Overview
overview
7Static
static
3VideoDownl...,].exe
windows11-21h2-x64
7$PLUGINSDIR/INetC.dll
windows11-21h2-x64
3$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...ht.exe
windows11-21h2-x64
5$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
02/09/2024, 22:48
Static task
static1
Behavioral task
behavioral1
Sample
VideoDownloader-[6c4e6751d63d9e03,,,,].exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/INetC.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
$R0/Uninstall Televzr Light.exe
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240802-en
General
-
Target
VideoDownloader-[6c4e6751d63d9e03,,,,].exe
-
Size
883KB
-
MD5
c81cb68acf93b90668ac70684d27412a
-
SHA1
d63748de51af206bd9866abaa48ce9423d1885eb
-
SHA256
9fdb487bceb937fa973c4e0cc2dfd09888be0cbf09aa375a2464be0829110b29
-
SHA512
c5b6af547bb108d19500b6a1a2a54b8dd9a9b8fa1525008a980cf601eb45a1164e631c77b2b103195298d41c341fbfe2ec35848d1201d4b93ced10855a590409
-
SSDEEP
24576:riXE3goN3MMDu173CTPG1szLSvJwk+bnf/8:pXuMK73C7fqvCk2nf/8
Malware Config
Signatures
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3108 tasklist.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Executes dropped EXE 6 IoCs
pid Process 4804 Televzr Light.exe 4368 Televzr Light.exe 1780 Televzr Light.exe 3120 Televzr Light.exe 3124 Televzr Light.exe 1624 Televzr Light.exe -
Loads dropped DLL 20 IoCs
pid Process 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 4804 Televzr Light.exe 4368 Televzr Light.exe 4368 Televzr Light.exe 4368 Televzr Light.exe 4368 Televzr Light.exe 1780 Televzr Light.exe 3120 Televzr Light.exe 3124 Televzr Light.exe 1624 Televzr Light.exe -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x0002000000025d9d-601.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Televzr Light.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Televzr Light.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Televzr Light.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Televzr Light.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Televzr Light.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Televzr Light.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mp4\shell\open\ = "Open with Televzr Light" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.avi\ = "avi" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\URL Protocol Televzr Light.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\ = "Televzr Light" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\shell\open\ = "Open with Televzr Light" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\televzr_light\\Televzr Light.exe \"%1\"" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1287768749-810021449-2672985988-1000\{A31638C7-4656-43BC-B5DA-18C03BC856C1} Televzr Light.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.m4v VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.m4v\m4v_backup = "VLC.m4v" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\DefaultIcon VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.mp4\mp4_backup = "VLC.mp4" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mp4\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\televzr_light\\Televzr Light.exe,0" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mp4\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\televzr_light\\Televzr Light.exe \"%1\"" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\avi\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\televzr_light\\Televzr Light.exe,0" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\avi VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\avi\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\televzr_light\\Televzr Light.exe \"%1\"" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\m4v\DefaultIcon VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mp4\shell\ = "open" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\avi\shell\open VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr Televzr Light.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\ = "URL:televzr" Televzr Light.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\televzr_light\\Televzr Light.exe\" \"%1\"" Televzr Light.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.mkv VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mkv\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\televzr_light\\Televzr Light.exe,0" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.mp4 VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.televzr VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.televzr\televzr_backup VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.televzr\ = "televzr" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\televzr_light\\Televzr Light.exe,0" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\shell VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mp4\DefaultIcon VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\m4v\shell\ = "open" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.mkv\ = "mkv" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mkv\shell\open\command VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\avi\shell\ = "open" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\m4v VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\shell\open\command VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mp4 VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\avi\shell\open\command VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\shell\open VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mkv\shell\open\ = "Open with Televzr Light" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.avi VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.avi\avi_backup = "VLC.avi" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\shell\ = "open" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mkv\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\televzr_light\\Televzr Light.exe \"%1\"" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\shell\open\command Televzr Light.exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\avi\DefaultIcon VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\m4v\shell\open\ = "Open with Televzr Light" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mp4\ = "Televzr Light" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mp4\shell\open VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\avi\shell\open\ = "Open with Televzr Light" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\avi\shell VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.m4v\ = "m4v" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\m4v\ = "Televzr Light" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\televzr\shell\open\command\ reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\.mkv\mkv_backup = "VLC.mkv" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\mkv\shell\open VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\m4v\shell VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\m4v\shell\open\command VideoDownloader-[6c4e6751d63d9e03,,,,].exe Set value (str) \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\m4v\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\televzr_light\\Televzr Light.exe,0" VideoDownloader-[6c4e6751d63d9e03,,,,].exe Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\m4v\shell\open VideoDownloader-[6c4e6751d63d9e03,,,,].exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 3108 tasklist.exe 3108 tasklist.exe 4368 Televzr Light.exe 4368 Televzr Light.exe 1780 Televzr Light.exe 1780 Televzr Light.exe 3120 Televzr Light.exe 3120 Televzr Light.exe 3124 Televzr Light.exe 3124 Televzr Light.exe 1624 Televzr Light.exe 1624 Televzr Light.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3108 tasklist.exe Token: SeSecurityPrivilege 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4804 Televzr Light.exe 4804 Televzr Light.exe 4804 Televzr Light.exe 4804 Televzr Light.exe 4804 Televzr Light.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 4804 Televzr Light.exe 4804 Televzr Light.exe 4804 Televzr Light.exe 4804 Televzr Light.exe 4804 Televzr Light.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 2212 wrote to memory of 1440 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 80 PID 2212 wrote to memory of 1440 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 80 PID 2212 wrote to memory of 1440 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 80 PID 2212 wrote to memory of 1412 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 84 PID 2212 wrote to memory of 1412 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 84 PID 2212 wrote to memory of 1412 2212 VideoDownloader-[6c4e6751d63d9e03,,,,].exe 84 PID 1412 wrote to memory of 3108 1412 cmd.exe 86 PID 1412 wrote to memory of 3108 1412 cmd.exe 86 PID 1412 wrote to memory of 3108 1412 cmd.exe 86 PID 1412 wrote to memory of 1160 1412 cmd.exe 87 PID 1412 wrote to memory of 1160 1412 cmd.exe 87 PID 1412 wrote to memory of 1160 1412 cmd.exe 87 PID 4804 wrote to memory of 2852 4804 Televzr Light.exe 93 PID 4804 wrote to memory of 2852 4804 Televzr Light.exe 93 PID 4804 wrote to memory of 2852 4804 Televzr Light.exe 93 PID 4804 wrote to memory of 3184 4804 Televzr Light.exe 94 PID 4804 wrote to memory of 3184 4804 Televzr Light.exe 94 PID 4804 wrote to memory of 3184 4804 Televzr Light.exe 94 PID 3184 wrote to memory of 3828 3184 cmd.exe 97 PID 3184 wrote to memory of 3828 3184 cmd.exe 97 PID 3184 wrote to memory of 3828 3184 cmd.exe 97 PID 2852 wrote to memory of 2996 2852 cmd.exe 98 PID 2852 wrote to memory of 2996 2852 cmd.exe 98 PID 2852 wrote to memory of 2996 2852 cmd.exe 98 PID 4804 wrote to memory of 4368 4804 Televzr Light.exe 99 PID 4804 wrote to memory of 4368 4804 Televzr Light.exe 99 PID 4804 wrote to memory of 4368 4804 Televzr Light.exe 99 PID 4804 wrote to memory of 1780 4804 Televzr Light.exe 100 PID 4804 wrote to memory of 1780 4804 Televzr Light.exe 100 PID 4804 wrote to memory of 1780 4804 Televzr Light.exe 100 PID 4804 wrote to memory of 3120 4804 Televzr Light.exe 101 PID 4804 wrote to memory of 3120 4804 Televzr Light.exe 101 PID 4804 wrote to memory of 3120 4804 Televzr Light.exe 101 PID 4804 wrote to memory of 2424 4804 Televzr Light.exe 102 PID 4804 wrote to memory of 2424 4804 Televzr Light.exe 102 PID 4804 wrote to memory of 2424 4804 Televzr Light.exe 102 PID 2424 wrote to memory of 1824 2424 cmd.exe 104 PID 2424 wrote to memory of 1824 2424 cmd.exe 104 PID 2424 wrote to memory of 1824 2424 cmd.exe 104 PID 4804 wrote to memory of 4876 4804 Televzr Light.exe 105 PID 4804 wrote to memory of 4876 4804 Televzr Light.exe 105 PID 4804 wrote to memory of 4876 4804 Televzr Light.exe 105 PID 4876 wrote to memory of 3036 4876 cmd.exe 107 PID 4876 wrote to memory of 3036 4876 cmd.exe 107 PID 4876 wrote to memory of 3036 4876 cmd.exe 107 PID 4804 wrote to memory of 4260 4804 Televzr Light.exe 108 PID 4804 wrote to memory of 4260 4804 Televzr Light.exe 108 PID 4804 wrote to memory of 4260 4804 Televzr Light.exe 108 PID 4260 wrote to memory of 3392 4260 cmd.exe 110 PID 4260 wrote to memory of 3392 4260 cmd.exe 110 PID 4260 wrote to memory of 3392 4260 cmd.exe 110 PID 4804 wrote to memory of 3124 4804 Televzr Light.exe 111 PID 4804 wrote to memory of 3124 4804 Televzr Light.exe 111 PID 4804 wrote to memory of 3124 4804 Televzr Light.exe 111 PID 4804 wrote to memory of 1624 4804 Televzr Light.exe 112 PID 4804 wrote to memory of 1624 4804 Televzr Light.exe 112 PID 4804 wrote to memory of 1624 4804 Televzr Light.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\VideoDownloader-[6c4e6751d63d9e03,,,,].exe"C:\Users\Admin\AppData\Local\Temp\VideoDownloader-[6c4e6751d63d9e03,,,,].exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C more < "C:\Users\Admin\AppData\Local\Temp\VideoDownloader-[6c4e6751d63d9e03,,,,].exe:Zone.Identifier"2⤵
- System Location Discovery: System Language Discovery
PID:1440
-
-
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Televzr Light.exe" | %SYSTEMROOT%\System32\find.exe "Televzr Light.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Televzr Light.exe"3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe "Televzr Light.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1160
-
-
-
C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe"C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Televzr" /v userid"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Televzr" /v userid3⤵
- System Location Discovery: System Language Discovery
PID:2996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Televzr Light" /v vid"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Televzr Light" /v vid3⤵
- System Location Discovery: System Language Discovery
PID:3828
-
-
-
C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe"C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" --type=gpu-process --field-trial-handle=1688,11023142926712716617,184116178620457202,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Televzr Light" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4368
-
-
C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe"C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1688,11023142926712716617,184116178620457202,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Televzr Light" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes=fs --fetch-schemes=app,fs --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1204 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-
C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe"C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Televzr Light" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes=fs --fetch-schemes=app,fs --service-worker-schemes --streaming-schemes --app-user-model-id=televzr.televzr_light_desktop --app-path="C:\Users\Admin\AppData\Local\televzr_light\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --field-trial-handle=1688,11023142926712716617,184116178620457202,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2556 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr" /f"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1824
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr\shell\open\command" /f"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr\shell\open\command" /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr\shell\open\command" /ve /t REG_SZ /d "C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" "%1" /f"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr\shell\open\command" /ve /t REG_SZ /d "C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" "%1" /f3⤵
- System Location Discovery: System Language Discovery
PID:3392
-
-
-
C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe"C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Televzr Light" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes=fs --fetch-schemes=app,fs --service-worker-schemes --streaming-schemes --app-user-model-id=televzr.televzr_light_desktop --app-path="C:\Users\Admin\AppData\Local\televzr_light\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --field-trial-handle=1688,11023142926712716617,184116178620457202,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2368 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
-
C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe"C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1688,11023142926712716617,184116178620457202,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Televzr Light" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes=fs --fetch-schemes=app,fs --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2908 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C41⤵PID:2188
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
854B
MD5e935bc5762068caf3e24a2683b1b8a88
SHA182b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD59802555b78998a9b71e718b834fd1167
SHA122d27673e544c3f841ec9ce641080958ce27727e
SHA2569c861a87a8fe79851eb62ee9cce4234d0696769189932da1abc8ebeb40066c27
SHA5127e5c3f14b3c7af291cd32256e9766170653f62a0027331bbcabc04c3664327aa588fae5e164d83cad01082287ddd9daf81658faf65e98009b4d5e30e4aeded32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_0EA8BE9F5A236A565654851B389EB70B
Filesize471B
MD50b9fec2b46492995b622a88a6c629b54
SHA1b3e22cbb1285f977580942b6caec8dad558bc48f
SHA256b41c13ec66bf8a6b9f21dcc763a42efd2d566a8f13905c38818fd76970f68783
SHA512f2c2950e9bc146d64cfb6c9a734c8de53a8cf14b00cbb11729b440ba731edb32d6cf949c32902189020d4fa4c9ad9da3338e128524949fc38d93aeefa8c06833
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Filesize170B
MD5a1d3c116e2bc8c924e98d9759e662029
SHA16909c0f952f21986a725fc70ac55e9e7d5b35d01
SHA2562aa158269739641d04f534aeebd09939637dd5bb55ff2a68a9d77595d7068746
SHA512b9ef4a71b1be9f1ad5f65d348585acdc3b004c91201150c18f271d403b221dc1bdb8ca118a59822a0eb0a5a44197fa0cce9dc7d29252ae9573ec2d85da1547e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD56805fd6ff03ada27be5f4059abd6277f
SHA1d55432f34d629cfc5360c1c2fed99111e35ee8d5
SHA256d1c20e86a014e3eb4e65d6dbabe6b7048ca62baa1350e47a0a938216c4b51349
SHA512b0e2551b25fc88ea0c37718507027fa3d36a5bcacb45c6bee4a09419ffb234c526ce4affe33ad115bc86ad9c133e6ccda935a3e5405fa9585a8129863a27f7ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_0EA8BE9F5A236A565654851B389EB70B
Filesize402B
MD5706eb86679daae858a8a89cedb964ddc
SHA1c41a683c55bf2b060bbd467d6aa3d4797c460147
SHA256f93de579c1f74abffa136c3b623ff164e4878ad8db8d009ccbd738727ddfb75a
SHA5124e01b4119339a9b0e97009fec649b4df3a584c3ce54e58b43de0a02b70fb144ebc195d8a6659ee462c6c8090c596b055b23a23821b1cf1b8c6308fb734b114e0
-
Filesize
1KB
MD54d42118d35941e0f664dddbd83f633c5
SHA12b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA2565154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA5123ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
-
Filesize
5.2MB
MD502ca1f89c7e4815b82bc8974bffcd183
SHA145bf8a20bad7953b7e16a74348fa034ff5844475
SHA256fcbf6d29363d798b931f4fb0dc95b09c1a44c3ccaf79a9651ab280a8562e82b6
SHA512024794b3303ff4ea5f3852c505e39e140113264d24e5dc14a365e8a1fb6f9a0683e72098f1923cca187c666b39a904fc18ac53645b8a25bd8a235cf01b661a60
-
Filesize
203KB
MD53e50e56e351309566b7e3e5a5ca7c7b6
SHA13ef35792e0b9c3b902d4da59d0a4bb34590c5400
SHA256abd207d3e55f0250b27ce23f2a15b0a5ff6f769c08f54e705e2fd0273dca5f1e
SHA512b24b20fe5dd9766b86869c51b6d92fd3b191bc3a2cac8a4b43b781644958b49500a0fca3fc69781d9c5a80868508f1fa0af9bc1896dc73f944cf1af8546815f0
-
Filesize
3.5MB
MD52f2e363c9a9baa0a9626db374cc4e8a4
SHA117f405e81e5fce4c5a02ca049f7bd48b31674c8f
SHA2562630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df
SHA512e668a5d1f5e6f821ebfa0913e201f0dfd8da2f96605701f8db18d14ea4fdeac73aeb9b4fe1f22eaeffcdd1c0f73a6701763727d5b09775666f82b678404e4924
-
Filesize
2.4MB
MD5a2f9725fe0825723c419ef8c40e8cfc2
SHA126fed33ef410ccbb90f86c593ca5d2edafce25e5
SHA25626a56e368cd95e65e3a34b308e89bc027f40e2d3d000abb52448f475ddc37216
SHA5123c0ce4376ba7be3449fad0cf67e381c3f8ea2ec6c34989ce0425e787b7cbdef391b4da422b32676a23f2fe28553149e94d24f93a62a231581f5021b79c4bddc0
-
Filesize
9.7MB
MD5224ba45e00bbbb237b34f0facbb550bf
SHA11b0f81da88149d9c610a8edf55f8f12a87ca67de
SHA2568dee674ccd2387c14f01b746779c104e383d57b36c2bdc8e419c470a3d5ffadc
SHA512c04d271288dd2eff89d91e31829586706eba95ffbab0b75c2d202a4037e66a4e2205e8a37ecf15116302c51239b1826064ed4670a3346439470b260aba0ea784
-
Filesize
349KB
MD5bcaa8f69bc5aefbe5cc63004d3ba1d3f
SHA12ca7ac5cf30a93f098877d5904e6cde0ce691937
SHA256c936ec0efcffefca5c1b1d79ca1f845ef6d07644841269ad673afc42a16770e2
SHA51247a2345f3904135ef61afd34f04fbdf8e0623bb96d44c4811ca5996a1e8666e40756bbd8804acc7fd6ae58a75d0447c078698558a629bcbd3725a7360f516a4e
-
Filesize
6.8MB
MD54dea46f48f426ba6e3e6ab325c1f875b
SHA1a39c7452657ee8ee8bced69935b765f4034a10e1
SHA256700fd217fdee890876176dcae6a121c59c0457f127e781cdf70774334372239a
SHA5127331f27379c93ee165429180acbe1a154379b4d9379ccb2b3f432fc71df11d579e460f257fea14dd4ab8b555b6eac1d38a51afee9a3bde2fdfb9aba8ff902aa9
-
Filesize
165KB
MD5d3c12cbcfd29adb63f8314fe0fd3f8ec
SHA171404885cd93305a6ccc196de8601ab2cd542197
SHA256d61b254715fd71356b55a700b4b818c050507ded9f7474225e6e1aa1825616b5
SHA512fd354ac4e65d04cafc75fe772c840257ff1cc03a4499e81bc988504d557382dcf78361933503dea09ad9449c9f6b0fd13708ccea7b03a7c6ae2131c7bb8e4fc7
-
Filesize
170KB
MD535c44770be6e0efdd0441d8b7822fff7
SHA1817ea730072c3745f354bf0e7d817e349152ebbd
SHA256dd4d43c7529525cb21885e12b337f8e8a9db3ec993d08d34f5d3a6cedea4ecd0
SHA512f47b20578fe93b57665c4fe6c716b2eb34e9bdfc334ee1e3dce64b3004515ab0e7896773fbc672b087a0c53c7e1da8f599b533d04d93932202236619da3c82be
-
Filesize
180KB
MD59c5a545da2150eae00a0240097fd423f
SHA196012d94d903c76c2b2a058c6ec94488a074bfa0
SHA256a47c73ae35583c284941793a1ed8b80b3bc8a3e2ac1a049354a3b1c408232b00
SHA51283e33a8e574f8d0c323fad29d82fd749715902ad288b082708b970c0efb0e15c2e7f7ca4e704f98d9125f998bed72cf725677d28ad4acac796d2e5bb36c057d0
-
Filesize
235KB
MD535c3ddc2656d79af4b6f84f5c222acbf
SHA10aee7b3b7ed037ab111d34d2fb6687f6c2a022fb
SHA256c5316a524046786f7b05993b35bd4bcbeaa397b3750302e029671214e1ac5ef4
SHA512fd93ea72e37ae14c0d651708709cffe547eb866ddc7779879b7ad74b80cbc6c8f357e8685be266ad2b5eef063cad8d1f20cd604a7a15e8c9adf6f1c42c0a40aa
-
Filesize
114KB
MD5e285ad8235b1ee37782ec312a1f26568
SHA1dbf7e749d045527353e22575c18933d1a1d2e77a
SHA25639702855f1542560aa20a36f243a87c29488ac9f16c702cc775d8a451720b1c7
SHA512972ab076069a202c4cdf80a45f1b61710124c0d1c994b62093a786ad9438bc6d29f3601f79f040cd2df641f54a649bec92cb20b462099e4cf784574baa9d71d4
-
Filesize
117KB
MD543d386593e5a1e1171e8d4b44099deab
SHA193394e1ed0f62a0067b0b5cf7c3f1d1a844b8dfc
SHA256901786dd658fe0d92c8164c602eb6c561671348705945527cbb1f762184f7ea0
SHA5121ca613cf3ad927b745ac8ab2009eaeabdd2d305ba39edb197748e738b751449f99f6ad75c8466f4336914cc8404b6e6dd219d6c978ab3aad5e68bc33e8344c98
-
Filesize
107KB
MD5bb894d74dd92ef0aa83df6175dba7019
SHA1fbc61c8ca2ab0829fcd3c7ddce50456e90e67a42
SHA2564c38c8e4848c103935993f7a7dbcf691e540223150b38313bf4874b05f8e072f
SHA5123040c1905a79bec17d25748a88ae2f833303bb7e0116b60baacdcd8be54fac2af418b9e1fc49ea0dfb39f54c1c540f0a096b98736bb7c7be0655995ba80ebb57
-
Filesize
115KB
MD5dc2bfe9dcf6af567ea9743d43e654dbd
SHA1adcd891a7d44fd0fc28f43b205208482f7829fb7
SHA2563b1e8df83a5846ec428e3bfa0c37e814dd66810e8815f9bb6ba3d443cfd3fbac
SHA51275d2919a8784f1d982e1fa8536ea8fb3c67f5c28f5c4f4a816f73fa2ad64dea2c5642264b692c16734f802e8757fed5072703b49863ca18ff3fb23a99a2201d6
-
Filesize
200KB
MD59faabc1de76443407626da99a4d1abff
SHA16754a7560bd95150b7840eb79c259e7129ac727a
SHA256ff397cddc6f3cf85717fcb31bb9a8a859ea8cd980bb29825857fdd7cce46b5d6
SHA51280e714c8e119ce9633b9b1d2675328026f36eee8115d40664effcc557d90c01a342d44d788c56b286632d050c9a9a07e79bd1374b037812320835e2128af0f9e
-
Filesize
94KB
MD5a018d7cca96e723dad8ee78ce2a54e38
SHA1b23f44bb0c3db7b41a450188ebbdcdcfeac6a319
SHA256cce70f0b61e20e959341ae9391f03a59653895808fb3dc10a26bc18e0b06465e
SHA512b3ccfcc6df338ceb534dbded2b66cdfb5c47161b6f7c5e3fafdee7301854f165d5ae47f988beccec37782f246a84c6d6bf98474eef5d5e95176cc80582d48a6d
-
Filesize
95KB
MD5a986c722c10b0639d00250468bb41100
SHA17d5d7188ec4723f32bfb13e3573db39b234d934b
SHA256cb40b01d42057e1aa9a3660afa5db2507e4dadb9b23099ab087c4ff14a99d5e9
SHA512768145c6dd70e9d3df09cbabb0562249442e86369c6d60d27b2408b8e9d767899911bcc254c0aedc0d29705ab51367a08ff1e25e387a5eb6daae5365c2082d81
-
Filesize
112KB
MD593c19079f60e28f206fe0a2ea1d132dd
SHA192bdbea3ccdf934190b0672d6660d7e9ddcf2d51
SHA256548eb08c2f822c6d4c19130bd01c7e434ec4a677997490cf9c2acff1442ba5f3
SHA512a3fea3ce9129651205626231254fa052031b9966321129505e8f8110d8e55fa5c74bb036ba9b1712aa9b26d69a3190d91c2606a12ca518b26045d720c526d97a
-
Filesize
114KB
MD5c7849e2c968c78cc4de1447395dbf8dc
SHA1a8641721822c29c38eaea10a17c957d9712557ab
SHA2562a5c127356c37feba93144ddf4184887ea75c51e5a109dc658aca99f658be83b
SHA512d24471bd148bd7614826310b87f4bcef22c7db59d99ac7432760ca826458cc8059e9903c3f3166eca3301a57229454d892c61df51c1fe307bab33cc0c93dea66
-
Filesize
103KB
MD5158f1611fae6353d53e81e6a4864b3f3
SHA16d4e9b592d1be3e47eca32153914e7a7bfb7f3e7
SHA2560963025006e19a797014b08401d2a094034599ca8928729e5a15723d42ee3970
SHA512811d9f32da15363568c481454e61f12a6d8f05c1d57cec4787056863b1efe82a060ee2bc40d02e2ce813fd317be7676e56520e3ec3049c03747d063c6a6e5d4e
-
Filesize
161KB
MD57b4971f90f97b194d94271cba61b8fba
SHA12920d1acc7787c68f8038aacc02c9038818d8eb4
SHA256e3894f96a14f6e81ebe6a3e6c0c0e64d80457c066b3ab733be8aac4fad3ca1bf
SHA512190aa19996e72e442c3d03cddd7f9dbfdd8153b5e3310ce45cc19f63a5d114d7b7f3cbf885f43c54a03edf4b178b89a9917b3f07dd6abe772e396ceca3ecc73b
-
Filesize
105KB
MD5d8c3fbeaf04a290eca106384e2d0d02f
SHA1a0df019725055abb72ba3a7bc917faaf5115224e
SHA256fcc01915f567263e5609cff7b8c57e790431e062fc172ecffc5df78e801f2506
SHA512f0e4ed32bc8e946e19a5b46b5c6b487309f46c7cc5db1e41239b32dcd7a0d653434bf13eb51347657a3510c7e253f270473d3f5abb8c0dfccc594f6b12b62357
-
Filesize
117KB
MD519122716d06dfbe8bead02aaeef643e6
SHA1703e9719423e4860ed8d25057b5b04453969f3f6
SHA2566aac8afd091e6dd4565dea26adcd2f88d7375c2ec6bec15c5c840a531ba1b53b
SHA512d90cfa64660ad67c462a944708d7d22d929b42caeda4231c790c28f4e165f50603e8fe235ddaf47b89e853903ff7c81401309075f76ec7c9d6a0447cf259378b
-
Filesize
123KB
MD5bb5adaa9f67c11326909072f16386916
SHA195b7b7428007c31c5686738b8580a571d75b1248
SHA2569f0779d4cafca2e01a65b6ed633182379071a758c401ab65e8bc7c6b7f7f2366
SHA512040a4d7be549f120389ea31a1b05f6b738c45a769ffd3bae2099cf004db897299f9813e66c895751b89c142884ea92fc3e1779715ae857ea15c90439eac0fd88
-
Filesize
226KB
MD5685283e075024e054b6d78ecca07d8dc
SHA1a40c69c1d05879b500c8b5da2a2ebeba7984d59c
SHA256fa8568302e82ce1956989bb038a12beb4f1e85365b3e2bdfad4b38aac5658ff2
SHA512b8a46a8e9eaecf50fb11d8b4bf28db032319c2c874185933edd2b5f356ef9e9ade21de8bfec1efaa58d7ed2d20e390595319b6d487bb6da1e4f8df9b5d140fa2
-
Filesize
142KB
MD5263cc280b1cc18540152a7f09989d1e7
SHA1533c50cc500735f88f1b67d81f3f90db45c3cc01
SHA2566a7b3c4ca714308836cdab39d9edff193c4fdbbc627ec4c0fbe37bdf3aa9eaea
SHA51284a0ab12fcb265939b188512d3097fc71b400a2e1695eecebc3d458cc4be6ef5dd587872300716cbf8b469065f92d098bbd0bb3ab87c9ef4206ee10427e9adef
-
Filesize
234KB
MD53e7719993e970a5875c5b4f806c37c9f
SHA1a74c6f1c9886c0e76760c66b80269d532acc7adc
SHA2561f2b69f27cb3cac9d0e3b71a513d92e21f1ab5fa8b7cbdc21324c696bd671f35
SHA512ebb36c27fa117e29e21288851e910297ee3a801db29668312ca8522d88db5d02c342f91aa57019ad80e82b441ddf5ae9231acbbb972c2d2ead01ccbd482c6ecd
-
Filesize
112KB
MD5127607c466e9feeb91c6d377b57141cb
SHA18b5e4b8a71578710337253f9a6d96792c8227d91
SHA256f6775b51dedc0e857497bdce004e1e14eb113a170f050d29fc1cb564797ea706
SHA512709751cd4db70823754259dd300a7a928f98b534fd0f5b4aee51f91ae13e4aee07da69ba81958b180d132aa98cd20367e699db214ec88899548fd2afe38f22e5
-
Filesize
120KB
MD5086766328d307018c22007ab7fc4217b
SHA122dec7b3aec098c665829dd179511cf415fb7ce3
SHA256772b0a8604471335f60246b93af29e7faef4ef46e04082b9aff30cef1ca33969
SHA5127e29b8206dd19c3c243b0806b419214996e35c8c345e95e4b62bd78192426effcf57026f182856a8faefa7a6f1ba7dbebbae29d538b74bf3c1bbc24471fa5595
-
Filesize
102KB
MD55f0ad5d827844c2b9d970536c9689d77
SHA17566b01b28d671d4cad78cb24d24fa8f831859ad
SHA25672f75b3290891869d201dfca7eb82eb58d22ee61c6d6610646b486d68f928a10
SHA5121ab719d6bd257ec3b4f1b3779a8c7dee0f8ab5ec9292ff18003e6bf7afef81506e34e40db66663580d1ac95eaa3f10eb0db71273586b647e4d5b0445b66ee60a
-
Filesize
111KB
MD5052b2bad3c3260dad219c8fd1a0ee37f
SHA197a3ef9e5095eea34aeb693658494a08c1914e83
SHA256b0fea999ce8800a2c9e06c6d49bede060b6138dca6ce5c31bfc60aed72b529ac
SHA512170217a234b11534a29e2faf8d9876c3ab0c2c95986955802d84aa8075340a4dd3c5047aa22759d298e571c8f3195fc6543e729f5f2a7e6590deb24356d96964
-
Filesize
135KB
MD5b19d7e3512c6795757bb51cf21bfd05a
SHA16d99513f20701c9c18c1dc34a31cdeff6dd1eb41
SHA256a4111fd046e8c50231e870f428804250c0738bfc12714720e0907e2213a163c2
SHA51272c68af157f2c56efeca80f1d65bec50730b390d31a93308975b04b17de890e692a1894de581417f988e459f784c6529c9c24e5ac5b6bc3b5a93601752e5beb9
-
Filesize
258KB
MD5c70fb16c67096a02b5d35c16867c2119
SHA1319f8f9ec99262887047c90bb957772f2458e79a
SHA2561446663d893d6753ef413a1d2ea016fae76d8fb4780deff2080d82514c4ab6e7
SHA51266a6572d138b24ddfb9a560c2bcdeafa83596edf445d71378b8d8346f487c04c374f11626b4497c438d55ca0ebd934739af291dacc33e1f3a63a553127db87a2
-
Filesize
113KB
MD58ee07cf91bc38d8b6abcdec4e0d4b3ad
SHA152addc945a9f097ec1d2b24258efd1e7f1211d7e
SHA256137dcf11c916aabd48f2543895740c6f359fbcf9bdfd5863ef08d9ba95e39f7f
SHA512a78e7c6b11521901a57791012efbf116c2fe67b2dabb925f1a744d6a2f842f72224fc9f79d18cc9e86e53afbf6bcd1ac87289451ad05d78a9c1fa71e9fb912dc
-
Filesize
122KB
MD55b1f97690df00c585231c5bbb13c19b4
SHA1e2d8096b0735f7030420de2321216b6eaa100a0e
SHA25662e6fbbfd2177ebd87388ff7c57c8d06c8d7bd85fbbd83a00af822e56031c3ea
SHA51219aff1c238819235cbd2f32d42e4aa70b2f6b571e6caf193af15989aa3d570237fb99f48782024589e300a77f6ae8fc1fd3843e63fbc0d3e3c4a4f577463a457
-
Filesize
122KB
MD5bb16ceed3a1005f5fd35b8c4d0d1ea28
SHA1737be1ccf8a6c901daa8ae004d9b89ccd19899d0
SHA2563ea936a64770f7d288f9723179aff17ac0f15f79c708730b67ab15b1a10c1eaf
SHA512315a0fb44b490ee68ef6d1a9a2e3e395ce35e83b9d44e7382cc2eb75c8c3686a42eded42bea000ed068a04368154f78ccab8d41868feccd6f91deff2b89eb622
-
Filesize
271KB
MD554840f3ffdc38ba464285697d25319d8
SHA11d7aba8ec6204f4e4933da74f665c79a882b7832
SHA256f2207dbc18822fc3e2abacd119fa5553215aa1e4ae8112af014f1707c1873dd4
SHA5126babe51d4f647f0e70f0f8149f9845f85df040a6abd705f9d9260c9bfec6a5adefba09c1b80e9fc9905a1048a6a8cc813cd4b8daf53a6afb0a9d72c6b2709fca
-
Filesize
222KB
MD5af2b1e32c5bdd8b750d569aa5525d4ee
SHA1dcbdc3230053b69a85567cb5013568ac80b1c8cb
SHA256d330c8f2719a26c64f32e49ac663b1c12a4e7fd27f6297de2d70189e845b9931
SHA512ee20c9bbeb42a9f1018400e409f53fe8e1165a4abf7a8b96cefea28711f1fd17593d75baf38ef631c06296befa93367a634f91866c936668926756adcc068cfa
-
Filesize
105KB
MD5fb5ed1282cf0e3e23953fb0ee8ca3869
SHA1e0b6e7301af8e4deb0e566745af6c09d00748fc6
SHA2562af29c23c1ba3cd2a6de137894d8cbcbeb656c0d2c0c499de45393d6d594a2bd
SHA51268d8993521a93e9d6514719b0554915774bf942a2e93cc7448c0f32f938c838b2e76d117ab66413aa874dddd2fbf96303899af27d6b82d362e0f7b31ae023ebc
-
Filesize
104KB
MD5dd93951abf6974e52bb7e6c9a16dde34
SHA15dceee404bdd3901093acf1da054b8f9c9606133
SHA2560492cdc45637ee3e97a55f86449fc3e85ed809fc598517899acca4a0f54bdb34
SHA5122e261c2ba1b9a3d73f5ddf9adf7b59eec41a11b44e3d6b42bd6d34b429dfa47214f7c1505629955284cb866234a1f885004971f0ebfaeddcd40af44d6d6c3b04
-
Filesize
107KB
MD5d3197711ad54c013258b6c1b3ac0a83c
SHA1bf934e40884f41ed4f5fc0d6f7767cede374e886
SHA256e4e7843a26dc01eb55f7b7ae31d279acf11c61dc9ddfb6ee8353b928b6c4982e
SHA512234449843edd93dc130799212bb7a9bdce81def7f3464d643a1632a10dd0021320c3066cd81cdbb71da1a05212b1543e122cfb412d7ae49b405d687b0c92c13d
-
Filesize
118KB
MD55a87a89094e57921565d0ce0321d9adf
SHA1cef9b65386aea4979ba2745c5e51866a7ca507fb
SHA25690f184568f88f1e10c0b0580dac3b83356033016c7c3e28583635b3e5024306e
SHA512352f20db67fd4e0dc2fd4495a01f5c954025af952a622fff01fa1ac735344ed1225fb8d9185e056ac61a2f927f5bb14f6d6ddf8ef74dbf638ac3f7d3c99281d1
-
Filesize
111KB
MD57c7df2e7408eaedba853461230e59c83
SHA17a76b7a1777a767e2704d60ee3b68dba241307c0
SHA2565f6d50b7e5d8426f6bea55164102d40965fc530a59eb67e1d8d06a00e33bb08f
SHA5122ac99ae520438043733fd9484c56626110ae616316b2eafdaa580cf6409f0d82c20838f65f355204ab8dbc8e57f904d77ec8d5ea5e0df77f2e52915bc365bb6f
-
Filesize
112KB
MD50a49be229ecca6772de0a80dc80a2c86
SHA175f03921c8f2c592f674b9092e35c400e0297405
SHA25622c475fc66ceccbf01e0aaa29f0f5c70d0ae94cf7d83c301665781e26dbf8640
SHA512f4fe391f17b7efe92edbd145279956409517548533ec41b46af25156725e99af0a7dc3de4f7e987bac25c23594fe0d4c744c12f0baade1adcd94df2a4615a2c5
-
Filesize
115KB
MD53fef23d7b143d74efb8b4a99dd6dd9e7
SHA1c2b3f032c7b13f4dc3c69426a73c54a857cb274e
SHA2565761f94be36903f31b0c3c61e0d81dc15cbe0a6da92178b4f50c227163d8f0bf
SHA5129e91f10490d3d05e5ed9995b635fb21bb81ef4bdc7e5516d364e50b0831ea85eb450e9de633d335a914eae6c9c85903b73a14e2309f27e763334d9c7d066e0c7
-
Filesize
183KB
MD5de335564e6b1f9eeedda733f09e6ceb6
SHA10d4ad4c48a351087cdfd100ae61cdacb4edc9df2
SHA256b95753057ccd4555c2d9633c3f737c2ccaa1499e9dcb9567c745d8f6fe81f45d
SHA5123f551c858cb329935e99778471b67662052893c859bb534cbfae1bb0569b04f495edda7d26b65d3e88657f432d6fd0ed9dc21cefa4406c05e7eae9531e92c509
-
Filesize
119KB
MD56a968970a5b249237d6d2fd775397d73
SHA1598886fcd52809099d6c2efd916b73c5aa2d6b5b
SHA2563884365ae6fbdd2c00d2dec2cab66f0816ff3ef7a5a4d8f91ea13fce372e877c
SHA5126d9c4b493ed4ca1051a4833d24aa39ab8064329e05a102137a4b089d10dccd04cde4fcd0a6e878cec90e663596788b7249640ca3a029e9ea6c5c4c42f493859e
-
Filesize
113KB
MD509932a71b9fd2dac7aa87bd42dcc99be
SHA1dfaed169dcf15bce6a5e1c3e7a3e77a17f9e66ec
SHA25670ddcb1c405ee48f85b671284e0f16df6baf73c1f41487c5cf6d065c2e06d2cd
SHA512344a4b8cea89e3688d165dfd5bab8702c0022833dea9ce7bb436ecef8fb2a8761f48fb7359cfd5a259225fb482ea1fb044cc890eb6a51b0105801c32f7d44c0d
-
Filesize
172KB
MD57221286bddd593fc43366cad65ac3c90
SHA113c428fcda5145502dbc71543220216042a5e42f
SHA25600906957c1a4a33d6b5f24c32494d1ddeb56f98877c957232d06a879d56d7182
SHA512fd2119ff64ec4296578ca4e9887a4f9206e495811807c503632beeb9fc78200099756692c8beb1032d75606047ee1daa25073081e5f3f5755cba7e4f2079ddac
-
Filesize
104KB
MD5cc693a8d0a18e77c60ad0ccc0f35e2c5
SHA14b27117597bc471cc93ae7406af480e5faefd14d
SHA2568d6f9eb64e6700e0c5daf07b6945ee20368535ef6e3c71bd5ff49c827b64bd7c
SHA51287a5da69b42d6395c998d12eaa614fab9242fa10545246e05e7accdceb35ae6d0ced1b15ef4a73bfd5d1308ca0fc586165f917309dda5060d08de55a4ae3dccb
-
Filesize
106KB
MD54e33675799c16aaec75a31804571ba2a
SHA1dfc709362bc81911018e1282abeec0a51d0ff757
SHA256d35fd90c735dd6318aa81bc548284e51b522514288a701ab69277e2347db1a55
SHA512a731d8bcb6274be9079261d5a200217670974d57e618e561195dc45ad244c4c6ff7f3dc5a3126a51d0815afe4f56e2f3ab9d2d2e878e29e34f9eb3bcb438396d
-
Filesize
268KB
MD5881c4814ab067734a89d02ed6855c2dd
SHA16ce805c7352d2b7fd3b6b23e8c3f4d8d6886635f
SHA2560572f88a09ae99bb1f7ab3f9360b2037578459b8dbfb1adb6f1d966a74a7fa94
SHA51233a303c39c7893d043ccce370f9ab39832c18d421372b3b8372c4e90c2ad1d0d0939fbe181ec8644f150c7632a02de8fd9400a5b3ec74371ef3a3e230726e38b
-
Filesize
249KB
MD561088f80b570fdce22100164e39841fb
SHA115c7efb5692d262165c55adf6dc70c5050c42ccf
SHA25677bd7c08f91862534c9ba750d61c4d157c241d6bd719c2bbb0d862f65c4f9bc6
SHA5125425d46f8602ab0d6246874d1caf7576bb1a27a5d2c489cce464a106186d99f0e2264fda1b5d2d1c10feb9165b8947ce7f45b1ea1835cf7674426fee6382e5c3
-
Filesize
212KB
MD5ed1a9bca30ca103975e0a9242841f1f7
SHA1721fb1a7988ad6c045b663f99ae47525e0227320
SHA25683387bc53e4610f91379a1f6b4183dc8998de8f5e2b1a64214b1904830dca83c
SHA5125e3fb081b1fa90f86230e0e36815ae9a7e7576b4e6736f024bbd1924dabf8ad801738a12cbcaac890fc6e572a33fef9e430a641d4dbe94d783414a0f80223cd5
-
Filesize
109KB
MD5c045af6cecde150d100851b8e187ae28
SHA1c1078bca00be65ed0355d014817241bb5f467a88
SHA256c51004587c5df0729c5ef1c0c36e2e38136081fb3f70a93e032635daba6c51bf
SHA512ab82626e4ba45b0b56ec628a406e35bfad4876f4264366db0166a039bd178ae9d2422fe40458ff0bfd87dcf5e37c8402d989a207ccd8d2f8ea065dffa2e81081
-
Filesize
183KB
MD5e6f21cf0eb41bb5f8d6d3b4ab265d2c7
SHA18f45622f7686d398f0374b4fa91adb3d6bc17832
SHA256538922ca9ddbfa49a98b2d09706d7b62bd5283ca831fe6bea0edde838262cf55
SHA512003b5174fdeb46e9f6f8cdb5261fb7563dbf438a1377a6c659d07619a6ca1eb8937564cf55fd7afe422b9cd9721c2dd43c40d5f74c87f3f461c82ca250dc4d34
-
Filesize
130KB
MD5bf46a32597fc185b69d1109ae9596d6a
SHA12890b119abdffeb9e4618101cbe8996bfd9a1d6e
SHA25681d090373b8a9a2988b9ac9ec05c8ef1af1cac88b19504191f601873a7cccde7
SHA51223e25b865aed4345735585f5fc6c4f6f6573082d57ecba31315162f2f9bfcbec99213b15c643f2ddef5f72cc074ce1e875b28050bd28cd4fde31bbe1538f065d
-
Filesize
96KB
MD5f766b1d7d70e9db14fbffce63d2b2f30
SHA12fa1bae675b623f46ffbeabb6f19cf9ca7223b13
SHA2567983e51f68cc1ef5a41e44858e49014474dc529e04cbc5dce9f5c822dcf60266
SHA512fb235712a9d3fa3556b514c1b86c0ba91145d8d4e370c7c16e2fd8b0baef1444dea6d8cfb25a79161a6da7c63684d613a85136408d4d9bdf6176049441852202
-
Filesize
96KB
MD5cfe66f10e3f78106c1b82404dff6df64
SHA1783f664ad5a4ec45938c518c99e6b761745e8640
SHA256f5ca17ae66aa3883e4a69e3d4106933bcf600ebd9b0ba39402af074cfea74b9a
SHA512c4c110488d84eb8f96d709752cd92259187bc43da37a5620a047c9771cd217592dca74885e0d0e4aa64d6a14aff494533eecb9a9efa60658386df0f87b90a3a8
-
Filesize
4.6MB
MD5d98298d188d7ebed9b3e89a822f95df7
SHA1a50523cc15f47abb6f1b50982db454e4e956ebc8
SHA2560acd9cafd7c4fac398e85a6e008bad6d7ad34f90b0bfd207df330d3e69bcfa75
SHA51224cd58294f12f0541d49d180c23b89796596a599d1fc4346d8155b552d765bad0e759c85dded98cf4f3c74ec150b98baf27528f0e864fd37f71dd41c90345791
-
Filesize
154B
MD5e2f17d6549eddc594a532f4cf155df28
SHA1d02d8840e7bd43d9b85d4d16c1f3d586b1ed0b12
SHA256566cfba10a0d540e76919132abe4da1114ba0d15a9dfbfd12655dd1fc9ff0c4c
SHA5125f792888a5a1c37ef32b14ce11d695c146b7acb6d3c48e800b2a627b832b0e9f0505b89d80a75719186bb9510e626052ab0dd1e8a2a3d860e1c2ed675fc9c364
-
Filesize
15.4MB
MD5dbd6c92f85cdf6d037e55db8ca1c7bb1
SHA1a405f35981955ed0b950745e5fbcf7577fe6e605
SHA256c7cdabd125e03c959bd256d6febb750311ce5c677bbeafc2fcf10b81bfaffe4b
SHA5129252a7a842e6de4b1666357553739796397108630882330657e95e0b312d3ce297bc64ac42e2df5f33c5ef4f6bab39ed93181c76cc104d4e467ff36ffc62403c
-
C:\Users\Admin\AppData\Local\Temp\nse9125.tmp\7z-out\resources\app.asar.unpacked\bundle\6111917f3a5c9c62e67df5a0d0e9136e.ico
Filesize5KB
MD57558fcb923bb0291923f96e5281bee9b
SHA1b9d0503d1f65ae9e1238b593451850c03b59a808
SHA2563925c6b5a1f307b904b9988efd35f55bf00a8abbb03ab7b5aafea7dfe8127e05
SHA51265d0e57829b77fbd9cc25ce8f6a23b2a5c76aacfe568ab4715d57c2bf5f615f427a9300e6a72f3f0c670a028bfc107b35721bb25fcd9bca80e2ad7c9b4149b75
-
C:\Users\Admin\AppData\Local\Temp\nse9125.tmp\7z-out\resources\app.asar.unpacked\bundle\7f8b663e6218621b36b1867f8f2ff543.ico
Filesize5KB
MD5a93e6df957a67a4aef3b36af562770ab
SHA1a675c46568dbb6ccfb74567a395a66b2c2a1dfb3
SHA256a308956b317a63c6c1316d1a0098144c35a6fa39c1cb2d587b0b6f5b218c07c4
SHA512a6ae7e99a8dfcac76221c1c70450ace4130976e32a06ea93d95c65ad2e8dbe80531c564e5bbd60d07f7e8ea860434b5a8c588bc5d1b2c36c204a92ca057b2f25
-
C:\Users\Admin\AppData\Local\Temp\nse9125.tmp\7z-out\resources\app.asar.unpacked\bundle\af46f86f65f624cfee407eac19d946db.ico
Filesize5KB
MD58b40fed906b9169cd5ec54a4f7669d0d
SHA1e32de356f7709281c573715474cdec7c3ada7386
SHA25614699f50aa5ea12cc9f5ad132e62cc501eb328bec7364f8ea7d48ef1939e20c9
SHA512b4d012eb2e7e5c821ef6fb90caec8308a4af5b22b99ddf43ac1708056bba56d90fd6e19ac6df30fee97fadd104ecba3c00d1cdb66a859aad9c3cdba681b6b345
-
C:\Users\Admin\AppData\Local\Temp\nse9125.tmp\7z-out\resources\app.asar.unpacked\bundle\c0edcf9115ff85441b19ff0e2f387c2d.ico
Filesize5KB
MD5cb1de68eae747f6c9da4d95927679941
SHA13a3408f092dc9ff14e6d124f49309c8840648dd0
SHA2563f9dbbd99bdfa7c1c5517aa9929270ac3c632b1cb794b307f51466fab518d590
SHA512e011d374ea3d89c1e2ac00ac9a183051af25b98a8272866a7d9d42e8387c2baf6c9c2cabcd702d9894b3e99ade32fcd364e725a6d1e25955d112de8e91c8c268
-
Filesize
24.5MB
MD55d4ea53d3856b57b7d1f27a0f8566adb
SHA132626d84587fb3554940ba571a1fe10615bbe873
SHA25603bbf317ae79c42aac6b0885070dd4750c470bad0ccd6c29b1b56a9961d56fb3
SHA512994c2ca1d67d706d4fa06babe12733a33d3996df313084834f6991fe21eda2abe5456deaf2e16f18615d409ecebf46832628fd73bea13b90ce31f48cd8d882e4
-
Filesize
2.4MB
MD5d2f91936dc08bc55912d48350ca2999c
SHA10a990eb17eae58d9150ccaa7a4b140c2d0607720
SHA2564e08403e7a21af6d0661f4934c8abddb9f30036cab00338dbcb5d4059564f936
SHA51258b71d773a39df43cff68e13f529cc996f2e1de05ebb5d76336ccb37680970ec1a155ba521b8ffe39fa9d8cea62bff98d6c5dc1d47a56f4d9842493b47a67496
-
Filesize
12.1MB
MD5331602535345b72542484d33a037fc55
SHA17a2e78de85bee43d1c418832fb0ab872a3f92958
SHA2560a25b1b2f85aa8f2eda101c59e565dbbac4bf0e28bac2a2c285f45c484b28084
SHA5121aa13619bee71aa7dfd0d6248133e57369d60e2e1df28d1d7cfe544004877a35e6d3ea2f560ff17d200ca10aa073154b747e5248ac6961e591609c4f625ac771
-
Filesize
128KB
MD5a23e2fdaf318bc7078c835b3aba63c53
SHA1bfdc192f5146f82921cfc936a4e53bed7c4be508
SHA256417101919ce4c71d9a97433f5b43a061a1f0bee9db9f199f7ece344d2197e461
SHA512e5b3a93a6b5391e1774c1f6a4aeefe054c40e06ee331875409771903b5b68e74faca20d1f12d8658c8c01839c68918760cf5f6bc81c383e4425996e62c2c5998
-
Filesize
48KB
MD5aa596cd6b977b12cb4d7cf51c84f1b75
SHA12408089aedba78df414c9e9f3023074f99553344
SHA256c65ecaa58359e59ccd7c74518120f58839cc00bc9260c882c5bf1900b6429e43
SHA512bb9c7b45fdfa83c28653e31779a445897f9f25631879dda227f956e4ee2a1355c2bb4ef72e8bc0edf66d03b55b1185c892abd2bb5e03aed42095d6ccff087210
-
Filesize
364KB
MD507c89b5236f323128ab6db7d4c96f8ae
SHA10b792a45a27cb3c12fa2275603f4643332b086d8
SHA25698936f21f5593978073e3602454e8056d8d7787c331cc798c93ad01bf8686195
SHA512dd58979f45c51acf8964d6d030feb9c70ad77b60ea8df199801ba46a91826f2d0414c910e48bb48d0e201e530a7e03a746c120c6f745947071a6e7ccef2a9681
-
Filesize
2.7MB
MD58e95202666c859dee65d495212ecb663
SHA1e45180c39bd15e911e8d9b22a31d905d4692661d
SHA256c55e1e5ee0a6e725b1fe1beb10336e1f57297744c22c1926a266c4c1f6c8854c
SHA51221a8586a9f921610683265934953da0019437f6055f11ab976b71780755f0149778e0727030fd7ba31f6f9286e16c6f2d5e6e11b8fed7fcae797f0d6cb8f88e7
-
Filesize
160KB
MD5abc235f85f4aeb8051ef760c5ea4cde1
SHA1bd6e33f68fc9dfa259f0de6f94d0e5580694817b
SHA256cb9f8f5f52bbef1439f4ca6c6c8927c80ad1e68c6a5b662afbd69edd5e7a3031
SHA5121726e575416f27a4d0f9616384a29cfa712f29e497c3deba3a63e68521e7045a50e092232fa1844bfd75279eb11f101349d0f269f3400e42b851bb9e11aa159f
-
Filesize
3.9MB
MD5988023a452e38a029a67c9af63962c2a
SHA118898a1004e4f37d41681cf69d3af923086fd275
SHA25664185ac6ca07a47e76e64f250dfffa1b1e435a55fe8545fe31609cd9a55be6d8
SHA512547e7a00a44600765e63e203e512868a62fcb2922c16efb0449983c33b168d1899f5112c6b4e3a9537ca94fbfef652aac069bfc40cff050a7c073b55a9275c75
-
Filesize
106B
MD58642dd3a87e2de6e991fae08458e302b
SHA19c06735c31cec00600fd763a92f8112d085bd12a
SHA25632d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
-
Filesize
620KB
MD50f069049d6807cc924ef7c5b89ae84c0
SHA1112793506a676e47053e4407247ef4a484d0cfc1
SHA256a55cbc63dcbff53794c5e6636914db26c4ea2cbe9c4ad2c43a854b0a59ff934d
SHA5120e8c75abd68faaeae7fadbe51b2b28c09af03307155f66e1f45dc85f8fd9779cbc1cf5342ac647e474499e05188754c3472ca5ac9aa2927ec3359d287f8d53bc
-
Filesize
238KB
MD538caa11a462b16538e0a3daeb2fc0eaf
SHA1c22a190b83f4b6dc0d6a44b98eac1a89a78de55c
SHA256ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
SHA512777135e05e908ac26bfce0a9c425b57f7132c1cdb0969bbb6ef625748c868860602bacc633c61cab36d0375b94b6bcfbd8bd8c7fa781495ef7332e362f8d44d1
-
Filesize
9KB
MD517309e33b596ba3a5693b4d3e85cf8d7
SHA17d361836cf53df42021c7f2b148aec9458818c01
SHA256996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA5121abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
3KB
MD51cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
Filesize
6KB
MD5ec0504e6b8a11d5aad43b296beeb84b2
SHA191b5ce085130c8c7194d66b2439ec9e1c206497c
SHA2565d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA5123f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
Filesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
Filesize
139KB
MD5109ee8ffd715c63e3e2248c2ad5ca559
SHA17f89b213e80e2b4f52f75b449baecb88054d5e07
SHA256b581f176c6bdbf8a152947fb37af9c0e6d7651616408cb7312b336c37a704580
SHA5123fc5e1de128ce0ddf6dddba758a651f4030323e5285b54859019eb95fb0ae11321ba9c391e8bc578acb7f49dd4d82821c4f9947f39972d79360fd2e6abc67de8
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
1KB
MD5118f0ea033c56bda9d701f1ef2291dea
SHA1c88bc968a7d3407fe53379f0e485fb9f22064716
SHA25682468f95a3197b76c8d2346408778f6c98ef237e4a8908cfb4aff10397fc1aea
SHA5122ddc120f44c71efff55d746d3034eeadb26ab24b077707f822ee69372722256d60dc89562fbdca5e06baff109fff0a23105544f2bdfc1e67237e8f8ea04c1a79
-
Filesize
297B
MD563d342afc28e14dab848a99c5a6b52a8
SHA1b973c572a920f7d12465a9439cf358d418817dfd
SHA2561d69c862bcd96e23a8bcb912605d5c1e4e71918cf934434e92d27dcb4a7cfca4
SHA51203a54723064d3f7f8666fb6d8f52d780c626081f28364ca24fe532f13fb5becce631e6c50c4e82c0bbde091af92fd8ebaab72bd808daa3aa083a44954496ac51
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
57B
MD558127c59cb9e1da127904c341d15372b
SHA162445484661d8036ce9788baeaba31d204e9a5fc
SHA256be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA5128d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
-
Filesize
6.5MB
MD5001944be59e0ae97eea1c6fc3119f091
SHA1552a109039e9ada218c9672b3468af964c3456eb
SHA256510229aee6224395bb4a5ff04aff30f2e736dfa720d2dfb64ae1af3cfbb08cd0
SHA512b46d84af870c21a4564ead393ac48143ea5903fd7e06a09a53252c16cdc950a47012a3d420e8818a016e7604358b9216aef7ee213fd1e9d573540dcb4bd57370