Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    108s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 11:15

General

  • Target

    Shaderium 1.4.0.exe

  • Size

    66.8MB

  • MD5

    d02fb2f5aed16ab1f64dc6817794ba08

  • SHA1

    f9d391fc41a20f22f70a36bc7663a8ffc3c31cdc

  • SHA256

    541e799e81ce35d480d2d1cf1fdb11854bcd0bef29156b831c72e0a325d6dd0b

  • SHA512

    93a74432c8f363671d1cb42b0692168c161d20d2ab904ca6a6c5d7d2738f058caa3dff7e6367759897b115c764f523e557e48251f9f1acb4096596ffc76ed1fb

  • SSDEEP

    1572864:brziNx5qJRvEC8AA7qIsklM6uECzJRFnc35lkFcF7vz1Pz7:ex5qJRvtA7vM6HwJRFn8mqz7

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shaderium 1.4.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Shaderium 1.4.0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe
      C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4152
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,188,171,250,179,179,247,189,64,154,88,117,5,154,183,111,18,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,145,18,68,202,146,38,239,228,190,41,231,67,47,150,155,90,186,95,220,94,12,68,135,73,180,30,141,39,212,173,232,15,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,107,218,150,20,140,153,250,221,134,49,147,88,202,178,158,117,185,36,191,158,91,225,59,163,233,106,200,206,0,190,16,102,48,0,0,0,110,176,247,226,227,217,165,80,73,190,3,35,79,146,181,182,110,181,49,249,58,106,13,170,156,202,103,239,224,227,111,52,164,36,181,4,100,29,13,186,254,72,17,127,130,182,176,169,64,0,0,0,85,168,73,175,154,23,236,198,81,233,201,5,5,174,233,126,220,112,3,156,128,188,113,66,145,163,184,86,145,143,224,28,77,151,39,162,23,249,102,60,59,89,108,26,205,38,63,127,226,202,139,16,141,237,88,177,102,238,113,50,212,187,226,213), $null, 'CurrentUser')"
        3⤵
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:3556
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,188,171,250,179,179,247,189,64,154,88,117,5,154,183,111,18,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,145,18,68,202,146,38,239,228,190,41,231,67,47,150,155,90,186,95,220,94,12,68,135,73,180,30,141,39,212,173,232,15,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,107,218,150,20,140,153,250,221,134,49,147,88,202,178,158,117,185,36,191,158,91,225,59,163,233,106,200,206,0,190,16,102,48,0,0,0,110,176,247,226,227,217,165,80,73,190,3,35,79,146,181,182,110,181,49,249,58,106,13,170,156,202,103,239,224,227,111,52,164,36,181,4,100,29,13,186,254,72,17,127,130,182,176,169,64,0,0,0,85,168,73,175,154,23,236,198,81,233,201,5,5,174,233,126,220,112,3,156,128,188,113,66,145,163,184,86,145,143,224,28,77,151,39,162,23,249,102,60,59,89,108,26,205,38,63,127,226,202,139,16,141,237,88,177,102,238,113,50,212,187,226,213), $null, 'CurrentUser')
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:968
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5068
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,188,171,250,179,179,247,189,64,154,88,117,5,154,183,111,18,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,48,125,61,53,55,184,197,141,119,7,91,194,39,105,65,219,89,59,160,4,47,210,101,67,92,185,15,62,242,76,62,3,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,98,18,3,225,198,91,63,139,133,237,99,15,60,154,56,87,113,210,81,207,198,166,85,95,2,2,51,147,114,227,113,247,48,0,0,0,36,33,253,137,193,111,4,246,8,63,183,1,113,219,234,249,35,148,187,82,32,25,80,193,144,111,178,166,76,251,162,114,140,0,20,216,7,185,253,190,220,74,65,127,93,219,131,137,64,0,0,0,79,208,218,129,58,109,220,74,65,191,249,219,25,132,207,12,59,80,233,59,202,30,164,216,228,47,94,87,206,91,71,44,116,167,213,34,231,216,170,208,165,188,250,12,46,158,73,180,230,202,18,209,229,251,241,123,208,96,110,217,215,182,54,193), $null, 'CurrentUser')"
        3⤵
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:3152
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,188,171,250,179,179,247,189,64,154,88,117,5,154,183,111,18,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,48,125,61,53,55,184,197,141,119,7,91,194,39,105,65,219,89,59,160,4,47,210,101,67,92,185,15,62,242,76,62,3,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,98,18,3,225,198,91,63,139,133,237,99,15,60,154,56,87,113,210,81,207,198,166,85,95,2,2,51,147,114,227,113,247,48,0,0,0,36,33,253,137,193,111,4,246,8,63,183,1,113,219,234,249,35,148,187,82,32,25,80,193,144,111,178,166,76,251,162,114,140,0,20,216,7,185,253,190,220,74,65,127,93,219,131,137,64,0,0,0,79,208,218,129,58,109,220,74,65,191,249,219,25,132,207,12,59,80,233,59,202,30,164,216,228,47,94,87,206,91,71,44,116,167,213,34,231,216,170,208,165,188,250,12,46,158,73,180,230,202,18,209,229,251,241,123,208,96,110,217,215,182,54,193), $null, 'CurrentUser')
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3540
      • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe
        "C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Shaderium" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1888 --field-trial-handle=1928,i,9841983603874203350,11009540898162917967,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:672
      • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe
        "C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Shaderium" --mojo-platform-channel-handle=2156 --field-trial-handle=1928,i,9841983603874203350,11009540898162917967,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4952
      • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe
        "C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Shaderium" --app-path="C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2464 --field-trial-handle=1928,i,9841983603874203350,11009540898162917967,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3944
      • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe
        "C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Shaderium" --app-path="C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1928,i,9841983603874203350,11009540898162917967,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4504
      • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe
        "C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Shaderium" --app-path="C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1928,i,9841983603874203350,11009540898162917967,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2100
  • C:\Windows\system32\tasklist.exe
    tasklist
    1⤵
    • Enumerates processes with tasklist
    • Suspicious use of AdjustPrivilegeToken
    PID:3888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    f48896adf9a23882050cdff97f610a7f

    SHA1

    4c5a610df62834d43f470cae7e851946530e3086

    SHA256

    3ae35c2828715a2f9a5531d334a0cfffc81396c2dc058ca42a9943f3cdc22e78

    SHA512

    16644246f2a35a186fcb5c2b6456ed6a16e8db65ad1383109e06547f9b1f9358f071c30cca541ca4cf7bae66cb534535e88f75f6296a4bfc6c7b22b0684a6ba9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    68d80cc2ac40ea9e5c7297fba6623c45

    SHA1

    05908daef7414f753fa6006082c42485002a7da8

    SHA256

    3b059d656dae93233a96c9079352c1d77c6abfec689cc6236b93b427c9918e96

    SHA512

    2c51e963eba030ee4f2ef5df1577a8ce38cacd6ffc3d0c56258db173352b46cd6048505061c65bd5757d14e2e27d9d396cbce95d58406660af62365bd4e7afb6

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\D3DCompiler_47.dll

    Filesize

    651KB

    MD5

    9602dbb56d9f7778e361a9ddb49718d2

    SHA1

    cb5fd5d57e016fe88899a2bb80e5248ed044d10d

    SHA256

    398ec46a3f0a58b2c2dd42a39bb53073487650ee43d469e8f3fa0615906cc40a

    SHA512

    43978f239cbc503c76beed1b70a32b7337d0cbd6364cf10e6d5c9a8d42f15795f61560ab734c94397bc0a717bf6f5dd34624f67cc6088647959ba67fcb1519b3

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe

    Filesize

    975KB

    MD5

    dd77f232181f1dc48231fa32bda068e8

    SHA1

    ede3fc3e7a517fb980d37439cc0bde9aea6183b7

    SHA256

    0c6a2b475ebfee9c7532844a354c63813a95ed74436d35b2892a1fddd1eed10e

    SHA512

    c6db228f9d1cff323da1efb6dcff2f2bf75020a5e713eb74e253cb7843db078d83504d4e33196024f65a709a823d89a0837451b8b333465bc4b70571f02fba9a

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe

    Filesize

    670KB

    MD5

    004939d1e685cc5d7a8f4ca98c804bc4

    SHA1

    eee9c9762b7942df058b88f844767537e47b6fee

    SHA256

    afa29cec38ecd457958282a1d68c0ae392a0499a916303c890f779a6d3217aad

    SHA512

    c2fcb54890940f91e5227d0130e4c12cf27b1e91bb4c4c66438d0a3bc3a3e811adee416dafff58dbfb92e37000ac4f2123f0e7b4cbbadf49fc724d5d290bff04

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe

    Filesize

    512KB

    MD5

    436a46d5b73ced3f128e1d6546894be4

    SHA1

    6e41151a1247629de0cbb5cb6860141a4a94cfad

    SHA256

    c1e618061818dbd39dec2ce3c2751a66fc695b6de98f02eadc78f435d0d1b298

    SHA512

    192fe3971e43490d9d64de23d82fe8bb4d42d8121eea54b187fb70f2c9785b296ea053e1d323f8ffed844b003b3b6e6c7aba67066ce81ddb432374ce7fd01492

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe

    Filesize

    448KB

    MD5

    2bbafde1ec065fc2d9c8c1d8292ce866

    SHA1

    a4a48b3d4400bc4615eef51211c539c3e1d82b8d

    SHA256

    0ec3bf4d4c1995dd63ad76e8db1b3c2db5f93de7997d817a737a34d5848def8a

    SHA512

    6f6139c04d22fd95593572a55c95aa5d326946f194f3b5da2f99f14d2256df267287b0e124fad65f3c7af9f05dd3d257a7b612a54f07b19a893e2d039da50b47

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe

    Filesize

    372KB

    MD5

    650d13d2533fdbd41cfa3411299d894f

    SHA1

    18f29260aca217ea15e07283ae62951fae7757ec

    SHA256

    28d07e3b7411f22dd7c8ae4a585bf8c86ea76ab316d670d992564967e6b241eb

    SHA512

    5370dc6f126ba7f6f7fbdc10ec26cfb5269dee458541ccece2509260b473968c2bbfec85b72838b61ad50f6f87698ce670e7fdb7b1298dd44282efe6e5d8f6d5

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe

    Filesize

    4.5MB

    MD5

    099b117d66940c56e1a26d6da4647b27

    SHA1

    92c574fd6cd055ced67490d70a06f60afbd7ad47

    SHA256

    d0322845cbb419514163624b44e99cea5dd44584a128935f3e10b62626062914

    SHA512

    031de24ab0da4cca2ff1cc4e028c9abd99917db4a5b0c63898bff325a17ed4ea2ad54f467499457a66ac897e2554e335fa38921c695677f486d8b67b278d60cd

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\Shaderium.exe

    Filesize

    320KB

    MD5

    6fbf4617e73c1cbd4cc44d26bfba53af

    SHA1

    8571c6d036cdd482470e708d730e9b8ff426f5ed

    SHA256

    d86af97e39bd12c5ecd281e2f5b2c2098a7ffaa98687d2e126dabdbf2666a5ae

    SHA512

    d10997c5142ad64cda7e6079d3e39a7f6d851bfcf081eaf354ebc3fe7d797dda7f9d090d19e83398e5b13360605592996092e33967860ca4fb5cb57bd0313825

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\chrome_100_percent.pak

    Filesize

    126KB

    MD5

    8626e1d68e87f86c5b4dabdf66591913

    SHA1

    4cd7b0ac0d3f72587708064a7b0a3beca3f7b81c

    SHA256

    2caa1da9b6a6e87bdb673977fee5dd771591a1b6ed5d3c5f14b024130a5d1a59

    SHA512

    03bcd8562482009060f249d6a0dd7382fc94d669a2094dec08e8d119be51bef2c3b7b484bb5b7f805ae98e372dab9383a2c11a63ab0f5644146556b1bb9a4c99

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\cookies.zip

    Filesize

    22B

    MD5

    76cdb2bad9582d23c1f6f4d868218d6c

    SHA1

    b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

    SHA256

    8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

    SHA512

    5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\d3dcompiler_47.dll

    Filesize

    527KB

    MD5

    a06b539edf3d26e799f1b0720dc23431

    SHA1

    809441524b1a8c4d209eb9235d5ed697af396153

    SHA256

    435eb5ced88876e26b4d446cc52fd157a46ac5f767d2438a5845b07b65d93447

    SHA512

    e9bed8af532f1077c5e75c48e3137972aef2770c1458ff3752c30848b4ce4da5b67e7a03c6ed4b24c384c4730d98b5e6a3b3f9d8364467ba8b6e6c325c3fd029

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\ffmpeg.dll

    Filesize

    662KB

    MD5

    3ff401709afee659ad9477330319b9c0

    SHA1

    244d978581bc518b5c5a31205f467909b34a941a

    SHA256

    ad8c2da9201b10095a52c9b2bb6e9cdb4103a3d9da12bfaaa0b35c6bd007fefd

    SHA512

    cc2e9d8e0e44c722ac2bb859d9fafe662b6f08fe810f9c3db675acd9bd1e3bb9318576cbb25f7c6495007006a798078c970ba881ca7a6d6e73c26dbfbe23c0d5

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\ffmpeg.dll

    Filesize

    524KB

    MD5

    53b5a27bc599e288f3142b3599b88c65

    SHA1

    a00e45b3a2aed8f1c22a09271206eb535ac4759b

    SHA256

    ba44695adc14bb1163b19283a73596962dbef9a51b4c574c3a96fa400e207011

    SHA512

    b77ce802d99579009d38d7135204aebc9d6a4c9823a489ddd1e3ffc0177ccd10e5f8459fde30316b2e199f2b603d55c2f03661843a75c022c645ce908427e785

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\ffmpeg.dll

    Filesize

    464KB

    MD5

    29a400f5b51577f50ba72fd0191f2089

    SHA1

    2c0e0ed0fa8bf1aa8b9df64d989e6c950277b229

    SHA256

    0d09a8b97df01bcdb0de8defa06dc410684aec4ad1047c5d9cbfb13a3ebf0d2b

    SHA512

    d4ac7f98198924d96ac4610365d9b80a0e6ed35970f8c5fc3ef3c3849dbaaba54589c27e673ded62ab721975208edfd74f83c38b96b9ed130a3ef0dbd6861738

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\ffmpeg.dll

    Filesize

    617KB

    MD5

    98892376651576569ea3d79dd58798bb

    SHA1

    500884b58bf39b54bc6fc924551b16a9ab54b388

    SHA256

    def0a88846fd8ec680917def21904fc21016acbbdf5a294090ba01ee1d103dce

    SHA512

    b87ab6dd1ccec47d7c1cecee0da927252ec37a2cb869dfe43e34964a521a599fb13a4562b23fb42f27b08c18e8fde1ca8933683c7ffc8ec27023bf396930e36b

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\ffmpeg.dll

    Filesize

    2.7MB

    MD5

    d49e7a8f096ad4722bd0f6963e0efc08

    SHA1

    6835f12391023c0c7e3c8cc37b0496e3a93a5985

    SHA256

    f11576bf7ffbc3669d1a5364378f35a1ed0811b7831528b6c4c55b0cdc7dc014

    SHA512

    ca50c28d6aac75f749ed62eec8acbb53317f6bdcef8794759af3fad861446de5b7fa31622ce67a347949abb1098eccb32689b4f1c54458a125bc46574ad51575

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\ffmpeg.dll

    Filesize

    128KB

    MD5

    638dc0b8bb276047ced9b003932856d8

    SHA1

    fbdf57654d9a64ed5ee0351b1e99afe7b3839169

    SHA256

    dfb18e51fa0b5d3008f992703fdd15245e231e3e6e83ecd87abfd363e7b6d378

    SHA512

    f222a3d5d0b92e376723f5c06ac4ad7eb605029773dc9dfcffdd385349a8a71a77272cd3ba5c43d52e7f512517674997170420d33866005300763854c1f35c8e

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\icudtl.dat

    Filesize

    3.7MB

    MD5

    63b095ce0fc855867a47174ada6d2158

    SHA1

    98f6c282d70cb36b6330c65cd41e45a9e87f93ce

    SHA256

    e1c331d8d8c133668c5221b9e43257ac0620e66eaecfb1fc29d1f88f03a116e3

    SHA512

    5d88bfff0fc56ef7acb611d5e5521ea3b16acf6e3ccf4bd5fe69a492bc542680a3d61a9494646e38d999933097070e884e1680ad8b0fcec0429b339606d7d945

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\libEGL.dll

    Filesize

    365KB

    MD5

    40045e5d2f370eb25c35f7c40cb7f522

    SHA1

    c20fe0130f36b53c0cffa8502bd8a214ce1ce681

    SHA256

    7494001812f60dc0edc70f30476d639e6531081c28f72419d63e7d9652efec96

    SHA512

    b182267ef83a726213301492fd9f1591179740b31d126955d3d3503168ac7e54c9a76b5a232b0ce4215f3f4f7af6f85328c25af38dd0f0135fa140aa4b41ba50

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\libGLESv2.dll

    Filesize

    374KB

    MD5

    9baee1ff768044b3629b460f241845ca

    SHA1

    6c980bab82afec1bd66fc05e1c8a1aff69dfd28c

    SHA256

    0e470042baac51adf3375ccb51d7f40ad1ac128274bd3327098428b20502265a

    SHA512

    05f73c7bdf7d5f781ef83f9cd589bfd8a47cd120796ebdebcc083a3afaebe483d298fa83d5adc566ecc300294f5274e0a4173c5ed463e7c6b6b0f294b516e345

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\libegl.dll

    Filesize

    314KB

    MD5

    c9f8ab823249ad5a4d5a66c56ca743b5

    SHA1

    a459c077bfb2a464a64b474077bb9d68ccecb072

    SHA256

    9b6d985da46828418ec4ae65c30d5a875168c7e49c1ea9e000d9d64f6b05efba

    SHA512

    e8c2fa6531652636d329c810e7956a840dfc32948a77a433f3291d471fad9eeae6c1dcd3a7425a98a8762269dff49c8f59c2a48255f8ae94467e586c9daa7918

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\libglesv2.dll

    Filesize

    475KB

    MD5

    ae7902a323cf0ff1f911292eb221181b

    SHA1

    d6fff612836bf85594b2c4a77745cc4f07329774

    SHA256

    326d0943c4f786acbf066e05e71b7b06a0d4efbdb7899408b9a7439a198c314d

    SHA512

    ff6d851cdd328bec78f97d4127aeb2ae347b6b33a3eed5080313d86f5ef3afd06a17f0629c38a764b6c15c80cd9904af79a047c6707b33c34b07c795fad2988e

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\resources.pak

    Filesize

    875KB

    MD5

    163732b9e54ca57c0407b6eb777758fa

    SHA1

    6af5bab0eea20e65c63f4761ec3da121d5ebd18f

    SHA256

    f3207ef1cf52bc81f9eb630d71b1ab8073aa68d0f9f604a3e5b401250d1eb289

    SHA512

    56275839b10a3ba7d92cc7d1315e4175f57b2f8dccccc2b59b591b37baa9a42636bfd9123df95eca1f79e5ab53484afffa1f76413886e6445c774f0e63e1602b

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\resources\app.asar

    Filesize

    3.8MB

    MD5

    271e28fc456cf5d2d79887203456f316

    SHA1

    c9d2b6a2214c2af15d568099c9cc17d283d03b3a

    SHA256

    3088b20da8a6277cb112f064124e6a5c3887df951325a1f7826e8d68b5b309e0

    SHA512

    7a0a60901851745fd32cb09cd689e433fefc2378a560fa40f410e06f717b19d8169b2b388a6fc68eb88d712f426ebaff19b9a723aea2a13614c68919c233defb

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\vk_swiftshader.dll

    Filesize

    423KB

    MD5

    d18913f5675af058277ff41350090df5

    SHA1

    aa93da32c346c617400a221a9be4e3e207e5e253

    SHA256

    78da7d3dd68315a864812eac2b4511e1a61d8645799ee8b5bca23ff6f03b1b33

    SHA512

    c89cd8c4b1312cc60dddf4e7553360188c46f0483f3347ffb5714db838bca61ef73d2d64d54feada1d2f4ab0e11b101b2f8995be8a3d99dbe8a411cd77f90b1a

  • C:\Users\Admin\AppData\Local\Temp\2ch1J1q1yf3pFdsePZl8xdeR3TM\vk_swiftshader.dll

    Filesize

    464KB

    MD5

    5af2fa18747a8f5a9bf619c49a91d301

    SHA1

    135a3b56fd28226d5e90b00289594b28d34b2c12

    SHA256

    9de4ed2ae64f7294a1518d94198550b7003b92d5d5ae70373d871f5f595acef5

    SHA512

    a848783095a86b0c8a7f6fa339869c53fe9d49d582db082222ae5cb756d7cff9706738141374f287e92fa78bcde54fe88bde043b1af34b0761126c77f789d738

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rxiptxdm.305.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\c23be732-7bef-4b63-8e3c-640c4dd92bcf.tmp.node

    Filesize

    1.8MB

    MD5

    3072b68e3c226aff39e6782d025f25a8

    SHA1

    cf559196d74fa490ac8ce192db222c9f5c5a006a

    SHA256

    7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01

    SHA512

    61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\LICENSE.electron.txt

    Filesize

    1KB

    MD5

    4d42118d35941e0f664dddbd83f633c5

    SHA1

    2b21ec5f20fe961d15f2b58efb1368e66d202e5c

    SHA256

    5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

    SHA512

    3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\LICENSES.chromium.html

    Filesize

    640KB

    MD5

    40a9ed1fe2b370774c803aece460e879

    SHA1

    d256831b643805e3f504a05d50b36e6fec8dbfea

    SHA256

    ec046d048c32e6e8a739d36e3f4806af6207757d0510e9f6b1156847574d4917

    SHA512

    23b106e8edfe65bbbea2ccec58ff60f6f4f83648016ca40878b8507758df8b921de0862385b317b40bdee93d081dfb7e86473d31e8cb61df44895c34a96a4d27

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\Shaderium.exe

    Filesize

    3.2MB

    MD5

    c1f0d610e7e0bd36691052660d92be4b

    SHA1

    295c016c424e7aaf7fdc1086e34c50599ca076e2

    SHA256

    b4d5287468fee9840c4d2407c5a78d4e00466ac0252000df94eb4647d21c4eb6

    SHA512

    170227ae5ff74c22d51d6e526566d7b10b59a824b39008a6f2013b2a27b297aff9065c7c4c3e6e675fc5548fc59beca51206597da2983309827ef72ce7b92e81

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\chrome_200_percent.pak

    Filesize

    175KB

    MD5

    48515d600258d60019c6b9c6421f79f6

    SHA1

    0ef0b44641d38327a360aa6954b3b6e5aab2af16

    SHA256

    07bee34e189fe9a8789aed78ea59ad41414b6e611e7d74da62f8e6ca36af01ce

    SHA512

    b7266bc8abc55bd389f594dac0c0641ecf07703f35d769b87e731b5fdf4353316d44f3782a4329b3f0e260dead6b114426ddb1b0fb8cd4a51e0b90635f1191d9

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\d3dcompiler_47.dll

    Filesize

    1.9MB

    MD5

    4d04432da6b9404a7cc980ec531b3d4d

    SHA1

    6b583844771e4b01d054e22440566d1c13ccaded

    SHA256

    976c73684bc3884af3b0d2233a0a7cc33c8f9cd1e0898319cc612c5d4e02822d

    SHA512

    2097cee17f6eb6da944947836ed2788cefb5ee414c914d14abb2c20da16492d6f32405026d92a57187e34faa4d06eeb35837647a9cf28776175829e05a9a96e2

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\ffmpeg.dll

    Filesize

    832KB

    MD5

    feb0c7b2c24a25e95c0a9ce18fa48831

    SHA1

    b3c05f48fe9841f3f0c86c75c6e891cf0b1d04f0

    SHA256

    4e92d3644b4cfc513e4b21dbd85f5ca1c193087e513c6119714783d1d58c644a

    SHA512

    c1305e30aeaebc34fbfa4865ec8e53a93fd4dfaedd8f186575339f7421d2cb6ee959f8d807b9f658fbb9cf8e55d20d07cae8877e222d7060499166fcc60f2968

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\icudtl.dat

    Filesize

    768KB

    MD5

    d62f779cea9cbc7365ec1f6c6725f6f1

    SHA1

    2ff4454a7780fc41f4ec6208d1d6973263b720ae

    SHA256

    9e8c53d616afe0fa9635b0f0ed5ac6044a57bbad8b5d82f4595a046633d7b3ac

    SHA512

    0f0498ef8e27eb6845130005936eda06249701356ef219e5f6bb409670dcd0c6e9bb615e76e6699ead018ee35a188940bc6f4f8f5eed42d8333230c92a3ce4f9

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\libEGL.dll

    Filesize

    468KB

    MD5

    09134e6b407083baaedf9a8c0bce68f2

    SHA1

    8847344cceeab35c1cdf8637af9bd59671b4e97d

    SHA256

    d2107ba0f4e28e35b22837c3982e53784d15348795b399ad6292d0f727986577

    SHA512

    6ff3adcb8be48d0b505a3c44e6550d30a8feaf4aa108982a7992ed1820c06f49e0ad48d9bd92685fb82783dfd643629bd1fe4073300b61346b63320cbdb051ba

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\libGLESv2.dll

    Filesize

    704KB

    MD5

    fe88344be7a7e3fc1cf839d5ff489f44

    SHA1

    4da0cf5b701af092b0e5ba0b44d687ea73f35645

    SHA256

    e79f8aabc1d4a294fba8059a3da73eff5e7c87b5dc2bb1f15b2099ab24e7ad42

    SHA512

    d5b3124384af9d0b668d2eb97abf5c17163eebcc532d5259d7790f763d548442708af073701adcd87eec18f7a271614d5b1eac77f0c81991fca5c0be4906e5bf

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\af.pak

    Filesize

    353KB

    MD5

    464e5eeaba5eff8bc93995ba2cb2d73f

    SHA1

    3b216e0c5246c874ad0ad7d3e1636384dad2255d

    SHA256

    0ad547bb1dc57907adeb02e1be3017cce78f6e60b8b39395fe0e8b62285797a1

    SHA512

    726d6c41a9dbf1f5f2eff5b503ab68d879b088b801832c13fba7eb853302b16118cacda4748a4144af0f396074449245a42b2fe240429b1afcb7197fa0cb6d41

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\am.pak

    Filesize

    569KB

    MD5

    2c933f084d960f8094e24bee73fa826c

    SHA1

    91dfddc2cff764275872149d454a8397a1a20ab1

    SHA256

    fa1e44215bd5acc7342c431a3b1fddb6e8b6b02220b4599167f7d77a29f54450

    SHA512

    3c9ecfb0407de2aa6585f4865ad54eeb2ec6519c9d346e2d33ed0e30be6cc3ebfed676a08637d42c2ca8fa6cfefb4091feb0c922ff71f09a2b89cdd488789774

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\ar.pak

    Filesize

    624KB

    MD5

    fdbad4c84ac66ee78a5c8dd16d259c43

    SHA1

    3ce3cd751bb947b19d004bd6916b67e8db5017ac

    SHA256

    a62b848a002474a8ea37891e148cbaf4af09bdba7dafebdc0770c9a9651f7e3b

    SHA512

    376519c5c2e42d21acedb1ef47184691a2f286332451d5b8d6aac45713861f07c852fb93bd9470ff5ee017d6004aba097020580f1ba253a5295ac1851f281e13

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\bg.pak

    Filesize

    512KB

    MD5

    edc0bc95316080cfa46aae420e560f7e

    SHA1

    9b5f5bc36ce21a6f3094fd3f7c7fc53baf7d0010

    SHA256

    c47920b3b7a256a57288afad4f882adf750eacd99d7ad5bc26bc877fd9a50df4

    SHA512

    9efeec500d76320ae12f6f9a724778573cd77278f27c77b266be46ddf4ea60e8c5f977c586746b193220df4926599cf3e517be7a9c04282facd3395709473238

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\bn.pak

    Filesize

    512KB

    MD5

    e8a83f43da2d1c1a71caaf025c9d6d5c

    SHA1

    167bbdad9dde8a3a7ade5cb79a876f7c15451631

    SHA256

    02525c2876859a81d843ecf2f71ecb79c8aa602da77d7328844886bf642f29da

    SHA512

    388033da50c2d84aec9e0e1a1c774fd3e3ef868b3569abdac59bef88c11c27bc7f83edf8acb21bcde63faf42bf663e1b41d6fa2a01854c4e8669a4e600a3914c

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\ca.pak

    Filesize

    400KB

    MD5

    4cd6b3a91669ddcfcc9eef9b679ab65c

    SHA1

    43c41cb00067de68d24f72e0f5c77d3b50b71f83

    SHA256

    56efff228ee3e112357d6121b2256a2c3acd718769c89413de82c9d4305459c6

    SHA512

    699be9962d8aae241abd1d1f35cd8468ffbd6157bcd6bdf2c599d902768351b247baad6145b9826d87271fd4a19744eb11bf7065db7fefb01d66d2f1f39015a9

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\cs.pak

    Filesize

    409KB

    MD5

    eeee212072ea6589660c9eb216855318

    SHA1

    d50f9e6ca528725ced8ac186072174b99b48ea05

    SHA256

    de92f14480770401e39e22dcf3dd36de5ad3ed22e44584c31c37cd99e71c4a43

    SHA512

    ea068186a2e611fb98b9580f2c5ba6fd1f31b532e021ef9669e068150c27deee3d60fd9ff7567b9eb5d0f98926b24defabc9b64675b49e02a6f10e71bb714ac8

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\da.pak

    Filesize

    371KB

    MD5

    e7ba94c827c2b04e925a76cb5bdd262c

    SHA1

    abba6c7fcec8b6c396a6374331993c8502c80f91

    SHA256

    d8da7ab28992c8299484bc116641e19b448c20adf6a8b187383e2dba5cd29a0b

    SHA512

    1f44fce789cf41fd62f4d387b7b8c9d80f1e391edd2c8c901714dd0a6e3af32266e9d3c915c15ad47c95ece4c7d627aa7339f33eea838d1af9901e48edb0187e

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\de.pak

    Filesize

    397KB

    MD5

    cf22ec11a33be744a61f7de1a1e4514f

    SHA1

    73e84848c6d9f1a2abe62020eb8c6797e4c49b36

    SHA256

    7cc213e2c9a2d2e2e463083dd030b86da6bba545d5cee4c04df8f80f9a01a641

    SHA512

    c10c8446e3041d7c0195da184a53cfbd58288c06eaf8885546d2d188b59667c270d647fa7259f5ce140ec6400031a7fc060d0f2348ab627485e2207569154495

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\el.pak

    Filesize

    712KB

    MD5

    e66a75680f21ce281995f37099045714

    SHA1

    d553e80658ee1eea5b0912db1ecc4e27b0ed4790

    SHA256

    21d1d273124648a435674c7877a98110d997cf6992469c431fe502bbcc02641f

    SHA512

    d3757529dd85ef7989d9d4cecf3f7d87c9eb4beda965d8e2c87ee23b8baaec3fdff41fd53ba839215a37404b17b8fe2586b123557f09d201b13c7736c736b096

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\en-GB.pak

    Filesize

    324KB

    MD5

    825ed4c70c942939ffb94e77a4593903

    SHA1

    7a3faee9bf4c915b0f116cb90cec961dda770468

    SHA256

    e11e8db78ae12f8d735632ba9fd078ec66c83529cb1fd86a31ab401f6f833c16

    SHA512

    41325bec22af2e5ef8e9b26c48f2dfc95763a249ccb00e608b7096ec6236ab9a955de7e2340fd9379d09ac2234aee69aed2a24fe49382ffd48742d72a929c56a

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\en-US.pak

    Filesize

    326KB

    MD5

    19d18f8181a4201d542c7195b1e9ff81

    SHA1

    7debd3cf27bbe200c6a90b34adacb7394cb5929c

    SHA256

    1d20e626444759c2b72aa6e998f14a032408d2b32f957c12ec3abd52831338fb

    SHA512

    af07e1b08bbf2dd032a5a51a88ee2923650955873753629a086cad3b1600ce66ca7f9ed31b8ca901c126c10216877b24e123144bb0048f2a1e7757719aae73f2

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\es-419.pak

    Filesize

    395KB

    MD5

    7da3e8aa47ba35d014e1d2a32982a5bb

    SHA1

    8e35320b16305ad9f16cb0f4c881a89818cd75bb

    SHA256

    7f85673cf80d1e80acfc94fb7568a8c63de79a13a1bb6b9d825b7e9f338ef17c

    SHA512

    1fca90888eb067972bccf74dd5d09bb3fce2ceb153589495088d5056ed4bdede15d54318af013c2460f0e8b5b1a5c6484adf0ed84f4b0b3c93130b086da5c3bf

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\es.pak

    Filesize

    394KB

    MD5

    04a9ba7316dc81766098e238a667de87

    SHA1

    24d7eb4388ecdfecada59c6a791c754181d114de

    SHA256

    7fa148369c64bc59c2832d617357879b095357fe970bab9e0042175c9ba7cb03

    SHA512

    650856b6187df41a50f9bed29681c19b4502de6af8177b47bad0bf12e86a25e92aa728311310c28041a18e4d9f48ef66d5ad5d977b6662c44b49bfd1da84522b

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\et.pak

    Filesize

    356KB

    MD5

    ccc71f88984a7788c8d01add2252d019

    SHA1

    6a87752eac3044792a93599428f31d25debea369

    SHA256

    d69489a723b304e305cb1767e6c8da5d5d1d237e50f6ddc76e941dcb01684944

    SHA512

    d35ccd639f2c199862e178a9fab768d7db10d5a654bc3bc1fab45d00ceb35a01119a5b4d199e2db3c3576f512b108f4a1df7faf6624d961c0fc4bca5af5f0e07

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\fa.pak

    Filesize

    577KB

    MD5

    2e37fd4e23a1707a1eccea3264508dff

    SHA1

    e00e58ed06584b19b18e9d28b1d52dbfc36d70f3

    SHA256

    b9ee861e1bdecffe6a197067905279ea77c180844a793f882c42f2b70541e25e

    SHA512

    7c467f434eb0ce8e4a851761ae9bd7a9e292aab48e8e653e996f8ca598d0eb5e07ec34e2b23e544f3b38439dc3b8e3f7a0dfd6a8e28169aa95ceff42bf534366

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\fi.pak

    Filesize

    365KB

    MD5

    21e534869b90411b4f9ea9120ffb71c8

    SHA1

    cc91ffbd19157189e44172392b2752c5f73984c5

    SHA256

    2d337924139ffe77804d2742eda8e58d4e548e65349f827840368e43d567810b

    SHA512

    3ca3c0adaf743f92277452b7bd82db4cf3f347de5568a20379d8c9364ff122713befd547fbd3096505ec293ae6771ada4cd3dadac93cc686129b9e5aacf363bd

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\fil.pak

    Filesize

    410KB

    MD5

    d7df2ea381f37d6c92e4f18290c6ffe0

    SHA1

    7cacf08455aa7d68259fcba647ee3d9ae4c7c5e4

    SHA256

    db4a63fa0d5b2baba71d4ba0923caed540099db6b1d024a0d48c3be10c9eed5a

    SHA512

    96fc028455f1cea067b3a3dd99d88a19a271144d73dff352a3e08b57338e513500925787f33495cd744fe4122dff2d2ee56e60932fc02e04feed2ec1e0c3533f

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\fr.pak

    Filesize

    426KB

    MD5

    3ee48a860ecf45bafa63c9284dfd63e2

    SHA1

    1cb51d14964f4dced8dea883bf9c4b84a78f8eb6

    SHA256

    1923e0edf1ef6935a4a718e3e2fc9a0a541ea0b4f3b27553802308f9fd4fc807

    SHA512

    eb6105faca13c191fef0c51c651a406b1da66326bb5705615770135d834e58dee9bed82aa36f2dfb0fe020e695c192c224ec76bb5c21a1c716e5f26dfe02f763

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\gu.pak

    Filesize

    813KB

    MD5

    308619d65b677d99f48b74ccfe060567

    SHA1

    9f834df93fd48f4fb4ca30c4058e23288cf7d35e

    SHA256

    e40ee4f24839f9e20b48d057bf3216bc58542c2e27cb40b9d2f3f8a1ea5bfbb4

    SHA512

    3ca84ad71f00b9f7cc61f3906c51b263f18453fce11ec6c7f9edfe2c7d215e3550c336e892bd240a68a6815af599cc20d60203294f14adb133145ca01fe4608f

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\he.pak

    Filesize

    507KB

    MD5

    fc84ea7dc7b9408d1eea11beeb72b296

    SHA1

    de9118194952c2d9f614f8e0868fb273ddfac255

    SHA256

    15951767dafa7bdbedac803d842686820de9c6df478416f34c476209b19d2d8c

    SHA512

    49d13976dddb6a58c6fdcd9588e243d705d99dc1325c1d9e411a1d68d8ee47314dfcb661d36e2c4963c249a1542f95715f658427810afcabdf9253aa27eb3b24

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\hi.pak

    Filesize

    848KB

    MD5

    b5dfce8e3ba0aec2721cc1692b0ad698

    SHA1

    c5d6fa21a9ba3d526f3e998e3f627afb8d1eecf3

    SHA256

    b1c7fb6909c8a416b513d6de21eea0b5a6b13c7f0a94cabd0d9154b5834a5e8b

    SHA512

    facf0a9b81af6bb35d0fc5e69809d5c986a2c91a166e507784bdad115644b96697fe504b8d70d9bbb06f0c558f746c085d37e385eef41f0a1c29729d3d97980f

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\hr.pak

    Filesize

    128KB

    MD5

    f12f56acb7655348ba91e89143198f79

    SHA1

    4b6b991167e95634389ef7f40250e05ca40ada4d

    SHA256

    ea17dc5659775d1aca698387b721560d7fee68fc982cfab3beb3fabc3172b8d0

    SHA512

    6893977719d4b78bee7409588cf1bbfd8ff4fe4c19a79a733ad7db5070ec7607e879854f69c52d7957e99cb5fde96571dacdb0698982b7937e4ca61ed4d606d5

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\hu.pak

    Filesize

    128KB

    MD5

    bc58c95e13af8a1581f09b856eaa6da8

    SHA1

    9891558de21476e910d9fc7394275182ff1653e4

    SHA256

    f786ec7ce6847cc8794c491f64afc994b1b93a4d094d4e94272fbad8c20b81c3

    SHA512

    baae6d206f35b82608e5c325c13bb6c1f16d05f76793ab53ba3f2a38e4ae680b6720690fdeab73ee5403b1097491be2ca5b654caf2bc3b01fc0c2d1c575521eb

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\id.pak

    Filesize

    128KB

    MD5

    98273903a244f84f6578284a2b53122d

    SHA1

    44d334d2fcf90611142d63a524cebfcee4dec39c

    SHA256

    7e0417fe5508c41a19cb2f6749dc12008e77ad3c3d4bbc449c3dafba2e879464

    SHA512

    0236a9708aed28f650330be3e49f4779431a555a36650885dec24dffaeb4fa05699c0d40d1c0d40134ccf7f0aa61a12c3b2bb705c7207ab88860c161171080b3

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\it.pak

    Filesize

    128KB

    MD5

    7e5e3ad4f3a450e5e7022972a55bad55

    SHA1

    8e7d7271a4608317bdb7addb530c58062bc9b6b3

    SHA256

    51c7ad6e3625f2e06d28dbd19d13790f723cfeb4e75a7c85dcecd3fa57902bcf

    SHA512

    f20c8e7b19f362f46ea73cb0a0078bd53aa29ab2577b1330076be0bddab8a2f410e4215791eced8d2a0b0b01e644ba763be883cb45247717b33820bdc4a497a8

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\ja.pak

    Filesize

    128KB

    MD5

    b2a2d75fb291ad1419639134a61eaccb

    SHA1

    0e611511224999eb5849f814c0215f29b4b5a743

    SHA256

    f96a12cde17085d77d340bb8f403bc4ae998585593a44418eb57b09b28c57017

    SHA512

    326e9438e30902abf6c28d8f247b5880177a85e8bb2e2a9138ba4e30d7093adc6d90750dbf5f58e5be77aeb8efd076fc9d710abe50c52fe51f8f1190d60286a9

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\kn.pak

    Filesize

    938KB

    MD5

    caab4deb1c40507848f9610d849834cf

    SHA1

    1bc87ff70817ba1e1fdd1b5cb961213418680cbe

    SHA256

    7a34483e6272f9b8881f0f5a725b477540166561c75b9e7ab627815d4be1a8a4

    SHA512

    dc4b63e5a037479bb831b0771aec0fe6eb016723bcd920b41ab87ef11505626632877073ce4e5e0755510fe19ba134a7b5899332ecef854008b15639f915860c

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\ko.pak

    Filesize

    398KB

    MD5

    d6194fc52e962534b360558061de2a25

    SHA1

    98ed833f8c4beac685e55317c452249579610ff8

    SHA256

    1a5884bd6665b2f404b7328de013522ee7c41130e57a53038fc991ec38290d21

    SHA512

    5207a07426c6ceb78f0504613b6d2b8dadf9f31378e67a61091f16d72287adbc7768d1b7f2a923369197e732426d15a872c091cf88680686581d48a7f94988ab

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\lt.pak

    Filesize

    429KB

    MD5

    64b08ffc40a605fe74ecc24c3024ee3b

    SHA1

    516296e8a3114ddbf77601a11faf4326a47975ab

    SHA256

    8a5d6e29833374e0f74fd7070c1b20856cb6b42ed30d18a5f17e6c2e4a8d783e

    SHA512

    05d207413186ac2b87a59681efe4fdf9dc600d0f3e8327e7b9802a42306d80d0ddd9ee07d103b17caf0518e42ab25b7ca9da4713941abc7bced65961671164ac

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\lv.pak

    Filesize

    427KB

    MD5

    a8cbd741a764f40b16afea275f240e7e

    SHA1

    317d30bbad8fd0c30de383998ea5be4eec0bb246

    SHA256

    a1a9d84fd3af571a57be8b1a9189d40b836808998e00ec9bd15557b83d0e3086

    SHA512

    3da91c0ca20165445a2d283db7dc749fcf73e049bfff346b1d79b03391aefc7f1310d3ac2c42109044cfb50afcf178dcf3a34b4823626228e591f328dd7afe95

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\ml.pak

    Filesize

    974KB

    MD5

    1c81104ac2cbf7f7739af62eb77d20d5

    SHA1

    0f0d564f1860302f171356ea35b3a6306c051c10

    SHA256

    66005bc01175a4f6560d1e9768dbc72b46a4198f8e435250c8ebc232d2dac108

    SHA512

    969294eae8c95a1126803a35b8d3f1fc3c9d22350aa9cc76b2323b77ad7e84395d6d83b89deb64565783405d6f7eae40def7bdaf0d08da67845ae9c7dbb26926

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\mr.pak

    Filesize

    797KB

    MD5

    2cf9f07ddf7a3a70a48e8b524a5aed43

    SHA1

    974c1a01f651092f78d2d20553c3462267ddf4e9

    SHA256

    23058c0f71d9e40f927775d980524d866f70322e0ef215aa5748c239707451e7

    SHA512

    0b21570deefa41defc3c25c57b3171635bcb5593761d48a8116888ce8be34c1499ff79c7a3ebbe13b5a565c90027d294c6835e92e6254d582a86750640fe90f2

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\ms.pak

    Filesize

    365KB

    MD5

    aee105366a1870b9d10f0f897e9295db

    SHA1

    eee9d789a8eeafe593ce77a7c554f92a26a2296f

    SHA256

    c6471aee5f34f31477d57f593b09cb1de87f5fd0f9b5e63d8bab4986cf10d939

    SHA512

    240688a0054bfebe36ea2b056194ee07e87bbbeb7e385131c73a64aa7967984610fcb80638dd883837014f9bc920037069d0655e3e92a5922f76813aedb185fa

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\nb.pak

    Filesize

    358KB

    MD5

    55d5ad4eacb12824cfcd89470664c856

    SHA1

    f893c00d8d4fdb2f3e7a74a8be823e5e8f0cd673

    SHA256

    4f44789a2c38edc396a31aba5cc09d20fb84cd1e06f70c49f0664289c33cd261

    SHA512

    555d87be8c97f466c6b3e7b23ec0210335846398c33dba71e926ff7e26901a3908dbb0f639c93db2d090c9d8bda48eddf196b1a09794d0e396b2c02b4720f37e

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\nl.pak

    Filesize

    370KB

    MD5

    0f04bac280035fab018f634bcb5f53ae

    SHA1

    4cad76eaecd924b12013e98c3a0e99b192be8936

    SHA256

    be254bcda4dbe167cb2e57402a4a0a814d591807c675302d2ce286013b40799b

    SHA512

    1256a6acac5a42621cb59eb3da42ddeeacfe290f6ae4a92d00ebd4450a8b7ccb6f0cd5c21cf0f18fe4d43d0d7aee87b6991fef154908792930295a3871fa53df

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\pl.pak

    Filesize

    412KB

    MD5

    f1d48a7dcd4880a27e39b7561b6eb0ab

    SHA1

    353c3ba213cd2e1f7423c6ba857a8d8be40d8302

    SHA256

    2593c8b59849fbc690cbd513f06685ea3292cd0187fcf6b9069cbf3c9b0e8a85

    SHA512

    132da2d3c1a4dad5ccb399b107d7b6d9203a4b264ef8a65add11c5e8c75859115443e1c65ece2e690c046a82687829f54ec855f99d4843f859ab1dd7c71f35a5

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\pt-BR.pak

    Filesize

    389KB

    MD5

    8e931ffbded8933891fb27d2cca7f37d

    SHA1

    ab0a49b86079d3e0eb9b684ca36eb98d1d1fd473

    SHA256

    6632bd12f04a5385012b5cdebe8c0dad4a06750dc91c974264d8fe60e8b6951d

    SHA512

    cf0f6485a65c13cf5ddd6457d34cdea222708b0bb5ca57034ed2c4900fd22765385547af2e2391e78f02dcf00b7a2b3ac42a3509dd4237581cfb87b8f389e48d

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\pt-PT.pak

    Filesize

    390KB

    MD5

    b4954b064e3f6a9ba546dda5fa625927

    SHA1

    584686c6026518932991f7de611e2266d8523f9d

    SHA256

    ee1e014550b85e3d18fb5128984a713d9f6de2258001b50ddd18391e7307b4a1

    SHA512

    cb3b465b311f83b972eca1c66862b2c5d6ea6ac15282e0094aea455123ddf32e85df24a94a0aedbe1b925ff3ed005ba1e00d5ee820676d7a5a366153ade90ef7

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\ro.pak

    Filesize

    403KB

    MD5

    d2758f6adbaeea7cd5d95f4ad6dde954

    SHA1

    d7476db23d8b0e11bbabf6a59fde7609586bdc8a

    SHA256

    2b7906f33bfbe8e9968bcd65366e2e996cdf2f3e1a1fc56ad54baf261c66954c

    SHA512

    8378032d6febea8b5047ada667cb19e6a41f890cb36305acc2500662b4377caef3dc50987c925e05f21c12e32c3920188a58ee59d687266d70b8bfb1b0169a6e

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\ru.pak

    Filesize

    657KB

    MD5

    2885bde990ee3b30f2c54a4067421b68

    SHA1

    ae16c4d534b120fdd68d33c091a0ec89fd58793f

    SHA256

    9fcda0d1fab7fff7e2f27980de8d94ff31e14287f58bd5d35929de5dd9cbcdca

    SHA512

    f7781f5c07fbf128399b88245f35055964ff0cde1cc6b35563abc64f520971ce9916827097ca18855b46ec6397639f5416a6e8386a9390afba4332d47d21693f

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\sk.pak

    Filesize

    416KB

    MD5

    b7e97cc98b104053e5f1d6a671c703b7

    SHA1

    0f7293f1744ae2cd858eb3431ee016641478ae7d

    SHA256

    b0d38869275d9d295e42b0b90d0177e0ca56a393874e4bb454439b8ce25d686f

    SHA512

    ef3247c6f0f4065a4b68db6bf7e28c8101a9c6c791b3f771ed67b5b70f2c9689cec67a1c864f423382c076e4cbb6019c1c0cb9ad0204454e28f749a69b6b0de0

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\sl.pak

    Filesize

    401KB

    MD5

    ca763e801de642e4d68510900ff6fabb

    SHA1

    c32a871831ce486514f621b3ab09387548ee1cff

    SHA256

    340e0babe5fddbfda601c747127251cf111dd7d79d0d6a5ec4e8443b835027de

    SHA512

    e2847ce75de57deb05528dd9557047edcd15d86bf40a911eb97e988a8fdbda1cd0e0a81320eadf510c91c826499a897c770c007de936927df7a1cc82fa262039

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\sr.pak

    Filesize

    616KB

    MD5

    c68c235d8e696c098cf66191e648196b

    SHA1

    5c967fbbd90403a755d6c4b2411e359884dc8317

    SHA256

    ab96a18177af90495e2e3c96292638a775aa75c1d210ca6a6c18fbc284cd815b

    SHA512

    34d14d8cb851df1ea8cd3cc7e9690eaf965d8941cfcac1c946606115ad889630156c5ff47011b27c1288f8df70e8a7dc41909a9fa98d75b691742ec1d1a5e653

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\sv.pak

    Filesize

    361KB

    MD5

    272f8a8b517c7283eab83ba6993eea63

    SHA1

    ad4175331b948bd4f1f323a4938863472d9b700c

    SHA256

    d15b46bc9b5e31449b11251df19cd2ba4920c759bd6d4fa8ca93fd3361fdd968

    SHA512

    3a0930b7f228a779f727ebfb6ae8820ab5cc2c9e04c986bce7b0f49f9bf124f349248ecdf108edf8870f96b06d58dea93a3e0e2f2da90537632f2109e1aa65f0

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\sw.pak

    Filesize

    379KB

    MD5

    67a443a5c2eaad32625edb5f8deb7852

    SHA1

    a6137841e8e7736c5ede1d0dc0ce3a44dc41013f

    SHA256

    41dfb772ae4c6f9e879bf7b4fa776b2877a2f8740fa747031b3d6f57f34d81dd

    SHA512

    e0fdff1c3c834d8af8634f43c2f16ba5b883a8d88dfd322593a13830047568faf9f41d0bf73cd59e2e33c38fa58998d4702d2b0c21666717a86945d18b3f29e5

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\ta.pak

    Filesize

    964KB

    MD5

    18ec8ff3c0701a6a8c48f341d368bab5

    SHA1

    8bff8aee26b990cf739a29f83efdf883817e59d8

    SHA256

    052bcdb64a80e504bb6552b97881526795b64e0ab7ee5fc031f3edf87160dee9

    SHA512

    a0e997fc9d316277de3f4773388835c287ab1a35770c01e376fb7428ff87683a425f6a6a605d38dd7904ca39c50998cd85f855cb33ae6abad47ac85a1584fe4e

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\te.pak

    Filesize

    894KB

    MD5

    a17f16d7a038b0fa3a87d7b1b8095766

    SHA1

    b2f845e52b32c513e6565248f91901ab6874e117

    SHA256

    d39716633228a5872630522306f89af8585f8092779892087c3f1230d21a489e

    SHA512

    371fb44b20b8aba00c4d6f17701fa4303181ad628f60c7b4218e33be7026f118f619d66d679bffcb0213c48700fafd36b2e704499a362f715f63ea9a75d719e7

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\th.pak

    Filesize

    753KB

    MD5

    a32ba63feeed9b91f6d6800b51e5aeae

    SHA1

    2fbf6783996e8315a4fb94b7d859564350ee5918

    SHA256

    e32e37ca0ab30f1816fe6df37e3168e1022f1d3737c94f5472ab6600d97a45f6

    SHA512

    adebde0f929820d8368096a9c30961ba7b33815b0f124ca56ca05767ba6d081adf964088cb2b9fcaa07f756b946fffa701f0b64b07d457c99fd2b498cbd1e8a5

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\tr.pak

    Filesize

    385KB

    MD5

    5ff2e5c95067a339e3d6b8985156ec1f

    SHA1

    7525b25c7b07f54b63b6459a0d8c8c720bd8a398

    SHA256

    14a131ba318274cf10de533a19776db288f08a294cf7e564b7769fd41c7f2582

    SHA512

    2414386df8d7ab75dcbd6ca2b9ae62ba8e953ddb8cd8661a9f984eb5e573637740c7a79050b2b303af3d5b1d4d1bb21dc658283638718fdd04fc6e5891949d1b

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\uk.pak

    Filesize

    657KB

    MD5

    361a0e1f665b9082a457d36209b92a25

    SHA1

    3c89e1b70b51820bb6baa64365c64da6a9898e2f

    SHA256

    bd02966f6c6258b66eae7ff014710925e53fe26e8254d7db4e9147266025cc3a

    SHA512

    d4d25fc58053f8cce4c073846706dc1ecbc0dc19308ba35501e19676f3e7ed855d7b57ae22a5637f81cefc1aa032bf8770d0737df1924f3504813349387c08cf

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\ur.pak

    Filesize

    571KB

    MD5

    1ca4fa13bd0089d65da7cd2376feb4c6

    SHA1

    b1ba777e635d78d1e98e43e82d0f7a3dd7e97f9c

    SHA256

    3941364d0278e2c4d686faa4a135d16a457b4bc98c5a08e62aa12f3adc09aa7f

    SHA512

    d0d9eb1aa029bd4c34953ee5f4b60c09cf1d4f0b21c061db4ede1b5ec65d7a07fc2f780ade5ce51f2f781d272ac32257b95eedf471f7295ba70b5ba51db6c51d

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\vi.pak

    Filesize

    455KB

    MD5

    db0eb3183007de5aae10f934fffacc59

    SHA1

    e9ea7aeffe2b3f5cf75ab78630da342c6f8b7fd9

    SHA256

    ddabb225b671b989789e9c2ccd1b5a8f22141a7d9364d4e6ee9b8648305e7897

    SHA512

    703efd12fcace8172c873006161712de1919572c58d98b11de7834c5628444229f5143d231c41da5b9cf729e32de58dee3603cb3d18c6cdd94aa9aa36fbf5de0

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\zh-CN.pak

    Filesize

    332KB

    MD5

    82326e465e3015c64ca1db77dc6a56bc

    SHA1

    e8abe12a8dd2cc741b9637fa8f0e646043bbfe3d

    SHA256

    6655fd9dcdfaf2abf814ffb6c524d67495aed4d923a69924c65abeab30bc74fb

    SHA512

    4989789c0b2439666dda4c4f959dffc0ddcb77595b1f817c13a95ed97619c270151597160320b3f2327a7daffc8b521b68878f9e5e5fb3870eb0c43619060407

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\locales\zh-TW.pak

    Filesize

    330KB

    MD5

    2456bf42275f15e016689da166df9008

    SHA1

    70f7de47e585dfea3f5597b5bba1f436510decd7

    SHA256

    adf8df051b55507e5a79fa47ae88c7f38707d02dfac0cc4a3a7e8e17b58c6479

    SHA512

    7e622afa15c70785aaf7c19604d281efe0984f621d6599058c97c19d3c0379b2ee2e03b3a7ec597040a4eee250a782d7ec55c335274dd7db7c7ca97ddcfd378a

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\resources.pak

    Filesize

    576KB

    MD5

    48430e098701f8d00dea2c6a80c57a38

    SHA1

    7cc00018737a29881f636b33b3869a525577f18d

    SHA256

    5e0b9c52effce20bfd88a07d4ed3875a5f35b0a13bdca019dba244cb738e54f0

    SHA512

    8f5214c70e99da51e9454715c5514751ce91237c575965ceecf78520ca650b78861d9b84a2579beb6ed6cd75c657919896d4dcd12af44476a4ca727330e7f609

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\resources\app.asar

    Filesize

    2.0MB

    MD5

    1141ac23fd9db1a03753e7896ece96fb

    SHA1

    2c5b272a179b8f559091b6b6502e91733195c1bb

    SHA256

    1286031349bec66505ad9e46beaa09c61aa693710a93aa8164f3f538a8cb2274

    SHA512

    6d10be3303e30affb02eda7368bf92f5c01202dabbd359392c65f21af375dae149c63d3093575bff1ec3fa201f633aa9516789bbfb98d6e9252dd2238c33df2c

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\resources\elevate.exe

    Filesize

    105KB

    MD5

    792b92c8ad13c46f27c7ced0810694df

    SHA1

    d8d449b92de20a57df722df46435ba4553ecc802

    SHA256

    9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

    SHA512

    6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\snapshot_blob.bin

    Filesize

    158KB

    MD5

    8fef5a96dbcc46887c3ff392cbdb1b48

    SHA1

    ed592d75222b7828b7b7aab97b83516f60772351

    SHA256

    4de0f720c416776423add7ada621da95d0d188d574f08e36e822ad10d85c3ece

    SHA512

    e52c7820c69863ecc1e3b552b7f20da2ad5492b52cac97502152ebff45e7a45b00e6925679fd7477cdc79c68b081d6572eeed7aed773416d42c9200accc7230e

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\v8_context_snapshot.bin

    Filesize

    465KB

    MD5

    a373d83d4c43ba957693ad57172a251b

    SHA1

    8e0fdb714df2f4cb058beb46c06aa78f77e5ff86

    SHA256

    43b58ca4057cf75063d3b4a8e67aa9780d9a81d3a21f13c64b498be8b3ba6e0c

    SHA512

    07fbd84dc3e0ec1536ccb54d5799d5ed61b962251ece0d48e18b20b0fc9dd92de06e93957f3efc7d9bed88db7794fe4f2bec1e9b081825e41c6ac3b4f41eab18

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\vk_swiftshader.dll

    Filesize

    832KB

    MD5

    2646e7525f8704e5e2e27f014d9a15dc

    SHA1

    486d2c724b0383ac5b47c3c37fefe04e7b93a776

    SHA256

    20c04e812f616a4f24be2faf80ef8223dbdc003802a78deff9a8e4d74bb212e3

    SHA512

    b617b8f3fdb72e54c3d920d5e93f43f9a59322f782da270db89e9096bdbb23921ccc892c883aebd5e3af1517b6edfe82839630d77443d6b5ae21534f57d53a5f

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\vk_swiftshader_icd.json

    Filesize

    106B

    MD5

    8642dd3a87e2de6e991fae08458e302b

    SHA1

    9c06735c31cec00600fd763a92f8112d085bd12a

    SHA256

    32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

    SHA512

    f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\7z-out\vulkan-1.dll

    Filesize

    576KB

    MD5

    ba5753aee688a2bd7b633bc83d6d7ca9

    SHA1

    34f1a439529eb6c68eafc2d979fba4222e443c9a

    SHA256

    d09df463fbe29088abd5fdee9cfc3ded0a8059992140d9167f9a1d987cf4c951

    SHA512

    e4ad3b866c08b70761788011919cb8741762a724d5d303103e50ee2443e18cfc9078c5901b2adbac9f5b34e3e0a2f677d092d06153d4932ad83fa7567a5d7de1

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\StdUtils.dll

    Filesize

    100KB

    MD5

    c6a6e03f77c313b267498515488c5740

    SHA1

    3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    SHA256

    b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    SHA512

    9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\System.dll

    Filesize

    12KB

    MD5

    0d7ad4f45dc6f5aa87f606d0331c6901

    SHA1

    48df0911f0484cbe2a8cdd5362140b63c41ee457

    SHA256

    3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    SHA512

    c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

  • C:\Users\Admin\AppData\Local\Temp\nsi6785.tmp\nsis7z.dll

    Filesize

    424KB

    MD5

    80e44ce4895304c6a3a831310fbf8cd0

    SHA1

    36bd49ae21c460be5753a904b4501f1abca53508

    SHA256

    b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

    SHA512

    c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

  • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • C:\Users\Admin\AppData\Roaming\Shaderium\Code Cache\js\index-dir\the-real-index

    Filesize

    48B

    MD5

    cd3226683181b6c6ff52bdd139c0c446

    SHA1

    4790c2e77b51db311b7503470b1582a7e918fc4d

    SHA256

    10591d864acb63bb929b02dec2d33a1dc727a16e8adc3c89bb99e62fb0d1b951

    SHA512

    e81ea73c432d6e66bb2dc0e29d42723a7aa324a240b038a699f12e4bf9c1ab48b7ad57016d3b479566bf40c8095f25da77c13a671b0f13b142ea31248a27b5b2

  • C:\Users\Admin\AppData\Roaming\Shaderium\Code Cache\js\index-dir\the-real-index

    Filesize

    240B

    MD5

    95e89826cd1713b682876a3c08e02bde

    SHA1

    bd0252d6acd5012d6bbaeb34bac8681c934742c2

    SHA256

    0088bab8c4f49838b1ed2685b4eaf3dc1549a3b6d0daa75d81cf0d063d14204e

    SHA512

    3de12e3ef19a9b9baef06e6b1666d448b9021caed7f01a16c077951d84f11bb7811b1c893f74f51e4d02b3c2a260f0d08f0066f349c2ec054531ff994d662e45

  • C:\Users\Admin\AppData\Roaming\Shaderium\DawnCache\data_0

    Filesize

    8KB

    MD5

    cf89d16bb9107c631daabf0c0ee58efb

    SHA1

    3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

    SHA256

    d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

    SHA512

    8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

  • C:\Users\Admin\AppData\Roaming\Shaderium\DawnCache\data_1

    Filesize

    264KB

    MD5

    022f83334f7257bf4ceb563940874182

    SHA1

    ae3949c0bf77756f8f3130e18135dfe4f3884549

    SHA256

    5adbe3e89e6739f09bcd520e3578b7e121003f430d35fdbb2bbb960e37f10a48

    SHA512

    87cb380321cbf524f6ad779ef295892035378beb8c91a3aa241720ebb9cc3a12584476a95eceeed77a69bd837931a920307e3740acf7ee78ba00349b3feef0da

  • C:\Users\Admin\AppData\Roaming\Shaderium\GPUCache\data_2

    Filesize

    8KB

    MD5

    0962291d6d367570bee5454721c17e11

    SHA1

    59d10a893ef321a706a9255176761366115bedcb

    SHA256

    ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

    SHA512

    f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

  • C:\Users\Admin\AppData\Roaming\Shaderium\GPUCache\data_3

    Filesize

    8KB

    MD5

    41876349cb12d6db992f1309f22df3f0

    SHA1

    5cf26b3420fc0302cd0a71e8d029739b8765be27

    SHA256

    e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

    SHA512

    e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

  • C:\Users\Admin\AppData\Roaming\Shaderium\Network\Network Persistent State

    Filesize

    2KB

    MD5

    b2902301865d6c6b90183f148f837376

    SHA1

    9cf19bb9b22a66f894ed2c44f9cb8c27bd5c36e5

    SHA256

    868bd5392b7443374842ad782e390a70b38083d0d98eb9242870d81e6675b16d

    SHA512

    8ad37972fbada6fd7d001254033f9fad20b311a21493b918c7cefe50517aa4df9e4ef3b4c86c5433698d0fffc14cd0c07f48719bfd5569dc5269ccd9d7a61826

  • C:\Users\Admin\AppData\Roaming\Shaderium\Network\Network Persistent State~RFe58ad33.TMP

    Filesize

    59B

    MD5

    2800881c775077e1c4b6e06bf4676de4

    SHA1

    2873631068c8b3b9495638c865915be822442c8b

    SHA256

    226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

    SHA512

    e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

  • C:\Users\Admin\AppData\Roaming\Shaderium\Network\TransportSecurity

    Filesize

    356B

    MD5

    39b8782dd7cb032e307d992882ed041e

    SHA1

    6a4d2996c090690bde78fa2e11b40c434e40c53b

    SHA256

    680ca0dfbfd3be3f449b45d91806de06de57d8ebfbd435afda88ebcf25ea888c

    SHA512

    f6ddcf6b716d725d8d93af229b65b9dc3cc4f437523716f730ea80acae9b7731e623ac253d75b202b21ba4a04d03768f0fd3c28b0aa8e1485a2409ccb2b20beb

  • C:\Users\Admin\AppData\Roaming\Shaderium\Network\TransportSecurity~RFe5820d1.TMP

    Filesize

    188B

    MD5

    78a4c5daa24d016d63ef451cc60dde95

    SHA1

    ad6358b7e37ac0a0d408fb3b1d2a3475eb8613bb

    SHA256

    35a76a57c9108c800b94194296ce44ab5ee2e6fd075b69d01a1849947cdaefe4

    SHA512

    fbc565b7156bf676872ba7d6230e35204f932b0492a42f3d137e863cfb59c83e00e7b0cf311ccd8f55b07ad207807e42d388d07a444f985bc33bfa170f499184

  • C:\Users\Admin\AppData\Roaming\Shaderium\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

    Filesize

    56B

    MD5

    ae1bccd6831ebfe5ad03b482ee266e4f

    SHA1

    01f4179f48f1af383b275d7ee338dd160b6f558a

    SHA256

    1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

    SHA512

    baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

  • C:\Users\Admin\AppData\Roaming\Shaderium\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe580664.TMP

    Filesize

    120B

    MD5

    649068e75d9ebff38e19c07d8d778cf6

    SHA1

    377972b790b603ae687ef3da7b50ca20c1f63ed1

    SHA256

    0eb285c0af80734bde9224d3530fc434b8d8ae593889fb4c3520045105acb6cd

    SHA512

    a52096a5bccb8c84a59aecfd14d27d7e6c2454e0fb9f2c7f9fbd550cadd646ec4285e360703b4d6ab0101d562b1a8229f4d529f92b7ab5b9fd761702210651dc

  • C:\Users\Admin\AppData\Roaming\Shaderium\Session Storage\CURRENT

    Filesize

    16B

    MD5

    46295cac801e5d4857d09837238a6394

    SHA1

    44e0fa1b517dbf802b18faf0785eeea6ac51594b

    SHA256

    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

    SHA512

    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

  • memory/968-553-0x0000020DFE600000-0x0000020DFE650000-memory.dmp

    Filesize

    320KB

  • memory/968-549-0x0000020DFE000000-0x0000020DFE022000-memory.dmp

    Filesize

    136KB

  • memory/968-551-0x0000020DFE040000-0x0000020DFE050000-memory.dmp

    Filesize

    64KB

  • memory/968-550-0x00007FFD07030000-0x00007FFD07AF1000-memory.dmp

    Filesize

    10.8MB

  • memory/968-552-0x0000020DFE040000-0x0000020DFE050000-memory.dmp

    Filesize

    64KB

  • memory/968-557-0x00007FFD07030000-0x00007FFD07AF1000-memory.dmp

    Filesize

    10.8MB

  • memory/2100-702-0x00007FFD26D10000-0x00007FFD26D11000-memory.dmp

    Filesize

    4KB

  • memory/2100-701-0x00007FFD26A80000-0x00007FFD26A81000-memory.dmp

    Filesize

    4KB

  • memory/3540-561-0x0000027526F70000-0x0000027526F80000-memory.dmp

    Filesize

    64KB

  • memory/3540-562-0x0000027526F70000-0x0000027526F80000-memory.dmp

    Filesize

    64KB

  • memory/3540-560-0x00007FFD07030000-0x00007FFD07AF1000-memory.dmp

    Filesize

    10.8MB

  • memory/3540-575-0x00007FFD07030000-0x00007FFD07AF1000-memory.dmp

    Filesize

    10.8MB