Overview
overview
7Static
static
3BetterShad....0.exe
windows7-x64
7BetterShad....0.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3BetterShaders.exe
windows10-2004-x64
7LICENSE.electron.txt
windows7-x64
1LICENSE.electron.txt
windows10-2004-x64
1LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 07:29
Static task
static1
Behavioral task
behavioral1
Sample
BetterShaders 3.8.0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
BetterShaders 3.8.0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
BetterShaders.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
LICENSE.electron.txt
Resource
win7-20231129-en
Behavioral task
behavioral9
Sample
LICENSE.electron.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
LICENSES.chromium.html
Resource
win7-20240508-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
libGLESv2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
resources/elevate.exe
Resource
win7-20240508-en
Behavioral task
behavioral17
Sample
resources/elevate.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral18
Sample
vk_swiftshader.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
vulkan-1.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240508-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240508-en
General
-
Target
BetterShaders 3.8.0.exe
-
Size
71.3MB
-
MD5
e743e372a9ad2c75482b9c1a580a773d
-
SHA1
85783e01da015d56e27b584079eca6529107944c
-
SHA256
c0c47f91e18fc087051c2172c74ae96e14e01fadb12af47d3e301e99e22da8c1
-
SHA512
831ba32e260cc6fd99c04757118e31c999ce7f8a04a28765f5b1b91d817b9f43d12408fcd76710f2d8738cfbbe688b01f4b2b0033972bc2db095a1b6663c7ce1
-
SSDEEP
1572864:ZVg6PFyMnotsYEb/aSY+NPZS7oYpbswqeHHVBqXda6LpVAI6x7:ZVnZnwsYGaTe4lRqeH1BqXdt4I6x7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation BetterShaders.exe -
Executes dropped EXE 4 IoCs
pid Process 2336 BetterShaders.exe 2220 BetterShaders.exe 3400 BetterShaders.exe 4468 BetterShaders.exe -
Loads dropped DLL 13 IoCs
pid Process 4288 BetterShaders 3.8.0.exe 4288 BetterShaders 3.8.0.exe 4288 BetterShaders 3.8.0.exe 2336 BetterShaders.exe 2336 BetterShaders.exe 2220 BetterShaders.exe 3400 BetterShaders.exe 2220 BetterShaders.exe 2220 BetterShaders.exe 2220 BetterShaders.exe 2220 BetterShaders.exe 4468 BetterShaders.exe 4468 BetterShaders.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 33 ipapi.co 34 ipapi.co -
An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
pid Process 1332 cmd.exe 3896 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2632 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1480 powershell.exe 1480 powershell.exe 1480 powershell.exe 1864 powershell.exe 1864 powershell.exe 1864 powershell.exe 4468 BetterShaders.exe 4468 BetterShaders.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 4288 BetterShaders 3.8.0.exe Token: SeDebugPrivilege 2632 tasklist.exe Token: SeDebugPrivilege 1480 powershell.exe Token: SeDebugPrivilege 1864 powershell.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe Token: SeShutdownPrivilege 2336 BetterShaders.exe Token: SeCreatePagefilePrivilege 2336 BetterShaders.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 4288 wrote to memory of 2336 4288 BetterShaders 3.8.0.exe 93 PID 4288 wrote to memory of 2336 4288 BetterShaders 3.8.0.exe 93 PID 2336 wrote to memory of 532 2336 BetterShaders.exe 96 PID 2336 wrote to memory of 532 2336 BetterShaders.exe 96 PID 532 wrote to memory of 2632 532 cmd.exe 98 PID 532 wrote to memory of 2632 532 cmd.exe 98 PID 2336 wrote to memory of 1332 2336 BetterShaders.exe 99 PID 2336 wrote to memory of 1332 2336 BetterShaders.exe 99 PID 1332 wrote to memory of 1480 1332 cmd.exe 101 PID 1332 wrote to memory of 1480 1332 cmd.exe 101 PID 2336 wrote to memory of 3896 2336 BetterShaders.exe 102 PID 2336 wrote to memory of 3896 2336 BetterShaders.exe 102 PID 3896 wrote to memory of 1864 3896 cmd.exe 104 PID 3896 wrote to memory of 1864 3896 cmd.exe 104 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 2220 2336 BetterShaders.exe 105 PID 2336 wrote to memory of 3400 2336 BetterShaders.exe 106 PID 2336 wrote to memory of 3400 2336 BetterShaders.exe 106 PID 2336 wrote to memory of 4468 2336 BetterShaders.exe 116 PID 2336 wrote to memory of 4468 2336 BetterShaders.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\BetterShaders 3.8.0.exe"C:\Users\Admin\AppData\Local\Temp\BetterShaders 3.8.0.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\2gTbeMldvUY1QbVk9q0VzKvt38D\BetterShaders.exeC:\Users\Admin\AppData\Local\Temp\2gTbeMldvUY1QbVk9q0VzKvt38D\BetterShaders.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,141,209,47,23,25,1,243,79,176,9,152,101,62,67,168,130,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,100,45,30,55,4,43,36,46,117,206,242,173,170,176,108,19,202,67,58,151,110,121,255,194,88,217,13,94,222,165,147,25,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,184,25,86,164,167,3,38,237,220,217,70,32,60,141,193,118,208,44,21,118,228,11,245,190,77,33,179,174,218,96,37,39,48,0,0,0,128,76,103,109,84,22,48,16,54,15,51,36,217,43,166,161,32,32,76,158,216,170,185,175,179,58,96,175,19,143,37,191,121,159,105,17,219,113,35,174,27,216,244,40,222,71,139,5,64,0,0,0,115,19,169,120,17,6,13,251,101,159,88,143,169,47,31,238,227,138,204,104,2,220,89,96,200,47,96,224,67,227,255,197,251,30,251,57,102,17,209,228,30,42,240,218,181,57,222,132,48,194,191,104,151,159,250,16,47,133,46,75,40,33,65,52), $null, 'CurrentUser')"3⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,141,209,47,23,25,1,243,79,176,9,152,101,62,67,168,130,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,100,45,30,55,4,43,36,46,117,206,242,173,170,176,108,19,202,67,58,151,110,121,255,194,88,217,13,94,222,165,147,25,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,184,25,86,164,167,3,38,237,220,217,70,32,60,141,193,118,208,44,21,118,228,11,245,190,77,33,179,174,218,96,37,39,48,0,0,0,128,76,103,109,84,22,48,16,54,15,51,36,217,43,166,161,32,32,76,158,216,170,185,175,179,58,96,175,19,143,37,191,121,159,105,17,219,113,35,174,27,216,244,40,222,71,139,5,64,0,0,0,115,19,169,120,17,6,13,251,101,159,88,143,169,47,31,238,227,138,204,104,2,220,89,96,200,47,96,224,67,227,255,197,251,30,251,57,102,17,209,228,30,42,240,218,181,57,222,132,48,194,191,104,151,159,250,16,47,133,46,75,40,33,65,52), $null, 'CurrentUser')4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,141,209,47,23,25,1,243,79,176,9,152,101,62,67,168,130,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,196,248,228,101,71,131,172,77,194,172,133,240,72,151,85,98,195,141,47,122,241,197,198,148,168,118,183,24,19,238,92,156,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,76,2,141,219,91,180,143,6,238,34,214,155,97,148,157,126,103,171,104,222,50,192,217,48,63,97,169,68,141,177,117,82,48,0,0,0,150,222,17,220,244,215,58,83,202,16,71,94,175,71,115,114,100,113,165,156,217,69,197,201,239,13,69,137,144,24,11,47,71,204,58,13,79,36,151,138,162,143,78,135,93,41,69,178,64,0,0,0,26,141,90,72,10,239,131,16,201,255,131,222,75,56,68,55,164,187,184,168,44,178,127,13,248,51,78,90,195,220,241,31,26,75,196,19,204,92,213,64,33,47,113,82,32,246,160,115,246,10,214,176,205,153,94,243,120,0,56,214,118,215,232,220), $null, 'CurrentUser')"3⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,141,209,47,23,25,1,243,79,176,9,152,101,62,67,168,130,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,196,248,228,101,71,131,172,77,194,172,133,240,72,151,85,98,195,141,47,122,241,197,198,148,168,118,183,24,19,238,92,156,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,76,2,141,219,91,180,143,6,238,34,214,155,97,148,157,126,103,171,104,222,50,192,217,48,63,97,169,68,141,177,117,82,48,0,0,0,150,222,17,220,244,215,58,83,202,16,71,94,175,71,115,114,100,113,165,156,217,69,197,201,239,13,69,137,144,24,11,47,71,204,58,13,79,36,151,138,162,143,78,135,93,41,69,178,64,0,0,0,26,141,90,72,10,239,131,16,201,255,131,222,75,56,68,55,164,187,184,168,44,178,127,13,248,51,78,90,195,220,241,31,26,75,196,19,204,92,213,64,33,47,113,82,32,246,160,115,246,10,214,176,205,153,94,243,120,0,56,214,118,215,232,220), $null, 'CurrentUser')4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
-
C:\Users\Admin\AppData\Local\Temp\2gTbeMldvUY1QbVk9q0VzKvt38D\BetterShaders.exe"C:\Users\Admin\AppData\Local\Temp\2gTbeMldvUY1QbVk9q0VzKvt38D\BetterShaders.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\BetterShaders" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,12707938682525165998,4858843997834756897,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220
-
-
C:\Users\Admin\AppData\Local\Temp\2gTbeMldvUY1QbVk9q0VzKvt38D\BetterShaders.exe"C:\Users\Admin\AppData\Local\Temp\2gTbeMldvUY1QbVk9q0VzKvt38D\BetterShaders.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\BetterShaders" --field-trial-handle=2188,i,12707938682525165998,4858843997834756897,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3400
-
-
C:\Users\Admin\AppData\Local\Temp\2gTbeMldvUY1QbVk9q0VzKvt38D\BetterShaders.exe"C:\Users\Admin\AppData\Local\Temp\2gTbeMldvUY1QbVk9q0VzKvt38D\BetterShaders.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\BetterShaders" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,12707938682525165998,4858843997834756897,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1256 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4468
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f48896adf9a23882050cdff97f610a7f
SHA14c5a610df62834d43f470cae7e851946530e3086
SHA2563ae35c2828715a2f9a5531d334a0cfffc81396c2dc058ca42a9943f3cdc22e78
SHA51216644246f2a35a186fcb5c2b6456ed6a16e8db65ad1383109e06547f9b1f9358f071c30cca541ca4cf7bae66cb534535e88f75f6296a4bfc6c7b22b0684a6ba9
-
Filesize
1KB
MD5859e42b26f7ee23d5506b3a25315e7b3
SHA1e5006776b0aa2f17f1917bee838ff98d587b93b5
SHA256df88a26688917e567b1aa297e8fe00b22163a92d7374bf8c50f46d76a4e0f79f
SHA512b96d2617bd1f616e384382642ec86054925ab498089b467f1fcf109c4dd99451423fa2d28f0edb27f9238f6d4f493dfd28d696ec0eeb250e03b496c050933fd1
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.8MB
MD53072b68e3c226aff39e6782d025f25a8
SHA1cf559196d74fa490ac8ce192db222c9f5c5a006a
SHA2567fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
SHA51261ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
-
Filesize
1KB
MD54d42118d35941e0f664dddbd83f633c5
SHA12b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA2565154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA5123ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
-
Filesize
9.8MB
MD5b620990ddbd932d6475152e5a833860e
SHA170de0b3d7ffa77900f685c1788b32997a61ec386
SHA256921452a09f92f10da4cfef0521acd6ee6c689c630661ed35189e793de2c99fc5
SHA512ba84b5e6281dd64d5da41d0db35942b6c0b1ee6b47d24dedd5006be40b2d22d90f58dc653e17893347900fb1bfcd37b0f2fff5b532175ccacc3b63d98fe42ac7
-
Filesize
146KB
MD56c2827fe702f454c8452a72ea0faf53c
SHA1881f297efcbabfa52dd4cfe5bd2433a5568cc564
SHA2562fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663
SHA5125619ad3fca8ea51b24ea759f42685c8dc7769dd3b8774d8be1917e0a25fa17e8a544f6882617b4faa63c6c4f29844b515d07db965c8ea50d5d491cdda7281fc5
-
Filesize
220KB
MD577088f98a0f7ea522795baec5c930d03
SHA19b272f152e19c478fcbd7eacf7356c3d601350ed
SHA25683d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d
SHA5125b19115422d3133e81f17eedbacee4c8e140970120419d6bbfe0e99cf5528d513eea6583548fa8a6259b260d73fab77758ad95137b61fe9056101dd5772e8f4a
-
Filesize
4.7MB
MD5a7b7470c347f84365ffe1b2072b4f95c
SHA157a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA51283391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
-
Filesize
2.6MB
MD53b74a017d60d588937ccb7453ee3df14
SHA137505b193d45986daccb3e4c44f40675d0b4c40a
SHA256395fc47fdafec2e93c3534da579393466703ff6f9380ca6d2c2e7628462d40ce
SHA51238efc1f695375bc6599848b4a5d10aba8571c618b8ecc3a007dd953c9e724e9d7839eb27e2cefd2c482bd9f5f363733563a592b8fa8af16e311644e44bab0872
-
Filesize
10.2MB
MD574bded81ce10a426df54da39cfa132ff
SHA1eb26bcc7d24be42bd8cfbded53bd62d605989bbf
SHA2567bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
SHA512bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
-
Filesize
469KB
MD5c7e24104c3d3e96b15fd0e309208f6d5
SHA1974f73ce194123d7a024aa1dcfa3cbf9f0ceec0c
SHA2565264e6461af122eced8ef3ce198c1c40851839d987f1e974e5c760dd847b9552
SHA512e7d8203c895aaff2e29d870979fecb2b1ccf8334fa494341bde95cebb80f51893998ed65526dd433daad7a600dc14c97417c7069cc3db9516f741280d11609b0
-
Filesize
7.6MB
MD57b6eb3934932d133f25cfda71c2cf129
SHA1da9dfc18f03667bdc950b11cdb7db31d2417d27c
SHA256bb4625ec2c0811fc55f66904567035d8533d6a3b88250ee2dd848cbccd6c5dbb
SHA512059d97edb4ff4d380ce1c955312ea38509560f279b560108e7237197e80172bf38da0eda7f821efaeaf6106366faa0c5b29497f973773ee16c9eb41d5eda1b8d
-
Filesize
481KB
MD594af96b7f60a4cfb9d596cd8927ba37d
SHA1556833517bc6ad77b5427000f2c3dccad91b92e6
SHA256716e296c2f663ad90cdde85c5134582fc2305e5ebe10649fc9653bea533500a6
SHA5126605688a373a358ff1dfbeda1c09dd031e4a63de662555f5304843c31eb3afcedbc8ffa4dae8ddc1483b04ea24cb709ecc639a9902caa68731d8e44d04cdbd83
-
Filesize
782KB
MD534b24f035bad74764b7cc57420488180
SHA1fac3fdba1a94d7676ac4d71447178cfbd1fa4e82
SHA2569cff5c4af5997b45fb2a384bd73560e56bcb7710149e1a7e3e172d64e6eda025
SHA512a01da4c45c6295a57248603f01a6b6231c4ce400aa3ec94e4228b26e8cea995c31d52b2008f99d0f17482aad80f1d67725c32e0f37cad6b012b1022ecde998f0
-
Filesize
855KB
MD583121a8093e7a335c577f11eaf101794
SHA14716966d9793e02b28573acab943453ab56dd441
SHA256245410cc95c79310cbe9755530d6be829b9fbb3bd70f90c9531d933fe803e44e
SHA512117f9231cb3b1fdf6db70d0222098c4fe7ef2505db021b2f27225b58a6e22228d6cca48fc7d7693272d26ffec32244d090f64f2a5c900419f0d1ffa28b877d14
-
Filesize
892KB
MD5d08e8e493f0b3c8ab19070ab05a78af8
SHA1c5fa430269dc2d32baa6885de2453fa84c36f2fc
SHA256d223e994ad1aa6e747507187f724cdede8c369d2e8e0def50c4a6c912dba3880
SHA5124b415fa2ae6ba399674f90ea67e571d90a35fff1ce93df77f20bf692b52c92bfc41e5a3622776e3979b1662fecd2d9665209d5d1d53ece1bff3ed01a28e499d8
-
Filesize
1.1MB
MD5696016f43190747d63befa354d76e50b
SHA13399e641930b820b627a4e28dea0a79fc457f929
SHA2561e49980f89360b395a70e844ccd0c43b3a34eab84461b1499e7621f757149e3e
SHA5123966fcc5988ceeb4dca79c0053fb428e5180029d44704faa4723334c69413a6eacf622e637857c1dcc096e129dd84e2369e4595ea50316cf8eb68696611a8430
-
Filesize
542KB
MD57ad12fe9117cd590312cd7d0b867de33
SHA1f71a25d4dc5cb8b5f2bf58db5f3e4cfbc2aaaf66
SHA2568f8511f02b6a1ea3022592d34b74abef93a5560567b09076b332961ab5a6236a
SHA5125b823124d4b0e424a80a0d4508baf5e892c6c44f56c432956c44817d4ac74895be1d10637c22838fffd7f06047d36e7849553e08ae808bf9ec7d37ab123f5692
-
Filesize
558KB
MD5c0b5c8b3e46c715f313ee78a788401ca
SHA15a59b4c2214f52c63f6e8c7ef7a11662c30a1ff9
SHA256f7eafc84e6e55fc7dcfbc749e0b7bbd7cf051390bef3dbc37f2cdeecf92637e0
SHA512b6a28846601ee937b21dc5e7c3b19e612b2a654e4de7e9dd7943f7b981ca6c3a1c86a93ce6a4b801debbbfbf71fdb243ca81e56163d44b2bc0fe8415ca5a55c4
-
Filesize
505KB
MD5a97f00b4bd958876ac55e9a3c73e7c79
SHA10a019a4e1077dbb735bacf7b19374bbeec1a3e6f
SHA256247790939c3e549ebcc079b872ba8f3b9645875c0bae26fc49b36d9bf73c3b82
SHA512fd6d89f016b679e3f4afad590a591e592eaf4a147b7d7566a745a695cadc51957c5df06d0d60d52de00f434d8d8a5fdc27aa5ae29086762c5fc4615f4302a10e
-
Filesize
539KB
MD50e434b38cfd98a0979a4373b6ffd1b8d
SHA1cda239ac9cbe2b93597940cad6f8554ae61bc5b4
SHA256e1a2f20da317a6a7790dc0b2832d6533aa451a4cb2e06cf1a46525db26c96b12
SHA51200b00aa6420dd0f7849144bc7b1d6e8ac93fe2cd759d196c5eb143a4950fe0a3af9f468fc6d952d347fc9706fffad0d5744ab5e276b4b1e0cdc5b445c90197a8
-
Filesize
979KB
MD5271c3234e3a07223e6db8f6ab1c18f92
SHA1dbc1ecc686eda75627f3fa60d034ea4021da0acf
SHA25658ca76aa55e11a475c830ac89010d4431f455f531079c1e8a0943490b4dd8e4b
SHA51250e6fab168889a283e26eacd7731367032db41841f39fef0f99543b98266c3784ee62a956cd4415c83a6fb7451b3f618f4f3dcf9807cf9b0f2f595ce26e24aac
-
Filesize
439KB
MD5161d0ee49ed171ea8491ceb6c994d176
SHA11d85de03cc44eb4f78738006ccef4e5809ff8015
SHA25677a6578635a0cd3a89ff11116fa819ecb6b2609bf8e9ba92c687711c92c4e143
SHA512c8600ae02234bbd846fdcdf8dbe270a0aae259a3615805a271117b04a9a2be52180520d855617c7709d694859c28fa63ec2c107ed90a4ecf84194d9717b2d278
-
Filesize
443KB
MD588bbc725e7eedf18ef1e54e98f86f696
SHA1831d6402443fc366758f478e55647a9baa0aa42f
SHA25695fd54494d992d46e72dad420ceee86e170527b94d77bfaaa2bfc01f83902795
SHA51292a5c6cfc2d88272bb5144e7ee5c48337f2c42083bc9777506b738e3bcb8f5a2c34af00c4ccc63b24fb158c79f69e7205b398c9e22634dae554410450978a2c4
-
Filesize
534KB
MD50b2f21294e4ef0dc26b3101e3b050c15
SHA16964d2e5f15767e771697488b67042ad4eb7f399
SHA256453f699a7fa645e0e1d3427e06e65c3626540c5f68e9469e1cc18dcd141c2245
SHA51254be2b630664ffdc02cfd58803a3e4d74edebcd814efbfc1530c777030291387f09bab5200f97951a47c70e6b1881146b798dbfc1deb2f953b9e91f3519c126e
-
Filesize
534KB
MD52e163e56cce7f1a0feed489ead44923f
SHA16a1b40ce5c3f210ccc5f64383010fa4796e36df9
SHA256ca83c63f335929fa300129c9661ec295a3d5749ee9edb0f36ba8da902ff6a6a6
SHA512509288b4324fb5f3e7a505aed4ea806d90fd437de52b2edf773187520c12b3d280020d90e98b0c091561da7e67c83b56846065a63d5f584cca95280a8e111c3c
-
Filesize
485KB
MD523c45c6f09d13fea52fd88e366348caa
SHA1d82057e2ce05d123d859be488adc27074771c73c
SHA256d4111b9c6baaa2404ea5c20dfefca1dc892a244b26c420314ee467fa2822de5e
SHA5120009c1c61839933db63e3bf73dac63453d7d5c94255da3c0650c9111424415c91bcf1f914be7ace119fe290c4aae9f282c6016a04c4082c881882b5c3f2d04e7
-
Filesize
794KB
MD55655e0036c0f7a656eb1320309d155dd
SHA1a38bb37d74b0de424c3df345a1fda68cfa916fb5
SHA25669454dbec49fa935ce242888de4614bf5f5321af5f26eebd3fd9a6c768652559
SHA51248473a81c4c611849efb531390fed7efe8f0204b45fa53ba4a1445c869c37ad49293316f00c3ca6147a44d87411aa528168528f36f52b782de3baeb372464845
-
Filesize
495KB
MD5671cff3aa38e9810a6fdd11c91861acd
SHA16062122660beade0e00cb86d9e2c8abc274f9f59
SHA2563e69afb533da49338f036ad2c286c4193ce6b5a2476230dc4a1140cdaf03a6fd
SHA5123127764aa594de149528b716ed135aff1e45a3fdf4a0a936b9240785812be2509f61d629c4dfae1759c87defab61e34203bf2a196381e87633d0fd02a1b76454
-
Filesize
559KB
MD54990033756bc1b2410e77a607bb62f8c
SHA1a02c0f347606bf50aa6f281e42d2d66ce6155299
SHA2563265ae5b6c16a09b1ec9ea53181de78df75e951c3ce28f33d4c483088a9ab37b
SHA5123d45c6dd30eea6d6929039c0cdaa7bb6f7b665fe67fc7a5ca79567d4fd3f907011857e5cb43c16cce9c558d4f669618bc5378f05fa583b19360df58b12b5f913
-
Filesize
577KB
MD5e7ee691a2570b917483afabe167d79d6
SHA1bfdb9a930223d2a7ca6e9c493e453990a8434a4e
SHA25610c0b55e5935764f194f9d787fcdf03a6b87df23ae4a179deb5b9ba4451b0220
SHA512034807542dfce6b2e74a4f42c2923adeea3ac930688ebb1844f9650a4f8143b807a2a30b521bd6b131062fdf8425c77cf6a521c58bf10ba81dcd4e7274134c4d
-
Filesize
1.1MB
MD586b829b3cdcf383f11ffa787a32446a0
SHA1c9f626a97bcf00541876caa7a49d23e0b84b83ef
SHA25674c62dca0b7a310aa593d1dcca8b0b0b382b052837e7cae6b87cf05b8b346b1b
SHA51272b69cc9846fb078a8c03afd60154a3b55bc828b9e13b5124a473c0ee528e3cb3ed67f67d7d763ec8e78883640c53d4c88a7a14552b851d493abf65e269353f8
-
Filesize
696KB
MD5433eee3490a1ea856768856f11abb357
SHA1f40c06dfe34cc21836c35b53310019265021abfb
SHA25630a044df9a5c665a2653a90e1a5a3868b6a16861ca945e70da1a65892f4eff44
SHA51220893e629a067c6b92cd03a1e805c6aad857388d7556e36547ebf8b51facef330ac8a0954ff7222b406655bb9254536e2857b1bfcdb27e829eaa9199fdc1189a
-
Filesize
1.2MB
MD53751919d994ad0a1b9657b947945c5a4
SHA1cdf66f0260e28076e56eedb07239e65cd195759f
SHA256d9979ea297325ae36f2a467b07d41e281f0b3a9a77373cbdf76200eaed2f48a7
SHA5128c161c5ff23cf35b6ec5c49481445d7cb978a8bafa5635d2dcdee435f73dd9bca994bdb51010223ded6c49089e5b4879ec3b4fe4a54f864fec00247c96678130
-
Filesize
538KB
MD5ee08edd61377c4d0aa6e1749ebe4cdb5
SHA1a2ce9d5f682e0b61fc2a92d42a8f90a32c6ed70c
SHA25686761c837293c3450e68905750d6888ad76cf7fea78d6468489c8ef156a444d6
SHA512cb140f6955a3291543b419241b0c16f8dd757643d40a7241cfcf8f2bb4dfcbc495e38716f0a54c773e91bc27415cf8450e954386227f3bda81434b8331cd7296
-
Filesize
581KB
MD592995b10868e466811b909c9702f1727
SHA16cd34086b876bf07dc1222cbd33e8fac60e401ae
SHA2560a62d168c0f6d9d651dedb4e01be5b533b94e8617535cd70ad22717748fbbc64
SHA512412d0f253d31eff5819fc05ed0da6284a39cd5dbc3f8dac81153511c69aef9cd3f1170d3c6a74616e3d9c51bc457045e9715456b1ef50e139f68f667d5662f53
-
Filesize
478KB
MD5fb42de6be21c78da1b05c518c5625882
SHA17d8d4e28ea196e3e48df4999d94a04c0be31de16
SHA256d9fc19e683240404a60d57037f24e1d8b20cfda4c8bcacfed577b86cd8988517
SHA51263885e8c82dbef4902c75ae7bc4c3f953057236b07d6919bf3a9f8d1e6ec0ae2cb94cbe0366e56e1272653087faf2fb07b92b18bd312e8e1b38fc76ff5eb3922
-
Filesize
527KB
MD5e25f7dcadda21b072cf012d3c23600f0
SHA1f172e6bec3cdf58260ae2b265bb2d2c2024d3c2b
SHA25653b018b82272a07929a3c4742d5217d81c49c54413010af3a9e8f3634d0ac361
SHA512fb12276e9dca5ec27bc85137872e44f5dd1451ab9bc4f87a18e279a33de8eb694c77769a58041ec2a3bf2bc8e0ff5cc42595d6aa89b6b3542d6124515502415a
-
Filesize
644KB
MD5e049505ad91c088b2bc6c11f478810f6
SHA111ccc84a0cac8b14728997eab4529e2f365e55b3
SHA256014c329d7c5d55364b4fb237ef3b117272a53f7a7e5f0d0cb7b2861942a5345c
SHA51251b983cbcad124687965afab566ce52fbab6d71b25022a377b091cc8f6b2435051fff70bf671df1d7e363ef64b80216cf64a6d05a472d55fbb3ba0ed29956bc6
-
Filesize
1.3MB
MD53c7b860c21dc86f7e62ed9033960a487
SHA147e870d1d1f758a6d8ab6da227cfdd2ea55076cd
SHA256b2658ad69c7b761cd12fead16e52bbdf1f1731b2ab96e6948f356f373ca01a76
SHA5129820633cbad79f90699c5c2813ef08d28c6c1f2e496780288a710856189686a0e1de3e27f5333e35fb3bc30a6bc81b8bfc093bb0c59cbb039c7afa8814791378
-
Filesize
544KB
MD5114ba02546a8662240b7ec23d101f47b
SHA17d6f10e25b6f4bde6659aa6d661a1139c3db539a
SHA25643086597d703d66c410d099ca76dbb2f35835b605f93fe9a98342a08cdda5c0a
SHA512d1097da68e6cdfc5cb963e6e5d18da714f3a9f3d76ad064ab9197fa8e379eff502b7b01e7b332aa1ec0ed98157537d28c2b7db8530e512e3b5b784a56d19367e
-
Filesize
583KB
MD51bab0f6c08b1cb26db455aaf581490dc
SHA13a32246b812e8ed35ddf0a6842b8bf26b19be9d3
SHA256946351ed2d74f247dea0f2742fc36d89225355480f0cec99d71599ccce3ea9e1
SHA512c6e4502fda62e2606e31a7c67679d59d21a04342c507e1fa39ac59156a4d1e1cab1923de4bcf30b735d5bcf89824d4283b57db11af9673b5b956c2f883a3bc7c
-
Filesize
582KB
MD5e4993f39d6fa671658aa3ce037aec60d
SHA12db9bfc42b07060f6e256c74a01c348cd6c2ac0a
SHA2561e6f9a40f4fa1206117063234399bd7c1e7d198cbf6c4ad633e5e18ad0929836
SHA5124192274330be238a93e370fc3fc8ada444b38fa1464889f0e3d0f6c5e548f7f7de14248937d45f8aa84c043078a69174ac1c9a5894fc9b4ff8f10deef6f77e5e
-
Filesize
1.3MB
MD59f0422326953a0c48c1db82ca2a9d639
SHA12305bc895e9ccc5b9a3d661e891c4f06d8a503ff
SHA256f2fb440eb0518dc695810fcb854b20b72aa47e5ffc75c803aacf05861d35a94f
SHA512a899dd975a56a53503b5cbc7448f54423b18bfbd917f73f0871840d6cf6a574bbaac8d735ae8de6a074cd78c43b6640e3e46be1550dcef8f8cfd1971cc1513d6
-
Filesize
1.1MB
MD5b0e1f36587445f28f22777d555683a0f
SHA142f7cd3c596c2f52662b86df9d9096bf822a80f3
SHA256a674db4e60152fc17a32d4b92add129adaebfc02a1a783a12653f984447c535e
SHA512575fdea827497ceab51df5fc8783f960b87d180f6031f0947525279d224189a6299943df37a014f7bcefc637ee23327fb1ae82eb77c175d63c515b29947ac0d1
-
Filesize
502KB
MD5c8d605a91b2b66603b379f5557783afe
SHA1d6f294eb91675182f658158ff9399592935c779a
SHA2567707f79a2a4aec553e68af87802a0f19d3714a25311fb7b8afdc6ff4a5b6c5ff
SHA512a9f100dc1fe0a19a0a0a4360fff392af4e07eaed6613ab6dc61548d36afe55e4c9183e6584ca4e15feb477947ee8a79a96775718197129a555319a162281b9c7
-
Filesize
487KB
MD5d1e0429ab9ad3821bb0ad398eb3ea362
SHA1ee4efa5aa14bb10e70f3542dbe0b256df6c99fcb
SHA2565844a4a660e41045bf86dca31242e33a6c4726b8dbde15161261446d29ec7add
SHA5125189abc6844372ed0c115c6ce341387514034dc2c54f068fe6b479d12ee76d5a727653fa0dabb2950eabff6e6f529c17cdd7ae822515d20b74889012d27f7032
-
Filesize
503KB
MD5525b638051d9ac36fa759039c17283c4
SHA1c1922ba3bceae681b90064b60fcb85a7e6c944b1
SHA256a2335c62cdd4875660e955b0d65d9e995946b1281ed7f34521d3ee01cedd643c
SHA512680c18b6782f977c87ae0ecae9d1cc0e2590ad75d8146a5ee3e9b1dd9ed1081530f310e871bbd6dccbba42306d8f59778f202691e5690da1859e22d485fc75b5
-
Filesize
560KB
MD510659a05a7180f54fc46f122ab331052
SHA1968a0faea6eac3e82f694eb76d24228be58cb734
SHA25616e9adf63d98e00d0a5433dc9c08253c678d5e3ccdde11783da3c94e98f65e46
SHA512b815ed62b10bc5abf8bfcaf3a1e42f821bdccb0ebfa6ac15dfb0d1246c71f613fb8c7f2f9f57001377ab5ef700406d0ce3c338fe4a41065d98398341021aad6c
-
Filesize
527KB
MD5c3bc628628f8809ec2d18f997db6e540
SHA114c6f0215b7895f2648813ad033b59242d058a13
SHA2566bb17174a3d061afe86cf901cca658793bccc53f7edd1cbde0b58fe90e71a9e8
SHA51273ca0eaf1f1a250bf50db5d1ae2f3b58c93289703ea85a7bb891463412a63ea8a88fbf19976d9fba637f99cca097fcefda773d2fcf07daf6f5a1d270597703a7
-
Filesize
530KB
MD5e4565bfa531c9c4344f84dc8be207c93
SHA15d1084ad5bff80383129850a853fe1319c23199f
SHA256fcd194e5caf36be4958c559acbde4f28a957083bf2aceac893f9e5c9e65d8a95
SHA512531a318e8ef1683abe4bc7b44e7d3a4d6ef907d5e7ddfa1f5cea20414dd33060981afdb8d1f4813b05be90985f10fb892f9060f6c1f2b975984f12acc8cdce6a
-
Filesize
549KB
MD58c922129bfb61fe14fa035d965108823
SHA1aa8d8dac978053163a303c1f1206480144d4b330
SHA25606c6486e8a42b447a55bd789bf2bc794354fa4be062139481e4612550f16c755
SHA51225f9c2b75febfe607cbdd872a82338aecb5f277ed2d3d80fe0ec01289e3361445102392ea23207658ac347a774a7f47bbe19672d49f080cd6aea220da5ac3618
-
Filesize
902KB
MD54fb18b712580caa5cdff8c8cbe9e67f3
SHA179bdeed0aa9bef9a8396a426e370b4022b09243d
SHA256bee87b5ef0ab61c05eb3ed4c43ba0900a75a853fdaef2218ffa1b2eaa4d29d21
SHA512fd91fae4dfded1fcb6cc0e6a6da4caa123c8347d1a9eff33c0d5339aa9854dc07bbb3c84e1880f260eaf932a1a2af9784157d5656b29d661e20961f499b1e5b0
-
Filesize
566KB
MD58e5ecfbf0ab9e00401f088489afed0c2
SHA1a99df2ed2a00ade4cde178f73893b84aaee521cc
SHA25625e0167d708a004e36e3c344e0209e979d42874122cae03ef2e2c5e110f39364
SHA512401ea003abfb4a32b52cfab912c2199800f54aabf1321802f973a9925f535d40cff9825832d98ca86eb3af794f64aa408dbbd99e2083f2e9fd0d02ec4debd301
-
Filesize
544KB
MD5be05e8eea54a25cd15d807264f8aa284
SHA1a63dc26044b31fb4e1a35b1f5778150d737ccfce
SHA25663963e60a45495ff762f02e02fd42c723d7c482a44c07e50473cbf7ccdd73eca
SHA5124163b3eeb5e55beacc53349cad6899e871d74109a50b28a001e98f0000cf6eb57d4e06f10a70557664f15f4456fbcbb80ac7dbd1174bd19a20975da108ef2dc5
-
Filesize
839KB
MD5b1f52cd111da3b1ea1f31e082f15ba25
SHA13f4f13a0d253e8fbcfc1fb93125feed51f03bc56
SHA2561410f7d93d53642ef9aa8dfd92497c923d71a97e419a6219c7bee7798c3561e1
SHA5122c0ae8d36c496d570d6e013f859caf655a74047a2a27b79ad0895eba5a46c0895d123d532b8bfa4370ce67caf6b874cb29d751fd025586bfafad0bb800b22144
-
Filesize
489KB
MD58132fd35c20f775508f5440b7f3d6871
SHA14e50c2b45c69e95f95f34398a7a4babc06420c1a
SHA256867687296810c4a95a1876edd91ce08e57ff1894c9f22913808fee1d21362589
SHA512e13ca94f6766a49a9b11a128bad1a5803c3ae9aaa9a8a536995eaf510da071995fa27b087fd3f14422cf21792a54b9527a1fe658947a446a6764b32a86479d3f
-
Filesize
515KB
MD50787972a076c6690e7938758c2a92e24
SHA1dbf02e5a3ae26acb060b533bb006756c19122bfe
SHA256eb96ab83e2e08e811928742590178e97454863bc581dd8574d6a644fd3c6615a
SHA5129f3560a3b648b1a7025cd8a98c39ec7634883aade1ac2c7836fde890cc04bd009aa5c1bca8354ee1259ebcd9482326c51a7d21bdee3caf92984ecbefab35d34c
-
Filesize
1.3MB
MD5088f7313392bd5bd898a984b434cee97
SHA1bda9d5f5e87055674aecdb609a46a046bb0a6903
SHA256e2868cbfde36485e8227ec24789a809ef4590f8841e5ee625cee154ba3701e78
SHA512f8849d13924da2f5e3bb98f2aae19317d3f4260ec8e916ab88a91d6af97c9ba8fab929f91acb3b5575e30e87dda847f1192b6b2dc1d05341ce75a86a4fee8edb
-
Filesize
1.2MB
MD5d251d089aa789bccc27a0b473d39e46c
SHA1283d8fb6b6195b3427144773ffc4691c82e31f0e
SHA2568dd7d206379445bd9afa4e01ab986c439cf70841d080fca6e152b453e94fcc49
SHA51227e6f13f6c7937c8121451d70ee90d2a2ce5e519d17e882a86b29a6a78764427022c36b6a99178e9933e01500b55bcbfd0dc79a6f028a046967c2c53f78424fa
-
Filesize
1.0MB
MD533dae3c79e7c1798eada31b70e3f2518
SHA1c386f4babd6545c915dda9dfd4bcc8cae5ff6c86
SHA256a88de31d7605a1c3eed2b5008cbf31de368d91fd57a543c995a3c2263144054a
SHA512a1d033f85ba340a8f6f3da1aaa15bb8b04abc1acca1e9554af04576f512d38e6088c406f3227e03239e741eab68fe3a83a0ee13aff3c51554fa7e41b1d42029d
-
Filesize
527KB
MD51e661df0ee32346b7816e1cec439e9da
SHA12bd38e0a4ec62f306aae932d8e448a0911a5a63c
SHA2566c5dfdfe34c0f6b2b00364dbd7ef3c62fb0d71a163f9254a7b4b3624d66c4ec0
SHA512ef49c1f329f00e2a9350e7a6e3789c6ea2c84026e541717e4d72ea3723ac29e9be3e0d4a82e36ccfab27365feceef0012c209c53e3b079148140e0f08f55de56
-
Filesize
902KB
MD5b11fcf5670f611e270552a51e8f4000a
SHA1c28630a621b77df7434fb016f5b1e50d456cf296
SHA25696f45509b52f046e70f3f61416b93ba8f2f5a0f06d7d849056161300a3ac6e5c
SHA512a6f357825e59c35f72d740ca23300b3e233be1949dc4c5c5a3a268f4e0194b0be839f95fc125d8527d851971952c09ac233b294002f43911c2599859d935e8c7
-
Filesize
790KB
MD57b5fed5150135b728bf8865246f7c8fc
SHA1214b0f507ff6384b1b305f1718db43023499eeaa
SHA256a0c752a805da7dd6608ad04625734f4d27cb75b682f51b2dc8ef08350cc7a2cc
SHA51281fc55db4b0635e09057fd060d9eb72bda5a5fd2d2e1e4284e1b45098b287c609526c766b030dd0eaebc0836a32bcbf6dc0aae94327c103f3f736b5cd051a8a1
-
Filesize
624KB
MD5b6174a2dd1e3f557cb99060fc3101063
SHA1be115f1d2dc8135683a182ab5c09feab74a3c97f
SHA256b654478c2d28b97d821a75543a0494bc35548749fc3eeb6b33b08b4f5f4fd84c
SHA512ddbd38e7513f213b3603b1fbf16ad21fa34382cd11e33201cf579c2913a7b6e143a03bf12f11afb281a40c6948da9844b6c9d5ab372d7500184014e98ea74c19
-
Filesize
450KB
MD58af3f2940137687b483ff2f4d9185b98
SHA158ce1fcadd8ca27abd11f0614401a12a7e93b11e
SHA256766f8ac9d4e06437fd3300608ad4d31228576dcaa1e164ccbc4333d56493e9fe
SHA512fe55fb3d0abab843e4ea1a33d590b3a9e885f6ea8a38cb8f651d090e8c5ea3400efd212502cac500ef26cc5d6b7a4a7cb66e4aee1a4bb13b97f0926ac99b16e0
-
Filesize
445KB
MD5ca8bf0d267507545580758c81e9fb2c2
SHA19ec7a2e731775bf3224317681847ffc54376702d
SHA256eb02d499aada4f358c0776c301416de758167ada695503c0e72135ee462fcdfc
SHA512d5322739253544d519d52aaf8a34fd0fcf3abcc49499e60d320265e85b173f49189d0f95c7ff67a9369400759830141bc342de7fb710cd047e8832070007716f
-
Filesize
5.1MB
MD565b03275e42049efcdb1d51da6dc43db
SHA1ec69b7de36ca9876ba63005a67f6a204203b7834
SHA2565e5a08f2b85927312b2cb9e0930e7af7099825d5783d470d40deff5bd0ebaf25
SHA512731a0252a4970904dc4c706f1183fbe39b06e85267f1b165a529165d3b2d748cc2d944249c9ed8ad69827c929185fbc5b83963ad37b98f940ba12b448ddb58f0
-
Filesize
11.8MB
MD5e17391bf3cc98be5554b509c39908fb9
SHA18f2e6726c940ce42df95a05c78385c824b4d560a
SHA2567fbeab871461f743124788a03f048c21991e6f8cd165cf7af5ed87bf11126e3a
SHA512998750ec0971f5aa7102253b38eb786dc3ba1f5ef9870a34ba7e4366cef37c04c15dca75467b17cfdb0b8c6950f042615ada8f6689d8cf8453460456133e67aa
-
Filesize
105KB
MD5792b92c8ad13c46f27c7ced0810694df
SHA1d8d449b92de20a57df722df46435ba4553ecc802
SHA2569b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA5126c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
-
Filesize
300KB
MD5f7c9b4ea6c9d3e22236cb9aef84bb6c5
SHA156d24d42dd338ece109c11ed2ed06f4b25d5a100
SHA25643ef9734d64580cc3dd0b9eb4f17ef69fe44945f1e34cb1342537facfc25d641
SHA512a640e365950b9cc2d8b44650b21f88f483da39ea16261b5b5f59a14d9a97aa388551c2fbf44820324b23a0b97d8ff1f442582dbe19c3e03db4c183b680bf50a7
-
Filesize
641KB
MD5936a529299d925f06181035c01c3fc71
SHA11795ff36f04aeb830dc47c7648890bc4040eb711
SHA2567249d4a31a52cdb29031445b9ccbe0ec2ff1b86c947fc16f8a0a96d5bd071898
SHA51260fc3fa4ecef679bd1041e5c072c97ef907a0f6026aa00616cfdc69e4458cadcd2812ce0871a1aae13a5196357dbc3325589e00084bf8cbbf791db9e077a79e6
-
Filesize
5.1MB
MD5063f0a33deddca0a6599386c12ee57a5
SHA16e05dfdfa7d5e5f35b593662227055011356ab19
SHA2561bcf8e101bc58413bf7d64fb757cd2627b91a2b7830213657a1f0237b1a4980d
SHA51215eb123bffde32d4d2ca22802320ecd697d091824949019420c082c2d57767aa04728874dc79bd02835e88ec7b4104f3553b4f09478cfee066273cdaacd916b2
-
Filesize
106B
MD58642dd3a87e2de6e991fae08458e302b
SHA19c06735c31cec00600fd763a92f8112d085bd12a
SHA25632d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
-
Filesize
935KB
MD5fb8cb93daa4650ff759a96108c972bc9
SHA15bc7321f696a198496f9adac4246d139b7a5ca2e
SHA2563389cf4e90f961466f4d0a226e649de628a537f0c2c1f6f444473f8330d94c57
SHA512f05270c24583e3141fbceec64761156d561b8dcd334cfdaf2a42e5cedb478f1f75b42341b2bdb0e0daa011d0d1701890e91e8c110c90b06d664bde932a5f5560
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df