Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

28/01/2025, 16:47

250128-vanswsxqfq 10

28/01/2025, 16:19

250128-tshtxsxlcl 7

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2025, 16:19

General

  • Target

    DefaultSetup.exe

  • Size

    78.0MB

  • MD5

    d0b01f170c486dafffb1b6e595273a67

  • SHA1

    8bed0d7608ca48eca93e8c955e9410901ba04a49

  • SHA256

    7200d36264736d7fc359ad02b0ee625d964b71e058b034f9e014f13925138065

  • SHA512

    a571997430bb6675a4a546142e8445e44e53e4b1080b8048e6c08fa1ee42ccf1b4613cdd7a6249fe0c28beb836f5f8b2696a324d03d06d6bf06d5ffe466e872f

  • SSDEEP

    1572864:gb2/JSxJiUbUOXCSspU3UIBftflSBthJBpXl/S3fBzB:gDIOXuYU+fIBhTV/wfB

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 18 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DefaultSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\DefaultSetup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Install Wizard.exe" /FO csv | "C:\Windows\system32\find.exe" "Install Wizard.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Install Wizard.exe" /FO csv
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1576
      • C:\Windows\SysWOW64\find.exe
        "C:\Windows\system32\find.exe" "Install Wizard.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2024
  • C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe
    "C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe
      "C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\InstallWizard" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1772,i,7557541706199348011,8927599210674006283,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:864
    • C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe
      "C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\InstallWizard" --field-trial-handle=2208,i,7557541706199348011,8927599210674006283,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2316
    • C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe
      "C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\InstallWizard" --app-path="C:\Users\Admin\AppData\Local\Programs\InstallWizard\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2512,i,7557541706199348011,8927599210674006283,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2640
    • C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe
      "C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\InstallWizard" --app-path="C:\Users\Admin\AppData\Local\Programs\InstallWizard\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3568,i,7557541706199348011,8927599210674006283,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:224
    • C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe
      "C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\InstallWizard" --app-path="C:\Users\Admin\AppData\Local\Programs\InstallWizard\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3688,i,7557541706199348011,8927599210674006283,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2144
    • C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe
      "C:\Users\Admin\AppData\Local\Programs\InstallWizard\Install Wizard.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\InstallWizard" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2464,i,7557541706199348011,8927599210674006283,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Programs\InstallWizard\chrome_100_percent.pak

    Filesize

    148KB

    MD5

    83ec43f2af9fc52025f3f807b185d424

    SHA1

    ea432f7571d89dd43a76d260cb5853cada253aa0

    SHA256

    a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c

    SHA512

    6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86

  • C:\Users\Admin\AppData\Local\Programs\InstallWizard\locales\lv.pak

    Filesize

    628KB

    MD5

    b35313c11d423dd0fcd50b77d4a4006b

    SHA1

    7aa3a4b9a1020d9c693ec018c654c9e7a0a2ab53

    SHA256

    5c74465b83cef9aae45a6b61499e79b745a91a6038fdd61a3321425056f77b5b

    SHA512

    9dbceb5096885a26cd749f011cf720a1faa84a390645a0bbf854d53c6d55a23e098955077e893b2c053fe4db7ef035ef870547c2d81861ad7c6b625d9e269d04

  • C:\Users\Admin\AppData\Local\Programs\InstallWizard\locales\ml.pak

    Filesize

    1.4MB

    MD5

    cdbfea85429ae6b9bb4f1017142468b8

    SHA1

    507c88dde41fa51c0662884e407e5a9334a9a4bf

    SHA256

    01b8451504a151efca188b43e4f1265fb81c69a8d7b7a98d107896608bc57734

    SHA512

    6dbfbe38fec2a94a04e7ec6d828f7356ef5a76ee4d5d7dd1242b77cc594066888150495d3377eef86ef864c751c95f71ae092ed3847c040fec1a6026df420fc2

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\LICENSE.electron.txt

    Filesize

    1KB

    MD5

    4d42118d35941e0f664dddbd83f633c5

    SHA1

    2b21ec5f20fe961d15f2b58efb1368e66d202e5c

    SHA256

    5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

    SHA512

    3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\LICENSES.chromium.html

    Filesize

    8.7MB

    MD5

    6ff57c0aeccdf44c39c95dee9ecea805

    SHA1

    c76669a1354067a1c3ddbc032e66c323286a8d43

    SHA256

    0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca

    SHA512

    d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\chrome_200_percent.pak

    Filesize

    223KB

    MD5

    dc48a33bd20bfc7cacfc925a84b015b6

    SHA1

    8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c

    SHA256

    2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6

    SHA512

    1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\d3dcompiler_47.dll

    Filesize

    4.7MB

    MD5

    a7b7470c347f84365ffe1b2072b4f95c

    SHA1

    57a96f6fb326ba65b7f7016242132b3f9464c7a3

    SHA256

    af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

    SHA512

    83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\ffmpeg.dll

    Filesize

    2.8MB

    MD5

    e4d06c9d97d4eb125c0d8e0bf6cc5bdc

    SHA1

    436c699c627e23092105ac0b41994e0c6ef42d2d

    SHA256

    4a3ce3e8a30d1bfea36446f884e51bb2eb65b9e559dc016300e0e18c0f823e5f

    SHA512

    71c670b14b3e0fa3d442fbdc711aa564df9beca5f4d7963b04ecdafe49ff31ef5e5a34b8c52f90d02c72c7bd171755cc22f545f8f40315abc8230fc5f84690ce

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\icudtl.dat

    Filesize

    10.0MB

    MD5

    ffd67c1e24cb35dc109a24024b1ba7ec

    SHA1

    99f545bc396878c7a53e98a79017d9531af7c1f5

    SHA256

    9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

    SHA512

    e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\libEGL.dll

    Filesize

    481KB

    MD5

    6ea73dcb05168e3abf168a2eab9cc441

    SHA1

    48497760ba5c65b57be5ad111b90b3d8b6f0f5bd

    SHA256

    3839ad80072ba6fd0516fa5b947ab794eda5fc679ece5492b25f888e3006327e

    SHA512

    0fc8b64ec0e3a8f4a8612daea2f7a09b087b7e6949f7d8a44a0bb3764a1007196ecd09f9fd8520f40339f140b733867de4ea09e361ab64eb2e810f8cc13dcdde

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\libGLESv2.dll

    Filesize

    8.0MB

    MD5

    92128651eba3bcf49bb3b1e4c31b296b

    SHA1

    77b769fa5c83e5b895408f00be9ffb41bdbc88c9

    SHA256

    d5142ccdb81a06fd43e1f789c5a2f636973e019d1e9fdab7b7bf738145333554

    SHA512

    b25ddd64a3b13689915cb23145fd55576e5102abbc81918c5000d01807cf0ee9c5ed79a15d990e7dd5e1a0d859ec87ee8b82207fef98f7b8028d846d2f16905a

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\af.pak

    Filesize

    520KB

    MD5

    fc32a6b72fc91e1be9c2c9d2ea586ec3

    SHA1

    5d439600cff26476d8715b778881f5735356d723

    SHA256

    c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7

    SHA512

    b34c7390d4a15936b1f74f42fa91ccd0ca0587f0dd630096c9a16ec77756e2137d9e49ab1ebbf703c8ce6f56f110d5bb3333b1ebed51779d1bb2460b203a7250

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\am.pak

    Filesize

    840KB

    MD5

    e0c0a175875fe04c01c7606efc083d24

    SHA1

    15cea393a6cc1cbd619303d78eef6948f05710f6

    SHA256

    49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c

    SHA512

    3fe18007d138b39707007a98b95781619f892aa5163f74c600c930c6284f4219c2a6714d25a104eabb98f763fdc481ab26ddddd1bd4010ca1630b5d8fc4e2994

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\ar.pak

    Filesize

    921KB

    MD5

    480baf1a6d7fdb28a105180bd5791388

    SHA1

    9556fabb0744eaa5eb17c93a5375f31b5315d7a5

    SHA256

    817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc

    SHA512

    24853a554509eb069b04dea588ac154d5dfb2601cff8f1575d9f83e8b1fc787fc723c65d952028e1ecd2eecf406226ed8b5eb07a1bec58efce4673e5d97d4e18

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\bg.pak

    Filesize

    959KB

    MD5

    d9d3b4d420be9277d69584a3c0b5080a

    SHA1

    285a094979b739c4455e3790968d33ca4d466146

    SHA256

    f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83

    SHA512

    388ca1cc11485fd3d31a7fbf710145cbd480cb386d96cf6dfd83e1ef2f5376df76db5c2cb051c5a045452875f8362890cbc6df547200bec624c9f13636655803

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\bn.pak

    Filesize

    1.2MB

    MD5

    f22d531de1ef474d9839c96e22a06277

    SHA1

    9b12fcf37966444273451d9859e20a3c4a4be1f1

    SHA256

    5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d

    SHA512

    86f9958450e6d4fddca876c7bbc87d154d17fd6e8c002cef98a97c5d265f215c2d8e32c9cbcdad5a28361419877367cd959cbcc24eb77229cd982df0a8a2c8af

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\ca.pak

    Filesize

    584KB

    MD5

    d042acc4d9f540c737480d25488ad68b

    SHA1

    a3a59a5baab008eb1d24693bcaf551fe1248c4fd

    SHA256

    bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89

    SHA512

    0e11225f2362770d10a387c56ffacba75c2bf1607da7df576e0a09ff0254736f825e5e4f5b055171d62c46d6a7f7e33548e9147d26bdf8113576cae9a5e0849c

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\cs.pak

    Filesize

    602KB

    MD5

    836282b5cf247f9b05f325693f38ad90

    SHA1

    77557300014cc465002bdfd5a8ba2b14e01bc7c1

    SHA256

    add0f8a685e87efd7735a8a32563d08fde529fac60091373f394a2048f182a6b

    SHA512

    708dc9509b1467a8979ddafda7916957356439ceac6d77e4e4b8ace5092e0e86d83e3f6650bd3acf717388b369e97b2785599226c152671a2a093e04b394045e

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\da.pak

    Filesize

    545KB

    MD5

    7ba71428f60f52c7b799c5a8a0c60d9c

    SHA1

    f5a31239e58de8a666909d8e432f859955fe0495

    SHA256

    989d87673f72c77d2cf72def27129003e7f9645a41bb7acab1875be44f02d94e

    SHA512

    03f5d064ac421c4e983b1bece02fb0e730573e6374585aa3878f3b35f8163c0bae94d8cc0ccc7b2a6a7b99fccd0797387c5cac56dc388e4edf4c793dfc934529

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\de.pak

    Filesize

    582KB

    MD5

    f13adcc145f23f6f263c50318da302b0

    SHA1

    1f9b92e5f0ac9a0579cf511a7ceb8c00a40d564c

    SHA256

    4f123245b062d71d56819ac1198d13a3d7953decd4491fca0fbd22c5e129c3bd

    SHA512

    04557b6ccc5caff3d3ce15bdfa9a1b7415ddc8a67963f58931ebe5678b149c6d771928ea785f07b5ca0e86370e2130f8084d1586de15521fc11a435b11c168b7

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\el.pak

    Filesize

    1.0MB

    MD5

    2f0639ad04c3c16a216d4789dbbc12d7

    SHA1

    b0ed4b4387545015b4cf73b50fc473b5c35d3548

    SHA256

    b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d

    SHA512

    c5a5332c67c8aa38deec7254bac15a73c6d432b705fac8c4d6feeffff1a095ba4766443a03c1e4f17a4f09c1fa29d6d1c8740d6e455be2c0973869ccf8dd0122

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\en-GB.pak

    Filesize

    474KB

    MD5

    7b278baf4598e7ffeba15180c017311b

    SHA1

    2a8f2a9138c700f607441647833ee5a8d2ba2b85

    SHA256

    3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39

    SHA512

    654b69d06eb9de0b187dfdf5249f88cf9c73031034e0620703db88910737c22f3dcef75f05993237bbda657703fa2b152c467f33b6f3c48cfdc8c35291049db5

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\en-US.pak

    Filesize

    478KB

    MD5

    a99b6152bdeac44148f94394c4149622

    SHA1

    df7371533e92aa24f48469116d9a8ac73249315e

    SHA256

    75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82

    SHA512

    3160b58d10ca147594ff4aca004007d4e6823421be349cfad945c681e220eec7266d88434a4d31c719a346650ac0ed31f1f13fca3e824d81bb65ebb4d21cc2c1

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\es-419.pak

    Filesize

    575KB

    MD5

    cdbcdaed721e027cdd6c76de0c166f6e

    SHA1

    105dc222d858bc32c3a5acef310d08a821ec7cfc

    SHA256

    4dedec1ac933c73773b1e54caab1c4d606d12f3788cbeef4d6a2a382138cc907

    SHA512

    0afc3970922ea3efebf595bdaf27228eab79da2545d63a85d94d6f319353907a5fe265a139a1563eca653d06dc8f3de7dd9f8de4bd9ee0094f6873f521f58429

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\es.pak

    Filesize

    575KB

    MD5

    45ac4970655382ce9ad3648b28fda391

    SHA1

    52a8b700386d8a2baa5a7ca9feba74a49f3f9a77

    SHA256

    a18efc1896cd029453b422a9e4ad0c22f7a39521e1bcfb52190825b575811855

    SHA512

    2ce32618a67686b7977fa59275f664616160b4082449b5fa12c4509db48f16a7fabaccca884b19cea0516f6e55153064bda21e1a98df761279b688b7de5df78d

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\et.pak

    Filesize

    523KB

    MD5

    329ed6280c7dd038837cea60113e4baa

    SHA1

    b3f4658ea3ad3322454ebea2274649ab835fca7d

    SHA256

    919d3e0e6b8253731c8ca00a9304fa1337344c1ecbd552288675c733d14c46a3

    SHA512

    5248e39cd56e5a51ac2da503b54d82ed3c0e9245a9b8cd4f44bcab36987eb21fcb2a2032b76848d9db1fca3f171f07d4f37f8c8b6ea5f4fcdd2b33c9725ffc05

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\fa.pak

    Filesize

    855KB

    MD5

    f514986cf76b183fe3436adddaaf532c

    SHA1

    1254533d181b748e249235fe307288980b2a33a3

    SHA256

    bd43e05809c9623623797d906d19a196c820ed95fce81002ea763b48b83ba238

    SHA512

    de12708a965a63f5ffe7640db5cc50494be5ad5d2cf7ace844ff163385461c2291b681cb2af7dcba13ed70db7f08de652ede2534f7704540aa31c390154cb9c4

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\fi.pak

    Filesize

    534KB

    MD5

    b452982f5d1dc232ac8869217348bb74

    SHA1

    39cfefdce0ad7dbbfd72789eef4835e25d1585f5

    SHA256

    8d62395944362d437fc1bd7810d8fd037afcc2f94f56bfaee4368350c189c106

    SHA512

    f053285f4341e92a6b06bc019a90c461cb76281c8c5d6b8024f8c15eaa20ac42ad7409b71178ca0b9cb5adbfac0216d73b9eb63bf8563f1c9f82c1028a5f5c3b

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\fil.pak

    Filesize

    604KB

    MD5

    1f9d4a873c12948379cee5092476a12a

    SHA1

    016b780d49470603b2e8bf1c4953036f0e30c125

    SHA256

    9b69d82f50c159d1ec5603ef45dc139143b4f05761f38f263a66fffedd28ff5e

    SHA512

    a6477b04f21ee5f1c15002adfdb44a2c81759a1d8e0b2af2d705be6572afa6e0037d1944b4e0e7ccde8d2bfb2d97e739fbee0d11ecf7199c229d5a6db4aaad81

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\fr.pak

    Filesize

    622KB

    MD5

    9d67d3483398e57367f6e1695c7e902d

    SHA1

    03f5c8df607c25e4b59372555749fc297a5a0c08

    SHA256

    7290c6224cd04e7c9c3b704239e2e21372126a9dbbc566ef9c4e0499006e11c2

    SHA512

    e6d52348ef3942dfc4e0be8b5878de4d61d2c3ecaa2d77b493cfd71034746b582455a159d4e5b1ef4bedadbcf246021deed8c55f657c3680f29322f113376ecc

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\gu.pak

    Filesize

    1.2MB

    MD5

    ef08b87556684fcd04e7c29859e91711

    SHA1

    5f83bab1a2bffb7d35792a7a0d7c8bd4b1e6a9ee

    SHA256

    1adaaacf2f9ab872fb35932fd1ed3b005f370f0ec22b95b42039b4c58660675c

    SHA512

    bd3deed6ac3ac45bed7a9c5d3f5c4e77967a7113cd9e810d02a28aa40dae8b5e6eace99f54793335e12764959d923e3eddf002d980d2a9234e042ec544e5caa5

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\he.pak

    Filesize

    751KB

    MD5

    1833176fec61454b32e3ea593a327940

    SHA1

    50407ceae5b1a803ba2ca16a1c8fd95576806899

    SHA256

    df1b83384ad42d4ca9f47aebc909baa8a6dde79fa1b0706023a279698e302e89

    SHA512

    8cee4c00b45a47429fd62a50c9b17f78f03d2f303df9d6bdb80430680b2423f8e47220b8266a2997db6b6537ed4a676bdc7e221f97dd50241fe02aeae097ca88

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\hi.pak

    Filesize

    1.3MB

    MD5

    fa5f71ca9c17172d374d0a2fcfe907eb

    SHA1

    23abf6f3ead1559632caa31ee351193ef6cb7983

    SHA256

    f73ccac3debba20fb225209805ff2383609853111f931e6b82095c1eb56a6ce4

    SHA512

    06d990747eded7aa09ce13107e44fbdde17e60031191564d51d7e15c6dcc2ed411dd31ed5b343052757fa99ce2969321c61733cfd28c4309f3db97ae4c8e2c87

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\hr.pak

    Filesize

    581KB

    MD5

    8f562cb34d12de7be78b5ec0d9972d74

    SHA1

    ee62c7899ad82a16d2a8e49ddecbfab7020626d2

    SHA256

    7b4b841d36f753a95269e5bb45435532ea0a68d1cb4df39a1afd59f6a0fb4580

    SHA512

    aafddbd3a15cab6dd5fa7a1d2f7e62f3f90c4fc0748f8ceece7c43a4293fd408713f78db111135f59aea6771b06aa51e8f2562e7738290812a5a31f108826b3d

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\hu.pak

    Filesize

    625KB

    MD5

    85d8bd3516b1965b153236d86b9bccbc

    SHA1

    996fa6ae823e72e811311c7f4f4fe76cce686dd6

    SHA256

    ec81ac981af0e962654ad4f65030064a6369dc2316cb1b10bb24b473808ad1e9

    SHA512

    ecaa5210de1b3e389e5c728fead4538deae129339f3aa577aeb231e5fdb6c6615c11fe345753559ff491e63f80eb8390893a3576f3061979ce513a8193c3595e

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\id.pak

    Filesize

    516KB

    MD5

    51e77dc2ac0210ebc821a196a1174655

    SHA1

    1993a2f09802674d50a880e9942ef31de88060f7

    SHA256

    aeb815a3dc6ce3cd1edf2c158a3b16e9c8039af25752367bf13826516a295cb9

    SHA512

    72fb0db144a2672ab2ce9542b4aa17ef3010d380fed5a737ea344ad75fabe62926ad9930c53692ddba38cb43f5ab1a9a5c7299130c1aa089daae57f8d76a2842

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\it.pak

    Filesize

    567KB

    MD5

    da26b38c305f39c6a970ee3134c84da2

    SHA1

    3293d8dac21e7d4d302141683eba1e847fcbd412

    SHA256

    1b16b0af558629dd53e35d1b4bb7b18dc1d8cb5353a4261112d2cd3b0a4c55ea

    SHA512

    0a0a29dec539d37f3de558a40f766c82423ff3c18c210abe28438e4191f353b284fa97bc13e332b6b3463322dad48c8a1d7d46888a7e607af3ad5fd089de793d

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\ja.pak

    Filesize

    691KB

    MD5

    1315b97a069ba7069046d0c544496802

    SHA1

    fd27bf39f24b95ab241ae1c52c460c608a85e545

    SHA256

    ab7751f408a46eff78929bf7f4f31be000821a5b4c169dea9633694b24d05dbd

    SHA512

    932da886044d62e4d3615113c7c2ae98fccf2dc651c6816386aaaa579fed967eeead548adf7d1809f0d6c5a6a8460fd0bf398bd6bd04d977a40296b163c29d2a

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\kn.pak

    Filesize

    1.4MB

    MD5

    36f3d535e0300b9910c9f2cda9622f43

    SHA1

    fb9da3bc55faa942feb0d36695bf3daad91e8be5

    SHA256

    9dc20cfefbddb76de749f672b4920bec77fa0028c1235a12f56bdeeac1282227

    SHA512

    04904603ba827a859f8a75eb76f2e99ab4cd84ffb93430ea9f8d767952b2ec79a611867fa40881c6be0c0f39cb43a69c61629267460398cffd0348a900fa92fb

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\ko.pak

    Filesize

    585KB

    MD5

    bd6baa5d7db9abb0cd5e72fce7ead6f7

    SHA1

    d5f962c162d42161fbbcd4cd742c5f01740c4b26

    SHA256

    5e117abe7a478b8500883d73a7c69ad32a99a3e286802ee806a336fd93aae206

    SHA512

    801fc5a5859803eb4e61caf069751aab94b9c17b5cd896c3adf7a6d3428b9f14cc68217e5051b1ba166d6ae5de5afbc49ee8bf988094c1bb149cde73e8fc8da9

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\lt.pak

    Filesize

    629KB

    MD5

    cb02dd1bc9b6c81254ed823b412ad969

    SHA1

    d1a8c2fb83ae75dff61ef637504a15d2d261ef64

    SHA256

    9fe73d75dd155d0bda60a638b8f8d48048d17fadfd2d746bac597e5ac3b7f6dd

    SHA512

    c866b7b9db4822816c7a401cd410ac18ed3e8810e939dc1f7bab0b4e05abab923a15beba814fa4895ec1571cbbc420a0250737d80d361324929360f203c23194

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\mr.pak

    Filesize

    1.2MB

    MD5

    1651f1fc93ddbf17ef1085eff8492cc4

    SHA1

    9cc4315dbae033b5e25ef46a3741cd9768d1e471

    SHA256

    7181c3bc7a369d2d0b8ae6c1cf8f160603ec56996d20b266833edc3acce4c78e

    SHA512

    7901a092001aee29734493a7b120a604782929f039879a1ccfc41b130a69b965d32b0bf6054a76694c86f85390e560aa55d11bace7141e371d830d5e0b534de6

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\ms.pak

    Filesize

    541KB

    MD5

    e4e08a32c9c25573f4ec6e5d2df94f36

    SHA1

    b16b5ed72ed70e872f2ae46374cf701cdbf91c98

    SHA256

    6a3ced7828f0608297da29c99832a389ec9d0d03060ddb20304cd081be494adb

    SHA512

    ac5533c5b6e01c82384f3e8b938717099fb8fc34e5cae2401ec5ad07d89f8135aeab2ac66fdec4c1a8d05a91b65eae2fad14bb8ebfa5ca7c7a27d0cb41ca09d4

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\nb.pak

    Filesize

    525KB

    MD5

    84bb0f7aec428dc3d18aaa5d95d649f5

    SHA1

    090a7a274f885c7a31c6872ca353000e6e7276b7

    SHA256

    697882ac2da78894e449cb1f75da43e7115c2481bbd2fee3bdaa425e82fc232c

    SHA512

    5e92c748bb0b0f8e9605a5e851fe4441399d3cdf12192339c5ed6b707cc7d0b3d7a0131add9baf7d7a83abb895a415f93bf2472009bec423d1ed6c59c3e7254b

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\nl.pak

    Filesize

    543KB

    MD5

    4f096e97bb5cb921ecc150aa1da33a42

    SHA1

    7e105f2efa38b39f13a5d5aa9a6bf621e186b5ce

    SHA256

    ac22005c476adbb7f3bcf0b17597a7a1595b83c4e6a8760d5553b630f0833305

    SHA512

    c9f3a7636e218c7e5eebaa5f0922a92125e69acff24d56054526fead3ab2a1f1cfa5717f5950a269f7d18fc27e5b617b46c51f6c63be7757de902f0d48ed1ca7

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\pl.pak

    Filesize

    604KB

    MD5

    94042abf274885c2c8773168b9dac0cb

    SHA1

    1a0d8d6c82a05f219f5aa78492b604eaa85c7d6b

    SHA256

    e8a107b3568a289a6e60118e4b8e2f27338116dafcef078311bc16f0857b1f35

    SHA512

    a3b5ca8790557c5385c25a94fb775262c423c8506958f1d6166565cf06a9758776a14f2577d0cb7ce9c47b1f8a6c8631f4fd7a73bb60ae0b5135e362cc3d7c13

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\pt-BR.pak

    Filesize

    567KB

    MD5

    a25a1fe3b44192d6ccf354fa2c152e6f

    SHA1

    d0757f15c07f25cc8cca123d7d9c8aab3cdfc9fa

    SHA256

    1c0d67a4259df36655aa97761e71e02bb0407e7bb1fe1319394e0916c7d76f7f

    SHA512

    beaa71be07a2ea7b01440703dd46a26bec6c7922af2f9bbd528bfc60bb1c290a34c512459eb8a10f0668399f72bea233e6bf93feb55561fe279d8a699bcc4f1d

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\pt-PT.pak

    Filesize

    571KB

    MD5

    75a31e0fb6cd1d9725ac06a0aa3571f0

    SHA1

    c72a670a4ad9ae358acc58b6a0e9c0cebe5260a9

    SHA256

    9ebafb943bf20c66f8d9ca533633fdc63519e8ad38d78a3dd28b4457c38ba79d

    SHA512

    1aa5874cb6ad6da85b3cd36787d6783f27a8f6a0a17b7bae1e1fc1749b385d76cd899f95ba1b3900e80113d176b011e659b8ecc17e0a721db2d357f7cf1febb1

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\ro.pak

    Filesize

    592KB

    MD5

    1d5fb4a97472ca13ac7499e57427b797

    SHA1

    26f2a496314130cd4dc08c69787788e39b195da3

    SHA256

    cf59cd7c26cfe3d87ed2b3a2ef254c3a3667824bbf06cd591bfc9dbf2a83ab91

    SHA512

    82f6f1ca4937bc5e16ee84118b9c20b725210b8dfae85d1c923789cc4264f24662ab2fcf8878273bcf813b0ca830480d58e42200232d5092ab29afe4c680da90

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\ru.pak

    Filesize

    972KB

    MD5

    5f9fbc8ad4cca9e3404bd9b647f32ff9

    SHA1

    58a37e1870cb59baafa305f11b5d8ee32eae7e07

    SHA256

    a9e03a32fab1313969541e15de2df2e26d9f4ce5920ac7fa1211d823a37bf9c2

    SHA512

    dfa0663000d04111336a4c0e3718eee11073e275d9e97dc91e542f556974050de39f37176e4e961ab83adb643cb7b1a79b4374b841ff527292e6c2128154c3aa

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\sk.pak

    Filesize

    611KB

    MD5

    7a0f6ae29bd30b6763778d42d2878237

    SHA1

    b20de38fa62b86ec7e57842d17c213c99c243316

    SHA256

    19286e076c93af124e9cf1d1ef95ddf56b60bb24f253fa52f895a18e97d90f47

    SHA512

    89a700a0ace7c46485080f56d39b6f890d6e64cc6b574d37358b9820125fcef4417dbdaf1e974f9118a2b4ecb73cbb9f1388557e0c11eebf5bdc8084ba809fb3

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\sl.pak

    Filesize

    587KB

    MD5

    3d978f2474117fdb60ac3c237e8e3f2c

    SHA1

    a2a7fc9b9913d6b112b6a171249208781de767fb

    SHA256

    0d2bc3529bf9a52da8506c8ea270b48493e1022b17e2c7f4fb02b5ac6a005219

    SHA512

    832a1e0f5b2be59fd2cff9d5aa1d0d0c9a5c5eca6614234f9070e9b294dff543bdd56809e161dbf0e6325a8f44147421cc527078307e8b7ede7297e534c9298d

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\sr.pak

    Filesize

    903KB

    MD5

    bbc6be53db3203370b1502f06e62bcb4

    SHA1

    4bfbc0b93377b480af45698339f2db9ee6561e5a

    SHA256

    10a29c3d8b7d1c3ffe6fe7735f1a841e46b845da854765f3b18508f0fe0d426e

    SHA512

    da37a307898992b684c2d8ec0a64877878fecd989f2eece1aae6c7dc968eff8c9c8caf58127e5c4e4072acce1ffd17400583e63ec30fde07d2453c15e2493dc9

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\sv.pak

    Filesize

    528KB

    MD5

    eb8298b6ae52874b6d98a49c53bf5113

    SHA1

    2519d36625b82aad1dc34a6237a71a892c6988e5

    SHA256

    90667ab33b5f891d960a09fb7afddb9e57477f151b5a3238f5100db5c04aecae

    SHA512

    60dc300db5836bdcbea142549fbb288dddae4e60ea04414800813403d60a0aaa7e20c16f8cf23475c90910a273831fd129c1596fef216c69041fcb22345761ee

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\sw.pak

    Filesize

    557KB

    MD5

    af1fb718bfb3484f5df40300b777e399

    SHA1

    ccfb3f58a16388448bc9707e7e5cf79a6cf3a838

    SHA256

    434879a83079fba562af9dac928ad2fcc1033e0a6a5a1f4822d36e710decdd2b

    SHA512

    7666c6aefcf9a7c266e3b2a0144ccd77448ce09d6b7fd2d863d9ff12689e393b5733b2dd577db853a0775935f176cc1f6ea3e804b11db14b831271af4d6f0aee

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\ta.pak

    Filesize

    1.4MB

    MD5

    131beeb0dca7021bdc552005564d20bd

    SHA1

    77524c260c13ed53b3164d26c7ec99d85dcf20e2

    SHA256

    0e1d7c0fa1eab312b42ff5e8978b7146d6cac313603fcaf101bef2eedc70313b

    SHA512

    627082ae714baa1c4eb6a6e900946df400c8b1389b5110c291d99a2db1ab14d841577de908139ebd48f5c0d8eaea68607da4d41433ed48e92e086d871afb0acb

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\te.pak

    Filesize

    1.3MB

    MD5

    d20ca0ebb24d9696814bf13d5e4436d2

    SHA1

    cc096ebe0fab4bbb3bff78b76bbb0c561c9fbf19

    SHA256

    1faa8cb780908552f3ca0d2b0e20eb6aaa902cb5bd759c18ed1238beb0bb34dd

    SHA512

    c4d06e2ed755157b6a5ac1e9eb2f836adb4071cdad1aaa064be9de3d95ea69096b4fb5bf31b2352484866ed29b95b7914fa2cc26f3ba2b2d8e41ab8b46cbac79

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\th.pak

    Filesize

    1.1MB

    MD5

    8cfbb8cbea05777edc0ce668579b74f6

    SHA1

    272419a5f508548de9cdf2bec59424cd8de76450

    SHA256

    9210c77f0024c705018f5292b3021d3eca58bb290604b116e2d4e355b8ebfc59

    SHA512

    012de2eaff9c0faa4b3e8c71ccc5476b119a7f77f0ada859565dbc12e44bbe4795c84db907db4a5ddd412cdaa4b883fd1ed6a1f8a142625f6a81136a46a64513

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\tr.pak

    Filesize

    567KB

    MD5

    b2bd56aa978482b3812620251a561a7a

    SHA1

    c5036846a84014a2ad957ef8f969e0143c1d2cdd

    SHA256

    25d1667b691b5a950b8b42652f7763338cfd238b22d6bd35a5c38da8cb73a67a

    SHA512

    7d738ffbd91aa9f0b45180359e84a4bb0d94b4068268a53979a4ab47ed9b63121ad2f331be44a07f96192d12dcace22ba29bb5dd142037f7969912da66c648ec

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\uk.pak

    Filesize

    972KB

    MD5

    36714cef825ce023743ed1b2421c69b0

    SHA1

    1ecd6020c3e5e0bd8ecc725b3da4622381ec04ac

    SHA256

    5c77d80cd5fc24950ea0753cc1bf8ceab5fa4c1523e079bd93ce322abb8d7cec

    SHA512

    7dd1a07cb016f4543ff7d8f09ef52c2a48fc2db1b87af06995b4fefee6eef3b0bf0917c1e5aafe8cc7f353cbcf1ba44691145165bbe6d183942b35631dece921

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\ur.pak

    Filesize

    850KB

    MD5

    e63b8cf9588245f579fccb8dae57daa4

    SHA1

    8638a0b0bcdfdc973b6491f9bdaaf2ecf9c6ac94

    SHA256

    1929f3c85e550ccca9985cef47be30b690a701cbca70345baa0c2aaee99809f6

    SHA512

    e7e3ef949b4917f929536f094884149e27d98a13d90a00d81f1fd0e2a67408839705bdd718e17da6e1228dbe20d63746d7078ca15d2f59a8a37310f1972c04f6

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\vi.pak

    Filesize

    673KB

    MD5

    031ecbccf301b6ebfe978cc1ec63a957

    SHA1

    a1245e6526ec42606e8811731edf73b7dd0d390c

    SHA256

    fcd18b598c2d7369708ad60e87e1243ebabb3d2aa1057b8aa32a069ec54ebe98

    SHA512

    732fe6975bfeadc494965ab99a358d3d4e092ad3649e404fe8493b658e323d54881bc8c2a2f57c8c694d14734a21e1a165961f3929d1edb0176fc2f86b5e4cfc

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\zh-CN.pak

    Filesize

    484KB

    MD5

    5eafe9b165f653383a39f71caa1c850e

    SHA1

    5b4a6f93d30ca7a8194ae49c102190fe3fb8a8e0

    SHA256

    4db9d3f1c03e06cc760614eb1149943b05ee381288711ea40475370024bca612

    SHA512

    8d5416888e50d9a3fc43eae4af58537202e7ec41061cea45357ea1fb894283b1e6570d8cf2d2f66eee86ed978cf786e24f5992036ba3824f57c25b6c6d346432

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\locales\zh-TW.pak

    Filesize

    479KB

    MD5

    b764742f26738df3e1a5beed21232715

    SHA1

    eda7f2730ce6019cd42f44caa272a543dcdcd384

    SHA256

    514d6a95fc7094ff00cb7700bca2b10191df866c18c551e1d2c07050ddee80bf

    SHA512

    1bd4000f79a16c978e98eed6f42b28a3f1b356c63c3f648ade83147ec06a416351349c6d3b6c2c734b6004a5c92751cef83a551553c4dfe696bc1d6e1a7fcf0b

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\resources.pak

    Filesize

    5.5MB

    MD5

    9a641272dc25d0908bb79aae27ab2c51

    SHA1

    8ba37601520be18691a47c6ab496e4f6db32c6da

    SHA256

    a1e5297e2bee9a26960025049c0570340b230e6e1bdbbb55d6fabd11cfffe89e

    SHA512

    3e636c8d985f24684dd1124ed58d2ab8b6ef396e0cecdb9da04d220a027105bf71511da82b8cc54bfbca2901e23887a740fe00828a2a647fc090b68a925d2874

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\resources\app.asar

    Filesize

    3KB

    MD5

    0efb7e6957cb0993ab8bcdfb6554e91b

    SHA1

    ffac15f04a4a333991088a2f12761886b65f632b

    SHA256

    0620bda30af20fc08cefa6010d5cb50855bebc68ba376135af3c31a352504f2f

    SHA512

    5034ee5a105ae667c49169f50da8b0472db78a1cc95db3d5907dc9291408e9c2f20b63535dc5a979c90d7e1911d2fcdff1f00ea9b56e217dc489127fc5a74b41

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\resources\elevate.exe

    Filesize

    105KB

    MD5

    792b92c8ad13c46f27c7ced0810694df

    SHA1

    d8d449b92de20a57df722df46435ba4553ecc802

    SHA256

    9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

    SHA512

    6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\snapshot_blob.bin

    Filesize

    309KB

    MD5

    bdf2e2cab5037adc41774fa1caba8ea1

    SHA1

    b1669825b4ec8661d2f65eaf70eb2abef1ff0e10

    SHA256

    31b6067f7e43c00946343d88f5f9167151543292211874f1edf8ba9b6b19d9eb

    SHA512

    5138e55645dda2918ef73638547fd8851b7bd3211c5fd5ac4f8331c5cf48425af58d4fb8aee223b12606865b37ade17bf8252d2dc079f3a5c432af5ab913d8fc

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\v8_context_snapshot.bin

    Filesize

    671KB

    MD5

    04d61b8d7f3e6a3a81df5bdf418904f1

    SHA1

    353ec04045f72d7712e013bc0e1e782e24275015

    SHA256

    96539ed02416163441b9847175f2ec1f5708e321e1fad25b03ff7b47b7aa991e

    SHA512

    608021d64470fdc4cfd20e55b92dbf2e901b1d239395ca7754df1260cb7884f45f175951a81ed5cfc6165c1cd91997725a2ca060b7cf701102bad33c1cf34054

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\vk_swiftshader.dll

    Filesize

    5.3MB

    MD5

    251f0372d263f52c9593fb39d4ef621d

    SHA1

    e01a91d211e442dc9cc43e74a8bae9708a82a971

    SHA256

    22b81a04d2d7ff13c86317148080a7feb1d967ebdf10ba8d2446dad6db849913

    SHA512

    c32afda44ee135a1be318e07dd965deeb440c9c56515d61343b11cef09254508ee8d67c3fe0d08201eece9575671ac0fd69ab1d280de94f2ee949e6bbb62ed34

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\vk_swiftshader_icd.json

    Filesize

    106B

    MD5

    8642dd3a87e2de6e991fae08458e302b

    SHA1

    9c06735c31cec00600fd763a92f8112d085bd12a

    SHA256

    32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

    SHA512

    f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\7z-out\vulkan-1.dll

    Filesize

    874KB

    MD5

    4ecf3e42731c897fa4f0f74468c1874a

    SHA1

    4fb19be1e78b4f8206befd8ee05160a08436e392

    SHA256

    08e6cc4aa3e1154b1b236a0ad0837b35ad07daea2febc4e567e59c02b27d8646

    SHA512

    42d65eedc61236bfd7738ac57dd9489903f22dc7121cf74c03dfd4055155db783b4b69ee300da68a4c96e222a8793c753630c8144d7c6586207808c91d0fad86

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\SpiderBanner.dll

    Filesize

    9KB

    MD5

    17309e33b596ba3a5693b4d3e85cf8d7

    SHA1

    7d361836cf53df42021c7f2b148aec9458818c01

    SHA256

    996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    SHA512

    1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\StdUtils.dll

    Filesize

    100KB

    MD5

    c6a6e03f77c313b267498515488c5740

    SHA1

    3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    SHA256

    b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    SHA512

    9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\System.dll

    Filesize

    12KB

    MD5

    0d7ad4f45dc6f5aa87f606d0331c6901

    SHA1

    48df0911f0484cbe2a8cdd5362140b63c41ee457

    SHA256

    3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    SHA512

    c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\WinShell.dll

    Filesize

    3KB

    MD5

    1cc7c37b7e0c8cd8bf04b6cc283e1e56

    SHA1

    0b9519763be6625bd5abce175dcc59c96d100d4c

    SHA256

    9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    SHA512

    7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    ec0504e6b8a11d5aad43b296beeb84b2

    SHA1

    91b5ce085130c8c7194d66b2439ec9e1c206497c

    SHA256

    5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

    SHA512

    3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

  • C:\Users\Admin\AppData\Local\Temp\nsqAF1D.tmp\nsis7z.dll

    Filesize

    424KB

    MD5

    80e44ce4895304c6a3a831310fbf8cd0

    SHA1

    36bd49ae21c460be5753a904b4501f1abca53508

    SHA256

    b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

    SHA512

    c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

  • C:\Users\Admin\AppData\Roaming\InstallWizard\Code Cache\js\index-dir\the-real-index

    Filesize

    48B

    MD5

    e729fca284d0718db7e143906f41a58c

    SHA1

    68cabd7ebe6e4455a1b70f19e5ee1fbd8198fca2

    SHA256

    6f0630aab1422b49b10a5c1e63f7725cf0d6eb060861d5f82aba0ea65fb7bd20

    SHA512

    2d16a59ad4d3dfb5bc0aec5954018d76f51465d143a121a88008a07fc1844588790ec76ef35933b163c53fada2bb7e023a38d09a4cafa73cec3937c76e6e98b6

  • C:\Users\Admin\AppData\Roaming\InstallWizard\Code Cache\js\index-dir\the-real-index

    Filesize

    96B

    MD5

    5ebdab88c6e31988ba220467bdf6a67f

    SHA1

    74d6aa0c604ca12ee8cb48ed3f562795199c2a73

    SHA256

    d5f70c7775514235e45868b34543bae61279c3cceedbccfa12fe622bc2f51f22

    SHA512

    6eba71cd538050bdccc990e65d33e09c7915f4a8e999717802fa0d08ad085a145fc774b8f7528b0a5c8fd0c41a58830d84c17d87a58ad90cabff4d0b3ffa92e5

  • C:\Users\Admin\AppData\Roaming\InstallWizard\Network\Network Persistent State

    Filesize

    384B

    MD5

    791e72f9cbca9246077471457c60819c

    SHA1

    bbd6eaab1911fe0ad2a3904b05daccf0971305f7

    SHA256

    7c1d097df6cedb0ae1624e5a8c389bc44e32aa7066658ce6190669dd71f619f0

    SHA512

    c94f7db4edba837aaf14552bb78fcac50433a1481b05fedf953ec14ab85718f65c7de9c2a0c358ef9c022bb5fe9bfdc9582d9db517205735675c346711c26de0

  • C:\Users\Admin\AppData\Roaming\InstallWizard\Network\Network Persistent State~RFe58efe9.TMP

    Filesize

    59B

    MD5

    2800881c775077e1c4b6e06bf4676de4

    SHA1

    2873631068c8b3b9495638c865915be822442c8b

    SHA256

    226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

    SHA512

    e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

  • C:\Users\Admin\AppData\Roaming\InstallWizard\Session Storage\CURRENT

    Filesize

    16B

    MD5

    46295cac801e5d4857d09837238a6394

    SHA1

    44e0fa1b517dbf802b18faf0785eeea6ac51594b

    SHA256

    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

    SHA512

    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

  • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • memory/2640-619-0x00007FFBB7100000-0x00007FFBB7101000-memory.dmp

    Filesize

    4KB

  • memory/2640-618-0x00007FFBB6C10000-0x00007FFBB6C11000-memory.dmp

    Filesize

    4KB

  • memory/4452-844-0x0000028E195F0000-0x0000028E195F1000-memory.dmp

    Filesize

    4KB

  • memory/4452-846-0x0000028E195F0000-0x0000028E195F1000-memory.dmp

    Filesize

    4KB

  • memory/4452-845-0x0000028E195F0000-0x0000028E195F1000-memory.dmp

    Filesize

    4KB

  • memory/4452-850-0x0000028E195F0000-0x0000028E195F1000-memory.dmp

    Filesize

    4KB

  • memory/4452-852-0x0000028E195F0000-0x0000028E195F1000-memory.dmp

    Filesize

    4KB

  • memory/4452-856-0x0000028E195F0000-0x0000028E195F1000-memory.dmp

    Filesize

    4KB

  • memory/4452-855-0x0000028E195F0000-0x0000028E195F1000-memory.dmp

    Filesize

    4KB

  • memory/4452-854-0x0000028E195F0000-0x0000028E195F1000-memory.dmp

    Filesize

    4KB

  • memory/4452-853-0x0000028E195F0000-0x0000028E195F1000-memory.dmp

    Filesize

    4KB

  • memory/4452-851-0x0000028E195F0000-0x0000028E195F1000-memory.dmp

    Filesize

    4KB