f58e65dbfb291837b0c692f51c94f6e8d39d654ea779c4e6a6dfeb2171d474945b686c2e7ac6e93400ec802bbd39d93d78c003ddd58c0

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\nb.pak

              Filesize

              344KB

              MD5

              bbae0915edec081b04bb903b689bc40b

              SHA1

              6a0fc635ce1c431e512b8b3b8448176aa4025556

              SHA256

              d565c6c95dad89d3f2b7210de4ec3fc437633de4dcfc994fde0704b92bb53ff8

              SHA512

              573a9fe43213829a6a4b39e67be25bc330b417750ea6d66e26163de7a80c29f6f5deeb841d9ff8303595943a81fc01ab668aab02a5cac4eda078ed06120138b4

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\nl.pak

              Filesize

              326KB

              MD5

              19f707fb4ec72dc89f38e8b6c3669038

              SHA1

              4e0df755932d1b36ab9814630cb7ff6df36ebd2d

              SHA256

              5261e232ecef1085507c833b1e04fc9b096b8096186c9440921cd245d1fd138d

              SHA512

              c3013bb8d0006724e034615bff157ba4e7e4cdf60b7a2114222557570ef274600b13ba61963dda114ba037addb42520cb2375f221243c0c6d9e4d9f2ded9d057

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\pl.pak

              Filesize

              245KB

              MD5

              376849ef41367878a9107832d6aa180c

              SHA1

              40e7789a5c7033ade60a4144e655d0cc7aba5738

              SHA256

              dbb029335bdaf85b465b1d7c07c18cfba839481d1dd64e921df5a751df5b384c

              SHA512

              a208fcf8716df73c99c77b9359e7d60b40e01c1e2c6ef26d863b011d3fe3449ddb8139753db5da60bf39f84aaef826e0acf80de86011a45cf5d88d185faa43aa

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\pt-BR.pak

              Filesize

              374KB

              MD5

              a064cb9d7cf18936600e9ccc03297006

              SHA1

              eb436a0c584ba91acb05dfccde139afbe26fe9f4

              SHA256

              c9ec3822044365457b8736348cf95a8e39bdfe3ed36267449bf3ed739accef2e

              SHA512

              95af684abf9d24cfc4d0668a02da1e2e69f5e671d671d8cdfadc22ec991908c6aa5663fe1fa88ca8e85c0508f409fa6c2bbc174c53674270f2b188018d358415

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\pt-PT.pak

              Filesize

              246KB

              MD5

              709310c67951641577e7ff9c9650b8db

              SHA1

              b71850dd23ddea0b3dea18af4e08b88dd276d557

              SHA256

              e8c474356ec939a1ce980dc9c7f10fb351390a5089b4e9384f07aebeda38ba5e

              SHA512

              3f96a398a017d905711af19e83235a8cc9a3e9fa5e47fe34e47022034822d9f4894827241afdf96abffcb436fa9dc19c9b30a2a8b14c8fdc3b095cd079ac83c4

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\ro.pak

              Filesize

              205KB

              MD5

              4ec218248c0cc00553fd95a7cff733bb

              SHA1

              380fe5fe72ae69b953697f601611dff993384bea

              SHA256

              3d47f3ea7e080a01c893425d951c9b69b08e3e23779621539150844d8352b689

              SHA512

              08f457faa66fa027f3a432832dd1ea63ec9493337f0bcbaee7d8bd0c358e591add17eb1c33993285cf890ce7e3b31b8f4cbcb577231f97884d08944aa3ff6cee

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\ru.pak

              Filesize

              634KB

              MD5

              5cc0f54e022a9996773dbd64906d5580

              SHA1

              87c103bd69724579b478f904235e03caf61d5d79

              SHA256

              b4223b56ec88235819a427d60bb937eb3984076523f02a018f57819e0429bea9

              SHA512

              b3365fedcba50643cecf1a70297e1e67990d63ae05caa87de01a70ef6f28e0f73a9a0edb0ff80b4138c624e51aa2dac065a2d40877fc92137714ae07734c2f4a

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\sk.pak

              Filesize

              399KB

              MD5

              72946b939f7bcaa98ab314cfba634e0b

              SHA1

              71c79a61712c8c5d3dac07a65d4c727e3b80ab17

              SHA256

              75f179897cad221ca6e36b47f53cead7f3fb4159ee196f1d10a5181b84e1b5b7

              SHA512

              2a8fa7108c58f4cb263900a555714d5638d961d14d9f4ddf8a9ab5b880afdbc5d2325fed1e158dbaf42a9cd20e8e372e6a8f52fce842a6940ea52e43e4a1f1e5

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\sl.pak

              Filesize

              385KB

              MD5

              4ad22c6c64dbe0fc432afaa28090c4d9

              SHA1

              19eb65ae52a585dbd9c25c32f22b099020c43091

              SHA256

              6002c129a56558832e9bd260c427c0bd2e1566e0aea3ad999f89c8e479534f9b

              SHA512

              94f9d34e76560059ef80fc04be4d54e52a7d934dd28747db7f0f6684243b841087245699a471a55d667623d2ce5e597a3d2c6bc37cfd7ebd2f5b8fb40e6207e7

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\sr.pak

              Filesize

              66KB

              MD5

              172e394612863587a01e8dc1d33faac0

              SHA1

              444d44b13bea682e0b7a91fa0928fc6130b763f9

              SHA256

              6b4c18cbbfe11d85c6b860325d8eedab02b450254d3f6ae54cdb36bf02b11326

              SHA512

              5130f4c4e76cf74b0128f2cc4df29ff5bba85c89ac2e8881708cbe755b296281d2acbfc3985cc4db2d13862e6be744c83c4338b8de0038e3b05ed9a2bc9a0b48

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\sv.pak

              Filesize

              103KB

              MD5

              57583f2f2fe2d263b12373a10db48885

              SHA1

              2c5d33e1de044efa1839795b5275e64665b4da7a

              SHA256

              60b6f0634f33f7872da9db1983b8b89f9b28a43ed66861a32f3c1217b9b9e910

              SHA512

              1237e0c47e782ab2482fabc613012ddd1b9df2167ef1868c1d18185bbebd3a14afb216bd19d9dcbb5e2109187de90918f597aa38a44449ab524624536156cf1a

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\sw.pak

              Filesize

              365KB

              MD5

              9632dd7d883fa4deb3963ea663e0ffd4

              SHA1

              0db135be4b3a7c54c39e9df5034d5576b68ea92e

              SHA256

              690027c4a31c4aea00b7d1b32ec6cd3fa50b1eac412ae273ab15e72eb485dd6e

              SHA512

              3aac1857784dfecd2ae5f7c4056f58e27a966a6cb949e02eaba56fc1fc283243ed6213f17628d62d435e33fa4771eb43623f25da6510aa4ce6f2149f72ab0d37

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\ta.pak

              Filesize

              544KB

              MD5

              6df059b00a614319ab0fb2e3e16480cf

              SHA1

              443d0782b7012f110683a16244cd0e8989e1fdd2

              SHA256

              e20d3882f47c5124fa471ac7a9db648374b9750a64e5977b91cf0bad977160b2

              SHA512

              94eb44a944a052d77b354cf609f4de2f6d2261d99e0c82df679aaa6e227309d2c80049f2b7b1bd38b2744ceeb6214fbce977e2732e4efc986399dd11e245e426

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\te.pak

              Filesize

              142KB

              MD5

              faac11670665450d1c4855fdf2c767d8

              SHA1

              e8c27562bcce435f78d2e5d66c5f788a96d20ec9

              SHA256

              3715efd68626f484fc080dfe9f2ca859d87c041740043d8bc85db55375a22cff

              SHA512

              ad96e07143ec10ef763fc6173d82da3bdcb5cf650bd103e077a1df8b00ea33569876c58564ef092b7a87e30710d8f86d67e84f1ba13efb08c600949688c4e150

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\th.pak

              Filesize

              85KB

              MD5

              95cd12aa2469fc056183fde776c76fe3

              SHA1

              a2196f0ded658c2d2fbb05b180fc56b0a2151a21

              SHA256

              2423fde90eb8ffbe5d768a0a734abfdb7f3088c71226ba0a26fbf7c45e9da95c

              SHA512

              ceb2db9fd2055a0e634a86a1485b567f2b303220165bd5a75a0cf9e494b8e0188e55ed9d9a0645bdcd9e7bb6332847957802b364a8c5c1cc0ebb5c25136689b0

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\tr.pak

              Filesize

              371KB

              MD5

              46f9b2a35efdf1120a8a946e4f1d0115

              SHA1

              af7bec1fba32d912b50288a7d988440627e4ee85

              SHA256

              b22fc7b75c52cc142f201d5cf107d17c1b173a494a6add022127f559fb46bcb0

              SHA512

              cd67f9c328408a8295f224aec190c7c411a868755fc5c9e90b4985b3c41a05d6d34dd30d4a3866f6c24e1d640f4c324bfba8c7ab806a6b216151cf0a504a03d7

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\uk.pak

              Filesize

              83KB

              MD5

              2e3eafb86786a5c139336cda18050913

              SHA1

              fccdcc5409ee2a6f4532c2fd8f44e1cbd96a2da6

              SHA256

              c4e56f151bd26ceefcde5049648c7f6919bad78bef1815ebba21bddb1e23739f

              SHA512

              e13d3cfc7bc366f83499c1aac35ace4a8958f91489278e6d457353e432af3d704d6f2af8ff0854eb037b17f0c1f278b832c11259e3775da807207c26b882fe27

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\ur.pak

              Filesize

              485KB

              MD5

              4c09866e013075a5bc02b44fc477757d

              SHA1

              37a62b745401d96407ea1a005ee61db8c62a4379

              SHA256

              9b6e1ec8707b23384447e392692b9d6c03b2bea125b78dcc9dcd504a438aa2bf

              SHA512

              f88605b908f577c212c26869332c0ddac3a0454849b9a1722544acf8c6173fd8b96a26afc6299260cdb6a55e88a680b4f3d5fbff424425979c9e0f432aa1ad0e

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\vi.pak

              Filesize

              327KB

              MD5

              b3eeccc9e7a6bd7fdcccc7c6d4cd9dcf

              SHA1

              e2407b79707f87346294769c062ff7b3bc677c06

              SHA256

              2b56b60524b5e0e478e731c1ab248fd4c77d8a4bde64e6c01b100e5a87b18ee5

              SHA512

              455779fd844b97795efc2ca11d6a13e8362264c7db1beb602f0af950d2ed63c8cda45aa8d2e36d07f9aefdb914becc24ca98c82b1065ef33cb547015c2513c9a

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\zh-CN.pak

              Filesize

              319KB

              MD5

              2febe4ef32e1a3884089908f402ad62f

              SHA1

              e65c54adc127b78494dd6189cca71f1c7bd2a5b0

              SHA256

              a7ac9fda6f4cd189b75fdadc4b70cd0d369a09b66eaeb5d032678cb97ffc98f6

              SHA512

              8e8b030af4c952c32ec277850d5573414630ff5196eaed52820f44e9c5bd03ab6f71a8add19215b0456eed859be0d5a6f28d48e12f1677d39842f35feffd5e57

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\locales\zh-TW.pak

              Filesize

              57KB

              MD5

              ebd34dc09f0cfedd226635549ad5d42b

              SHA1

              bd8436e39be34778c5b7b894078e734e004c0973

              SHA256

              841482f02446284fc380ea44e38c10a45289086ee6bbfa7f219181b7e39c4919

              SHA512

              69ecb2085dc0b9c45d6f2029df9833d2225367810ad5328ebba6df9ddbaf03ccfbc1d011671bed2fc31f1b4a38b4d4d84b9b0eeed437e2acea50aeff39e7d386

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\resources.pak

              Filesize

              1.7MB

              MD5

              d84449fc9d9d4b0a564b8ad0968dd049

              SHA1

              9c29af17c87d3ef28271f9e12aca436de9670800

              SHA256

              05793bc0941834b1281967a2a8e5cb180e2b471c1c044c6545b000e064e276ce

              SHA512

              d67ecba1d39845f6217d3c860a82aeed0dfbdb6afe3caf40ea440df4612ddba67a06f53f1a79712aa2fc0baab9672c4697760f2e2d0e3759701fb56338b2c82d

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\resources\app.asar

              Filesize

              291KB

              MD5

              520b40adb679ac2cd8aacdccd42b1fd5

              SHA1

              d8825b4f20b276a686ec1a4309bdec30948b31c2

              SHA256

              e8f8e2a108bd593cc8a0f68a0801c29bcd50b2df006a49db346addf4a2f1a41b

              SHA512

              85e28979488fa610ec98db6283fc3b3a22a8b00355fabbee59a751bad1ac108684a63248897de1a75d2bf56b6e5f08244e14d5f3d05956e673164edba6c5b346

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\resources\elevate.exe

              Filesize

              105KB

              MD5

              792b92c8ad13c46f27c7ced0810694df

              SHA1

              d8d449b92de20a57df722df46435ba4553ecc802

              SHA256

              9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

              SHA512

              6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\snapshot_blob.bin

              Filesize

              168KB

              MD5

              b82ff216a0babf602940759b9a3af870

              SHA1

              07e8a22dcf8d7be04a6ddbcab3098e040494bb0e

              SHA256

              943b27009d41801c5a649caf680e32d4dd25de002787a4ccd86b0925b3aac3a5

              SHA512

              da157570afbab7be135f7749df7f4518df1452ea24f98d8f5189430e732ad06ed438afc701cb70451bbc7137b5f35a0c5957df92ecb40d47d54c1071ea79fba1

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\v8_context_snapshot.bin

              Filesize

              471KB

              MD5

              031ea03da08fe1247280cfe781658791

              SHA1

              e91db50ad16b5a5fbbaf4118672d60b347ea6161

              SHA256

              c16dcec41919a6d2850214f2275824be8a97d8c5e694e2ec8dd7d16ab2d5015c

              SHA512

              b3d6f282761f8ab8760728ecb108f64741f6f3cd2a143813042ff63a3b6604fcfe7c1feabafb65f9f67906217edb5851f44605a34f7a50ed2058c25ce5efb30a

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\vk_swiftshader.dll

              Filesize

              724KB

              MD5

              e06ced11ab40f8115ea2c2343d078b53

              SHA1

              9f7820dfacfaf3d6ab4d5843dad6ba05acbe950c

              SHA256

              4a1ff756f7625daf78c8dad2911b6b73b9c9bcce8e75d864e378e0644d4e32b3

              SHA512

              6000891b3d06e126515c46b214d43e4ec914f009ba105b968e58b591bfc1ca20362a6e163fbeb884e150d01cf024327bcb4913ba45c8ae6102cfd21003797817

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\vk_swiftshader_icd.json

              Filesize

              106B

              MD5

              8642dd3a87e2de6e991fae08458e302b

              SHA1

              9c06735c31cec00600fd763a92f8112d085bd12a

              SHA256

              32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

              SHA512

              f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\7z-out\vulkan-1.dll

              Filesize

              894KB

              MD5

              28e6a399ea40a5845c8589c165f808f9

              SHA1

              daa656cda0676bd609d994730cc51c3f538a600c

              SHA256

              7da096dcc3d0ecc5236cc8ebf29e68128334f250959b9807ac45dd52eab185a4

              SHA512

              fd0070bf0ccb880e616459d7bab4fa5ff17feae6e73f9523414de5c3af70270e3d291e0766ef97eac3f86f95423636605b72daba2d4e00542a68c9be8938e872

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\StdUtils.dll

              Filesize

              100KB

              MD5

              c6a6e03f77c313b267498515488c5740

              SHA1

              3d49fc2784b9450962ed6b82b46e9c3c957d7c15

              SHA256

              b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

              SHA512

              9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\System.dll

              Filesize

              12KB

              MD5

              0d7ad4f45dc6f5aa87f606d0331c6901

              SHA1

              48df0911f0484cbe2a8cdd5362140b63c41ee457

              SHA256

              3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

              SHA512

              c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

            • C:\Users\Admin\AppData\Local\Temp\nsg55A3.tmp\nsis7z.dll

              Filesize

              424KB

              MD5

              80e44ce4895304c6a3a831310fbf8cd0

              SHA1

              36bd49ae21c460be5753a904b4501f1abca53508

              SHA256

              b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

              SHA512

              c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

            • memory/2680-550-0x00007FFBE6CF0000-0x00007FFBE6CF1000-memory.dmp

              Filesize

              4KB

            • memory/2680-592-0x00000219D16C0000-0x00000219D175B000-memory.dmp

              Filesize

              620KB