Analysis

  • max time kernel
    99s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    14-11-2024 13:17

General

  • Target

    GK6X Setup 8.0.1.exe

  • Size

    132.4MB

  • MD5

    c7709b4a8d88a03b9f909f6ffb80b35f

  • SHA1

    85bd3980c8bb001002e3033f9ec6d783cd4569b1

  • SHA256

    a13032054265962b2faa5f557ce83045014b450a4343182fa50c578be8f00e68

  • SHA512

    49dbaacd821e6b43b42bcb080c891edbc4dcad992143e81434aa9cf32dfd9f492118e06f2c74b71c69564813af71b3e05aaafb4f7741b29fb6d6b5cba0690b18

  • SSDEEP

    3145728:VKO1WMs6dJVSKqOyqk7vZ3dkoeMOlMWp2G6lvzZ:9jVq+kTLL8Mc+ll

Malware Config

Signatures

  • Renames multiple (148) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Renames multiple (181) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GK6X Setup 8.0.1.exe
    "C:\Users\Admin\AppData\Local\Temp\GK6X Setup 8.0.1.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2172
  • C:\Program Files\GK6+\GK6+.exe
    "C:\Program Files\GK6+\GK6+.exe"
    1⤵
    • Adds Run key to start application
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Program Files\GK6+\GK6+.exe
      "C:\Program Files\GK6+\GK6+.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GK6+" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1164,i,15806842106850122035,747390552651743794,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:972
    • C:\Program Files\GK6+\GK6+.exe
      "C:\Program Files\GK6+\GK6+.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GK6+" --mojo-platform-channel-handle=1408 --field-trial-handle=1164,i,15806842106850122035,747390552651743794,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2592
    • C:\Program Files\GK6+\GK6+.exe
      "C:\Program Files\GK6+\GK6+.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\GK6+" --app-user-model-id=electron.app.GK6+ --app-path="C:\Program Files\GK6+\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1652 --field-trial-handle=1164,i,15806842106850122035,747390552651743794,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2464
    • C:\Program Files\GK6+\GK6+.exe
      "C:\Program Files\GK6+\GK6+.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GK6+" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1284 --field-trial-handle=1164,i,15806842106850122035,747390552651743794,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2432
  • C:\Program Files\GK6+\GK6+.exe
    "C:\Program Files\GK6+\GK6+.exe"
    1⤵
      PID:2980
      • C:\Program Files\GK6+\GK6+.exe
        "C:\Program Files\GK6+\GK6+.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GK6+" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1044 --field-trial-handle=1100,i,1265185905371507497,750236186949058488,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
          PID:1992

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\4f63a301-552f-4f56-b908-c04a89e70023.tmp.le

        Filesize

        3KB

        MD5

        4de207e72f3031c43425572897710d2d

        SHA1

        0bab9d47916f2c8cd2920eb2c7d38cb4066235de

        SHA256

        d0dddfd360f4d640debba94ac0f9cc7a6de7301736953b1c40f835566bf12275

        SHA512

        555c0e250891400e869312b92f618bb2753998c350f2412b76982a6458fe9666dc86d6e58d28186c189fb33411701f94e3d9f3777e5e2992e455eddf35eba9f5

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\LICENSE.electron.txt

        Filesize

        1KB

        MD5

        4d42118d35941e0f664dddbd83f633c5

        SHA1

        2b21ec5f20fe961d15f2b58efb1368e66d202e5c

        SHA256

        5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

        SHA512

        3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\LICENSES.chromium.html

        Filesize

        6.5MB

        MD5

        d18c09a075cb6531d7ffd7c3da77bd4e

        SHA1

        571f29b6004007111782bf5727c4bc9510cca286

        SHA256

        86f5222580a4ab03dad8ea62e6cea22b23454dccf1c77e74ae0e0410a13b16fc

        SHA512

        091cd68e12633919fc6100b606f3002b16f4b9c7c6d7c820ff20e31a3b9ea690c8a1fc90529ff3e5c21e8d778e254743a8708049830c3bb046eda8f2653000b7

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\chrome_100_percent.pak

        Filesize

        126KB

        MD5

        d31f3439e2a3f7bee4ddd26f46a2b83f

        SHA1

        c5a26f86eb119ae364c5bf707bebed7e871fc214

        SHA256

        9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e

        SHA512

        aa27c97bf5581eb3f5e88f112df8bfb6a5283ce44eb13fbc41855008f84fb5b111dfe0616c310c3642b7f8ac99623d7c217aecc353f54f4d8f7042840099abc5

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\chrome_200_percent.pak

        Filesize

        175KB

        MD5

        5604b67e3f03ab2741f910a250c91137

        SHA1

        a4bb15ac7914c22575f1051a29c448f215fe027f

        SHA256

        1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c

        SHA512

        5e6f875068792e862b1fc8bb7b340ac0f1f4c51e53e50be81a5af8575ca3591f4e7eb9239890178b17c5a8ff4ebb23719190d7db0bd8a9aa6dcb4308ffa9a34d

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\d3dcompiler_47.dll

        Filesize

        4.7MB

        MD5

        cb9807f6cf55ad799e920b7e0f97df99

        SHA1

        bb76012ded5acd103adad49436612d073d159b29

        SHA256

        5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

        SHA512

        f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\ffmpeg.dll

        Filesize

        2.6MB

        MD5

        824f3c2f3b90e9dcabef26d9695cb0ab

        SHA1

        c8d9a93bc21ddbec5f4ac0219cbad5696f73393a

        SHA256

        c8427ee59fe634071c813d803f086e4757ceaa4be061739a1644f49c4b051acd

        SHA512

        f7ef8cca9e633327f57469742bc86ff209fc7d201c5b6629578689f2fbf39bda1d326bf24b68a2c6ab22e9d64d03b628bab1c635f9ac3f6b7441a680e98b9dad

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\icudtl.dat

        Filesize

        10.0MB

        MD5

        76bef9b8bb32e1e54fe1054c97b84a10

        SHA1

        05dfea2a3afeda799ab01bb7fbce628cacd596f4

        SHA256

        97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3

        SHA512

        7330df8129e7a0b7b3655498b2593321595ec29445ea193c8f473c593590f5701eb7125ff6e5cde970c54765f9565fa51c2c54af6e2127f582ab45efa7a3a0f6

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\libEGL.dll

        Filesize

        473KB

        MD5

        18aa1595f0249b97859f158b73be7f6a

        SHA1

        c1a877e27a65aed080fc4cb2d1ba301efda777d3

        SHA256

        d019e2c51b5c3e28744aeb4bcabc1c5a29fe05f52936fbeee4ec6c96430db8af

        SHA512

        21aac167e72e0aef481c799407a928b0c81cff32f6422e4d92eb4d3ff58fb59430804804c21826c5d2b2947e9c68004bf9a26566b0dd734a8be64062568acb95

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\libGLESv2.dll

        Filesize

        7.2MB

        MD5

        00666e5e2de77ba843b7c0fab5771476

        SHA1

        6d6ff22eb3dc651bc146d2716c4c817e424e93e7

        SHA256

        04e542edbf27f1bfc7d6620aa7c21b8039b05b6ac1b682d6f71ddddd771dd6d5

        SHA512

        7236a0c1ac81cb1b5b68d14757fe5e25eac933da08e9136a26527d01c6d96c552337d7e5c37313507f5032d03e4e94ff70a2b25a293187b7e88c3f8ef13caf3d

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\af.pak

        Filesize

        340KB

        MD5

        198092a7a82efced4d59715bd3e41703

        SHA1

        ac3cdfba133330fce825816b2f9579ac240dc176

        SHA256

        d63222c4a20fa9741f5262634cf9751f22fbb4fcd9d3138d7c8d49e0efb57fba

        SHA512

        590dcc02bc3411fa585321a09f2033ca1839dd67b083622be412d60683c2c086aac81a27bc56029101f6158515cc6ae4def39d3f246b7499b30d02690904af0d

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\am.pak

        Filesize

        551KB

        MD5

        952933d2d388683c91ee7eaa7539e625

        SHA1

        7a0f5a10d7d61c32577c0d027db8c66c27e56c7d

        SHA256

        55357baf28716a73f79ac9a6af1ae63972eb79f93c415715518027fc5c528504

        SHA512

        5aa5ef0ed1da98b36840389e694dc5dcef496524314b61603d0c5ee03a663bb4c753623fb400792754b51331df20ac6d9cf97c183922f19fc0072822688f988d

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\ar.pak

        Filesize

        602KB

        MD5

        98f8a48892b41e64bef135b86f3d4a6c

        SHA1

        32f8d57ec505332f711b9203aed969704bd97bc9

        SHA256

        e34d5cabaed4634c672591074057c12947bc9e728004228a9e75f87829f4a48a

        SHA512

        6ed3fe415b2f6de24136917da870b47c653d15c7a561baae55a285946a6f75e5141aba3bc064982f99baef0a893266693864c2d603c5c22c2b95627b2035f7a4

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\bg.pak

        Filesize

        631KB

        MD5

        9dc95c3b9b47cc9fe5a34b2aab2d4d01

        SHA1

        bc19494d160e4af6abd0a10c5adbc8114d50a714

        SHA256

        fc4a59ea60d04b224765be4916090e97ed8ddda6b136a92a3827ed0fcc64bb0e

        SHA512

        a05a506a13ac4566ecbfe7961ace091295967ea4e72a2865e647b5fa9adac9f7cf5e80b53fae0e3917dfb0b9a3f469189cd595cc4ae9239d3a849f5cedd60e46

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\bn.pak

        Filesize

        812KB

        MD5

        d6ccc9689654b84bc095cec4f1952cca

        SHA1

        286130971826b0af1b6d29c5283dfa71af7cd7b0

        SHA256

        e325d936cd97c3f9ddfca2d87caefb8b6e7465ffa31d0386ae2456b18f7a92da

        SHA512

        db0400820c5cd1100337c955084eac3036b55bbf66b403337bec2079bc47696e2e48a771214662b286f4f45f763d2ad423aeccbd0f06cf0bc11038662558f4a5

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\ca.pak

        Filesize

        384KB

        MD5

        2f8d050c228583559cda181291b76e5a

        SHA1

        b047f1cfb30b1162b1dd79f7e424a83fd807eec7

        SHA256

        e1d6b5fd0bc411f2895eaaa1409916f5ffe39a5c6bd1bafe8af7ce33da5be17d

        SHA512

        e4f150cd9942ef5105e72376835da6edc31ef91783e41cd2fc04600c04f342bbc96e08e23c8af1c0c1e563bb8a7d3840a2289767525c30d08c2f23d0e837801f

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\cs.pak

        Filesize

        393KB

        MD5

        26765c7be201444f0238962bb16a506b

        SHA1

        f9d4a33795e45127c14bcf35cc770845627e15e8

        SHA256

        936466784a55b965d23b016bc49377655bc5d281d012c8369c0809c961e05c74

        SHA512

        577d52d2d5048cd952aff1e76121a495328c1978cdea2eaa4f85812cc513917f69510e135e96f7967f4ed43cf88e180cb1d9059e17c855c8d4f94ca036730214

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\da.pak

        Filesize

        356KB

        MD5

        fecabf71853bab84eacdd95699c49f69

        SHA1

        8519afc13e100a550ca3d756518a0bc33674e0d3

        SHA256

        1b0793b1cbeb6a56ff1e64523c37ba753457320aa29f9718022caa07b4981d8f

        SHA512

        e932d382d41a79ece172349e916221a67d97f5fd4b2dc1325d6bd2f7c6757cbc01d6fbc8d9846f6ec462eb637210f7c650f6944418edbd3f8614ef99030d9392

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\de.pak

        Filesize

        381KB

        MD5

        ec069f60c9825080b9d18ff6492e816d

        SHA1

        34ce5101c9646f9c2deb9820a3b26eb91c525ebc

        SHA256

        e0f632ce324951002c80e019dd0169be9f6b0640533fa434cd6ca80f28a1d3f7

        SHA512

        95a88ac98f0957e5f200af76c1a743b976228f7da1bb6c6b3b88a54adcff05e1172d7cf2e6f0a82cbc8ad0aa79974a1bc046516250a3a5889fd7b2e4d7c0b804

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\el.pak

        Filesize

        691KB

        MD5

        306a80dadadb1f9182810733269537fd

        SHA1

        bc01a65a9d024ec72e613aedc60f4838be798040

        SHA256

        92403b6160e38746597d4dd7f64d64cf19e30b5e7862901263c39679187b2c91

        SHA512

        491016b8fcca59a7dc9523358c4a7b56c55360f424e8fe9330d6f01480835805e961f1e48f8777660510d9af9a66961c639df162190dec595a867d54150eecfc

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\en-GB.pak

        Filesize

        310KB

        MD5

        502260e74b65b96cd93f5e7bf0391157

        SHA1

        b66d72b02ff46b89ee8245c4dd9c5b319fc2abf7

        SHA256

        463af7da8418d7fb374ebf690e2aa79ee7cb2acc11c28a67f3ba837cf7a0937b

        SHA512

        0f0f9aac8e6b28c1e116377ab8ee0ffadbf0802a4026e57aedb42d21c38fbf70159be9e0314799c1de1f7638fbbd25d289dff7cd2c9eb7c82e1b62b6c4e87690

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\en-US.pak

        Filesize

        313KB

        MD5

        3f6f4b2c2f24e3893882cdaa1ccfe1a3

        SHA1

        b021cca30e774e0b91ee21b5beb030fea646098f

        SHA256

        bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f

        SHA512

        bd80ddaa87f41cde20527ff34817d98605f11b30a291e129478712ebebe47956dbd49a317d3eeb223adf736c34750b59b68ad9d646c661474ad69866d5a53c5c

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\es-419.pak

        Filesize

        380KB

        MD5

        774ced79da2fd32bd1ba52a0f16e0a19

        SHA1

        ff36dcf8b62046871f441f301dd7af51cb9ce7ee

        SHA256

        5aff3762747a6e8c6df9f2a3b470bf231b44163006b17ce87e2a03694be27b81

        SHA512

        7763c15fa97efa9a5af73dcdedd4fe260139bd8ff782ca3aa0937d9355b2d14c3e482e570844ac33d22d7b016c7b9097d727c1dd585f421dccd59ca7bbc24269

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\es.pak

        Filesize

        380KB

        MD5

        ba80f46ef6e141cef4085273a966fd91

        SHA1

        878f35e15b02558f75f68ec42a5cc839368c6d61

        SHA256

        267e7b6376e7e5ab806b16fde93bbbcd961bf0c3a7b3a2cabccab37faa9a1d16

        SHA512

        8a8b4f7db23d4c93756b6dc4219f00c77358a8fe992da1f51431597b82c3aa87abf3a98d79e13e7b4a14a1a9e94d388760fb6abf3a744406dee951c8e78cf361

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\et.pak

        Filesize

        342KB

        MD5

        e97fe1e6d06a2275a20d158dc4e3b892

        SHA1

        1575b9b1fc331a70bbe4ca7d1095d4ed6777ecc1

        SHA256

        d984aee4d18ca24a88846b1b6e0294d373733430f30bb4f1b97bc7d50d512c2e

        SHA512

        77879a4d1062671b616ba9b2ce0b6f69a5dbed6bd56b73ded902d1f9f44ecd96a2212690b3568c0ba273c73d91589ff2bf18c7ef9b66e0630fbaafde2a61b1b1

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\fa.pak

        Filesize

        557KB

        MD5

        d55f65c6fda6ed6f549d2c9f0a4ce874

        SHA1

        952792f2da5ed9cb1cfed14e5afb8abf5cf29cb3

        SHA256

        221bbbde078d135f6daca4978a31cc6a82f8f46536467ebc9a0cd322c58a7785

        SHA512

        d0bb83467182d8b3a8f8371d749e682cf05f89daefe28764f2c263e7cfbfc3f86cb388061b48dadda26c3dd246dd6f7a57af58ca9344c2f6b90de87af1e91c69

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\fi.pak

        Filesize

        351KB

        MD5

        fa7dbd2ee35587ff31fde3c7107e4603

        SHA1

        baaa093dcb7eccf77ce599c8ff09df203e434b60

        SHA256

        5339b8ca52500bd0082e0ba5a5f440c5f04733803da47963280479760c7fff2c

        SHA512

        587f6d0e216d1688227345a8a75b94848ee710ec633fe6805db66bb0e8cad1b8d24a1e6a7e234061516770d881571166c78d8fa1c40e6335f3dcb1339fbffc14

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\fil.pak

        Filesize

        394KB

        MD5

        3126f74d021e9423d71913bb45a62935

        SHA1

        c9a80c8585aabbfec34ae891416794b1b3e29a11

        SHA256

        4cd3fa70487e894400ad29e3bfbfba3e1c5edd799aab12c62c3aff3c2580ce5e

        SHA512

        fb360723ee53b3f7038eebd1b919a36784a0e3dc878e810bc905c4297379dade6006c8872ed68412b06161cacb0d6e32a7157ecf97d9e103a4ca3b2b71db8765

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\fr.pak

        Filesize

        410KB

        MD5

        51ee1ed54fec49effd103c29677885b5

        SHA1

        ced6fd3354007d1ef3ea7b6689aae5213c20cc69

        SHA256

        1f6bc09499ee37456968a28b67b81bbf5b9df4f0c6035a388242d2037a3b65a1

        SHA512

        dfd50ad99b89345940afead11c3a6940d4408a0e6265cddda1d71ad92527ea00d8057ac77ceb2ffe137a3f0d2f321c210bc7cf97ed821f01e538dc08d07149a4

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\gu.pak

        Filesize

        787KB

        MD5

        b7f4c73d56be31042d8edd7e8ea080f3

        SHA1

        c0c3595701c0a75c14931ed65958d36df0d925c5

        SHA256

        c36a20730d5f2b91cb61b5b2a5912db2ea5a328a9b8abe0fca0af300446d3c20

        SHA512

        ea0d766a754604cad4d5f3180c30f7dfdc3e1cfe79d67365b72adc0d7574851f21bdd5b748b16e8b4a95ade40c8ed0442bcefd511a2934cc9c701e379c955d60

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\he.pak

        Filesize

        488KB

        MD5

        6376d0a5f4273b76b1f4aabade194e0c

        SHA1

        337ba39f09454c0779ab64872b9fa11f866d6adc

        SHA256

        875712bb852c698f677c0c74e088f62d31adb2bce65648fc390607aad8705c45

        SHA512

        00347f16b5abbaf47fb08663d5efde26ab7de0c7a2fa42e6b5f03c41a83cecbd8e78cc3aef41d5f08658cf346e0ade732774485e8a10008a43fa41ffaf73b2be

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\hi.pak

        Filesize

        821KB

        MD5

        ede7fa471c5eebc1fa55b9b3b6f92d00

        SHA1

        1d1f529c615799bb3a3319ddd1357cb5dc71464e

        SHA256

        1e9623c7407ae8b8a88df3f69a47ae8117f74c4dcb56897bb794a9c38ee5805b

        SHA512

        0f51ea54e828700080effa6c728230c523ff8e26fb350e6f337028d18614d5dfc4a2792cb92b5e606bd0702067f55fea546029cddd1ebf7fa74ef5521ff08338

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\hr.pak

        Filesize

        381KB

        MD5

        7095ef4caf6bd39174487002a4e09300

        SHA1

        1efe686bd0b7f035aee7ab4c52be6133121cd0f3

        SHA256

        3d7685163c5eb6a11e745ff934312b8681c5f85dfa8d9ea701e9dcaee1e7a285

        SHA512

        45488d46dfe7a31a007932917f7baf4c195da899de5dc56d98e555336668af3edb77996487649b86f56beac688374ce77f8feadc01e3f84d30d83bd67631f9c1

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\hu.pak

        Filesize

        411KB

        MD5

        d6904e7d1b6750d43a6478877c42618d

        SHA1

        919f090a6a3aa1112916f5bb0d5b73a62be43c1e

        SHA256

        3ec43893c6de5ec0f9433841afd5fa9feaaf59ddcef05f7e1cab14dba799887f

        SHA512

        d600fedb5ef1b2eb49a0122536c642b350ce67bb7a9da205890d9d13a195ac17c14607b4489715fd34506ec0ea4c80f245e09cf048aef52dcc8094f3138b2fad

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\id.pak

        Filesize

        336KB

        MD5

        881ff04e220aa8c6ed9d0d76bfa07cb8

        SHA1

        cacf3620d1bf85648329902216e6cdc6f588a5ba

        SHA256

        9210c4c4c33e7ceb5f70005a92a4fd36ca4facdd41701fdc1d2ce638db8adf22

        SHA512

        9134102928aa80c49bbf2b862e8079b2ee23636ce63412a4c3813f234d623ff563f5ca1ac407ddb77cecf1224896ed59ae979dcf63435d35a4f13de9c22755d5

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\it.pak

        Filesize

        373KB

        MD5

        91391f388b4b6c12a72710c35f4c355d

        SHA1

        f89e6ea977a10a9f050395489285ce8c041c2c05

        SHA256

        c0dc0a4a87f7bb054a30eb1174c3228ea2014bd94668a7d22995b99c4937d817

        SHA512

        8796d69d1a8bdbc7690ded45404174b7fa0b5bec8453d79a3c85bf4707c3f32caf634c792c72ce7bda3522eceb5fc6761b696471586397064d9f1f1988ceee88

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\ja.pak

        Filesize

        456KB

        MD5

        8209dd8cf4e416416e015ff239b7c483

        SHA1

        7affd1707b9eec52c26a4c17708c8471c369e2f6

        SHA256

        3accfd9a1833ddeedb2082fb94101beb59b555c60f42e3070e9e04a372eba84a

        SHA512

        6a58a1ea8a46c325cac0629f2e3b571532a9a2a342ed61ca47bd1dcee20ce0b0350e4f6d3e8e4c6903c7ba4a4592a6382bf0fcb5437febd1673b3c2ce8cd7499

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\kn.pak

        Filesize

        910KB

        MD5

        d3d6bc60bead608e68e776e07d21ad30

        SHA1

        e40e38ca99026056c127e9e1a1ff821a50310887

        SHA256

        90b2df3338468e84e2cf2f2f67597cba5c3ceb5dba9c59ebd072ec15a70ce741

        SHA512

        05421db2f1202573a34de1e722c6bdb55a35821c4aebd54c80e6594fc92075cd9b97e5bfdfe93b4228c3a2646b92a27da4722ef3826e2807238dcc56ba273706

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\ko.pak

        Filesize

        383KB

        MD5

        b31780fff9541290c1d9f5b76141430d

        SHA1

        8b0fbdccd0a7f8141846763a0d27e4e0da0552dc

        SHA256

        b04c1b91cab31054be70cb851dc6716065545445801045daceb96eeee4d2334a

        SHA512

        a573dd09520059832e7f53386a64dcdde47452b02ce1e5d7e11385abbc8b734dcee0065b4ca351591bf9cc2f66fae204b9300702246d20265e8ddff4f7c1e6d8

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\lt.pak

        Filesize

        412KB

        MD5

        7b6bf901352885c0699db71239b7cf24

        SHA1

        9e3ec5f327c0d0e54a449332061e60a8c79243cf

        SHA256

        9200a9509bd77834d9912f4ba8f4219d2b9bd2cdad49a11873db30e99b9d1350

        SHA512

        79ebef723fb4c17581eb869b4b4e1a364a3d28df0e168e7e1a3583e0c1ec5b9716dd270925c0545b8247421a64b03705f10910fe3416900de9258840c470d580

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\lv.pak

        Filesize

        410KB

        MD5

        e664eb35f1284e9fc615e1bb4fab892b

        SHA1

        e777653abec377a394170b04f79e78acbe4b6a3b

        SHA256

        b5a31cbfcb40ad8d911de1618c4eb7e8cc67b97eb8878220f15d40eb014d8ac8

        SHA512

        c3232997e8d306e91ded72e9d81ffae2018af3e6c32fe620532e03bccd2883fce59b2a2290a1580d7080c468c02bcd24c1bc90051f06bfa9a4e17857d4aa583f

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\ml.pak

        Filesize

        948KB

        MD5

        00292b0801e0dd0a74091bf53f1574c9

        SHA1

        63a002e7a8796bc4b4459a19c95ce426fbd1ec7f

        SHA256

        61a372f170de0a22712be980c3c78b22035ebf40ce79332fab75cdcc4208c9e6

        SHA512

        e2e15f66851aa435e3bf4de6672f4aa8b01204d8efe11ec6ee9a51d9877ec4f2e71d7e9547d6eab9bfa04af1bea71fa72aa4963fa08b48717bf1c3fd21c00cd5

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\mr.pak

        Filesize

        772KB

        MD5

        b9a2aa88c69c42ebcc41fef00c980a38

        SHA1

        9e373dfa11f95c31ffdca70bd83d2f66e1ddcef8

        SHA256

        481faf7dd66cf10a476d8b156fb4ea452f920322d8007f7e25d41b2837bdbc09

        SHA512

        5f4582723429a44dd517322babae4466efb4e8723c0247754e2a9a2929133d6fee5c3533c4cf567954e2a5aab47940a136a178405de36e38b50e8d4a6d5c504f

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\ms.pak

        Filesize

        351KB

        MD5

        d5da199f347452c5904bff9332a08f84

        SHA1

        b5fb8c22708a7e3130684f1a9923b6dab10c3ae5

        SHA256

        fe58cc4f62fc31e32c1fb9a0893a5483391ab6a91b1c92ed4a5e3103a962da7a

        SHA512

        9fddeb376bececc51dec997b3ed1e22821340fa172636f641af774dae8bc9b5c0780757380bf3fa8df0f9682a555ede81c449ae9468f63215c17123d13ee9f35

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\nb.pak

        Filesize

        344KB

        MD5

        bbae0915edec081b04bb903b689bc40b

        SHA1

        6a0fc635ce1c431e512b8b3b8448176aa4025556

        SHA256

        d565c6c95dad89d3f2b7210de4ec3fc437633de4dcfc994fde0704b92bb53ff8

        SHA512

        573a9fe43213829a6a4b39e67be25bc330b417750ea6d66e26163de7a80c29f6f5deeb841d9ff8303595943a81fc01ab668aab02a5cac4eda078ed06120138b4

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\nl.pak

        Filesize

        356KB

        MD5

        9f547a24e2840d77339ca20625125b4c

        SHA1

        23366411b334f990a0328a032b80b2667fda2fcd

        SHA256

        55413d5eddb3300e0ae0fa5d79d26fdf1e5a12922d7018c8054b1faa9d660301

        SHA512

        34da7a0b58ee3904d00cf02d16d5a3ef508fb708d7c0a887286fc32cd6145b2bd857d317c784d1d1b17662041eadcf7e225908980eb93f2b81161d845c0bb67f

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\pl.pak

        Filesize

        396KB

        MD5

        0dc77139d3530695cb4e85b708bc0bf6

        SHA1

        6915655afd1e37361c011f5c2113d72c7a0e85bc

        SHA256

        53b59486361b11512fb90f15065104b15ee2322bb7804f859cde2f2ecf9581fb

        SHA512

        ee1ca1d99ac279df4cc0e532aef2fc531061736b636a84310bdbd627e0f2435eac1a386ebb19aa901b6eae3929bda1c5da4f41b73a25a1b20137522e34547600

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\pt-BR.pak

        Filesize

        374KB

        MD5

        a064cb9d7cf18936600e9ccc03297006

        SHA1

        eb436a0c584ba91acb05dfccde139afbe26fe9f4

        SHA256

        c9ec3822044365457b8736348cf95a8e39bdfe3ed36267449bf3ed739accef2e

        SHA512

        95af684abf9d24cfc4d0668a02da1e2e69f5e671d671d8cdfadc22ec991908c6aa5663fe1fa88ca8e85c0508f409fa6c2bbc174c53674270f2b188018d358415

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\pt-PT.pak

        Filesize

        376KB

        MD5

        3f367760b57a5e4360dabcd4a650bc5f

        SHA1

        8d7cd6b0eb42361ee862455ecfa475d28f5aa934

        SHA256

        c89170385b3afb2ec89fbd61b8470ac718713c7296441c8430f173dac218e74b

        SHA512

        3dc30780d57dee91215a716dc6b4cb432838aa0161af4371f49f70db2076bd155b170fd2c1617f59e1b572144a2e150a34143eda82d9f2227d24d2281d5aba60

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\ro.pak

        Filesize

        387KB

        MD5

        745a9b8c6422682f2cfa5561cc1f4022

        SHA1

        31e3616ef09f9b1fd1c41cf8f43e504a6f90276f

        SHA256

        7247470057a936d03bfa2a8776508ab66aa1040c41a4eb8f79c1e93551c74bb8

        SHA512

        8e0b7f98cb842a862ceca65e0166462275feed26c32c9c299aba9986d36b716a90d4a8db5ccef355ac266b7e969071014cc7ab6439778e77c52754bc23b4c575

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\ru.pak

        Filesize

        634KB

        MD5

        5cc0f54e022a9996773dbd64906d5580

        SHA1

        87c103bd69724579b478f904235e03caf61d5d79

        SHA256

        b4223b56ec88235819a427d60bb937eb3984076523f02a018f57819e0429bea9

        SHA512

        b3365fedcba50643cecf1a70297e1e67990d63ae05caa87de01a70ef6f28e0f73a9a0edb0ff80b4138c624e51aa2dac065a2d40877fc92137714ae07734c2f4a

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\sk.pak

        Filesize

        399KB

        MD5

        72946b939f7bcaa98ab314cfba634e0b

        SHA1

        71c79a61712c8c5d3dac07a65d4c727e3b80ab17

        SHA256

        75f179897cad221ca6e36b47f53cead7f3fb4159ee196f1d10a5181b84e1b5b7

        SHA512

        2a8fa7108c58f4cb263900a555714d5638d961d14d9f4ddf8a9ab5b880afdbc5d2325fed1e158dbaf42a9cd20e8e372e6a8f52fce842a6940ea52e43e4a1f1e5

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\sl.pak

        Filesize

        385KB

        MD5

        4ad22c6c64dbe0fc432afaa28090c4d9

        SHA1

        19eb65ae52a585dbd9c25c32f22b099020c43091

        SHA256

        6002c129a56558832e9bd260c427c0bd2e1566e0aea3ad999f89c8e479534f9b

        SHA512

        94f9d34e76560059ef80fc04be4d54e52a7d934dd28747db7f0f6684243b841087245699a471a55d667623d2ce5e597a3d2c6bc37cfd7ebd2f5b8fb40e6207e7

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\sr.pak

        Filesize

        595KB

        MD5

        fca817ed4b839b976ebcbf59cac66d68

        SHA1

        413efa65470319999032b6a25b3b2ee33b8cd047

        SHA256

        524acc64e70918a77cda43fd9b27a727645b28ad2d4cce16b327105101c8bbeb

        SHA512

        cb246d5c5cea30d6e7514841ab93803984cda37461a09b6c340ca64f7cbce4e1212951a4de421d928d433a619dac18454fb403b42581757b76c7eb124ce70cf2

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\sv.pak

        Filesize

        347KB

        MD5

        5130a033016b45ae2c3363edb3df7324

        SHA1

        9f696d78b1b9efec180dc89ee0defc3ba23e6677

        SHA256

        3420a1fbcca5bf8c2d65d6dcb0db78b03f95f7f2fc56479a0de6e3312333ce6f

        SHA512

        401b71360dcacf3b1fdc411c92195051370db110863cbed37143263e7804cb24b75ff1908ee39ee848c28776df00d6edd8cc748acf3725668af7815929e8066b

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\sw.pak

        Filesize

        365KB

        MD5

        9632dd7d883fa4deb3963ea663e0ffd4

        SHA1

        0db135be4b3a7c54c39e9df5034d5576b68ea92e

        SHA256

        690027c4a31c4aea00b7d1b32ec6cd3fa50b1eac412ae273ab15e72eb485dd6e

        SHA512

        3aac1857784dfecd2ae5f7c4056f58e27a966a6cb949e02eaba56fc1fc283243ed6213f17628d62d435e33fa4771eb43623f25da6510aa4ce6f2149f72ab0d37

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\ta.pak

        Filesize

        936KB

        MD5

        f100566697a96ce1f0a0c7e0bbfbe36d

        SHA1

        4c80a4930ba7d174c4203c199492463242bddf62

        SHA256

        7e818deedd50a533851bbf08e056bf2ad8d45f442a1a61d9b48e66804ea848db

        SHA512

        dfa6132a5b7e819e8d326bf5ee539d9ecb2dcd7fea429c75afec2291df9eeead6fa347b01f9feaf2235bce627fd39116176195f7a3d7d74de28951f939db1645

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\te.pak

        Filesize

        869KB

        MD5

        b1b6a9e3a04be79080ebbfacc1a0eb2d

        SHA1

        a5c8eb6a930062f6021d073d5f74ae146dc7fbc8

        SHA256

        d839531c4ff4a2885c993e0d358f78667215b0950c77a06ef01a6acff9221c5b

        SHA512

        bf0b163c8fc3988bfeb3cbb4b981596ce5afdf7e40149622fc3b60994e7d8efa5bb24c830036d168a6638feca48b8755aefa8640faae37055cae8fffb6a85568

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\th.pak

        Filesize

        731KB

        MD5

        a970b7e9d3aec2cd1b8ab798b3179f07

        SHA1

        bf17a7e80e01ac1704a1efdf27baf271b4c21e36

        SHA256

        cd80bf232f2f128a3d411f52c8039987559dbc1055f746eed6e0e8478b116dc1

        SHA512

        880555a2ac2f278aecb8794d8cc51f0833052e9f4ca187ed91fa35bb475e68ae3255cfe1dc074eac960c73c203e62c6b38077b266f5fab66ccc3ca73e94d4d60

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\tr.pak

        Filesize

        371KB

        MD5

        46f9b2a35efdf1120a8a946e4f1d0115

        SHA1

        af7bec1fba32d912b50288a7d988440627e4ee85

        SHA256

        b22fc7b75c52cc142f201d5cf107d17c1b173a494a6add022127f559fb46bcb0

        SHA512

        cd67f9c328408a8295f224aec190c7c411a868755fc5c9e90b4985b3c41a05d6d34dd30d4a3866f6c24e1d640f4c324bfba8c7ab806a6b216151cf0a504a03d7

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\uk.pak

        Filesize

        634KB

        MD5

        3b2a976a25dca963e91df3695c502d8c

        SHA1

        ce7ae51211f512c3723bb43ea0de9e6debb70597

        SHA256

        28ea88f19b2c34699d535ca0c691449b7e4001c12e8aed8d04b2078916e88a37

        SHA512

        ba41ee074239afdf8f194b4ccb33060fa9655e3ccdac6a16090959d3214f8db15396b3e038d7de26c478fdd003472f680d2b6ac9a92acaf6ebf8aa258747ecc6

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\ur.pak

        Filesize

        552KB

        MD5

        ba86f1f13fdc37a2c48c1da34c84f4c4

        SHA1

        2f1578d0eee76e60effb63967712b15c0d56829e

        SHA256

        4c7affdcc324cd791d10e235da809ce7501e8005be64340b6e8bf5595647a707

        SHA512

        fb2fe1548574da860bf27408a4f29d781fcefc300f744f4214843f343e343ad8bae29cb7047f87f5c3277641f561c6a30e5bc9d6490afbefc7af36974305a688

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\vi.pak

        Filesize

        439KB

        MD5

        065179c466c5b7457e249f11d152b99f

        SHA1

        cfc05e9dfb91b2af2944aed4718fa05b43844914

        SHA256

        b75694e390bd2e20780b3bc72f6e1473ba45d7537c27642a7d888dfd3bb6c3bb

        SHA512

        fb598391a028b7d3c7e25cae21ccfde655e6f871e498767a54f7cf0d5d4e48207213cd2598ca88e4f46c303cd2d8175238a5a5b720ab37beec1873d681165a8d

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\zh-CN.pak

        Filesize

        319KB

        MD5

        2febe4ef32e1a3884089908f402ad62f

        SHA1

        e65c54adc127b78494dd6189cca71f1c7bd2a5b0

        SHA256

        a7ac9fda6f4cd189b75fdadc4b70cd0d369a09b66eaeb5d032678cb97ffc98f6

        SHA512

        8e8b030af4c952c32ec277850d5573414630ff5196eaed52820f44e9c5bd03ab6f71a8add19215b0456eed859be0d5a6f28d48e12f1677d39842f35feffd5e57

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\locales\zh-TW.pak

        Filesize

        316KB

        MD5

        02e9e0bc5c30ca60a869ea761fb662eb

        SHA1

        c5200f692544b681af8757627da430aeea4283ee

        SHA256

        c5061ec00bd969f76f3c0c6ff15ddacafed7491260bd8ced78118691ba57bdff

        SHA512

        07b5f401f89dfc36499a3e74318b471d9b2e795dc363dfd5a9394089d4783a4b51fd78e2092701b6974f1c51020f3b5f81171ce21690f8547ff3c8f3d54ce781

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\resources.pak

        Filesize

        5.1MB

        MD5

        fb620332959ee6e46ac1c2a2f0e1b2d1

        SHA1

        eb18c735d187647c3c529932b8b80d9c9af09286

        SHA256

        66153f7b388503a9bab9df1fa157d3af88548bee264525694bca9a61ce3495e7

        SHA512

        1e5bfcac24a76ca8fae7b7fa5407f4eafeecfcda54726d66586f1171a7ba30cf76544d75aa44f1eb64b202e686ccd2c00c8cc0b24b249fc5c6c28c156cd03775

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\resources\elevate.exe

        Filesize

        124KB

        MD5

        a112a67baf4a3b176e7c100b26260e9b

        SHA1

        723733c532d2a79b0a7acfe304a1a28efd5a08f7

        SHA256

        8c347954e3964a7cd285b63c91c086bd53fbd5dba147efb6160599841994dcfa

        SHA512

        89cf7d1939d3ffe03fb71dfc029fa90f9c7df755173511f7c70803ec41b761a18cc035d688a2dc0c78c0b482ef17a3ae3617896079cbb7835f36229dc62a9dd5

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\snapshot_blob.bin

        Filesize

        168KB

        MD5

        b82ff216a0babf602940759b9a3af870

        SHA1

        07e8a22dcf8d7be04a6ddbcab3098e040494bb0e

        SHA256

        943b27009d41801c5a649caf680e32d4dd25de002787a4ccd86b0925b3aac3a5

        SHA512

        da157570afbab7be135f7749df7f4518df1452ea24f98d8f5189430e732ad06ed438afc701cb70451bbc7137b5f35a0c5957df92ecb40d47d54c1071ea79fba1

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\v8_context_snapshot.bin

        Filesize

        471KB

        MD5

        031ea03da08fe1247280cfe781658791

        SHA1

        e91db50ad16b5a5fbbaf4118672d60b347ea6161

        SHA256

        c16dcec41919a6d2850214f2275824be8a97d8c5e694e2ec8dd7d16ab2d5015c

        SHA512

        b3d6f282761f8ab8760728ecb108f64741f6f3cd2a143813042ff63a3b6604fcfe7c1feabafb65f9f67906217edb5851f44605a34f7a50ed2058c25ce5efb30a

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\vk_swiftshader.dll

        Filesize

        4.9MB

        MD5

        1ae9e16933392c38b30d3c3c721d936e

        SHA1

        e86ed3dcf95d3d328f68e84c159a8008ab9fcfae

        SHA256

        7c71daf0fb1877bc9195894798ebb256215104ea55a04ed2a46f18c9d6d80ef3

        SHA512

        3acc00c6fb52a4e94cef01eb5adccffb68dd5479ae0810666789e2f7aecc94b61120b7c3f15d412a79a766b78c8d73c4ffdcfb4e2c6ce0c2063d3b691b6c5796

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\vk_swiftshader_icd.json

        Filesize

        106B

        MD5

        8642dd3a87e2de6e991fae08458e302b

        SHA1

        9c06735c31cec00600fd763a92f8112d085bd12a

        SHA256

        32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

        SHA512

        f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\7z-out\vulkan-1.dll

        Filesize

        894KB

        MD5

        bb02b08a6698b565d48d7c8a97c802e7

        SHA1

        0366a25a429af5f497f1df2e9ca49bdd999b79dd

        SHA256

        c3c0e649d7e0726a795f556ac0f057c18ce67cc6737e3b9c935af3b9b8991cef

        SHA512

        5223622d1ca039adffce86417fcc9d69ae6aa64785eba96fe74d2e45e1b2680c7f5aca2f064401d7b643fb61277d8e68481b07357d61be98d1700b64bf2f80d0

      • C:\Users\Admin\AppData\Local\Temp\nse28A7.tmp\StdUtils.dll

        Filesize

        100KB

        MD5

        c6a6e03f77c313b267498515488c5740

        SHA1

        3d49fc2784b9450962ed6b82b46e9c3c957d7c15

        SHA256

        b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

        SHA512

        9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

      • C:\Users\Admin\AppData\Roaming\GK6+\.inited

        Filesize

        1B

        MD5

        c4ca4238a0b923820dcc509a6f75849b

        SHA1

        356a192b7913b04c54574d18c28d46e6395428ab

        SHA256

        6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

        SHA512

        4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

      • C:\Users\Admin\AppData\Roaming\GK6+\DawnCache\data_0

        Filesize

        8KB

        MD5

        cf89d16bb9107c631daabf0c0ee58efb

        SHA1

        3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

        SHA256

        d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

        SHA512

        8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

      • C:\Users\Admin\AppData\Roaming\GK6+\DawnCache\data_2

        Filesize

        8KB

        MD5

        0962291d6d367570bee5454721c17e11

        SHA1

        59d10a893ef321a706a9255176761366115bedcb

        SHA256

        ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

        SHA512

        f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

      • C:\Users\Admin\AppData\Roaming\GK6+\DawnCache\data_3

        Filesize

        8KB

        MD5

        41876349cb12d6db992f1309f22df3f0

        SHA1

        5cf26b3420fc0302cd0a71e8d029739b8765be27

        SHA256

        e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

        SHA512

        e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

      • C:\Users\Admin\AppData\Roaming\GK6+\FontLookupTableCache\font_unique_name_table.pb

        Filesize

        124KB

        MD5

        51cce7178c23e65e77abd4de6aec2ddd

        SHA1

        586388241077e86b2e1fb181f30c1a09a3ea863d

        SHA256

        52f0d465c6dffc00ac7076b33e23864119b441a3b3f2286ce154136d5a8eb836

        SHA512

        8131457907bbd9358d4f4c3d87fda7803049c00525768165d0fe4844d37edee0c5d73fdb07d79cfed7da2adcbd0101198a4e4732a508640fd283a83e04691556

      • C:\Users\Admin\AppData\Roaming\GK6+\GPUCache\data_1

        Filesize

        264KB

        MD5

        f50f89a0a91564d0b8a211f8921aa7de

        SHA1

        112403a17dd69d5b9018b8cede023cb3b54eab7d

        SHA256

        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

        SHA512

        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

      • C:\Users\Admin\AppData\Roaming\GK6+\Local State

        Filesize

        389B

        MD5

        90693a0044d1c63c0698a576d0aa02ef

        SHA1

        c115e88b58924e37abef99c2ba513cb31438eca8

        SHA256

        906c46b9a5d928969b3dea6ea8e61be33e7c82e6fac29e9981bd79b201845be5

        SHA512

        0c9fea97720c64c5e5c606909ba136e92b4f00a26b6d63a9aa6dd202ebdc2c25a97d176bed53546183ce221971b8ab6d0f19dbab65326e3ff73fbed1512fccf6

      • C:\Users\Admin\AppData\Roaming\GK6+\Local Storage\leveldb\CURRENT~RFf791584.TMP

        Filesize

        16B

        MD5

        46295cac801e5d4857d09837238a6394

        SHA1

        44e0fa1b517dbf802b18faf0785eeea6ac51594b

        SHA256

        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

        SHA512

        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

      • C:\Users\Admin\AppData\Roaming\GK6XPlus-CMS\Account\0\LE\15AF7F87-B386-466c-9A8F-DD7CD55339D3.le

        Filesize

        5KB

        MD5

        0064bbed7c94b48d3c8c1f674a6b3f13

        SHA1

        a74eeba4ca628616c09832bd1ec6fbf3b4d5d79e

        SHA256

        dba6a061c3a19b57276ff324ca4ec2d26e7490327b4ef43523d57e289365d23f

        SHA512

        9cc208164cd001546643f46f207a22a5a1f7183e577e50be397172a5a2279176e378d4bbe37a974a39833de5409d7d0e5514f45156c4f8349587376d2a2ed968

      • C:\Users\Admin\AppData\Roaming\GK6XPlus-CMS\Account\0\LE\28AA6B77-DDE5-4bba-B3E6-F8DD27C7BCF2.le

        Filesize

        4KB

        MD5

        4655072364a587d2c46a7ca791fb40f9

        SHA1

        a5bccf702b157557cf28657e409c424478f3d793

        SHA256

        33bb18e2adcadc43d929ae919ab6a3b039954119252106060091782b7387b32e

        SHA512

        d4791bc8eb1b165e23783f3b9286edf15ba090de6d98106b84fd13cce7a38ac642fbd19958aa2c453534c71fcd1e1071ecb7b9ef8c5dd5fa9e530aac598b7df6

      • C:\Users\Admin\AppData\Roaming\GK6XPlus-CMS\Account\0\Macro\11859524-DC42-4fd5-8A56-A0FFC66F965D.cms

        Filesize

        225B

        MD5

        a008f27c7cb9cc98d1faa83e45aa6715

        SHA1

        cb5ea0316b3e782e2f143a16c80d672b761afcf6

        SHA256

        f14284bcf77e7f6ffa050023527b9f61afc92ea786ea87bb61eb958bbdb9bee7

        SHA512

        64857d844aaf23dd6698f46698305a85cef5ddd4d059b1abeb5afebf2ec275f12ce8ef388195df284c5e750c829050b372bc30ba869c309b6939e7835d035d4e

      • C:\Users\Admin\AppData\Roaming\GK6XPlus-CMS\Account\0\Macro\ABE5C7EE-8C52-43b7-91B0-334322E19F5B.cms

        Filesize

        263B

        MD5

        58a90b5e6fd8f22f140dfb8dce257e82

        SHA1

        a9966b0f80a6db0153dd011930245e0a2dbc9f41

        SHA256

        8eab484067790790f71bf211b4445cea31e19116b9baf7dae810baa258f24286

        SHA512

        8cd7a0684cafde09f3166b61ca3139d55dbde6ec6cd6b6544294fe83b1ef9b0c2368613d4b94e91197d1867d8344c17fcdb04266ea47821dfe005affb75d672b

      • \Users\Admin\AppData\Local\Temp\074fdca9-d3f6-4aa5-9c63-c62db77da58d.tmp.node

        Filesize

        1.1MB

        MD5

        49ca10dae58cf5a1a0222f83f6df4002

        SHA1

        2ef8603914516b24d7128c50827def28da97ccc4

        SHA256

        a6e6d835cafa1fc93f4b6ef3595a4c2b8e54fb7c1ee416ed8e379ff5846e048e

        SHA512

        815d5b7c5001988d48d059b80df5e6c5ed6c43c89934c31f27bc6e51cc8d6239620161ddfcd0307ed58c1c823e5bed4344a089eaa8b326595a9efe3c484ca9aa

      • \Users\Admin\AppData\Local\Temp\7c25c1c1-2801-43e1-9239-adb1883c9550.tmp.node

        Filesize

        164KB

        MD5

        e02b8dd62465b60e0e3d21c229bfe0fb

        SHA1

        4d39a70380063d41ce75e0f29cc8a5e18758b98f

        SHA256

        a7484ce78716fd576685c9ad3573243915c87c604e6476e7e22c83e6c3635686

        SHA512

        242386e4432b798728ab521c885a5ee2ffdf202f312a271bc6081bdd2c5869b86408cb43620c7ce123513c1f694d2aa018dff4cccb49222e20091fb4b5af9222

      • \Users\Admin\AppData\Local\Temp\7f208e9d-65ab-48a2-af97-575681305059.tmp.node

        Filesize

        254KB

        MD5

        83c6e16078808b94dff5686aecf119e7

        SHA1

        c0e4e7c859f3d4a052a9338a9052aabc1114c457

        SHA256

        f1a0786629d4b767fda448e1501eb44254aada2d2a4beab5bb9f231c19f9ac02

        SHA512

        213deafacaebb78a7fb9139ff98d93a8fde569cb6abdc3e2926384ca97d069702b2fe0d5606626634b5ffa940dfe5a6c5bf01febb250e9559474bcdd42929867

      • \Users\Admin\AppData\Local\Temp\nse28A7.tmp\System.dll

        Filesize

        12KB

        MD5

        0d7ad4f45dc6f5aa87f606d0331c6901

        SHA1

        48df0911f0484cbe2a8cdd5362140b63c41ee457

        SHA256

        3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

        SHA512

        c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

      • \Users\Admin\AppData\Local\Temp\nse28A7.tmp\UAC.dll

        Filesize

        14KB

        MD5

        adb29e6b186daa765dc750128649b63d

        SHA1

        160cbdc4cb0ac2c142d361df138c537aa7e708c9

        SHA256

        2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

        SHA512

        b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

      • \Users\Admin\AppData\Local\Temp\nse28A7.tmp\WinShell.dll

        Filesize

        3KB

        MD5

        1cc7c37b7e0c8cd8bf04b6cc283e1e56

        SHA1

        0b9519763be6625bd5abce175dcc59c96d100d4c

        SHA256

        9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

        SHA512

        7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

      • \Users\Admin\AppData\Local\Temp\nse28A7.tmp\nsDialogs.dll

        Filesize

        9KB

        MD5

        466179e1c8ee8a1ff5e4427dbb6c4a01

        SHA1

        eb607467009074278e4bd50c7eab400e95ae48f7

        SHA256

        1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172

        SHA512

        7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

      • \Users\Admin\AppData\Local\Temp\nse28A7.tmp\nsProcess.dll

        Filesize

        4KB

        MD5

        f0438a894f3a7e01a4aae8d1b5dd0289

        SHA1

        b058e3fcfb7b550041da16bf10d8837024c38bf6

        SHA256

        30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

        SHA512

        f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

      • \Users\Admin\AppData\Local\Temp\nse28A7.tmp\nsis7z.dll

        Filesize

        424KB

        MD5

        80e44ce4895304c6a3a831310fbf8cd0

        SHA1

        36bd49ae21c460be5753a904b4501f1abca53508

        SHA256

        b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

        SHA512

        c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

      • memory/972-794-0x0000000077210000-0x0000000077211000-memory.dmp

        Filesize

        4KB

      • memory/972-763-0x0000000000060000-0x0000000000061000-memory.dmp

        Filesize

        4KB

      • memory/2172-580-0x00000000028E0000-0x00000000028E2000-memory.dmp

        Filesize

        8KB