Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    331s
  • max time network
    336s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 19:30

General

  • Target

    MyGov.exe

  • Size

    68.8MB

  • MD5

    57ae702f9ccbe017404f9aa1eeb5b93a

  • SHA1

    6e0a9c83ce659571d62fe21053915d8c74dd7634

  • SHA256

    0ccf9d46633ad337dd31852311e9c4e7906c579af584a9eb77725360a6028ba5

  • SHA512

    befea9277259a64527f6c96fd907b9ebdff86f3387a2a7350c83c45ecdf227b8b594816209797eb1662224fcf1a7feb8b82edc6843a579580967236e1297caaf

  • SSDEEP

    1572864:7xsVMr+U67ndLM8D0XTCCvx96XG7q9Q+GhNVQRHXs+OyMdUR:7xs0mnCneCv7q9XVRMdUR

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 17 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MyGov.exe
    "C:\Users\Admin\AppData\Local\Temp\MyGov.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq MyGov5.exe" | %SYSTEMROOT%\System32\find.exe "MyGov5.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4040
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq MyGov5.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4384
      • C:\Windows\SysWOW64\find.exe
        C:\Windows\System32\find.exe "MyGov5.exe"
        3⤵
          PID:4892
    • C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\MyGov5.exe
      "C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\MyGov5.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3208
      • C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\MyGov5.exe
        "C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\MyGov5.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\MyGov5" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,2630617771693351567,6287076941046624023,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2836
      • C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\MyGov5.exe
        "C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\MyGov5.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\MyGov5" --mojo-platform-channel-handle=2060 --field-trial-handle=1756,i,2630617771693351567,6287076941046624023,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3068
      • C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\MyGov5.exe
        "C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\MyGov5.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MyGov5" --app-path="C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2316 --field-trial-handle=1756,i,2630617771693351567,6287076941046624023,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3648
      • C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\MyGov5.exe
        "C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\MyGov5.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\MyGov5" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2204 --field-trial-handle=1756,i,2630617771693351567,6287076941046624023,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        PID:3724

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Programs\mygov5_desktop_client\icudtl.dat

      Filesize

      10.2MB

      MD5

      e0f1ad85c0933ecce2e003a2c59ae726

      SHA1

      a8539fc5a233558edfa264a34f7af6187c3f0d4f

      SHA256

      f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb

      SHA512

      714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\LICENSE.electron.txt

      Filesize

      1KB

      MD5

      4d42118d35941e0f664dddbd83f633c5

      SHA1

      2b21ec5f20fe961d15f2b58efb1368e66d202e5c

      SHA256

      5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

      SHA512

      3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\LICENSES.chromium.html

      Filesize

      8.7MB

      MD5

      1ca87d8ee3ce9e9682547c4d9c9cb581

      SHA1

      d25b5b82c0b225719cc4ee318f776169b7f9af7a

      SHA256

      000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d

      SHA512

      ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\chrome_100_percent.pak

      Filesize

      163KB

      MD5

      4fc6564b727baa5fecf6bf3f6116cc64

      SHA1

      6ced7b16dc1abe862820dfe25f4fe7ead1d3f518

      SHA256

      b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb

      SHA512

      fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\chrome_200_percent.pak

      Filesize

      222KB

      MD5

      47668ac5038e68a565e0a9243df3c9e5

      SHA1

      38408f73501162d96757a72c63e41e78541c8e8e

      SHA256

      fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32

      SHA512

      5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\d3dcompiler_47.dll

      Filesize

      3.9MB

      MD5

      3b4647bcb9feb591c2c05d1a606ed988

      SHA1

      b42c59f96fb069fd49009dfd94550a7764e6c97c

      SHA256

      35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7

      SHA512

      00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\ffmpeg.dll

      Filesize

      2.4MB

      MD5

      fd6bc1ce74e00ef5f26da503cec352da

      SHA1

      10ca7b36eb48ac71772ea25a84f89231baf10e0c

      SHA256

      1bf14aa4ac17d419717f160fb7205df1fcd996a9367a6f326567dfdeb46cb36a

      SHA512

      46dccfb52518e5837830fd87ee54272e5c47db826c9978bd48f581af6f0b7ca49ad718b211b8d2ab0bb70f3ed94da55b21d89c1d76a767a158990bf4f467bce5

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\libEGL.dll

      Filesize

      359KB

      MD5

      d2b7a6281f42257e5bdf6b391a30403a

      SHA1

      9652c8735a04ff98508201e6c64b7119c5a23847

      SHA256

      09770541273f806e4dfd1699d8867bc75f5a9a4434fa63afd989df21e5403012

      SHA512

      aa545e1703cbb725cea52ca95c2b408a8863c692c273e9fd93c6dd9a71507bec91143b0d3ddd33c1e41d4cba25f2d75a6de14c6f97c0cc215e055d5bdd11ed36

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\libGLESv2.dll

      Filesize

      6.4MB

      MD5

      e2e71b573f3c4b847cdc17547a4a3e60

      SHA1

      948b4a027498efd4cc756fabb13f57bb44925a72

      SHA256

      0f95fbbabec744899c42cb5e005fbff07f99dddfd559972d42ae2ecf28a5e666

      SHA512

      44d4eae42dd936b2b698b5abf3b66524f2ebdde2a595317d629b0176201c907ad2a3e37397e51973d25f4e066c616df9c938710e02cd53d86069350d7daf63a6

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\af.pak

      Filesize

      464KB

      MD5

      862a2262d0e36414abbae1d9df0c7335

      SHA1

      605438a96645b9771a6550a649cddbb216a3a5b1

      SHA256

      57670eae6d1871e648ad6148125ee82d08575bec5b323459fc14c3831570774a

      SHA512

      a789a4cad72106a5c64d27709b129c4ae6284076f147b7c3fcb808b557a3468b4efe3ede28033f981335d5eab986532c0497ddd6ed24b76189fe49366692ee73

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\am.pak

      Filesize

      756KB

      MD5

      4eaa15771058480f5c574730c6bf4090

      SHA1

      2b0322aae5a0927935062ea89bd8bd129fa77961

      SHA256

      b05dcb8136751aee5eced680a5bad935e386bfce657dd283d3ec00ee722fd740

      SHA512

      b67e7dd24eadc91d4cd920f8864cfb23a9c67b2cecd54ec97e01705636604ce504dc417d6af1c53f374b58eddf71a12bb82248bd8fd68307161d4833342681a9

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\ar.pak

      Filesize

      829KB

      MD5

      f529e644ac3f062283d68e65241a54bb

      SHA1

      b36ff7369cf2c68fcc93dbfb4b36e6c90748323b

      SHA256

      7b6d035dcf6cf17ed7dbf055eaa6d1b2cf39c1d18743a540622602c3462bc919

      SHA512

      dc7f609b9061617fb425dd3000c54c5e52be8bf49df6c64df6384ef54232244418cbb78f3f9bb7764de95199cfa1c84908a6bbc65df1ece1de7e626dc99c6f4c

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\bg.pak

      Filesize

      861KB

      MD5

      0e8005b17ac49f50fb60f116f822840d

      SHA1

      f2486da277de22e5741356f8e73e60b7a7492510

      SHA256

      50e4f6b9c387adf4baba3377c61d99326cc3987928d8d60b88d1ac29352820ea

      SHA512

      5df18bbeabd56e70d4c5a80dee5b7ce48259000665941634937e556e3b3a1c6403aa45c410f6f755607549c9dd35d722987b447c50efca51228ffeca4628756d

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\bn.pak

      Filesize

      1.1MB

      MD5

      c8173f0cc63ca9e02c07abec94892b53

      SHA1

      2688b199cc40bb2082247fa451eac1304608e48b

      SHA256

      e6adcfb4f3b3bccd4a27edadc168b503c36551cd6b27fb24043efeb21f691ce5

      SHA512

      3d2317430722dc15c5d938fa55235af1caa03dcff7a574b44d37d89e7cf2c94dd2e84518b3eeca4a5a8dbec1b99d94aed97429aaf55c63998002d50ce9cb5019

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\ca.pak

      Filesize

      524KB

      MD5

      9e3ea2baf7e6c6101fb6b5b92c797bdb

      SHA1

      c181dcd37141d955d85be56e3e08d37c17feaacc

      SHA256

      b4efc6026115b7fac9f6b9cd360dfdd570cb5a16faf38d549fcad2b80e5f1fd2

      SHA512

      90e9609764847285d82894b3c4d98496fb9002c0cecae092e71b7d43d8871bd1463898d82b6a65a530ba76ecf403a30a01485f2f16e376a773f6fdf8f302e402

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\cs.pak

      Filesize

      539KB

      MD5

      70f320d38d249b48091786bd81343afc

      SHA1

      367decdcdad33369250af741b45bdc2ca3b41ab3

      SHA256

      1c9448ea3aefce1a7e1491e73af91af772d8b22d538676a2beab690558e668fa

      SHA512

      02b08ed9261fd021e367995551defaf4b4f54c357409a362f4d2470423644913375cac444f62153ec2963a84880a30a36f827dbfacdd76a6222838c276cf5082

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\da.pak

      Filesize

      487KB

      MD5

      f50d22a2b8b479d4b93b4ab57f3d9e48

      SHA1

      fda4217cb08139ac86dda33c1fd82fa8e1278916

      SHA256

      944ce6be74e1eb3605d1a5ef56666426a94bcd0749a0981de6337f5c65f5203e

      SHA512

      365bfe4de01a8b4e38ba376ed8fb26d74495c76f73ad927fa6ea24d696c03a793a6f3d1d36672d0292c232f36e2620acf3f0f98f3ec311ea901822d3af1c43ea

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\de.pak

      Filesize

      521KB

      MD5

      6ef50371a2467f6917f62266412a93df

      SHA1

      5435f819923e358361fcc44b61984646bf985fe6

      SHA256

      a0a0ff4d65a2253f0cf7af2894e74df4e05e1fbb3489e647c1ecf2578d660f19

      SHA512

      f4f557589e50774ec8af4b8b0647cf6e09c5decba1ace9ea074f9cf291772039243b0f66af79cd041e1837deca0e2d4f5371715a2ab7ee740b4d016eceaafe81

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\el.pak

      Filesize

      944KB

      MD5

      16bcd10bc81dd8a5b3ad76c90cfb9614

      SHA1

      240395860971fb9205d28602d4d4995007ee5c75

      SHA256

      6a06d1d6b566214f7c3b693052beec488f7aae5ceeca26781a5d66fade39388b

      SHA512

      353a26b21848f4dd30b3aa1f4196b23571e177893ec6912db4570493664ed987e688fd66c04e509ecc58233476ebe59453260bc3569136f275fcd681ae54a174

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\en-GB.pak

      Filesize

      424KB

      MD5

      65a60c82a8cf28b637a280c9c0de52db

      SHA1

      1f4bd7f2a41014a97f08e487c9f2e048b2417322

      SHA256

      42080ecd3f551e53bd1542f1c7f6cc3c178fdad53765f0666e2a5ff6304db48b

      SHA512

      3364e5242af731e7fd0e36e3622a8b86574ebce81d166218684e357f8e75b092af517fb97b021885388e920bc988ee0782755a03183dd103277a669a9a51c5d2

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\en-US.pak

      Filesize

      428KB

      MD5

      809b600d2ee9e32b0b9b586a74683e39

      SHA1

      99d670c66d1f4d17a636f6d4edc54ad82f551e53

      SHA256

      0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb

      SHA512

      9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\es-419.pak

      Filesize

      515KB

      MD5

      f9e9744ea1b2fc5fccd28ca861ecb7f7

      SHA1

      70d965a872e2adf63bdeb9538e9d1a92f3e4918f

      SHA256

      4caafeb7ca914904185c9d0d81abb801d71a91e330ba4c4d4e8efec62f5c4dfd

      SHA512

      07127ee4857225f7f66f855c65edd7de398f338cdb2917104c9df302a39fa6ef103aad872d9bb71d14cf4d692a78aff7288d78d4cdb548f722bbfdd3ec0d3d5f

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\es.pak

      Filesize

      515KB

      MD5

      19d80d10df56c695017cb22dbe3fcb0d

      SHA1

      fb2b978686400b1faad45847fab7f6fd30eeb994

      SHA256

      a8fa45cc4483bf386ee688b8c81e2b325d8a14645024a8d3f44714fa5b963ea0

      SHA512

      a33cb90524a6e5e907101a557be977536b00e2a83dae57139c84434012d6466a40466a387e80c1980a9f226b905e3d09c87b7dca216364683ddebd29203b2982

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\et.pak

      Filesize

      468KB

      MD5

      b8bae8d2a3f3b096a350bd77ea8e77ed

      SHA1

      3876d03600865d6943e4810eb5db6e005e250105

      SHA256

      9e45ac59e1b0b92e34f20bad3a49d77a249fe452a530566cde3fc2cbae943b0b

      SHA512

      aa5c451873af1c594f3f997a0dd165c50db54b2c7dd96f46208ba92fac3cb980903f6209d4c7d2ab9b184b0d366e4a37390373d7e31e87f9ec894a1f8f090e87

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\fa.pak

      Filesize

      767KB

      MD5

      3ec4a63a98a02bc81197eb87d5ffd0ff

      SHA1

      fab230190b4b7a7d60724b2e80a629d35ec95a59

      SHA256

      6fb81304d2fd771808cdfb012a20516717658d9f9823f5302503d39bf7e28220

      SHA512

      4585808b92dcdb9ff7cac836a5a0b914c7badc433a3ce361de5bb9ab669c8079fda1ec006a67360a1163678c2dcee77a46334bbe10cf043aa624361d687753c8

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\fi.pak

      Filesize

      478KB

      MD5

      a1af3eb1d0288e0d6ec0b65eafe2b662

      SHA1

      0a1515275fd6d9300046779b5862d94cf9505ab2

      SHA256

      ff53d982a01e8dfe175e4af7aab512964fe5996ef6b13400c6634e4b01e3fbea

      SHA512

      538263705f9a70e9a5ce80171d256edc487cb1a629f4a56b7383d296c6fdb85d2bd7a26e84593f8d4c00d47f41ba837357ec69df084258fd57d98c6fec67486e

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\fil.pak

      Filesize

      541KB

      MD5

      cbb431da002cc8b3be6e9fe546cd9543

      SHA1

      19fbf2715098fc9f8faba1ac3b805e6680bbcca4

      SHA256

      ab107369d45e105a4cb4f2f6bc8da2a8c1b6c65d5e94a7ab3e703e619c083dae

      SHA512

      3cabbfd021e5814587dad266c4f5c9f624e9d9278f22658dafd65ff2ad2bdc5f6df8a8672614b296cea826819211e12f8e77f183007c0a79075e2f0980b99911

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\fr.pak

      Filesize

      559KB

      MD5

      03cd2eef25e46f3e0f6ace6c7995ee54

      SHA1

      2e97b42041433fcc27de1cb399f2631e2c9b7560

      SHA256

      bb706206a7f8ae0b03c6fe5c734c798e3e23190707ac474eed53ce0b15f58507

      SHA512

      a22742811ec4483f8f302b6d72aaac44bf3c4ff1d7eed04c192715329019e4f4e77cd84a11af8a56a8df5293e78418a8e75d88f0a4661c884ea75a9e6b2e67d8

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\gu.pak

      Filesize

      1.1MB

      MD5

      a9e6d8e291ffec28551fccf4d1b06896

      SHA1

      adc9784433fbf2ee89bcfe05baea21beb1820570

      SHA256

      716ea0433e19edb5113dc8a25ae67c2587bc17c7fb63a93ac473bdcef8f72d34

      SHA512

      3a60002dc6a9008cac78bbc050fc36d1053bfbd21ecf4d0579b2780985d4e7a7aec94483d8b0b8dd7a899b8435d54a27bba68917a23945431183eda021722697

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\he.pak

      Filesize

      672KB

      MD5

      4958ab72f72195a86617e51cf583bddd

      SHA1

      8ceb9955f90ad3a948a23b31b01608cee41b7577

      SHA256

      25c090842584905842dea419798774eb4c22ea5e6cfbce6021396c9b742edada

      SHA512

      b1a23a461da674fb85ea8c1a535c0ca240b91d910b97289d91beefcb4f8364c41398a0aceba0c9edfe97aa7d0ec1ef2d2d20c223932864fed4bc57061f530724

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\hi.pak

      Filesize

      1.1MB

      MD5

      b841c49767097065ed39966c9819fa90

      SHA1

      defd854046b36767640d5f65bfe16ac9d738221d

      SHA256

      77f5e5c53e63126ff7fcdd0a7da8d09af98af93b61f7c343e06c4b86a25e5271

      SHA512

      f6e23e4be8bb0e4318f8f1d02050f75625b7ca61d0f8b055b2d95722e2eeebc3c520fcad2798f0f88925096b1ee17491d64c650cf1a52508b4db380d3c6fb35e

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\hr.pak

      Filesize

      521KB

      MD5

      86745d197b1be347efd6377929e4792d

      SHA1

      182031c4a984fb1b6486b5525d26dd21e74e9b78

      SHA256

      742b1483adf47b86d95296817b4874b63119a5885d396bcbfbe061c8fbf8056c

      SHA512

      62567bcf626000359447a47be8c8c28b05f5ffd55d52716d264d9373408f81e158b6d8059eb1df2bdaca5141d692af417c5ae34a1f1f5a103ef4a59b4ef2651b

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\hu.pak

      Filesize

      561KB

      MD5

      c65b2136a7fd786c2721fb3f388b159b

      SHA1

      d8c9d1d4a4198cb913477469bc0dc692a57e1e93

      SHA256

      75966f97ba3b4f4a3d089f65a6a23ca20dc767ce62848d01977e38a383edae08

      SHA512

      757f51644040083467df66c9a91926875056ffa10d3fd4a4cbd95bf47c1ad42e9f370d2f7fd7b70d046e9cdbeabb86db8dff8b073dc3f41af35eadb89bb6f10c

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\id.pak

      Filesize

      462KB

      MD5

      c640796c2b98411759320b9092a5c898

      SHA1

      e8929646cfbbef821bd5b8faffc13aafb29e23ae

      SHA256

      23d2be475fc8e98422e160e50d9245f601749df24e5f09b352853e0a15985916

      SHA512

      dec282ec1ce8c129715afdf862ac065608409cf148bf394a29df0ed7f5898b602c3c9b0f9da6e26a46f637c5da73bbfe2708715868809328a6108aae2ef974d5

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\it.pak

      Filesize

      509KB

      MD5

      f7b37bd87ffcb672373ae5ad067b195a

      SHA1

      74420317ca4ab2b92559d6fdeefe551f5c3e825e

      SHA256

      528680be954b25ee0bb5bcd9830edb3974ff3e62779520ed4a24553273f4a81b

      SHA512

      0d60f9cba087fd8791313dec48835db7e4b934e2f4c7a890f5985fc190c35fb13a6e9eafcd77f6d38f709ee487773878a32bcbaf6b4fb33f68ce0248a853469a

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\ja.pak

      Filesize

      622KB

      MD5

      2375d060aed81cffd56701ce0bb32e61

      SHA1

      b9bc899b67034018e6e2c690ac4f8454a9c75311

      SHA256

      0644ec929b7f7a4afde3ecbf07d6808d7493923d8c39f7d1c8082b97443bcff7

      SHA512

      3b6b2999223d3a95621bb5e1a325c650a4efcd84d9d4aba0275d9c4d22a2a414d43060aa267aa9acb78d5345905dd79adadc5cf96600166621c0fda980182064

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\kn.pak

      Filesize

      1.2MB

      MD5

      293f88ac75ca3f990d29653592845042

      SHA1

      d3b21856ad6be4d00a6a1e4a760adec82e40ea6b

      SHA256

      8433e5fb1aa16d6f864171fbaf18f8a020c143d898b99f032081c486595adb50

      SHA512

      67c03d441fef8a228ec0c8e0c95da8c3138523a2c9e4222d3676c28fe821d5b13b3d754e280e899ff8d73c4a7223a4dba3a5d247c601a3c0652455bac1f9e2ab

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\ko.pak

      Filesize

      526KB

      MD5

      36500ebc236ece05eff6f9f43bea897a

      SHA1

      9c9f32fd046799580950c900c2ac3834c3698bf1

      SHA256

      b53f396e0c2d16cb459c7b14025e76e0f675f1e3c814c822bd46c2e9dc8369e1

      SHA512

      c91ed7217610f9f4f69006d926495705e7e9ac1509dc201e3a15f41f20159a67019d54f5da2f5d4b201346330dde1c27f71faea122f1516086a205fd906e86d9

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\lt.pak

      Filesize

      564KB

      MD5

      edb2c872a4fec5367cbe68035ef0ecc7

      SHA1

      b4d42bcc83c98dda1ea2ef962d097f6fb3d25c71

      SHA256

      1bd385b780f3d13d41f8cf782a322e37be889aee273ffde3d8959e0ebcaabd0b

      SHA512

      dd801a1aac2242e3f532e968b4c9639a2c8bf3eccc17470d9aa8bd6730ae4be3e7276fb782c7908bb6f87d3ade20a40c644b9db5d2201d96d91fd95ebdf429c9

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\lv.pak

      Filesize

      564KB

      MD5

      393c296fabe0c4c64a7d6b576d7d2cf7

      SHA1

      16c0605e5829cde9738e1cd3344a59b74fa1f819

      SHA256

      91642c04de64f88a5c49b4eeaf5d627554e60d56fc40e7cd58cd2601b0d3dbf2

      SHA512

      067cccb059d4526c104880a26ebf04c7e2498c49c5641abdc91785e859bc0be1475ec58cae9ad1eb076f26fb9215ac246155e123baa13c06a05e4f22a002c2ad

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\ml.pak

      Filesize

      1.3MB

      MD5

      b690b0f01954735e1bcea9c2fb2ac4e4

      SHA1

      8d98860e202b15a712822322058e80a06c471bb8

      SHA256

      83d187cd70048f4129fa65ba148c74a04a47ee1f14218e7c85b36fe83e87b5e3

      SHA512

      786f08019a0917d0b3f29aa2d1885db6a6f995990fd8faaf41a9630f8347b4d210a844cc6690a41b4af37d60e11f41fd2675df1a01bab5915e20cd9bc69b4541

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\mr.pak

      Filesize

      1.0MB

      MD5

      378f29b8282d7344dcd938dc9f972604

      SHA1

      f453f175626250af4605548ae16163b7fd27c483

      SHA256

      3d10d4d40802285f4be0d7f5ebca43aef2645b66f5afc36cf4f11e9e06510776

      SHA512

      d29125b09b73123957ab00df7500a18c4e08154ddc4f57ee8e9780928b3d31a18c9ad659dd3543fd8d5cf41678f7f1afbd15b8c89b4dc1a87a1f05fd3800f1c5

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\ms.pak

      Filesize

      484KB

      MD5

      a269d94587a15e93e5c6da6549821110

      SHA1

      f88995624f8b044858f035cc05fd9b3308d40397

      SHA256

      f27b9f0cf0007d874d3065d17a53fcccd6c3be9bfa83b48219d43515c4884130

      SHA512

      5913627840de05ff8887bd6eb265066fde79dc34d26ec073aabba4f0fc7e605386e1e6b188c1b1374865c0457ce888883cced3614acd76d88741d8c779f01d87

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\nb.pak

      Filesize

      471KB

      MD5

      bf9bfdfab1479bb52254329d7aa229ff

      SHA1

      cd9ff35321731b839ea6e5f31f5de0bfb475666b

      SHA256

      96747543d9b2dbfb4482d4c24d7818d366545b2476633ad4fec8cc958ab760d3

      SHA512

      ba8e62d0a87c532ff46f2129724dd2f1bfdebd99c2606e0b9608cd07841776faeca15d04ec6241020c232d4c07809d718f40cf4ad9231d6a8996d55973486629

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\nl.pak

      Filesize

      484KB

      MD5

      52833e5c4c6608c7ba08f1698fb31206

      SHA1

      27804ef492bbc644f027bdb95836354054f1497d

      SHA256

      ab326437ed144590f84e9b7c2c38f9de44f85c5afefc084fb80ea92b773fc2ae

      SHA512

      738edf9c686c8267799a9781e6b96c1e38e0a372c5a63dd6e9034bdc9f37c69032b8d466245ccde7b19515a7c7ab654399f27cb2bdc44da556206a1ad29fe113

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\pl.pak

      Filesize

      543KB

      MD5

      8cfa8fb3d4ddaf33e86477e4f986e4fe

      SHA1

      a79e0dcb7c86e72390ba674d0a017f124604df95

      SHA256

      7be59c235d1a195491d4721de7bbee3aaa8473afd949b19625d274d5d94d0cfd

      SHA512

      c7fc8650233a673e9f095fefc256762d9e6326bab78285a6dc9224fa47aa71bd0c3ab3438231d28891527f3c137d93c86c6e9e9b55c5fdf184aae768f2b59925

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\pt-BR.pak

      Filesize

      511KB

      MD5

      d5e6233818389c0a6ffc8dd2e0a73318

      SHA1

      cf0fe8ac0be35566b75fd07fac4e5d49c8d36fb2

      SHA256

      6c0e879b0747847fd5026cb78f3c3ce1b2bad548ae36ab5a5daee02145994bb8

      SHA512

      ca9f98f7b5755ceea311d4990007ed53d5d8d6072755e96cf45263c847af5b23c35bb5c3179c0174d2590b52459bb623ee27873d31f923d287caf0b59221a222

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\pt-PT.pak

      Filesize

      512KB

      MD5

      134c49a617b734b4b63e007528dddddf

      SHA1

      08a4722645dbca509a3a8c55c31efbe1e878b139

      SHA256

      ecbd217a2ac71bf33416760b7b3e510361b6f5f89251836d8e019f9c4b21a058

      SHA512

      bdb9135de9dc02de2dff6de8e08e440db77290f55cf44cb2014a842748e9510f32b5971602137633d4570d049aae119c2e06baadbaadf444362d9f7cadaa23c2

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\ro.pak

      Filesize

      531KB

      MD5

      938e62fca60d7b54e9c54cdd1f745f06

      SHA1

      5a61a1ef3ae855ff436c5d7f45b6ec271a5228aa

      SHA256

      82e69f505222125ea62f8e90d8030d82a1bd49871192cb4274a8fd9d0e03d577

      SHA512

      d3f43881fc951c961cfb34babaa6eba2aa9175865dc07542dc529ab1c11d15703c03a7e8193c004b004d13f0a0672bccb2fcdd1cd88f32add159c337281d6d5f

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\ru.pak

      Filesize

      872KB

      MD5

      bb85d5b39356569ae8f8a7d32a25892f

      SHA1

      6a324070cc7ca2db8a707b825ba502701386b81d

      SHA256

      b2a561f8892248b58b13a9954468f0ec21c89ce0286290d51681575d17e64157

      SHA512

      6999ac65f770cc34417033cd98b96e47e796d003d16693d0d1423ccbd23f918dd3ae50b2709cf9937ab058b4412baff32af71573d053e84d5180423572400876

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\sk.pak

      Filesize

      548KB

      MD5

      6b61db7fcfc28dd532d571dca009412b

      SHA1

      eb53fcbd2b75b5f899a520ae9d5d08c07ae73165

      SHA256

      214d1b4d9ba67f6ac350b75be4b7744ee6c48b7af66477b5d91ad9a634d68f0d

      SHA512

      05041fbf0ba870a45406b26b6759abdc25726685b9ecddb37edf1721a7ce8b4534da3930d23beba36e55e9adeb983a5fc2add2c7e52991289975375802fb9597

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\sl.pak

      Filesize

      526KB

      MD5

      200eae7da258f3693022068ddbdc4f59

      SHA1

      57e4d82b26397961910120bb985cd39dd33bb5f4

      SHA256

      f8a28ca2c19ae8d3dc798f659ef06e42ab442018ac5ae572f4ed0c9630ab7274

      SHA512

      c0dcadabaf98d9c2ba0d9070de932d181f5a458d6c4c685a051fedeefe88967554a78fd4ebc26c18e697cde14e5b5cf624adbf08391af4740fb1f0a9523b495d

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\sr.pak

      Filesize

      811KB

      MD5

      5d70a218b7dcccab0406fa9239ef800b

      SHA1

      cd231758f84a0d56545d0a234a58757a18a58d0c

      SHA256

      a2bc6b064ff1f7b15707f61bd76ddd9d889bd982c4182e9e74272d39c6235c85

      SHA512

      ef6f71e0d9782b5ed6706d9226c1a7fb5a4323b8dc8de25737c7dcca87d04c16b545372127670de312079be993823f565de1aaaf5ad833bec5baa0856c19b0f3

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\sv.pak

      Filesize

      473KB

      MD5

      1c7593ace08332b76cbdba33d5429891

      SHA1

      362b038dba2dc47fe6224b2337bd9c93bfea5173

      SHA256

      6cf1e6fdf971efe5df86bdbccc3b1bf019563d0187c718d6cd8a552d51ffc0f4

      SHA512

      33a2015029cdc45daf9d498b410e0e9b1323d9c19e192efb29c3bbf4cd6b11b651032f7c5272031a2fadddf6b7b5b99f10fc040422452204e96e76e7dc0e1f5d

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\sw.pak

      Filesize

      498KB

      MD5

      9808a9df2da0844b1ce1a2a4213c48d0

      SHA1

      541f24f006ddb3361ff1e5015f097ab799120fc4

      SHA256

      1949953d638f266ce74d84c020174c074780166b880e7c2ec38bc6047bbb8ecc

      SHA512

      66b256e02ce11ea0273cc5bfa78e56faf8b250208d1e868bf4af77cbefd1c891708573d63873a5d02436f884544a6550176afcd3a8220cd35d64b88987e94404

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\ta.pak

      Filesize

      1.3MB

      MD5

      d50aa6815b63aff8c443622cb8bfd849

      SHA1

      fd247855e6e428109e7bf2e0018580cc6e0663c8

      SHA256

      6348cc2d385b9808fdf1b815914dbfb26f552da4d10f85b2613a5e6e9f95b8fa

      SHA512

      620e2f9ab9998c68d667e32ad9bbfa2569f7a60fbc2a67d7492c6c215af2a1037708e38b4ed7932074d29a140581fe0ffedddb362133a941966044b98eaa50db

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\te.pak

      Filesize

      1.2MB

      MD5

      d1429c1d2a5d17dffbd239dbe552a08b

      SHA1

      41fa775005c516e4a9683540bacd3f8c80f430ce

      SHA256

      ffc3c1066dd722f4a50ff73d6ceb487c4e804d542f4816e213d6d3db933f06c5

      SHA512

      5149a430ead0deac7a2c51fdb1aca3a0727162f4a406250289f00126dc14320b949c55656bf2f20aa8e0ac37e7cf1b0c44af1947b74c1189ce37ced21fa22ee5

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\th.pak

      Filesize

      1003KB

      MD5

      afe6fc0f7da67450b9ac750b396eb118

      SHA1

      6ef621f50a9e4e5905641ef4972cc3c3a1301f69

      SHA256

      05efbe80e86282c83b83ee48adbd472c07c566f00e48d057c4824d310b8aabc9

      SHA512

      1438193da865642c1da0b9f67641a4e5be0b8d5ae80e77e87e618625604b9d0fc2f34c3a6089967f38fee265791e48df39ad00e9ea706c0f4cbd318a0c5dd6b3

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\tr.pak

      Filesize

      509KB

      MD5

      afa120ebb9751f0a0ea8fc7c2715b983

      SHA1

      6be5085131b734b8afd2ef49d4c0a03457a118ff

      SHA256

      ec33033d23059660ab5b0d3c07e977e92bce91831a3cce562fae25b4c99890f4

      SHA512

      1082c5089678af44d0386e62d42a8391ba62d3b746146780ef2c09ff2e1a87276f599ffe8ed679f7ebe1795f7f3a872a4a90af239d33dc63ad233cee565d3a5d

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\uk.pak

      Filesize

      870KB

      MD5

      d44cb8a32dadf19f118ed27c4f22093d

      SHA1

      68503901a263652c24e29fdb0b67fa0f8e58759d

      SHA256

      efd0b7b8ca41f84f96ef4366ac52715b2126ddeb8f1c195e3aad62e3ff8b5636

      SHA512

      027f6717ddd3b02444364ca6c497cb5611f065efd57d99d715bb566cfc960fffdf087be1c70169ecf1d7cf81d11b9450ccad6c3f3f56084a5d6c9a76fca3fc9c

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\ur.pak

      Filesize

      761KB

      MD5

      29403f3d5c8f6ae2a768de2fbe8b368e

      SHA1

      da83015565980ea1a24f5493be6311f06427269e

      SHA256

      2520ba8471c840aa075075524c4ad2bde10f43fa7a1b623aa14555180ecd30ef

      SHA512

      a0709280adec39633ca19daf9f8bac6c17a999101246778a63cd9e172dbea2f281b20ce197290c4af6c7601ee7956da42f17e31461a1bd8b8a4bce3c36dc87b7

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\vi.pak

      Filesize

      602KB

      MD5

      09e79edd28d43f1a496871e8260c581f

      SHA1

      9c2457177f8012aae04f3c776ae0d99ffd10711f

      SHA256

      0b33f69fc2ffada0d2fa6e8ccec271d3bf773e88d402afc5c08fea0535d8cb9d

      SHA512

      2fc1370521b5d1258d2fa462591fed649952b5fd4627486fa4fa9f755d1368545305db096960cca76fe8583107e34667ec0338ed6d76d738d3755b2e2fc15e3e

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\zh-CN.pak

      Filesize

      435KB

      MD5

      c150a465b1e77aadd767a5b6049c4b0d

      SHA1

      06ad388f50d03a9643ddb8750158fa8ac479ee07

      SHA256

      ffdb626f59adcfcd0e206bc4c02fb4255374428762832ffbe8d323557bdf22fc

      SHA512

      cfcebcf74cbd3c8908deb2395e93bb0fb699be9e3885dae43601faf6c73da68cd6074f671419452379155450c4fe7f9f351a938571f0e0e85a6507fb990b042b

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\locales\zh-TW.pak

      Filesize

      430KB

      MD5

      09bd1bc0df2b220de8cf6f4da42f6a8a

      SHA1

      4ee3ae66927243e945c3ddab8500dda709d7246b

      SHA256

      1bcfb95540fb203eee77f6d40329ae5573644f4c6db68518ad5f8222fb6ab4ff

      SHA512

      5dd50370e57f35061c98b4f336924097e9849bd057d1b5f529852c8650149a1585fb471569b86bdeac0790a97cc8061f837f8eb928a07c5150e985a05fa55ee5

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\resources.pak

      Filesize

      5.1MB

      MD5

      b7df07d95b56a4a5802b53486e112aff

      SHA1

      3bd90c21fddda08906e43fcdf2b487335d19565c

      SHA256

      b2ce659c78ebbe7e6e5a756279afed30d11ff0628fff3628f30cdc2244ade5af

      SHA512

      eac384e7ebfca933d73c2a5a2a4285f377e0d3fd7d7c6b40bb6373cdb3e69a01064f158244b77344dabf484097c9b9185847fd2043acff8360c02805dd349d5a

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\resources\app-update.yml

      Filesize

      119B

      MD5

      e68f854871732fce99f64af1ddd234e3

      SHA1

      368977c7789fa850efa1c898763211bd4e9e8cec

      SHA256

      c4b2bbc921f52cd0f40706c784f56d2fa623122ace816f241ec2448679b26874

      SHA512

      0a86777ee419b20cd088b64ee8e0648026a731ebcaef10b62e014b540c63257c2473d87b90cda085e6c9d79ee217d207ce0807bd38622863aaf55339cda29106

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\resources\app.asar

      Filesize

      1.9MB

      MD5

      854b377733f6c474e701d6ae905eae2f

      SHA1

      667dd628de967eb53fcd517d697498a870cd3a3d

      SHA256

      4b293fe8ba951c0a5a467a0a75188182051b3383ba24b92ca160cc322efe2c30

      SHA512

      8982af44161c3ee982d5ae5b8d01723466521e1874edeb823eae69385e66b93e2d95675f4467b8c77d1b04888faef99a8890ac61df94e0571f1b0edd1db44b5c

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\resources\elevate.exe

      Filesize

      105KB

      MD5

      792b92c8ad13c46f27c7ced0810694df

      SHA1

      d8d449b92de20a57df722df46435ba4553ecc802

      SHA256

      9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

      SHA512

      6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\snapshot_blob.bin

      Filesize

      278KB

      MD5

      de65de798cb44ffa9a7e6b8ca709857e

      SHA1

      2805782c1a9fd670f14f4a329fa1dcb420df53c8

      SHA256

      972ac6ad95a0b15a5319ea5385d8c04140558a3994dbe569682cb397e0fe0f38

      SHA512

      16c0958c0f271c68051355f2d2fbb3f0b9e58e189de78a2824a79056ded63fa0a6945d9397f4a9fd11b75892abafb22ea4d23f46b5c1b5823f50ac01a008ca08

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\v8_context_snapshot.bin

      Filesize

      631KB

      MD5

      99bf029c18eecd0f822db6eb458dbaec

      SHA1

      aa4a6dffa9b64e79beb49b32b98c7aa74233b410

      SHA256

      b7652f350d3c6058baa9c88fdf06fe7499e8a62df722b1ea8783213bdf206ae8

      SHA512

      efb3cc8b994f00ffdf51e7e5c68426d56e929e94848ffe32b9e54377cfac1612d970a0bad963e419cf1fafd01c722e5deafde19465a9e21957ca183e3735e9d8

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\vk_swiftshader.dll

      Filesize

      4.4MB

      MD5

      01c646bf37c78de2406fa234b8f834fa

      SHA1

      43cef655048bc72247d62549dcc8daaef11443b6

      SHA256

      31e67930ecde2a13767d7b2a292dfd206d6b091b5f4bbab351fda7683ad60cf8

      SHA512

      dce374d42ed44ee3dd0bf04c9b6a34527a16a8e020e3d1067d1c0a3da57eac37497fb997fb721e0b713287123550c6169342315b0eed373eff8ff1a9c6259407

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\vk_swiftshader_icd.json

      Filesize

      106B

      MD5

      8642dd3a87e2de6e991fae08458e302b

      SHA1

      9c06735c31cec00600fd763a92f8112d085bd12a

      SHA256

      32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

      SHA512

      f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\7z-out\vulkan-1.dll

      Filesize

      803KB

      MD5

      4259b923946dc1290de39126a80fd09a

      SHA1

      6d109ab94fad49bff3dfd5985a52670a16776e04

      SHA256

      9c53f33f845b641569893333628fa9c51743e60aa4b6a153c83ab15b1e372907

      SHA512

      dcb613d7e3b533b4175547aa640a8d8f11c7ec97963ff43af2e2aca900b980c33e756ab7f3c94c307027dae05b2af56294118c5f300759b4a53da82f044c7ee1

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\SpiderBanner.dll

      Filesize

      9KB

      MD5

      17309e33b596ba3a5693b4d3e85cf8d7

      SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

      SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

      SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\StdUtils.dll

      Filesize

      100KB

      MD5

      c6a6e03f77c313b267498515488c5740

      SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

      SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

      SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\System.dll

      Filesize

      12KB

      MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

      SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

      SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

      SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\WinShell.dll

      Filesize

      3KB

      MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

      SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

      SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

      SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\nsExec.dll

      Filesize

      6KB

      MD5

      ec0504e6b8a11d5aad43b296beeb84b2

      SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

      SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

      SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\nsis7z.dll

      Filesize

      424KB

      MD5

      80e44ce4895304c6a3a831310fbf8cd0

      SHA1

      36bd49ae21c460be5753a904b4501f1abca53508

      SHA256

      b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

      SHA512

      c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

    • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Roaming\MyGov5\Code Cache\js\index-dir\the-real-index

      Filesize

      384B

      MD5

      5b5d5b144815766d92cf6098bc45debe

      SHA1

      213293ea5c13495da7658650dc7c2193ebab6fdb

      SHA256

      1bb5cee3a336ff8a9b36d6b12ccaef668130e067a495a59c808ff9443de0d158

      SHA512

      1c7cc1d3b1532c68e998aa95302facba2477150b32169e978687d882a6a3d631163614527063211a727c13e9e6e7222df720e3ab927cfc790e18378b5469e481

    • C:\Users\Admin\AppData\Roaming\MyGov5\Code Cache\js\index-dir\the-real-index

      Filesize

      48B

      MD5

      2e9c0527386bbd73a96282ae027952e0

      SHA1

      5200811cc75c2f054c244be2267b048f06bdf0fe

      SHA256

      2f2fcac1760f577a2edf4b8ef32044687e9c913a1670a79abcff331d2f18c07d

      SHA512

      bd26c8acd11a8fd66287700f33e56d00f9c02449705e2b12c4b5e0acd4ec44368931a52870a23ea1702c5d5294093f83655bd035e33d12856ce31b06bdc258cf

    • C:\Users\Admin\AppData\Roaming\MyGov5\Code Cache\js\index-dir\the-real-index

      Filesize

      336B

      MD5

      d2c802d4abfb900d2e99715664f0d764

      SHA1

      0bd112b19f0e86448eb728be44253608afbf5077

      SHA256

      15cd30a57ae0f48955a5b4e826b585215430e2c1cb20c44473515fd393af1825

      SHA512

      304dd89ee8d5095d589732fba2506ac25ad2299ffe9e06df35a0dfb2d729f086d1c195aa11757ea9a9621738bf48b9af575fc5901a60f6b08bf8a04d7db699eb

    • C:\Users\Admin\AppData\Roaming\MyGov5\Network\Network Persistent State

      Filesize

      935B

      MD5

      e37d0e9c262d33e9f8bac79ca5afc0a9

      SHA1

      91cb466d76fa7eb82bdb3185f2ad8531946d3a7c

      SHA256

      33c0cc20de9d6e96e44da9435b5024ddcd18bb5838ad5add534d83cae23aa1db

      SHA512

      3e4e82af04f58cf25586c751ee99cfa8da84229668410c9af1a656ed766d5f804633f6b8547c1c0d9aee7c208c2dfe8f9db0a5cc47336dfc9139387d692500a0

    • C:\Users\Admin\AppData\Roaming\MyGov5\Network\Network Persistent State

      Filesize

      935B

      MD5

      2443433870cde5e0c0b2e7a9861d124b

      SHA1

      2204421c8034ba66ff803b1fbf1448a15feb437c

      SHA256

      d61bf398b6281faa0a6a50355ef4715ec5aaae2b78b80d59792b25ecaee0ad02

      SHA512

      750055fea2cb1da3f3657902b98f5ff1e3a3dbcaf8a758f1a28733f70c051fcd9a0ea4543b1c423859faebf6fef2f8dc7455e3b273f8739bd61c67df9fba29f4

    • C:\Users\Admin\AppData\Roaming\MyGov5\Network\Network Persistent State~RFe587dc6.TMP

      Filesize

      59B

      MD5

      2800881c775077e1c4b6e06bf4676de4

      SHA1

      2873631068c8b3b9495638c865915be822442c8b

      SHA256

      226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

      SHA512

      e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

    • C:\Users\Admin\AppData\Roaming\MyGov5\Network\TransportSecurity~RFe590df0.TMP

      Filesize

      355B

      MD5

      d72b4806cb98f94544580e0c413abdae

      SHA1

      97512b054824a23b6b5193ca64974ba4dad169a4

      SHA256

      b433bf69367625340114ecdf60c707fbe41ecc274df509da87121e86948f6233

      SHA512

      079c98e90cb9cb18472baddba45acf988e46e154662d3abef287bf4fef2508b1cd319c35d6621f3e74432c305ba6eddd32b19b098d6e1748a7932605681a35e0

    • C:\Users\Admin\AppData\Roaming\MyGov5\Network\aa869767-4fa5-451b-883d-c4be297a2f4b.tmp

      Filesize

      355B

      MD5

      b061291303a849c03397d55e12e2efbe

      SHA1

      603783645659e914f93ea25e9dce783aac388229

      SHA256

      fd51cde0b9ed52ba3b0024254d0e5ca970fb99f2a7e19d052c05627d604e285b

      SHA512

      ca337c9587fff733d3a00c65de71c62b2f7c06510a40fc29d553a0113fa180f2788d753e45699d4ebea1f7412b999c93eede7bcd7390461fb2cc58bc344ed62d

    • C:\Users\Admin\AppData\Roaming\MyGov5\Preferences

      Filesize

      57B

      MD5

      58127c59cb9e1da127904c341d15372b

      SHA1

      62445484661d8036ce9788baeaba31d204e9a5fc

      SHA256

      be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

      SHA512

      8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

    • C:\Users\Admin\AppData\Roaming\MyGov5\Preferences~RFe578b38.TMP

      Filesize

      86B

      MD5

      d11dedf80b85d8d9be3fec6bb292f64b

      SHA1

      aab8783454819cd66ddf7871e887abdba138aef3

      SHA256

      8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

      SHA512

      6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

    • C:\Users\Admin\AppData\Roaming\MyGov5\Session Storage\CURRENT

      Filesize

      16B

      MD5

      46295cac801e5d4857d09837238a6394

      SHA1

      44e0fa1b517dbf802b18faf0785eeea6ac51594b

      SHA256

      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

      SHA512

      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

    • memory/3724-931-0x000000000F2B0000-0x000000000F2B1000-memory.dmp

      Filesize

      4KB

    • memory/3724-930-0x000000000F2B0000-0x000000000F2B1000-memory.dmp

      Filesize

      4KB

    • memory/3724-929-0x000000000F2B0000-0x000000000F2B1000-memory.dmp

      Filesize

      4KB

    • memory/3724-936-0x000000000F2B0000-0x000000000F2B1000-memory.dmp

      Filesize

      4KB

    • memory/3724-941-0x000000000F2B0000-0x000000000F2B1000-memory.dmp

      Filesize

      4KB

    • memory/3724-940-0x000000000F2B0000-0x000000000F2B1000-memory.dmp

      Filesize

      4KB

    • memory/3724-939-0x000000000F2B0000-0x000000000F2B1000-memory.dmp

      Filesize

      4KB

    • memory/3724-938-0x000000000F2B0000-0x000000000F2B1000-memory.dmp

      Filesize

      4KB

    • memory/3724-937-0x000000000F2B0000-0x000000000F2B1000-memory.dmp

      Filesize

      4KB

    • memory/3724-935-0x000000000F2B0000-0x000000000F2B1000-memory.dmp

      Filesize

      4KB