Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    27/04/2026, 16:25

General

  • Target
    VideoDownloader-[669599550.1777307091,,,,].exe
  • Size 879KB
  • Sample260427-txbleaas9l
  • SHA256 fa5ad20da227b4f58f80c225b59b54498655b5763c3a066142da64f841de6def
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 58 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VideoDownloader-[669599550.1777307091,,,,].exe
    "C:\Users\Admin\AppData\Local\Temp\VideoDownloader-[669599550.1777307091,,,,].exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3404
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C more < "C:\Users\Admin\AppData\Local\Temp\VideoDownloader-[669599550.1777307091,,,,].exe:Zone.Identifier"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1856
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Televzr Light.exe" /FO csv | "C:\Windows\system32\find.exe" "Televzr Light.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Televzr Light.exe" /FO csv
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2776
      • C:\Windows\SysWOW64\find.exe
        "C:\Windows\system32\find.exe" "Televzr Light.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2876
  • C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe
    "C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Televzr" /v userid"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4628
      • C:\Windows\SysWOW64\reg.exe
        C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Televzr" /v userid
        3⤵
        • System Location Discovery: System Language Discovery
        PID:540
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Televzr Light" /v vid"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4676
      • C:\Windows\SysWOW64\reg.exe
        C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Televzr Light" /v vid
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1148
    • C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe
      "C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Televzr Light" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,4515643007318855351,128838875065350157,262144 --enable-features=kWebSQLAccess --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3956
    • C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe
      "C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Televzr Light" --standard-schemes=app --secure-schemes=app --cors-schemes=fs --fetch-schemes=app,fs --mojo-platform-channel-handle=1848 --field-trial-handle=1756,i,4515643007318855351,128838875065350157,262144 --enable-features=kWebSQLAccess --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:576
    • C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe
      "C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Televzr Light" --standard-schemes=app --secure-schemes=app --cors-schemes=fs --fetch-schemes=app,fs --app-user-model-id=televzr.televzr_light_desktop --app-path="C:\Users\Admin\AppData\Local\televzr_light\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2928 --field-trial-handle=1756,i,4515643007318855351,128838875065350157,262144 --enable-features=kWebSQLAccess --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4300
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr" /f"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Windows\SysWOW64\reg.exe
        C:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4432
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr\shell\open\command" /f"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Windows\SysWOW64\reg.exe
        C:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr\shell\open\command" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1856
    • C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe
      "C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Televzr Light" --standard-schemes=app --secure-schemes=app --cors-schemes=fs --fetch-schemes=app,fs --app-user-model-id=televzr.televzr_light_desktop --app-path="C:\Users\Admin\AppData\Local\televzr_light\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3156 --field-trial-handle=1756,i,4515643007318855351,128838875065350157,262144 --enable-features=kWebSQLAccess --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Users\Admin\AppData\Local\televzr_light\resources\bin_ia32\yt-dlp.exe
        C:\Users\Admin\AppData\Local\televzr_light\resources\bin_ia32\yt-dlp.exe --update-to nightly
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3352
        • C:\Users\Admin\AppData\Local\televzr_light\resources\bin_ia32\yt-dlp.exe
          C:\Users\Admin\AppData\Local\televzr_light\resources\bin_ia32\yt-dlp.exe --update-to nightly
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4076
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4232
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4912
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1580
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr\shell\open\command" /ve /t REG_SZ /d "C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" "%1" /f"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4344
      • C:\Windows\SysWOW64\reg.exe
        C:\Windows\system32\reg.exe ADD "HKCU\Software\Classes\televzr\shell\open\command" /ve /t REG_SZ /d "C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" "%1" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4324
    • C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe
      "C:\Users\Admin\AppData\Local\televzr_light\Televzr Light.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Televzr Light" --standard-schemes=app --secure-schemes=app --cors-schemes=fs --fetch-schemes=app,fs --mojo-platform-channel-handle=3316 --field-trial-handle=1756,i,4515643007318855351,128838875065350157,262144 --enable-features=kWebSQLAccess --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1496

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\LICENSES.chromium.html
        • Size 8.7MB
        • SHA256 000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\chrome_200_percent.pak
        • Size 222KB
        • SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\d3dcompiler_47.dll
        • Size 3.9MB
        • SHA256 35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\ffmpeg.dll
        • Size 2.4MB
        • SHA256 88b7467f97fc9b3f0d3fc97508448ad71c987dc451265e6e4b64717827b64a4e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\icudtl.dat
        • Size 10.2MB
        • SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\libEGL.dll
        • Size 359KB
        • SHA256 a7378c418b3aa2c1aed263ce413e47da1610373b468083f49891d99e3745a5db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\libGLESv2.dll
        • Size 6.4MB
        • SHA256 2706fa5803e6bc9b6d8813e31eb5316426885f1fefe24e69e6e2a49ed9d204f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\af.pak
        • Size 464KB
        • SHA256 57670eae6d1871e648ad6148125ee82d08575bec5b323459fc14c3831570774a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\am.pak
        • Size 756KB
        • SHA256 b05dcb8136751aee5eced680a5bad935e386bfce657dd283d3ec00ee722fd740
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\ar.pak
        • Size 829KB
        • SHA256 ea49bc2ceb6b185030eaa0ee0155feca90e632390417299113b02fbe365ff731
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\bg.pak
        • Size 861KB
        • SHA256 50e4f6b9c387adf4baba3377c61d99326cc3987928d8d60b88d1ac29352820ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\bn.pak
        • Size 1.1MB
        • SHA256 e6adcfb4f3b3bccd4a27edadc168b503c36551cd6b27fb24043efeb21f691ce5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\ca.pak
        • Size 524KB
        • SHA256 4ecfa3785ab52564e0bd7dda04d59a30163561588a04f3bd1b1b71de051d2c53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\cs.pak
        • Size 539KB
        • SHA256 1c9448ea3aefce1a7e1491e73af91af772d8b22d538676a2beab690558e668fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\da.pak
        • Size 487KB
        • SHA256 438d2b1fd396c2108ca3902f69eeb372219edd5d95fe70970d8ee9e64556c9a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\de.pak
        • Size 521KB
        • SHA256 47253e2fcf0e4691f29b3ebbe8f888a97b28d6aeaf73ab000857a6b8d0907ff3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\el.pak
        • Size 944KB
        • SHA256 6a06d1d6b566214f7c3b693052beec488f7aae5ceeca26781a5d66fade39388b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\en-GB.pak
        • Size 424KB
        • SHA256 4e4d71f24f5eea6892b961fcda014fc74914c1340366f9c62f0535e9b94ae846
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\en-US.pak
        • Size 428KB
        • SHA256 0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\es-419.pak
        • Size 515KB
        • SHA256 d1019c780e836e0c30fe01928d23ecdd0ca04ed8ee886adb3428e3683e4ed6ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\es.pak
        • Size 515KB
        • SHA256 f6a01c26bc18dcf701e1d4b6ff76602f14c4bb9adf9dd176c9107d5aedb4503f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\et.pak
        • Size 468KB
        • SHA256 292eb18ec61502b0e952b447f73a66143c56dd95f170981945e5aab53a6b32b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\fa.pak
        • Size 767KB
        • SHA256 7a856070430e3cfad15b96b153b1cb483cca9a1b9a43453df3707b09c748a3f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\fi.pak
        • Size 478KB
        • SHA256 e6454458dfbe150112c37f8b02f8c72c593af22e8be16980ebc854ad113fb763
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\fil.pak
        • Size 541KB
        • SHA256 ab107369d45e105a4cb4f2f6bc8da2a8c1b6c65d5e94a7ab3e703e619c083dae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\fr.pak
        • Size 559KB
        • SHA256 976622fb851378f57f81423e5625e40d0753d7a5e34caed2c39e4b130a3427b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\gu.pak
        • Size 1.1MB
        • SHA256 716ea0433e19edb5113dc8a25ae67c2587bc17c7fb63a93ac473bdcef8f72d34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\he.pak
        • Size 672KB
        • SHA256 c3955c97b6998f1806f8871fd3137f6f504bdd091f8bd1ff5ab8cd089474ae8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\hi.pak
        • Size 1.1MB
        • SHA256 1f49622ec6682c90e03fc42c319074565cf9d3532a2a4e3798e2f6cc159b2e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\hr.pak
        • Size 521KB
        • SHA256 e442d083c32d752d1ef2225d84a4f1a91efab768e86fc63a7ed22c10fbf7e520
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\hu.pak
        • Size 561KB
        • SHA256 6ca150d0fc35492bafb411bbc520f3b34da6399969fa9685ae74201623882560
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\id.pak
        • Size 462KB
        • SHA256 af63384cf7d1d39e57decd823dff7538ab2b1e7e36e9ac61238477f7889d1d46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\it.pak
        • Size 509KB
        • SHA256 a7f555e7e797e1de1a66cfca8c7b709b0e542ca62e7de96e034701fcef316d0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\ja.pak
        • Size 622KB
        • SHA256 8260f4c9500b64d541386a8515fd0c9ddef82e3f044951b7b51a33ad81c1128f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\kn.pak
        • Size 1.2MB
        • SHA256 58d16195170f76e40e18ee0ac2e10e1b73bcfd083821158927a7d67a51bcbc42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\ko.pak
        • Size 526KB
        • SHA256 cba6b7633cce796407821264e176a6266f80c1799ade16bf16893d68144236c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\lt.pak
        • Size 564KB
        • SHA256 1bd385b780f3d13d41f8cf782a322e37be889aee273ffde3d8959e0ebcaabd0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\lv.pak
        • Size 564KB
        • SHA256 91642c04de64f88a5c49b4eeaf5d627554e60d56fc40e7cd58cd2601b0d3dbf2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\ml.pak
        • Size 1.3MB
        • SHA256 83d187cd70048f4129fa65ba148c74a04a47ee1f14218e7c85b36fe83e87b5e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\mr.pak
        • Size 1.0MB
        • SHA256 0877f2e75e0b9f5e709f0a0bf7cc793a02ff5bbb28bd6a8b6b6012760c1bbff3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\ms.pak
        • Size 484KB
        • SHA256 c7b56e9ca2f75b4414c13144ff4deee1459c2a7cde79730d863ab234cd4c2f8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\nb.pak
        • Size 471KB
        • SHA256 96747543d9b2dbfb4482d4c24d7818d366545b2476633ad4fec8cc958ab760d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\nl.pak
        • Size 484KB
        • SHA256 c7a18764ca908ec7f66c48cae2be06fef95213d7a5580b45f9bacee474456167
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\pl.pak
        • Size 543KB
        • SHA256 69e16e41f5fe7fa18557b938874f20cda6879f3cc616ead9a815c1381fe94158
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\pt-BR.pak
        • Size 510KB
        • SHA256 6d54f87f6c8b5e01bd0da9a961236344e95e85c3dc55fc92a34542777d6f6275
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\pt-PT.pak
        • Size 512KB
        • SHA256 a903ca2a8e52f987e23d040de7403b58d925a6c39668d3bc0822fb2aadd34cb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\ro.pak
        • Size 531KB
        • SHA256 82e69f505222125ea62f8e90d8030d82a1bd49871192cb4274a8fd9d0e03d577
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\ru.pak
        • Size 872KB
        • SHA256 d0068b9ddf8a9e6a5b1186bd0e00ed9f09224ed56ba7e653e2d54158d938c6f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\sk.pak
        • Size 548KB
        • SHA256 f9cd222838721a618c23c8f6493bc9699c795c0063998f1a8d506b4b7a297cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\sl.pak
        • Size 526KB
        • SHA256 b174c4c49654f7d65d223568c700bfaace74238447ae63171787236ce2aab00e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\sr.pak
        • Size 811KB
        • SHA256 a2bc6b064ff1f7b15707f61bd76ddd9d889bd982c4182e9e74272d39c6235c85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\sv.pak
        • Size 473KB
        • SHA256 48a71912e4843b03358fede7176b2e57ced83d3a1344a92b989886374dbded62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\sw.pak
        • Size 498KB
        • SHA256 1949953d638f266ce74d84c020174c074780166b880e7c2ec38bc6047bbb8ecc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\ta.pak
        • Size 1.3MB
        • SHA256 6348cc2d385b9808fdf1b815914dbfb26f552da4d10f85b2613a5e6e9f95b8fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\te.pak
        • Size 1.2MB
        • SHA256 09ab1ac2b69f868539d4f2e59dfea8c3c2f418a5455777e4c91d13c5ee55ab4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\th.pak
        • Size 1003KB
        • SHA256 f06a45f0395c3e42e42c46de2c19a2a104661b47be6f9ee97f8c68b05706ef1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\tr.pak
        • Size 509KB
        • SHA256 676d46d19d1673eeff4f5e908aec3b53a6273c440e69e7d655ced6c70531cb9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\uk.pak
        • Size 870KB
        • SHA256 29d68d90512ee9952635c7e074d5ab210531d93ae24c11a8f91bca20b685e9a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\ur.pak
        • Size 761KB
        • SHA256 2520ba8471c840aa075075524c4ad2bde10f43fa7a1b623aa14555180ecd30ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\vi.pak
        • Size 602KB
        • SHA256 25aeee59775ae38b21a091107022312fc228f96dbea906042bf3626b7cf86b98
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\zh-CN.pak
        • Size 435KB
        • SHA256 6a9a1f5b7674da36f20cb76af7e3e75e9e56873539e8a3b32895ebba439af83a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\locales\zh-TW.pak
        • Size 430KB
        • SHA256 6a43c8fac5a0ce7c7a21b30ac7bc2167488e17c81c76c00f0b92b49e9e46e469
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\resources.pak
        • Size 5.1MB
        • SHA256 1d241f5d4403a6e802e898c61e4753f8508ae4dda8fcb7750558ec1ecade52c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app-update.yml

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\resources\app-update.yml
        • Size 165B
        • SHA256 bce48b3568891e7542a83b1ceb8a15f6ad1b29f41ff612105481c03eaafeb664
        • MD5 SHA1 SHA512 TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\resources\app.asar
        • Size 22.2MB
        • SHA256 ea1cb0f5b2b336b1e0d7ccfdb97c35836e79605ae8acf4747b4df1ed2e2ceb28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        6111917f3a5c9c62e67df5a0d0e9136e.ico

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\resources\app.asar.unpacked\bundle\6111917f3a5c9c62e67df5a0d0e9136e.ico
        • Size 5KB
        • SHA256 3925c6b5a1f307b904b9988efd35f55bf00a8abbb03ab7b5aafea7dfe8127e05
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7f8b663e6218621b36b1867f8f2ff543.ico

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\resources\app.asar.unpacked\bundle\7f8b663e6218621b36b1867f8f2ff543.ico
        • Size 5KB
        • SHA256 a308956b317a63c6c1316d1a0098144c35a6fa39c1cb2d587b0b6f5b218c07c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af46f86f65f624cfee407eac19d946db.ico

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\resources\app.asar.unpacked\bundle\af46f86f65f624cfee407eac19d946db.ico
        • Size 5KB
        • SHA256 14699f50aa5ea12cc9f5ad132e62cc501eb328bec7364f8ea7d48ef1939e20c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        c0edcf9115ff85441b19ff0e2f387c2d.ico

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\resources\app.asar.unpacked\bundle\c0edcf9115ff85441b19ff0e2f387c2d.ico
        • Size 5KB
        • SHA256 3f9dbbd99bdfa7c1c5517aa9929270ac3c632b1cb794b307f51466fab518d590
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yt-dlp.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\resources\bin_ia32\yt-dlp.exe
        • Size 13.8MB
        • SHA256 bbbb4c98ff0cfe63c8db08898748b9e7d40051355671bb6d8c5772a1ac270fa5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\resources\elevate.exe
        • Size 125KB
        • SHA256 febea4f9b8e43a7c8bbd3506f96803ae6cf5489b7129f8b27f3c7dc7439c5c95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\snapshot_blob.bin
        • Size 278KB
        • SHA256 e0e7d2ec67b93b6f801d01a81632a7f26038f3e249c3b9c8c6625dde40a7a9e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\v8_context_snapshot.bin
        • Size 631KB
        • SHA256 457167b96cf7cb9d80bf5f74976314b465439adb0563ed820be15d848f3daf66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\vk_swiftshader.dll
        • Size 4.4MB
        • SHA256 7ca00d10f18573e32daaf3776ebf63edf27c13f249782de0f485f8e0195b2421
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\7z-out\vulkan-1.dll
        • Size 803KB
        • SHA256 0edc95e7633025b080a2866f1556f61c6b2230bf5498987de8f92334f7edc149
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INetC.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\INetC.dll
        • Size 238KB
        • SHA256 ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SpiderBanner.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\SpiderBanner.dll
        • Size 9KB
        • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WinShell.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH

        nsExec.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsz3574.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\televzr_light\chrome_100_percent.pak
        • Size 163KB
        • SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default.dic

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        index

        • Path C:\Users\Admin\AppData\Roaming\Televzr Light\Partitions\ui\Code Cache\wasm\index
        • Size 24B
        • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
        • MD5 SHA1 SHA512

        data_0

        • Path C:\Users\Admin\AppData\Roaming\Televzr Light\Partitions\ui\DawnCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP

        data_1

        • Path C:\Users\Admin\AppData\Roaming\Televzr Light\Partitions\ui\DawnCache\data_1
        • Size 264KB
        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
        • MD5 SHA1 SHA512 SSDEEP

        data_2

        • Path C:\Users\Admin\AppData\Roaming\Televzr Light\Partitions\ui\GPUCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP

        data_3

        • Path C:\Users\Admin\AppData\Roaming\Televzr Light\Partitions\ui\GPUCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP

        CURRENT

        • Path C:\Users\Admin\AppData\Roaming\Televzr Light\Partitions\ui\Local Storage\leveldb\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512

        169a49c5-cd02-4563-a730-0772c37acd7c.tmp

        • Path C:\Users\Admin\AppData\Roaming\Televzr Light\Partitions\ui\Network\169a49c5-cd02-4563-a730-0772c37acd7c.tmp
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH

        MANIFEST-000001

        • Path C:\Users\Admin\AppData\Roaming\Televzr Light\Partitions\yt\Local Storage\leveldb\MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512

        cf522c9d-c0e8-441d-9cf3-66946035cf28.tmp

        • Path C:\Users\Admin\AppData\Roaming\Televzr Light\Partitions\yt\cf522c9d-c0e8-441d-9cf3-66946035cf28.tmp
        • Size 57B
        • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
        • MD5 SHA1 SHA512 TLSH

        memory/3404-43-0x0000000000B90000-0x0000000000C4B000-memory.dmp

        memory/3404-766-0x0000000000B90000-0x0000000000C4B000-memory.dmp

        memory/3404-286-0x0000000000B90000-0x0000000000C4B000-memory.dmp

        memory/3404-64-0x0000000000B90000-0x0000000000C4B000-memory.dmp

        memory/3404-54-0x0000000000B90000-0x0000000000C4B000-memory.dmp

        memory/3404-45-0x0000000000B90000-0x0000000000C4B000-memory.dmp

        memory/3404-32-0x0000000000B90000-0x0000000000C4B000-memory.dmp

        memory/3404-41-0x0000000000B90000-0x0000000000C4B000-memory.dmp

        memory/3404-37-0x0000000000B90000-0x0000000000C4B000-memory.dmp

        memory/3404-25-0x0000000003550000-0x0000000003556000-memory.dmp

        memory/3404-24-0x0000000000B90000-0x0000000000C4B000-memory.dmp