nanocore | ceb348dfa61b34bebce021fa783b0afdb874ea7205f75e7fb42b01898439be75

Resubmissions

30-11-2024 09:47

241130-lr665avndn 10

30-11-2024 09:44

241130-lqny6a1jgz 10

08-11-2024 08:52

241108-ksvn2s1rgl 10

Analysis

max time kernel
1060s
max time network
1065s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-it
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-itlocale:it-itos:windows10-ltsc 2021-x64systemwindows
submitted
08-11-2024 08:52

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar
Size

5.8MB
MD5

c75744769bae7a3e7a4a1aec27673851
SHA1

56b0aa88b44c532be4975bc096cb8e4b9e7ecb49
SHA256

ceb348dfa61b34bebce021fa783b0afdb874ea7205f75e7fb42b01898439be75
SHA512

fa0c8d0b3adbb0bf11185b6c85f38c99421ef24ce55d94674e8d999c907f323a3eb0bcf711b60298e31db2958ebfa2dafad9d01cdf1e61251018ebd717934679
SSDEEP

98304:5S+zg4KC/4ObL3j/ZV2tKRcHhMBJcPpylijvjTZi1UBCFCX/IxCF+/h0k98nRDdj:51kC/40z3tKMrcByIT1B2zkA/Ck92thv

Score

10^/10

nanocore collection defense_evasion discovery evasion keylogger persistence phishing privilege_escalation spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/5252-4289-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/5252-4290-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/5252-4293-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/5252-4289-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/5252-4290-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/5252-4293-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: meBajiyreoLOr@vsh_BG
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	obs-browser-page.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	obs-browser-page.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	obs64.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 19 IoCs

pid	Process
2544	NanoCore.exe
2460	a.exe
3256	OBS-Studio-30.2.3-Windows-Installer.exe
2468	check_for_64bit_visual_studio_2022_runtimes.exe
1724	VC_redist.x64.exe
7704	VC_redist.x64.exe
6228	VC_redist.x64.exe
5508	obs64.exe
756	obs-qsv-test.exe
4200	get-graphics-offsets64.exe
2552	get-graphics-offsets32.exe
7176	obs-browser-page.exe
7316	obs-browser-page.exe
6792	obs-browser-page.exe
7472	obs-browser-page.exe
6680	obs-browser-page.exe
8132	obs-ffmpeg-mux.exe
2992	obs-browser-page.exe
6168	a.exe

Loads dropped DLL 64 IoCs

pid	Process
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
3256	OBS-Studio-30.2.3-Windows-Installer.exe
3256	OBS-Studio-30.2.3-Windows-Installer.exe
3256	OBS-Studio-30.2.3-Windows-Installer.exe
3256	OBS-Studio-30.2.3-Windows-Installer.exe
7704	VC_redist.x64.exe
1056	VC_redist.x64.exe
4276	regsvr32.exe
6248	regsvr32.exe
3008	regsvr32.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5af95fd8-a22e-458f-acee-c61bd787178e} = "\"C:\\ProgramData\\Package Cache\\{5af95fd8-a22e-458f-acee-c61bd787178e}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\F:	a.exe
File opened (read-only)	\??\O:	wmplayer.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2460 set thread context of 5252	2460	a.exe	182
PID 2460 set thread context of 6108	2460	a.exe	183

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-transitions\luma_wipes\iris.png	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-outputs\locale\zh-CN.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-x264\locale\nn-NO.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\win-capture\get-graphics-offsets32.exe	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-transitions\locale\ba-RU.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\win-wasapi\locale\tt-RU.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-transitions\luma_wipes\checkerboard-small.png	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\vlc-video\locale\fa-IR.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\win-capture\locale\he-IL.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\coreaudio-encoder\locale\eo-UY.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\obs-plugins\64bit\locales\ko.pak	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-text\locale\ja-JP.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\win-capture\locale\uk-UA.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-studio\locale\ru-RU.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\image-source\locale\lo-LA.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-ffmpeg\locale\af-ZA.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-webrtc\locale\en-GB.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\bin\64bit\imageformats\qico.dll	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\win-wasapi\locale\hy-AM.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\win-dshow\locale\ta-IN.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-webrtc\locale\uk-UA.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\win-capture\locale\bg-BG.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-studio\locale\sv-SE.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\decklink\locale\ar-SA.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\win-dshow\locale\an-ES.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\win-capture\locale\hr-HR.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-studio\locale\an-ES.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-filters\locale\sr-SP.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\win-capture\locale\ta-IN.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\rtmp-services\locale\ba-RU.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-transitions\luma_wipes\barndoor-topleft.png	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\frontend-tools\locale\hu-HU.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-filters\locale\be-BY.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\frontend-tools\scripts\clock-source\minute.png	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\win-capture\locale\ar-SA.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\aja\locale\nn-NO.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-vst\locale\hy-AM.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-qsv11\locale\ms-MY.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\vlc-video\locale\bg-BG.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-outputs\locale\uk-UA.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\win-dshow\locale\da-DK.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\aja\locale\sk-SK.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-qsv11\locale\is-IS.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-x264\locale\da-DK.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-studio\themes\Light\media\media_restart.svg	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-outputs\locale\fil-PH.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-studio\themes\Dark\sources\brush.svg	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\obs-plugins\64bit\locales\gu.pak	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\image-source\locale\es-ES.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-vst\locale\de-DE.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-studio\locale\sq-AL.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-studio\locale\id-ID.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-studio\themes\Dark\dots.svg	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\decklink\locale\fi-FI.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-filters\locale\sk-SK.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-studio\themes\Light\media-pause.svg	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-browser\locale\fi-FI.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\win-capture\get-graphics-offsets32.exe	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-studio\themes\Dark\refresh.svg	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-outputs\locale\pl-PL.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\aja-output-ui\locale\zh-TW.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-studio\themes\Dark\network-disconnected.svg	OBS-Studio-30.2.3-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\aja\locale\eu-ES.ini	OBS-Studio-30.2.3-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\libobs\color.effect	OBS-Studio-30.2.3-Windows-Installer.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB6E.tmp	msiexec.exe
File created	C:\Windows\Installer\e61d1b7.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID62C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e61d1b7.msi	msiexec.exe
File created	C:\Windows\Installer\e61d1c9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e61d1ca.msi	msiexec.exe
File created	C:\Windows\Installer\e61d1df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID418.tmp	msiexec.exe
File created	C:\Windows\Installer\e61d1ca.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\OBS-Studio-30.2.3-Windows-Installer.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6024	4740	WerFault.exe	228

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OBS-Studio-30.2.3-Windows-Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NanoCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	get-graphics-offsets32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Taskmgr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	obs64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	obs64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	obs64.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3200	ipconfig.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
916	taskkill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3785588363-1079601362-4184885025-1000\{275351DC-1EA7-49AD-BAFC-DF1BC582B484}	wmplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\NodeSlot = "4"	NanoCore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4BB3B8BD01A15F4197B6AF4AF3CE17A\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33810"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	obs64.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NanoCore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\4\NodeSlot = "8"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	NanoCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{5af95fd8-a22e-458f-acee-c61bd787178e}	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 020000000100000000000000ffffffff	obs64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	NanoCore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}\ = "OBS Virtual Camera"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}\CLSID = "{A3FCE0F5-3493-419F-958A-ABA1250EC20B}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	obs64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1"	obs64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 0100000000000000ffffffff	NanoCore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Version = "237536274"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	obs64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000	obs64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	NanoCore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	obs64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 0400000003000000020000000100000000000000ffffffff	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NanoCore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NanoCore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	NanoCore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}\ = "OBS Virtual Camera"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 19002f433a5c000000000000000000000000000000000000000000	NanoCore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0\VC_Runtime_Additional	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1"	obs64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 03000000020000000100000000000000ffffffff	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\0\0\MRUListEx = ffffffff	NanoCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	NanoCore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33810"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NanoCore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\PackageCode = "A40E8013387385E43AA0F61A9357B166"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33810"	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	obs64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	obs64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	obs64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\OBS-Studio-30.2.3-Windows-Installer.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5416	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5508	obs64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe
2460	a.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
2544	NanoCore.exe
2460	a.exe
5508	obs64.exe
6168	a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	820	7zFM.exe
Token: 35	820	7zFM.exe
Token: SeSecurityPrivilege	820	7zFM.exe
Token: SeDebugPrivilege	2544	NanoCore.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	2460	a.exe
Token: 33	7824	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	7824	AUDIODG.EXE
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	916	taskkill.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	5420	Taskmgr.exe
Token: SeSystemProfilePrivilege	5420	Taskmgr.exe
Token: SeCreateGlobalPrivilege	5420	Taskmgr.exe
Token: 33	5420	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	5420	Taskmgr.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeBackupPrivilege	7240	vssvc.exe
Token: SeRestorePrivilege	7240	vssvc.exe
Token: SeAuditPrivilege	7240	vssvc.exe
Token: SeShutdownPrivilege	6228	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	6228	VC_redist.x64.exe
Token: SeSecurityPrivilege	6924	msiexec.exe
Token: SeCreateTokenPrivilege	6228	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	6228	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	6228	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	6228	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	6228	VC_redist.x64.exe
Token: SeTcbPrivilege	6228	VC_redist.x64.exe
Token: SeSecurityPrivilege	6228	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	6228	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	6228	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	6228	VC_redist.x64.exe
Token: SeSystemtimePrivilege	6228	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	6228	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	6228	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	6228	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	6228	VC_redist.x64.exe
Token: SeBackupPrivilege	6228	VC_redist.x64.exe
Token: SeRestorePrivilege	6228	VC_redist.x64.exe
Token: SeShutdownPrivilege	6228	VC_redist.x64.exe
Token: SeDebugPrivilege	6228	VC_redist.x64.exe
Token: SeAuditPrivilege	6228	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	6228	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	6228	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	6228	VC_redist.x64.exe
Token: SeUndockPrivilege	6228	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	6228	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	6228	VC_redist.x64.exe
Token: SeManageVolumePrivilege	6228	VC_redist.x64.exe
Token: SeImpersonatePrivilege	6228	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	6228	VC_redist.x64.exe
Token: SeRestorePrivilege	6924	msiexec.exe
Token: SeTakeOwnershipPrivilege	6924	msiexec.exe
Token: SeRestorePrivilege	6924	msiexec.exe
Token: SeTakeOwnershipPrivilege	6924	msiexec.exe
Token: SeRestorePrivilege	6924	msiexec.exe
Token: SeTakeOwnershipPrivilege	6924	msiexec.exe
Token: SeRestorePrivilege	6924	msiexec.exe
Token: SeTakeOwnershipPrivilege	6924	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
820	7zFM.exe
820	7zFM.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
2544	NanoCore.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5420	Taskmgr.exe
5508	obs64.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
2544	NanoCore.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
2544	NanoCore.exe
2544	NanoCore.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
3256	OBS-Studio-30.2.3-Windows-Installer.exe
1724	VC_redist.x64.exe
7704	VC_redist.x64.exe
6228	VC_redist.x64.exe
856	VC_redist.x64.exe
1056	VC_redist.x64.exe
6652	VC_redist.x64.exe
4200	get-graphics-offsets64.exe
2552	get-graphics-offsets32.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe
5508	obs64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3200	4588	cmd.exe	104
PID 4588 wrote to memory of 3200	4588	cmd.exe	104
PID 1152 wrote to memory of 4884	1152	firefox.exe	109
PID 1152 wrote to memory of 4884	1152	firefox.exe	109
PID 1152 wrote to memory of 4884	1152	firefox.exe	109
PID 1152 wrote to memory of 4884	1152	firefox.exe	109
PID 1152 wrote to memory of 4884	1152	firefox.exe	109
PID 1152 wrote to memory of 4884	1152	firefox.exe	109
PID 1152 wrote to memory of 4884	1152	firefox.exe	109
PID 1152 wrote to memory of 4884	1152	firefox.exe	109
PID 1152 wrote to memory of 4884	1152	firefox.exe	109
PID 1152 wrote to memory of 4884	1152	firefox.exe	109
PID 1152 wrote to memory of 4884	1152	firefox.exe	109
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 4684	4884	firefox.exe	110
PID 4884 wrote to memory of 2332	4884	firefox.exe	111
PID 4884 wrote to memory of 2332	4884	firefox.exe	111
PID 4884 wrote to memory of 2332	4884	firefox.exe	111
PID 4884 wrote to memory of 2332	4884	firefox.exe	111
PID 4884 wrote to memory of 2332	4884	firefox.exe	111
PID 4884 wrote to memory of 2332	4884	firefox.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3628

C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe
"C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2544

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:3200

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {52eec971-26d2-463b-918b-8ed101803257} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" gpu
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e618ec7d-8ff0-4e5e-afcc-62b08bfb9507} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" socket
    3⤵
    - Checks processor information in registry
    PID:2332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2688 -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 3032 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df27abac-b471-49c0-9f99-47b397b29f4d} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4036 -childID 2 -isForBrowser -prefsHandle 4028 -prefMapHandle 4024 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94e84f96-8f11-4f1c-93c2-36bbc1bca670} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4788 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4880 -prefMapHandle 4872 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08070dba-fb61-4009-96d8-6dba85eaacb2} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" utility
    3⤵
    - Checks processor information in registry
    PID:5256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5336 -childID 3 -isForBrowser -prefsHandle 5300 -prefMapHandle 5296 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bdcf8c7-3cb0-42fa-96a5-ee032e3c560b} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 4 -isForBrowser -prefsHandle 5480 -prefMapHandle 5484 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d8fee40-4d86-4b1d-b007-e08f3ee270ed} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5664 -childID 5 -isForBrowser -prefsHandle 5672 -prefMapHandle 5676 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c5d50b0-cb38-401e-9a8c-41cf77368789} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6240 -childID 6 -isForBrowser -prefsHandle 6232 -prefMapHandle 6228 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb21046c-b035-467e-9878-3ab87994b1cd} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 7 -isForBrowser -prefsHandle 5432 -prefMapHandle 5744 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {288ab356-78a4-4028-8345-e4b640f7407d} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2744 -childID 8 -isForBrowser -prefsHandle 2748 -prefMapHandle 6692 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {989e139f-560e-49af-9a7f-5558d058a0ed} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7108 -parentBuildID 20240401114208 -prefsHandle 6996 -prefMapHandle 7100 -prefsLen 30533 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b4bbab1-0fe2-40e3-9f50-1a8f4b5ecbc7} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" rdd
    3⤵
    PID:3516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4932 -childID 9 -isForBrowser -prefsHandle 5152 -prefMapHandle 7108 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f94b51bd-cd22-4053-91a7-98d0c0b0fd4a} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6444 -childID 10 -isForBrowser -prefsHandle 6440 -prefMapHandle 5396 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0430237-ae50-4106-b136-0522392fcc55} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7352 -childID 11 -isForBrowser -prefsHandle 7360 -prefMapHandle 7364 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aded1bf2-5bc1-46ba-a88e-eefc2ff28ad0} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:1984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7244 -childID 12 -isForBrowser -prefsHandle 7364 -prefMapHandle 6468 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fc97772-00ed-484b-b402-90a19750a112} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7160 -childID 13 -isForBrowser -prefsHandle 7380 -prefMapHandle 5992 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {616879d9-8162-4d20-87ab-9fa4ec357b64} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8100 -childID 14 -isForBrowser -prefsHandle 8072 -prefMapHandle 8084 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {768e8ed2-6ca4-4b53-bc5e-af832c4a0987} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8128 -childID 15 -isForBrowser -prefsHandle 8336 -prefMapHandle 8324 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b55e4a1-f91b-46f7-9d61-b1dc800585f2} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8508 -childID 16 -isForBrowser -prefsHandle 8392 -prefMapHandle 8396 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96376d89-e31c-4b37-b24c-fde8c42c49bb} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8692 -childID 17 -isForBrowser -prefsHandle 8700 -prefMapHandle 8640 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47bd46d5-5d5a-4066-be80-fc04014af322} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8336 -childID 18 -isForBrowser -prefsHandle 8860 -prefMapHandle 8856 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9f577bb-f16b-4832-bede-bfafaca86b2f} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8760 -childID 19 -isForBrowser -prefsHandle 8996 -prefMapHandle 9000 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b1fd50d-745c-451f-9956-6f91c1c4ea1b} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8780 -childID 20 -isForBrowser -prefsHandle 8700 -prefMapHandle 8640 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72ddfa6e-47a8-48fd-bc5d-a546d5634efa} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9788 -childID 21 -isForBrowser -prefsHandle 9564 -prefMapHandle 9716 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c079d0a1-a575-477e-a151-3c24432aa965} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9972 -childID 22 -isForBrowser -prefsHandle 9888 -prefMapHandle 9892 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f2866ac-f2fa-464c-b9a8-a9a92c994279} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10224 -childID 23 -isForBrowser -prefsHandle 10208 -prefMapHandle 10212 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cadebe61-ff14-4092-884d-87862067b950} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10084 -childID 24 -isForBrowser -prefsHandle 10092 -prefMapHandle 10096 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2cc3951-9a0c-492d-aa05-6298c067dbea} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10460 -childID 25 -isForBrowser -prefsHandle 10444 -prefMapHandle 10448 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05a2ce27-7a4c-4a36-ad2f-aac0ec3bbdc2} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9708 -childID 26 -isForBrowser -prefsHandle 10640 -prefMapHandle 10644 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76958af8-e76b-4eff-8789-921735e3ece7} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10872 -childID 27 -isForBrowser -prefsHandle 10788 -prefMapHandle 10792 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e25a6f66-be7f-40fe-ab01-4698427b82f6} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10788 -childID 28 -isForBrowser -prefsHandle 10852 -prefMapHandle 10856 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69b3e777-4ba3-4a83-b36f-3c058eaa98a5} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10864 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 11132 -prefMapHandle 10844 -prefsLen 30533 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bae1fe3-d470-4866-bdfe-63ec237f3368} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" utility
    3⤵
    - Checks processor information in registry
    PID:4436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11404 -childID 29 -isForBrowser -prefsHandle 11388 -prefMapHandle 6872 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17e36da8-6063-4faf-afe5-0354301bb527} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:8132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11672 -childID 30 -isForBrowser -prefsHandle 11632 -prefMapHandle 11660 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {325128c5-b0f2-4c88-bf44-abd3ed35dcbc} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9152 -childID 31 -isForBrowser -prefsHandle 8872 -prefMapHandle 8444 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1899eae-4a42-4940-aabd-5b3b00d9746a} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:8104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8112 -childID 32 -isForBrowser -prefsHandle 7356 -prefMapHandle 10980 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f710321d-323e-43a2-9ed3-304e0a62d571} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8104 -childID 33 -isForBrowser -prefsHandle 10136 -prefMapHandle 10148 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1116247-9d18-4aa5-917c-7e5f43068c46} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:8124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10048 -childID 34 -isForBrowser -prefsHandle 9024 -prefMapHandle 11540 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5b6e5da-82f7-4308-b2d1-0fb311bc303c} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10568 -childID 35 -isForBrowser -prefsHandle 10072 -prefMapHandle 10544 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e78c132-e98c-48b9-8969-efcc418c0e34} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8308 -childID 36 -isForBrowser -prefsHandle 8388 -prefMapHandle 8596 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11556c7d-4f83-4fdb-8c7e-28970e7b4c49} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11348 -childID 37 -isForBrowser -prefsHandle 9320 -prefMapHandle 9628 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58ee891a-06ae-4853-99a2-ed9686188fad} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7332 -childID 38 -isForBrowser -prefsHandle 10172 -prefMapHandle 10168 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aba5d847-1ff7-4b59-8baf-1afc34ca4694} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7452 -childID 39 -isForBrowser -prefsHandle 8404 -prefMapHandle 8572 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4af5ecf-38b3-47ba-8573-745a462a63f8} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8696 -childID 40 -isForBrowser -prefsHandle 9960 -prefMapHandle 8828 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00a9faaf-f0a1-4e58-8a40-2ed568e452da} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:3288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10764 -childID 41 -isForBrowser -prefsHandle 8780 -prefMapHandle 8224 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d440e07-16b8-4272-990a-a1fbb3194b78} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10428 -childID 42 -isForBrowser -prefsHandle 7424 -prefMapHandle 7216 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e14787b-29d7-43c4-ba27-e977a87f7371} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7512 -childID 43 -isForBrowser -prefsHandle 1408 -prefMapHandle 7124 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6aca1e57-3375-4c00-91e8-ec46f18e5277} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:3148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11844 -childID 44 -isForBrowser -prefsHandle 2716 -prefMapHandle 7844 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4487523-8343-47ff-810d-2396a4e2a0f1} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10412 -childID 45 -isForBrowser -prefsHandle 10372 -prefMapHandle 10356 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8095ec85-e48f-4d80-9022-440def8a4c60} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8672 -childID 46 -isForBrowser -prefsHandle 10972 -prefMapHandle 10668 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {efaf6357-7057-41f9-aaab-4367c3010903} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9616 -childID 47 -isForBrowser -prefsHandle 5208 -prefMapHandle 5188 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65646e2c-fc48-446a-bd87-b8ffbf866697} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3688 -childID 48 -isForBrowser -prefsHandle 5192 -prefMapHandle 5184 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2e8a8c9-d0f2-420d-89b5-bd886b577b70} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8320 -childID 49 -isForBrowser -prefsHandle 9836 -prefMapHandle 9824 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2975a9c9-0a2f-4db6-875a-775522a49dac} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10108 -childID 50 -isForBrowser -prefsHandle 5876 -prefMapHandle 5936 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1335a59e-a93d-4936-8c11-c7c388034e34} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7832 -childID 51 -isForBrowser -prefsHandle 11252 -prefMapHandle 5140 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e8dc83e-5e67-463b-aefd-a893c0bfb272} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9936 -childID 52 -isForBrowser -prefsHandle 9320 -prefMapHandle 8976 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31374345-7346-4c5c-abfa-397e55805a64} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11956 -childID 53 -isForBrowser -prefsHandle 11392 -prefMapHandle 11124 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e14d2f01-9bd8-43a5-b39b-a1090f7becde} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:1720
- - C:\Users\Admin\Downloads\OBS-Studio-30.2.3-Windows-Installer.exe
    "C:\Users\Admin\Downloads\OBS-Studio-30.2.3-Windows-Installer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\nsb7531.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
      C:\Users\Admin\AppData\Local\Temp\nsb7531.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
      4⤵
      Executes dropped EXE
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\nsb7531.tmp\VC_redist.x64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsb7531.tmp\VC_redist.x64.exe" /quiet /norestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Windows\Temp\{24BFE0D8-31EB-4B90-9827-1529E283C205}\.cr\VC_redist.x64.exe
        
        "C:\Windows\Temp\{24BFE0D8-31EB-4B90-9827-1529E283C205}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsb7531.tmp\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 /quiet /norestart
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7704
      - C:\Windows\Temp\{C46D7EAC-FB91-49E8-B046-AF8CF16F0777}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{C46D7EAC-FB91-49E8-B046-AF8CF16F0777}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{3FDAC323-4FB1-4B65-8393-6DDA02FE7B03} {5F630EA2-DDFE-41F7-BC28-082E705E41B7} 7704
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:6228
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1172 -burn.embedded BurnPipe.{B9D3C065-82C5-4BA4-8F94-570186BBEB01} {FE7D5EA3-62B2-42A4-AE49-1446DC976871} 6228
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:856
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1172 -burn.embedded BurnPipe.{B9D3C065-82C5-4BA4-8F94-570186BBEB01} {FE7D5EA3-62B2-42A4-AE49-1446DC976871} 6228
        8⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1056
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8D5E9DEC-B73E-47CE-A399-4EEBB58482FF} {97C9733F-54C8-40A1-9410-985DE2C68738} 1056
        9⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:6652
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module32.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4276
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6248
    - - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:3008
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio\OBS Studio (64bit).lnk"
      4⤵
      PID:744

C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\a.exe
"C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\a.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill -f -im cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
  "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\xcj1ktsl.xie"
  2⤵
  - Accesses Microsoft Outlook accounts
  - System Location Discovery: System Language Discovery
  PID:5252
- \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
  "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\cqb4v4tj.hgh"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6108
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\CompleteWatch.mht
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x140,0x150,0x7ff92c2f46f8,0x7ff92c2f4708,0x7ff92c2f4718
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1579978939984830836,17189873035811996376,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1579978939984830836,17189873035811996376,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,1579978939984830836,17189873035811996376,131072 --lang=it --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:7612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1579978939984830836,17189873035811996376,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1579978939984830836,17189873035811996376,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1579978939984830836,17189873035811996376,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff6dfe55460,0x7ff6dfe55470,0x7ff6dfe55480
      4⤵
      PID:7372
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1579978939984830836,17189873035811996376,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    PID:8044
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument F:\GroupUndo.shtml
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ff92c2f46f8,0x7ff92c2f4708,0x7ff92c2f4718
    3⤵
    PID:7912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,17931607459996903942,18118610156112363154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:8144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,17931607459996903942,18118610156112363154,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,17931607459996903942,18118610156112363154,131072 --lang=it --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
    3⤵
    PID:7800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17931607459996903942,18118610156112363154,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17931607459996903942,18118610156112363154,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:4140

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4 0x490
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7824

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:644

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:7132

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:7088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7240

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7156
- C:\Program Files\obs-studio\bin\64bit\obs64.exe
  "C:\Program Files\obs-studio\bin\64bit\obs64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5508
- - C:\Program Files\obs-studio\bin\64bit\obs-qsv-test.exe
    "C:/Program Files/obs-studio/bin/64bit/obs-qsv-test.exe" 53fc 5539
    3⤵
    - Executes dropped EXE
    PID:756
- - C:\Program Files\obs-studio\data\obs-plugins\win-capture\get-graphics-offsets64.exe
    "../../data/obs-plugins/win-capture/get-graphics-offsets64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4200
- - C:\Program Files\obs-studio\data\obs-plugins\win-capture\get-graphics-offsets32.exe
    "../../data/obs-plugins/win-capture/get-graphics-offsets32.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2552
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=4928 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:7176
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5208 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:7316
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5224 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:7472
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=5472 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:6680
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=5480 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:6792
- - C:\Program Files\obs-studio\bin\64bit\obs-ffmpeg-mux.exe
    "C:/Program Files/obs-studio/bin/64bit/obs-ffmpeg-mux.exe" "C:/Users/Admin/Videos/2024-11-08 09-04-41.mkv" 1 1 h264 2500 1280 720 1 1 1 1 1 0 30 1 0 aac simple_aac 160 48000 1024 2 "" ""
    3⤵
    - Executes dropped EXE
    PID:8132
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8248 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:2992
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7360 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4968
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8400 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3896
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8452 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3600
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8508 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5204
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8520 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7668
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=2196 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6452
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8512 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5276
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7732 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7308
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8452 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5184
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8540 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1980
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=6164 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5056
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8360 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1412
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8472 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6388
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5676 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:8076
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9136 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3460
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5396 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3492
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5388 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4748
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8352 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:844
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5384 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2568
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5676 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7192
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8328 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2976
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9008 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1488
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8400 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6844
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5624 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7272
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8092 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6828
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7360 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7456
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8852 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7856
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8724 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4948
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8856 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5536
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7728 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7436
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=6176 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:8088
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=4912 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7944
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5304 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4036
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=6164 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7068
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8952 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6632
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5304 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6936
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8956 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6864
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7624 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7000
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5396 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5936
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8856 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7072
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9100 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5468
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7624 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6124
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8852 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3848
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8088 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4816
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9008 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7764
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8856 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5328
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8140 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4140
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8952 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7552
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7524 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3824
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7624 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6508
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9008 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6744
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8340 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2804
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=6176 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7752
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7524 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7700
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=6164 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7080
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5676 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3696
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8724 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4452
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8400 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1636
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5012 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6212
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=6176 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7248
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8856 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6036
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8076 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3568
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8264 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2832
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7360 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4624
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9120 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:216
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5676 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6252
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8092 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7820
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8956 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5256
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8324 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3456
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7992 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6248
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5320 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:456
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8324 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6700
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8856 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4076
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8100 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6868
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7780 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5216
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9120 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3252
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8724 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3172
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9008 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5212
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8100 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7716
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8260 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6228
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8340 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5160
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8328 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6312
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8844 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5144
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8548 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5472
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8452 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5812
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8848 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7276
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=6164 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6748
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8076 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4712
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8340 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7416
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8012 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7380
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8324 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5420
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8268 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3176
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8844 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7664
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8340 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3196
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8400 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7696
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8956 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7556
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=4904 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2272
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5012 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6172
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=4912 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5980
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8152 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1516
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8140 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:8040
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9088 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4940
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5012 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1668
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9112 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:952
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8444 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3304
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8064 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3600
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8028 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7452
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9160 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4476
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9172 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5372
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8100 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5340
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9180 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6420
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9140 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3156
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8284 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6040
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9212 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6500
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9164 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4300
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9172 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4328
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9184 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5380
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8100 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4448
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9196 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7348
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7728 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:784
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8288 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5464
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9132 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3160
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9200 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7344
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8852 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5896
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9172 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:8004
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9176 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6576
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9168 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6156
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9208 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:8024
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9152 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:332
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8284 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:8076
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9156 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1020
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8064 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7208
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8852 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9148 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4748
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9204 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6964
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9168 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2096
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9104 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6436
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9072 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7608
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9172 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6208
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9208 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2468
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8028 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:408
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7996 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6840
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8148 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6884
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9088 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5084
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9212 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7428
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8852 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7272
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8288 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2204
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9204 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3576
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9164 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7456
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9156 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7508
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8332 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5996
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9072 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1100
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9212 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:224
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9184 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1784
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8148 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2944
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5396 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1720
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9208 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2264
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8016 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7136
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8148 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6956
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9184 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1748
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9160 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4004
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9092 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7356
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9188 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7680
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8852 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6280
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8140 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6008
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9072 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1468
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9104 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5244
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9168 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5768
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8016 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7540
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8956 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4084
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8852 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7260
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9176 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:448
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9200 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5712
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9120 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5300
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5012 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7644
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9088 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3480
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=7984 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5952
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8852 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5936
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9164 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4600
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9200 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7972
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9148 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4104
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9132 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5468
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9120 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7968
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9092 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5664
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=4904 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:8060
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9176 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6888
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8064 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5328
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9144 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4140
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9180 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:8020
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9112 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:3560
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8956 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:968
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9160 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:6908
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9104 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7920
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9132 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4532
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9164 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1956
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8100 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:8092
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9116 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:8160
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9176 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5376
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9132 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1564
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8028 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5796
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9160 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:7996
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9192 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2212
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9208 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2484
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8148 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1480
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9140 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:852
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=5624 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:2556
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9156 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:216
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=8028 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:4896
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=utility --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9092 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:1984
- - C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe
    "C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent-product="Chrome/103.0.5060.134 OBS/30.2.3" --lang=it-IT --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --parent_pid=5508 --log-file="C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\debug.log" --mojo-platform-channel-handle=9152 --field-trial-handle=5072,i,5739382458502910370,10147836491636587094,131072 --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,WebBluetooth,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    PID:5384

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4740
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:628
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    PID:6644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 2288
  2⤵
  - Program crash
  PID:6024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4740 -ip 4740
1⤵
PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3620

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:852

C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\a.exe
"C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\a.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:6168

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3920855 /state1:0x41c64e6d
1⤵
PID:6256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:7832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e61d1bc.rbs

Filesize
19KB

MD5
e2d69b429841a8fb807e008da92cd04c

SHA1
99d8adcfebf62a1337c1cfd6daa5bc7447f3616f

SHA256
5242face33167d1e6e55483be457f2328c412457e64ac72375f57c60c105d919

SHA512
804638e1a82715eb3267fd1a2b0cf5e072dcd95ff67317d9190903024f4f81bc299a0b09a4b2d925852e06c17cb0919e32b4f1ab2f10a089d0b2a35d9af9894c

Download Submit
C:\Config.Msi\e61d1c8.rbs

Filesize
19KB

MD5
e30b831d024e977122779b7aade6db71

SHA1
ef98320937eb32165ead0fde3e30a133be3ca5a1

SHA256
ed47b609534693a66fc06e28a57513815d2f53e3e5105022d81f1cbaabb14ec4

SHA512
00b0a57d2377b60c79323db9be8e6e65f4170f5ecb20d049c6993e7aadbaaec2164c7ee126fb7a4b36113669304947006ef1314aaabd248063531aac7c1cd2cf

Download Submit
C:\Config.Msi\e61d1cf.rbs

Filesize
21KB

MD5
b0f6ce62c60dbc0cbd33ad9a61a5c7bb

SHA1
e104efe1659b3c133fce3e42ddab505a778f8f5b

SHA256
8fc7fadf8862af2925c2ba3b5c02505043dec96543b0cd11c8d52d5e815a935b

SHA512
1aa020cf7fde22decbfe6830181ea041adf7d01ca3f1d41c5e72ce717cda944cb21b122e1849cc1247ab3c231a7196d2c1b08bcec00b7b546c47a36085153433

Download Submit
C:\Config.Msi\e61d1de.rbs

Filesize
21KB

MD5
de23def79523a9f7d869d80019a31796

SHA1
59ce537a2bca8e03aeace1e04ae00335783fd3f0

SHA256
a6cc0d6fae1f096d2a77fbb4d115f39c853f207f52ac37adfdfddf0ddece4be5

SHA512
359e1733eff8839f36b5fe50a35ee30deb33f1da156d25749b102af56a34aec32387dd639cb2c37f8a093fae52faac6e21019840f36419eb9ad98e9bfd16ec4a

Download Submit
C:\Program Files\obs-studio\bin\64bit\obs64.exe

Filesize
4.8MB

MD5
33ef36a3d50f57907d7e6eb1c54bff84

SHA1
f0e910b6d5da4a2601e202de95c25517be3f271d

SHA256
0529f157169fa270e4d5786beaf56f3ecb4aa18ad1fbe354159a787570b14c3a

SHA512
f159671911a4e19b608b4b82a22dd126e96b8ec6d5072a444e94842a024dd8f6a42d31f1063174e2d3b8bb57a7091a28cc8da53fab3685b87f9ee48da57d4633

Download Submit
C:\Program Files\obs-studio\data\obs-plugins\obs-qsv11\locale\en-GB.ini

Filesize
1B

MD5
01abfc750a0c942167651c40d088531d

SHA1
d08f88df745fa7950b104e4a707a31cfce7b5841

SHA256
334359b90efed75da5f0ada1d5e6b256f4a6bd0aee7eb39c0f90182a021ffc8b

SHA512
d369286ac86b60fa920f6464d26becacd9f4c8bd885b783407cdcaa74fafd45a8b56b364b63f6256c3ceef26278a1c7799d4243a8149b5ede5ce1d890b5c7236

Download Submit
C:\Program Files\obs-studio\data\obs-plugins\obs-qsv11\locale\oc-FR.ini

Filesize
18B

MD5
0ebd4c9db48f04f789e6254a92af4b97

SHA1
45f98976d001a97e4b18489cb73cca2aadcb1cf3

SHA256
54550f5495ca78de8ab1b4d32ddec042077823cb5654808e9f9f003857125450

SHA512
9b3ca441b80f23ff89094175bca2a2647d76e38277830420e933935a631a82ee010743410b632078750f4272cdc6b3362a56649ce9694a2c712367e0ab7f0e21

Download Submit
C:\Program Files\obs-studio\data\obs-plugins\win-capture\schema\package-schema.json

Filesize
1KB

MD5
cfc8555dce7c954555346ec0ef15fae8

SHA1
da1983d90d8bbbd3eb778ebb92d45427f1b35f41

SHA256
524437addbda00d3a64413b639847211054905a959786a4a5609fcbbb1f101f5

SHA512
4add0e8632568a665d640f63ec9eb992a3f50a21675883d48d26e784caf8b25c4bf6de706c2ab705fdad325adb02cd681779eed632976dfb042caa88a16d390d

Download Submit
C:\Program Files\obs-studio\data\obs-studio\themes\Dark\sources\media.svg

Filesize
558B

MD5
7de24f4b717974d92d44505a76bfbf14

SHA1
7695bf5a0dcf4847644ebceff8564f0e5c214dd8

SHA256
0c3127f56d6c3bfab49108c5d7f2e405f7e3c80f8ea9f5c407fa0902f02d919f

SHA512
75023a1588843a5a91c12787cea903b42da052a06106050885160dcf90386cdf8693fc0323d60802c767b524c7d4e83083815cb2a786aa6c082e88bf12c45640

Download Submit
C:\Program Files\obs-studio\data\obs-studio\themes\Light\media\media_pause.svg

Filesize
526B

MD5
b2e1d7d541b7fab7513d295f0ffdbc6b

SHA1
50fedc18267466537fc9c1d9b362143cb3621b01

SHA256
d71fe1d398ab1a31a0906c1054d67b022954ff3df6a750bb6c5e66375ed9a642

SHA512
575e068c38119ee7f873dc2243a15ca390a409ee5b9d2108ce5ea5ed5fda2974e3316f9d53e5a6a155c1def25f15f1bf575218347be71bde8b5a9310c9799ba3

Download Submit
C:\Program Files\obs-studio\data\obs-studio\themes\Light\sources\media.svg

Filesize
558B

MD5
782275b15439d90e21c0595b28e1f251

SHA1
a40a166994402a2fe2e782864c3612dbf2619179

SHA256
16440c1cf957bf20c8cb01d2a490ff46d4f2812376275d35051b659b62ac888d

SHA512
704da362efe3ee13771d589d1c3a94a8a85836d5c26d35aa76d02f502f683417e162df4067fb7fc26762c858d708b921a5fcf6c80f6505ef90dfa68c102af738

Download Submit
C:\Program Files\obs-studio\obs-plugins\64bit\obs-browser-page.exe

Filesize
537KB

MD5
7d888e828d846da738ba0b2ebba6f821

SHA1
4a2b886525922fc5e46ed5fbcb47514e796027d6

SHA256
b9bef61001c4860b4bb1697e873176219fffe215b0cecb612b14d504312809cb

SHA512
15be656f719d8fb29f09fda2575effcb9dcf76c8aa55823a30be64b58e0a60ad9ec63777c5b5a8b51546779ac69b4cf09e61775c3158deeccf47e52efc380773

Download Submit
C:\ProgramData\obs-studio-hook\graphics-hook64.dll

Filesize
297KB

MD5
aafe24d6bccc0b684d4a7811cdfedcac

SHA1
242fdc3037529b1be4a728e400f0fc1d24c1bee6

SHA256
2d1ff7b5fd1ab7764121549295611731a1c0a2c8fa9e6644009ca22f95c15a76

SHA512
91013fb37be75a8449e31145a95ddf726bb39be32d584ec06c0b2a848c897f3b72ee5b8ed50cc732cf217878488f81086daf692ed83c1adab620e84cf28a96f3

Download Submit
C:\ProgramData\obs-studio-hook\obs-vulkan64.json

Filesize
514B

MD5
4a0ee9e5f72aec20551148f649ed58c5

SHA1
f5e897db4a7c311b2afbe6054fe28ba459712481

SHA256
7b6b0813fb58b276847a8583eb5c3f94aee7d7ad0ae3a1ef6133d5d8771f20f4

SHA512
8c7977ba8781ab0ad9d0ddeabb230d9466da6c9c47f33cbcee6380079734e832a1000e4a55218ea0d5acaee500fd458a3be76c6d4cb2831767cdc07c3930aad5

Download Submit
C:\ProgramData\obs-studio\shader-cache\1ab7aa1b854459a7.v2

Filesize
840B

MD5
0b2301660cbb980468bf1b8b4eda87c7

SHA1
ef3c7bf64ca477dad586d5ca3aa16318b27f4e72

SHA256
d913ce5b4ace04b97bb8f05bf49d777a5c231ce0737dd5a63bcd3215d8c63bd9

SHA512
b392bf58b9da599c8896f233c4a01e61e23546daef235d279b771a8849ea718a13b457b768b7196e3800ab82d24b946e066d334299142551bf3565d96673cf80

Download Submit
C:\ProgramData\obs-studio\shader-cache\4545d6ee7b176b7d.v2

Filesize
964B

MD5
925008d85689f03f9c2c19b2a58864ef

SHA1
9707491fe67342b0428924976a5d4d4cca787fef

SHA256
b03ed79f9d040f865ac250b25a7a99ccebf244c5bb9d2bae4287f025bae8edc1

SHA512
097e0733c12a57d148ffbdc844f9444026fd13359a52d8fe73d172e8ac8479d4e23dc1a00be3b04f2880e2f094a7a322fcafc3ba00603ee7f89c586a75cf84fe

Download Submit
C:\ProgramData\obs-studio\shader-cache\62281a72182c4ba6.v2

Filesize
908B

MD5
a09b098bf807333abd23734e543dc2e5

SHA1
972a560bbdcad956b41b96d5a5d98b74b3744aeb

SHA256
5e7044f39d34e7f45770264f93647c2701bed73c904f8f233dc5ea94870b4403

SHA512
bfced55e2eeeff8f5393a84b23ca0bec0391411a1b649be153cc1563c1e736e3e124b502fb6df18c5bab5ccb9f6dbd6369cbb5251dd03acfce8078ee96d8eb05

Download Submit
C:\ProgramData\obs-studio\shader-cache\6a755cdc9e6092ae.v2

Filesize
840B

MD5
a301b07b443e54d2763c6cdaf88ffcef

SHA1
f2da06b9dd608eb5786ad2fbbb42aa77f351c39e

SHA256
fccbe79d93005236718ff168a3ba2267d228b4f93cbc848a95eda3b8482b6697

SHA512
db51188f09eb3b13baeb726f80f06dbe36d1ae8c960aa75a7f88eedf42e67e286f3e7f33034fbe9a16c7cd339058dc4782e58467b0c033e94073bd326dcbebf9

Download Submit
C:\ProgramData\obs-studio\shader-cache\7a6e3fecabdd460d.v2

Filesize
888B

MD5
b1695633020889910efc1cd4fb9b02a0

SHA1
09eb2ec232b08bb092fe2cfcee795ee57275f93f

SHA256
3b625049381ef7d97538364c28efbbde8e5eb28f010f077afa36ef5a74778333

SHA512
2b4be7f4c6c8182a119d440204505e1022d017d9199933a9162a35ad5b2092efee29be847caddaf7e73d310a320f69481381a4527a59a9847ded132fc42946bc

Download Submit
C:\ProgramData\obs-studio\shader-cache\7f0084f9c4106e16.v2

Filesize
1KB

MD5
15d39c0e4271b5ccd51d06dd38ea848c

SHA1
beb07872ec6f978633df7a92ad12e239a41f0587

SHA256
ea9109f443a204812899fc727c2e3e779a9114136db0afd729deec2e817a2db0

SHA512
16ab1fb86f5ac7dd412c1e3f87668a8ced4881a578739077ef74f68869e3be4d802fad72232aed270be0be25712de494473b2f883a94acccd1dfa7342a83bf7a

Download Submit
C:\ProgramData\obs-studio\shader-cache\8d390f4ad08d5c53.v2

Filesize
936B

MD5
edac8cc11ee6b2f4eedf0767d9bd1a25

SHA1
816ae2f8507a2dd7f87da5645e5a28f144811539

SHA256
442e3643bab4f98c14485a18e239d2580f18989831f9cadd19129e3df30789e2

SHA512
666d64b4caa7229b888bbffc58db1995c791c8a6b1518fca195f466b6e5f6062f5928f897ed5ff14b02518df6fc078dd45662bbddb5d5805a6cf34d58e4026f5

Download Submit
C:\ProgramData\obs-studio\shader-cache\9ea4a251d7aa3c18.v2

Filesize
624B

MD5
e8f1aac1454a9411ecfd28bdf322b910

SHA1
12ca860dff45487c176212e2e4db4ced5112991e

SHA256
6c40664272501dab61c1507f87b612d40819510781d05971735443cef8ebc95f

SHA512
677dfc0140b6a75fbe9ae6e2c59dc0f305c8d5d7e34f858caad917893614c95c7eed8ddfb280d2f913117e3b02dc6613e369550ba38f97102fd6c4b197930254

Download Submit
C:\ProgramData\obs-studio\shader-cache\cd9cfd09db70c3cd.v2

Filesize
960B

MD5
a36fa067d5417109e7c2a79fa47109e8

SHA1
2cd916c1a5c0a21b021ebc424ab316be4cbcb499

SHA256
c0d87fc26b604a942bb03b1349794cb397ababfb1a14eb09fd8ea1de5144aed2

SHA512
d826b76826b10f675fd40fc36ebf3aaa8b5b69c41090282b491a7ffa77b853db80a3473f6032bd1afe406e5272d671585a93d0bca29d7cf9029ab50a140cd1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
557df060b24d910f788843324c70707a

SHA1
e5d15be40f23484b3d9b77c19658adcb6e1da45c

SHA256
83cb7d7b4f4a9b084202fef8723df5c5b78f2af1a60e5a4c25a8ed407b5bf53b

SHA512
78df1a48eed7d2d297aa87b41540d64a94f5aa356b9fc5c97b32ab4d58a8bc3ba02ce829aed27d693f7ab01d31d5f2052c3ebf0129f27dd164416ea65edc911c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
843402bd30bd238629acedf42a0dcb51

SHA1
050e6aa6f2c5b862c224e5852cdfb84db9a79bbc

SHA256
692f41363d887f712ab0862a8c317e4b62ba6a0294b238ea8c1ad4ac0fbcda7a

SHA512
977ec0f2943ad3adb9cff7e964d73f3dadc53283329248994f8c6246dfafbf2af3b25818c54f94cc73cd99f01888e84254d5435e28961db40bccbbf24e966167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
469c6f6a3f76aed4d977255005d3e1bb

SHA1
05bd55fe7e1b51e4574a0a3b708f7de6e4914643

SHA256
80ad3b8971c937d0277c5a8318ddc7aa2e0186103d01204da40c8139fddee50d

SHA512
83d64b92341594dc861af2f6cdee53c783275c5a209edd65cc29d7ee62a7666cbe7100908014691b3b2cbc899abca76827ef04eff56ba787573ecbe90d2758a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fb1762616f4313d00948413809c7a8c

SHA1
18c136fe65224f0c9c166f0eda35464ccd26c679

SHA256
8f9af5d4224cc361c4ece079cceb90cd44c1a576fcfede755deb8855e61903f4

SHA512
98d0c07baddabb59a84f11605d491a25dcfb90acc315cd56aabf9942f0d2099238d83c342f935ec27b9fae1bbb3c11b454cd678ef05ce7dbb396be6f84f134ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
cac0dd462cc65871af8f6d9034972389

SHA1
e0bf387a1bccd543d7a3e83830dac4870b72527d

SHA256
099d3de092525a64e31b5fb1e66c38b2b8070f2dcb1177a9404747732dafe495

SHA512
ced745af80c1409155cdd76ff6896484092e1214480dbc199ee16a5750d504ea51b981507c7496495f927b1180011d35e7d3630a862f1130178e9cd3dce99bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53fa0f19ba61e93fcd22892cc768c82b

SHA1
980e3982c7f82ef4a85dd6e353d7de47fc523cbd

SHA256
691093f4c50b3c533ad05cdfbabc4d6c53b0f7ec6af40138ca3c4e9c7e5499a9

SHA512
e843c151cbe7efeb80bcd8cb204d3e7b856f9bcbc19d8cd8e1a661655305937a2c288f80fc779f0d4c4a3ddf26dade24f9f06faa4be583f7be3b700dfda75a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ede124da85e50bde33ae46fe37e487d5

SHA1
f2a50ace70a0dcf8dc353028ae7fb73523c9e17a

SHA256
753925e9b09648fdf3a55ac533278ab5c84fbc1ee9d3efad209a54cfd0f5efef

SHA512
e94a2dab43d1bfcacfecb3abea8e3a1a32421e665935cb2522a264306f92cb75221f8b34174b7bc260030d528918e45604c4167bc7506a7882c61bfcfdc7021c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6779a26349a425b3224ca2243f3cf0f3

SHA1
3cae33e7b59a9d22282c8fc8e84549ada39be825

SHA256
8d04b10f93223b05ff34e93189695d129e264a116368d4d37e566b2f96a4244e

SHA512
cdcde7b5c50d99288563b099670dc89b92957767c4052be9905c1d2bd33ae621663f888a33386ec5cfb01cc604796ca4b89cde158fd52215a1948bb75aea37f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
952a6e3cbc50f011cf2f04c9470080ff

SHA1
a0d6a2509af73e523c970f6e4351861bde63d6db

SHA256
faa79ba7dfd140106187ab50f14aa7cca13650f94f796419bc0a44d7a2b79d5f

SHA512
7955092a6086f05268e4b0f88648d9275020b6cad83f81c90eac5a7cd994cc243b8dfab579d4335db62f3577fd2d8a7fbefcad6cc615e2bcf1d014115056cde4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ec974d6450b1d66b1603b4d8ab6f311

SHA1
a69718ede5e64505d611081ce519c13bf1874c71

SHA256
c8f35daf396d3857417f59817d58bd0d546a726b6d8a00a8a1c2d158623a721c

SHA512
9a524e266bc6b297d510d791445a6c014684c7d583037e2e40c8ad5e886e49f843662afc3c39cc9c82ae9d165e0a9ef3345dc800eb0655ca70b0769bf207bd2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6ae4875b51e3c0800d6a0d8eafc62fd3

SHA1
c5ec574cb1b70b6e37cae144483f8e7e3ec75da3

SHA256
38fdb127d597935dd857b10b7d6f21d858ca275a8d2ea7cca8884403e4cdafa0

SHA512
3f1d63065dcb5017c1de186fabf4587b589ea4c2cf2c5f2a5dac48901390428c2e319b71e136781a61ba4f40ae08ae03070ea562c2ec2e07aa23731c7f2f761d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8ad8d6527f5161d342c07c5b75e1f1c1

SHA1
25c687e0d026db0d040a06985f950177002fa333

SHA256
3001baaf0be3ed5d75c8b07bc66891c892bd6a6082df275a6236b107f612d1d4

SHA512
8792959c733fac20973398c32851a3aa2901fab72107c3382559ecb151a5f8bcfe46be8cf84c00d841f1eb00d80f6d35f2a44788dcd5b90c63da2bdc5103cfa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
544195f758b9224e6dfb978e32954850

SHA1
a588b2abafea8a6549b7d0db7dc12b64aa874f0a

SHA256
41e77be9efad85dde6dd3fe822a609129ff47a98959d2f66324d4d0889da72a1

SHA512
7de2e1c33da5c3a2b3bb51d59830b1e2eb3637782cb2016109978c224f969919b996f29cd32ed53eb2f0b7a38fb13cabc0996a9a09f1ab4a3327ad2db75e364e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\doomed\1507

Filesize
21KB

MD5
8776f9127f8a19c0463a125b0a213529

SHA1
e9aad8085845af9d41d944456490a0738600613a

SHA256
7229aed50a7fb46ca14eb37012853a9c859eae6de7936ac9e8c11efac15ae94e

SHA512
ef2789b76155099e3c9d03f3fd3299306cfcacfb416be9e3bb02ebb2d2f8fa5c34988588bb58db9882df8a44f60564c30cbaa94470ccfb1e591278bd97b33e1b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\04AFFD2590A322D01F2421A1EC5F947A40C2EEAC

Filesize
647KB

MD5
5c0bede5942bd9d3724a74e257e674b4

SHA1
fb675220b039cc893afdf22a6051531c723a5213

SHA256
b0f4868fb65448fb671d95f432cb9c80b07fcc5e237932fe4f06e2f4b0c4baea

SHA512
2d3932a1bceaf6df64836a6f029016eeed18c4fec05efcf0af99fc02aa806e57b08c932294333276b6f0cf6d9fd9c999fa4f546890bba35d1c6f413d0a6fc444

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\06EEBA164CC08D9EC29D8921F8D9E0EA861E82D5

Filesize
56KB

MD5
ccc275fc2c7d6aca54a290cd67a64f9f

SHA1
14142ec8a7f3e18c388e04b973150ffe78481cd1

SHA256
f17305314e95990430b94474c79b91977984cd0b821b43d775db137a53f474b7

SHA512
8b90100525004f8fdb7e7733af32bf8d0249c3eca59d93cc18ee869ddd142eb6c86a10cc09d8211f807143374980f445de9c6bc5261a9e72a869719678fb369a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\0E129E7DEAB1935D9D8862149E903CEFFD81C844

Filesize
305KB

MD5
46aeb956b18e1e3089b2ea679cb1aee5

SHA1
86ecfb12e883e978ad86ce29d1a420a2ed2f94ed

SHA256
6edf6a1fe0650e4f7f418f0ba80f17f4e1ea30a06c19626eb8aae0c6c227167a

SHA512
8d23da4e606bdb668b514f22113478c530a2b7f813e8228a51e300c3fafdac6811b4984996e1cc9c5b8648c0bc2f7d855b31ef5f6c006b5fd0b0a6821f66de78

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\0F27D4790793AD5B03027BBFE8C9EF33127014ED

Filesize
140KB

MD5
c78e91861234b0705c35c7898b68551c

SHA1
ce76ff4039e2b38226810d9d980c40ed64933853

SHA256
51facbace757c04a2ce3eb3e3069453118f54447b9dd9c8e0036d4d038256f4f

SHA512
3f94cdc0e37413c932b1649a7c29372a9118e284a7b46a0e4d48bb585c288ee00d9a2254912ba8c2c93dd2ceeddb9053739b9f045a371b17c38ee2693a063ce8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\15A8B4FC4BDDD01E686C9EC9C5DDF840485952F8

Filesize
28KB

MD5
0bee34061ef498d1af0c805379531866

SHA1
5c34650fd285f46c0d2542bd07a1c3c77583804d

SHA256
46ba24daeb3836aef5ef1fabd1339a12d41ffad3d4a1a98ac2cacec616244387

SHA512
1118b78028c6ad359b443df0d792f4f20b13d40e3236cb7be98e8b6c7e80a95a995c4043067db49d0d189fc7af8d63023b160678ee7a9878374cbd58863849f8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\16A028B26A24E145E11113F1114E1BF8F3B6A7A1

Filesize
58KB

MD5
c45141728aab68499fd952021bba8651

SHA1
f6e7fd447fd99ab97d7fff384e6b90dbe6e621ea

SHA256
4b53e6b74df1172f9bef99dd264de2dbf1173ec10f9d6f8509a91dc079474b73

SHA512
850b1c842a233fca817c3e8f7bf35f983d84ca19d78f391297cf75aefd83edef16be597f890dfc7d633de2460f8ed780fbb249863fc52bf01f37b8ab75e48200

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\3F4EFA012EECFD4086EA55A98F3A34FF8A285529

Filesize
55KB

MD5
7a7e3487f8e3c58da5560fcaf77b5fb9

SHA1
4c7b041b68ffcd68b303c8227f3dfa44f5c9a4b5

SHA256
16549515cb041d22ce25eaf352be567d0b5885ca57b0e9e4fdb306967fc50754

SHA512
233cfbdadb7abfe19ddacb1af686c49476594f983ac146e5087e5ff30e5206ebd536a01df22c6e965b32ebb06b00226d15ff26c7c369a800e0409d9063953753

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\43E0998A80207E335FE7A68D5790E0E42D67F7E4

Filesize
446KB

MD5
ac3baef04f4d9c726576866f0110f7d2

SHA1
20ffbb06f4a2a6397cfce52e308412de7f2d0efc

SHA256
20ef72a36ade15b8f3f38d7c6eac50fd4b593ea8b4a8628351c8c841bbcf90d9

SHA512
5e6e6bd0f25cc8016a72fb571245657b2651ba72bacc57a4bfc30b1d97cb0d5379e109592b455ba4b45ce02885ac93bf070f9dcde73ffa5e8f517eaf3ef8e32d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\4EF9984941DBF03CD953EB7406AAE4DF24FB9A56

Filesize
1012KB

MD5
96cd9b0211fe7d52f21e940d9c93587d

SHA1
bc287e857a029a1c8d79296f7225bfedbb7cc6e9

SHA256
5afdbd2539dd99545db5a9799d139eb566e547e475d7e47a53514b4da76b6ba5

SHA512
2e2695eb85d67c8236b5ec1332dfbc39586a9035ea26cba2bf266a583b7324224c56bdc2861be48bb18106a07c1717577c271662d10d02460742cadb62f26b4c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\5303174E501C66734C0133BA44D20971DE168F57

Filesize
13KB

MD5
e3ed6ae9c6a927d8d035455974b9f5f2

SHA1
0c4b0efa98d15951786af940735e10fc3838a59f

SHA256
d38c9b643bd5ca3cd299b524cfde225ac4380c2f720836a377158e6a7dd35ac2

SHA512
faa37df887f71033a6ce1c864e8c86fec83098382d285b077aa903443d786e5753c7384b546b307f955beb1eedb7c5e32cb57faa076125aefc33a4fa9e0377a1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\67050BFCD02086D59049655C132796EFBA128B33

Filesize
302KB

MD5
05a1986320cb649806379fe401d9c737

SHA1
090e6d83cd4a000d434883bea015e3122fc85131

SHA256
1793e7acc87346185aef1f0d66a28d0ce05a8f617fabff3ab78e49e068eefe3d

SHA512
021050786c66a072da6009e39f6de00e7a20eb6f18435647030d557ce77acfe50cc85a8895a7dfa14abec4b8ab8fdb24ecb7baf07a7d6085b58efe8df11778a6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\6B080F81023334F122E759844329011A846E7ED9

Filesize
314KB

MD5
05c748ea35581d681dfc6d4901f1a451

SHA1
3f19c2f692583ba96896dc8b1f13ff2cfd44bc66

SHA256
8017ff1febff7dee52ab6cbf08442f522aac39935aba0ea776846ab444b4b76b

SHA512
73d7838c3627173ad14f56a70e127aa406a980f24eec7c39ddd73d2f3e7d9e221df960ce044db8b03c81e0356db19541bed888601b8c31d3865bb4b25117cafb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\6C1B9A8073AB967DB4C634967BDF5307C33C2F06

Filesize
1.8MB

MD5
583b3c4f5ce3d3b393c405c6fcdb843b

SHA1
52dd5f40fc79107f93779feb8acb56a2084cdfec

SHA256
3ebb62985b86f2fec60683287e195d1316067e84cfc245e1f6a619384fc64906

SHA512
a5e1e5ecfad28272fc6a507239d90ed1fbc83b2d37068daa6cbdc575040ef4dc50f007e34bec6ef80814f562490eae01f1516eb4296a0f43be2dcc5e75d1456e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\6C3401899301DCE4CA3751E21AC5A30D87F1FF53

Filesize
1.8MB

MD5
4432d8d2bbabaa38af6474429ee38d81

SHA1
f67e30dc16d466578dc6e77c6d7a587bfd2a73e6

SHA256
e3d7774c4a96d0ab9e6e17ca1093d1864533893619cd952aa82dfaf5e06c9e7e

SHA512
8c7d1ef02f613889e9ce059fe06941e29059e167c25da953552bce67ed7709f20f7796733048aa4ede3761645e1f77e7886ba96e9d27066989ad167a69b6b06e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\76522C5617104056D2955F5E75FEF6E8AF18A413

Filesize
26KB

MD5
7f221d2fda780980c93fd7e4cfab72f9

SHA1
88b92bf0dae19d44a30165bda8e15a6eed056dc0

SHA256
c3a1f4522b526f827c815931f0d1bcfadeab64d30c6868e4ccd7ecbfb22aaa0e

SHA512
a02f4365349d51f0026a5e7949ee76cf9b1f1149377bc48c456e36a47eb2be87d90e2edffcc361596516f392a2f12b9f626e81d663967b283db23e3829b4f100

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\7AC0247CA2E08A96C2FC3571B665075B1A57DFA1

Filesize
601KB

MD5
0f555a3028be109b882263726712343a

SHA1
e42a7113c5453aa2816e8db7e4c24f81fe51ca6b

SHA256
a30b74619101f4cdd15cba82f43186613d6f71f3f4eb5881dcd4594bf2154ee6

SHA512
9d7c17ec7303c6a037f2702b7e48a2ca52bbc5391b1b767f2351896ebcfc0046bd6606c139851a43e51c4370ba6d9df14d64a0e39ca112eaa32368f8b1489cee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\860067C72BBE2678554A1A0D74B630E9C45CF935

Filesize
1.5MB

MD5
dab5d42e7a4fbb729673b3182fd530c5

SHA1
61832aa6c9e36d4fd2511f50301322f6ab664b39

SHA256
cff983acc29c55afe403f886608e74b30eff6ad82bd7b3db3f9579a5316cc0df

SHA512
84e19ebd42d7856b49b88c29f63731eb6a9eb26a64d92832670a8c5b9dc5212fbf15bbfffd9c51193732f1d789b2552103c1ca7641a2a16f5bef1acc90d13171

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\91B8ECD6293973C80EF5D0987C2B4C442D57AB58

Filesize
847KB

MD5
538bdc1a5177f8cb43b747071c98e9eb

SHA1
6c9eff323c7a665ce99541489e0d8e5293bb56c3

SHA256
719dcedab24c1383e6f9b2215c6bacecd6514678f6ba9d3768b98f45d885e5f5

SHA512
d3a5666bb7ff780855bd83d01261963c978cfcd9e83b1e213d29d5b7d5c84cc7de5c1a8568c35bdb68b09669340d48e99b46d48d64b618e3d231a842ff90ad88

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\A19607DB0D8CCB3B9E40B67376CDE5512164F29F

Filesize
195KB

MD5
331ab739db8547aafb1739bee0182253

SHA1
91e93455b0c14eb4a2e484f455d54a06d648c09d

SHA256
0947453bf16887be0cb86ef2e045e202b2db88016c20f509c3f283441a07dbf2

SHA512
5912dee53922df89ed5cfd69a3987ddbd90fb2874509a84376ccdcb7dcc093986601997afc3ef47920b8da100bd6458afae61be2e72af2d23abf7bd75ca7cc8d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\AEFFCA3507A2D57FB92E078387BEFD6F9632566A

Filesize
21KB

MD5
dcd76394e18928f89434aead834da519

SHA1
12789abbbde74be086ebd76f8b8da22e57840fb7

SHA256
ea649283cf5e232164c86250ee51c09b970240afd886d40856d0c0b8500b1bcf

SHA512
7afd2f81f67cc7eeb1ba0975c316137c105995568967b245aacfc6955786e8691d479b621a3297eab6e99f8b4a5191e2a1d926b41630de54a24e973a1e1c37d0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\B1784C9F881540EF25AD2FD55A76E4F0B2C7345E

Filesize
16KB

MD5
73269587c634b470e2c3ac88f006b6fe

SHA1
b942918b6ebaff35a2d21940426bdde183648cc5

SHA256
99453039f61ce2979e5c49ed44801a467b6772dab10ede0106ddb3a63ac6fc70

SHA512
8ec2ec4ccef6def74975eb71fb5d6c50f82cee56bccfd51bb35f96f182e29ddebe68307fa76513d023c29e4c45a96ec074e9e5d817c1c81dfa402d58cb9881f2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\B29D74E78F39BDC6007C07B7BFD850A13B19679A

Filesize
125KB

MD5
5612f60a1790bcc0f2d2995b1a597595

SHA1
98d3329dd74c9dd0fa4f771ea4ddd8bd6acd8d94

SHA256
59d0f0199dd1a2da7349f8fe995ab8fedbba057f4d62c8372de50dff02148b32

SHA512
c68ccff2e4a3eb0be506d5453c8e733f8b86335ddc9b42d117e2ec0d18b1b94d0fc9cc95350a857286ae2f560831c798e5ce1f26b78f78a444d53f3ccfce63d9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\B776E8F3536C5D0C173DA4D1EB849C5087534298

Filesize
13KB

MD5
ac7f83cf66e0ffef5785e4c4934e7892

SHA1
366d8425b9f34811a61ff5d344e4209584075b6f

SHA256
8c0e46a4c46dd75ef696dcc85568faca3f2cfc8023f3282f8f8f8f1655b36de3

SHA512
6eaa3d973b1b9d2c0cdf9967f9559358f93dc3aab0d98654f02a2b818f8e114c3f4252da642e1ffba1243a57a55bfb8a5c3096d795ccd9ba81c9f6800fd700fc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\B883477A9588B1C0BBCE3048ACCA5572ED7E0834

Filesize
1.0MB

MD5
da74ffc473b6a2876520b3482627e4a4

SHA1
631ffae878f641a99f76ffe7de7425b7671a9354

SHA256
736cb3910c5863ab16900ec8de5692b216ce54e17f1593abddabc45793dbf4a3

SHA512
e399f982785fa98ed970ac3b6310f189204fd4357bd3a24a87148e8cc10cea660b53a7929de02889519f4e9e81717696b3b6b39c5d412a8c42e91a0bc4816d07

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\BDB47244A734941C8C16C6CA959E4F48EB5084CF

Filesize
440KB

MD5
cf0f14b0b2f539acd90b726aaa4b1977

SHA1
a7ccc7476607aed0113e104d6101ac9af7409844

SHA256
985d318e91a46a45e0018eb21112c4eaa8c0da88a0a9a9c16dcd4541b44b2202

SHA512
e0e26e43f31dbcb99fc99b8e137204f82ff17f36c575c29c77f73a9a14f653fd458c6eda42c71102a88fb1b45a71af56e527a926f4caa0f007d41675783f75da

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\BFF3E1C8A040B12F697487750CA756779ABCE046

Filesize
208KB

MD5
6c778a6157ac37a86c5044182bf0cfd9

SHA1
d911a1f5e9aebaa1f3cb464bcb6135cab6bf8e3a

SHA256
226a71e6a42a4c22ba3b7f2a04b08b1ffd43f39725d68c3258eb41d7cec50caa

SHA512
5b464b7c6228dabab34fc5dd465f991c5f11b7123516688eb2db9b682ba5711e5427baf6ba6898e07710caca636b33b7c7a23a0a1f4940e031bc33fb5bafd1a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\C0594F0DACBD980A84182ABE624DECF2C0B5F4FC

Filesize
1.0MB

MD5
514f83f461c7f7afcb9d0a4ab1365c07

SHA1
d3b54f601f7d635a7eb15de4fbc5867a138542f0

SHA256
f962c1098520e8aa9afdd8e068d907842a143fb15d5c04f8b90ef12b9b952cfb

SHA512
0a08df0cdd2378b45902ee0586c82f0f64fd55ce234ac74fbd608a85ec0f5d41320491be605efc308a5b0b0450f21e727f5ab86a9d1fbae85632d8201952056b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\CAEE8AE5B2C1000E808418C71379E4E90527805B

Filesize
187KB

MD5
f5bd29ca6079886ef586a992dd0d5e85

SHA1
0a47de21de076c1d90b6ba95dfb6972f183f6b39

SHA256
cf22ea883a440a5782fa03c8c9d7351da392e7692926d2f8c3a294568547ff19

SHA512
e6126c88314f24c58f5a4e03e62860760ca202f32a31b8c94c19fd1e75edad60ae9c039b5fbfec9682ec2aeab9a917be9f3a38713fd68897f24de4266e5b9d20

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\CCA3F37DED2CC33739B235490FF1BA64F98F360A

Filesize
253KB

MD5
e5b4199aa343196b1a298cbe83fa225f

SHA1
e6777d5948004fd836a9482f5168aacf52da5884

SHA256
0869901497636668f5b1d707c8ab5e23af9921150c5a7ac6803783118f2927b0

SHA512
347d68d13f85690c3dd249da2862254a86d01a33ac2689d0c8206b23dec6a7155e8fb7fb2abaf27f8d03ff821a478a8951eff0f492e010522a295bb0ba19ef3b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\DB848E1CAA7BBEA3F6081ED7E8AC3B5C5CE9E048

Filesize
29KB

MD5
d9e476593e524f1cae1602eee16cca97

SHA1
452c519e8b2baecf7b87023d8913b892dfe8eec6

SHA256
111d7cfe078e249d5ba518a4e88a076512937515fd7f25ed97211e2e5b1fee2a

SHA512
d58031f82bd56ac0dc6f227037c2da0678954ef118c893069922661818f173582b81f2af1a5b27f7027a1a120dfcb7dfaec3ff1bd787f0e7720cbc7047bc12b8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\E8F82FF507585AF8655F245209766BE49794B690

Filesize
32KB

MD5
e05a46f57ceadd6a8475d46c94e0e3d2

SHA1
238f1fd190420e40e383f8501077df7f9a739c83

SHA256
750fc6acf46dcd07dd35c1847a0a69689f5b874e350adceb2ade0769e0c76ff0

SHA512
3b9a98195c18ca4c3eac12e17a7b4fb23a9270a650f5a49d89677fe8d0b270fff039b102f7bb825bed68d7f1838167aa5bba6b4ba5d30d8183161d14a108c2fa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\EC711898AA9EE8A1BB703A0365CEEF2004B53AA8

Filesize
261KB

MD5
6e7e7fd3d3e58ac81f621d348d53ad5a

SHA1
4709a14e856a0079e40bf92d110578bd8593626c

SHA256
4422c560ad9efeb73f338f4866ca966b0b540490bcb1453633b966e1994c1909

SHA512
21d1bf0f0f85003adeba25ed020c2f96d62f8860c3b57397c76ed58185639fb537f9dff24a0d58699c21c9d67801777ac5f1b52edfa9ccee9731b3cfcabe9196

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\F00A838B49E7FFD7F2FAB351637102AEB381837B

Filesize
135KB

MD5
798f10de02570a8130d25839b94eeed4

SHA1
cf446a7347764a706a589ad02aa5e62bb2baeb7d

SHA256
c6270b52e2e6fa94f5bdfecf75f120f0556d2b3aebe11cf289487ee4c185c317

SHA512
ba076a963c86e9f35fb73edc66e0db9a770d205ced858918531f7c2921c3c700f6557dd4b3b73d2d22ba2b512ef5827afd602db9de116a7684daf4b5c790f293

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\F1B1D2419B07819AFCD1C8A391AFE87898796E88

Filesize
1.5MB

MD5
4e5b106735f2ddce4cfeded0cc6896a8

SHA1
b52cb4066e780eda552f5e841e47865da0520231

SHA256
be20e341f2ea36eb548bd402a22676fb41ae3fdb969ccbf654d7c64564f80504

SHA512
4bc4ee454ab1daddc463827f9e3e20e197c2b382f041732b63bb933adb10bf2391657019ef52207de3c57950924b8f9de52e0477253035b81adedfcdd12b3127

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\F574BEEEB070D957B569379E0F49182F0E8C83A9

Filesize
278KB

MD5
c8d51b225582fe3ed8a6abda7b4ed4f7

SHA1
8b3ff966a3af12f28154e176afd5a9ca270cd1a3

SHA256
8504bc6acd8c1b11be8a600efaa590fe366197dbb2767943199856b43fb6c307

SHA512
03f9af258627c2a7f2a53054504e55ec45b7d99c2b2302ec3957690ca7a01fbd1e20506fa0e7ecb471f58c6ef08f919a560827426bef3677cdf02276d408971e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\cache2\entries\FB878EB599A920B05E18BE46ECF685AD7EA507D5

Filesize
77KB

MD5
cbb868c493fb3e28d59cf736b39d4bfb

SHA1
fbc22b7c4c9cfb0b8c5b49861659e0b5eaca22b2

SHA256
846f4bed253df0843d1180064eb51d2fcc285d6a4f7abf90442037115b6f03f5

SHA512
b10a81193fec22ab0966016223ef81359854aedce2db4a72342111984d7fe04b07e0be8ea0e5e50072f626eda0dbcbb2016c626753ac4e1a32aeeb99d6d426b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hohja4eo.default-release\jumpListCache\bn1XkVm_SsTuhcvUkKvDxvlCRIsiEWNGWeS9md11zxI=.ico

Filesize
2KB

MD5
d5b78028a2a98f9d6c1a95d4cbd71a39

SHA1
206e7223616f00c78af7f61ddbcd398dc7773c68

SHA256
2c158b0c4073f99d433c21098fde18d25b0e251faf9ac8d218d14ffa1e990175

SHA512
6f3b9d4f7453a65c13d05f1b235f887e58adf00718cdec1ead86604727deb5ed5a3260f9208467e1319ad7fc1a1b3993957a2d6697d1df7d32555bc933ece0cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE433B60B7\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ListIcons\flag_aq.png

Filesize
351B

MD5
b841c2ebdca6bb23c15c98da4aa671d7

SHA1
42f562132fe6e9a5029247a2b9666395dd5ad9b0

SHA256
b668f1a313e57c97a5abd0212631ea6211aace15b10f1ca82484f23f7d6924b5

SHA512
e093c2c454e8ceb318df0629f5f7e8494213e69caef640dd4554f3c250029e8a06b4c5add9c13e457f901c3d328738b66db524a8404617e486fd8c564dd04c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE433B60B7\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ListIcons\flag_cx.png

Filesize
626B

MD5
fbf02dad6f60392ce777d006d5762248

SHA1
f9d95e6e5e25b83953e4f898bf99636d85511709

SHA256
45203a04468ff78fb3434f46799ca630172e04f97c566f8e143539a80c48bfc5

SHA512
9f5b7b5399cb7c8b41cda202eac5a344524f135fd2e32a5f312917c7684ee13a94976984154355297bb31fd06435efe91456e189bb5f1c9d6010dfad01415b4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE433B60B7\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ListIcons\flag_gp.png

Filesize
546B

MD5
5ac0d15234533136bf6ec230686a4aa5

SHA1
2f208a8baf30d13aa23382d3821cc73c4aa466f0

SHA256
5cceb033c0262b5905f88d5905777471e9f1b0b0d9cb857f2361e88ada73610d

SHA512
d6215183f13e36a268b849056fe1479ebd36eab4b6f175cbdd3a4ecd4ba4df7734189a2f9e9d69ee344ca63baf2c9ef10f62663cc721e9c9c59775d5e84e2268

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE433B60B7\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ListIcons\flag_sj.png

Filesize
562B

MD5
4f82c2e83eab05d2bd9baaeff6c81a96

SHA1
e1cd3981d14653bf5df976ece649120134e88546

SHA256
15493361692068154ac1b1baf8878c179b353996dcda4d63e0322ea37f998f9b

SHA512
b69030fffb689094952eb472b272e1d18b40d0f11e3bba647c9b01226ccf072d276cc31ce3a1ffcbc84c5de82bedfe7fc2466fb060ff50e528f7c258179e626d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CompleteWatch.mht

Filesize
283KB

MD5
b8b781d167cabf10ac0e5c6e17446bd7

SHA1
dd452fa91b2496bd987abcf7793b858a33d820b7

SHA256
df6426b13dc312adb72e0dc022ccf7be967f0e23539929bbc117f5855013c097

SHA512
3f6d2e4c067ce1c925c9b29cfd6d6c24b1a6c957bc5d1fb4441f91e24d4bde910814226432c7651e78e42d4460db4667edd957adab23474e90a647668702338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb7531.tmp\InstallOptions.dll

Filesize
15KB

MD5
d1eefb07abc2577dfb92eb2e95a975e4

SHA1
0584c2b1807bc3bd10d4b60d2d23eeb0e6832ca2

SHA256
89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a

SHA512
eaffd9940b1df59e95e2adb79b3b6415fff5bf196ebea5fe625a6c52e552a00b44d985a36a8dd9eb33eba2425ffea4244ed07a75d87284ff51ec9f9a5e1ac65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb7531.tmp\OBSInstallerUtils.dll

Filesize
426KB

MD5
e1f825260e7224ef0526514754f7d0e8

SHA1
553d67289b039ffea5d8b59f509b9265dca2ba19

SHA256
1d84aa191fbbd842d5eeed302195579de1256a9acb980308bf31a631ac01e530

SHA512
b9453eb4ae6edbfd86e438ed0825725ab91100b8403a933bb0e359703be462f6d3d37f8bfb32eeae375a46512c619370f9802925ae0d8898f540f933b05b281f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb7531.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb7531.tmp\ioSpecial.ini

Filesize
1KB

MD5
bba272ddf976751a6fe5ee865bc35efb

SHA1
d46c687df4e16a2114768e5b2548882c160c3618

SHA256
561a22fc618764bdad3835650bcd0e67736bea7a933722633b4a30f5ccddf7f0

SHA512
1a03b3cfa5ab17c46fac9898f949e93f46b98249acf22f5469e93088004bc05943589f7bff9f6b3968e19dc4b4c9eae5c540f69a991e22d3c6b2d6d4c13f6a02

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb7531.tmp\ioSpecial.ini

Filesize
1KB

MD5
5475dac42669e4286525740aa885c416

SHA1
a917dcf0df4d8ee6c3069ff2ffd5450f8d5ecbde

SHA256
e6ceb4b31175107b37bfaf1ffb578ebd830d8fa24c0b4a5b53ae160c916bbaa7

SHA512
3483223a4bd4302758316fbd397d7f68d51ffecda4fd315554590bdb9a2328daf7c425136a8a0a006960fac7cae0d349cdc4bdc3c9ae5cf8af229fe45bbfba59

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb7531.tmp\ioSpecial.ini

Filesize
1KB

MD5
d6afd75919ccaedc49985439913380ec

SHA1
f0dbe4201ad1120a3ba2b7e0256d305409f89199

SHA256
9c656ebb43f85976f5a35592f391adc4404571f548b0f1bd3f059cd042c7c7c2

SHA512
12e2ff2ef0a0138d367c4ee7242a157ee0794f8fb58a351ab9a615a73dcc77e71140a45308e0e2eae540b23e5638fb4029888eee83c80d4bd169a6c86dc52548

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\38YC0GHWX6FHFWCM95QE.temp

Filesize
18KB

MD5
15b29195c9a131cdbbc5a81ebafbfa0a

SHA1
4feba8badb34682cad4366faf384d228bfc38868

SHA256
d2bfaab78c6905ab0897dca412a6d7704a724cac55a214bcb41cc364aa0d8c16

SHA512
644941017176d079851df749ff7d28344207d3c050a1822b3c83d34e447e87a853fea224200617e7f6b7af54f4078845540653fb9eeb049af8cb47b4589d1e24

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
07bfaaca505272644e98125934991388

SHA1
69173acd58dc3984cd6a7310fee4ed3652538dc7

SHA256
6bf8ec4a0ddb078fc1007f1ef1ea80b516728af977853cf0e2765c0572c6e50b

SHA512
d37507804940512b20c24fd3e62d9b9a183efc3e395d48c5966a24aa0257188c3b50a7d94dcd71dd146dea11b9de7b5556da1c4e22d692c5ed765b0722a4eb0f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
9c5c82fcd420b577287ca074b9f7f36f

SHA1
b374cbb45bf65d0f07e63ca0aa3a3a56b98b29a1

SHA256
4e83bddb0796abefbba03cf7509e6e15a0c5e460d9ce27ff67073cf028aff8b7

SHA512
3fe6c06ca26c3b16780a169f884c0323e7fa203b953a644971fc768717b29035f5dcc5a87868d6d42901e0dff5a7727923424609c3eeb596b9dde03cae5be97a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
6738bc49ac616c35a657e9faf95d04d1

SHA1
8435ed04f7751f7b9133e0d8511e1e9268787ef8

SHA256
3acddf559d7a65ade13c846113a801d8f56fd61aa03d179f4ad936660693f91c

SHA512
721b5737a628af2136fb80cf93b68fb8eb6f00f948df2be468d74b4b15cd858fd93a4397975fc2c30f9694a035484aef4fe31d1bf75a69ca61b58e65bc67986c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
feff8b10c272201da428f2133417bed7

SHA1
633f82fc88df1f4c1f287469cd2c1042e8e6af8f

SHA256
946a654bc7b1d6833313f6e1004a135c6f66076fd183934a2590826b4a6fc7a5

SHA512
06c15e54dde85970ce0032d7058ff0f830ed583204c73ff31fb94045ea25e2a3640fac6fa0a0cbbdfa8c5b2c2dd1be44cd4c24160ffedc54cf0c26f1db47edce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
8b3bece02660c586b09764cbb3ecb369

SHA1
0a3111e45154cb36fa517e082543ad985c9bf06d

SHA256
193d274268292b801b51ae9fc2047b450050d8640a739654f6becd46f7c2675b

SHA512
2a0cf68ddc0ee7394e434c97185b09cf7a67681b0bcb65fefbee7eac13e854e5b20c15e1aac898a4ba3480c9bc84a10430ee9b9816ae0914f364502abaff55a1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
74e977d7ed63fdec4adf7683f37859be

SHA1
2c039ad33c9b2033d55f25351b1eb21f0378e51e

SHA256
9bcf12ae9962b6ea0a0c9c998106552dcab074ebc5d574f76ad1da1baeff8dd1

SHA512
ca2f0201cb70cc4ce9c1466f68a1810c03f94a3f2bd027de529e3e9fa91e6ef6f5e2fd8ad9830b3648a3df6c9952b1d6fb84ae82ffec927e10e2c54ced824d1b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
9dacace7eef921d0f52e63c6cd2e0714

SHA1
406901b2585a44641219a80d869e44cf11fef6de

SHA256
0a5dfe4ba45d1fb88e21adc3cc60aecb5fd91e253fa73b2290809862d23654d2

SHA512
6752db06ff8e0874bbbc5621b4584b3b091e9f1b14e29b19ad7ccf25f953a031b413a31966439dbbba170a21b159cc800f58a22f52c589286cc9b8e8d668ce1e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\AlternateServices.bin

Filesize
8KB

MD5
982880e400d8008df40265b18f344564

SHA1
f2e0898e7ca23084bcd153110e2bde3f70634933

SHA256
6a23948b644fa856c35a228d2353a2d6f691ab661febbae1b133a05932f3426b

SHA512
eaef83d5f5e9844588c0c6034fe6c8f5b6e7752aad5eb1111ebf5c420f82649d80dc6ff920aa3849e81e81eca861a4207f82e89e0d6eaa733fbc00bdab219afa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\AlternateServices.bin

Filesize
31KB

MD5
d6402b0d2d0092e244a24ac23509a864

SHA1
484bbb60bd01993145117c353bfaec526e3c4f90

SHA256
d9d064338c117c74d169110895422b5a81e3d419657e7be8e0c64f6f6ce13d6d

SHA512
25b4781ecbbecf919aee4c7326fa1dade0d8f325ce4288046b94ad159d24bdc77e0e7fbea834ac1ec565527321dbae496c22e59b43673dc3d7e138ba7d73c20c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
c35a0fb488c58c4aeee8755d41c30b0e

SHA1
8ef1445928a9e51a071fe09fa66987d6d09340df

SHA256
87cf0089a90768dee05a8f88d78dce5d8f9509764fa2fc432b42f13736849c6b

SHA512
d0f2977c2969d452c97ea3d2c483642c507048e03e0447ae29664e2d6b2eeebd612e0f091b9d8717bdda9b1925f71e4e537df238bb54c91e609b64a71ee5e883

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ff69459da565537450bf465c3bf32174

SHA1
89d1562152203edf902dee24b8160dcf6fe86b12

SHA256
a44647c9881a9aaff3ee5c31b8d5d963a1ce7bdb510034b545898d4cd861d4a6

SHA512
8b62d8a2a50be6c1b2058596d1ebcae4ec5ec4cd566bdf879cf2742360f4354ad13a6c087fd6e62bbb169cd701956664c7787965372d7adaa7c5a9785a5488f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
e585aa2f38ec98885c4a3d10813b6336

SHA1
33f839b7b459d6a5afc7913bca427067b96509bc

SHA256
32bc8b4b555e2ceaa75a68153d6ce041f09e57edf0ef5f0bee165a4aecad4136

SHA512
6f52c928bd76fe7fe854c4c5054df981708f62b6246a20e0307370a347b940ac1c9357ca926db71dc0beffbef1d87fb59b85de99e0216b15c10f7703258c8ab7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\datareporting\glean\pending_pings\0121be6a-1576-4da7-9d14-9658637aa00c

Filesize
671B

MD5
04479037fefade8e6fe0df75dcfd515d

SHA1
1609348fcf359600ff775ac3b9fe5ebda0cc136d

SHA256
bdc4a5423c6831d71a8e9fe8018550092ae81cb1b60abe3cbd7e4cd486a63564

SHA512
386b944847747366070b86f2777e3f3007f13e30903c01438e390cf4a7d439f3db64872fb24225823564b7a0e94a41cf154620ea46f4524f677d44f8f9eac63a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\datareporting\glean\pending_pings\32cdc32c-bd17-4ac0-a429-d30cd9df8d77

Filesize
3KB

MD5
32009b7fea09a5532265d79dbb5018f0

SHA1
34fdb67e040f95b9467d83b0ba7a046aa4993776

SHA256
2bb9eb52263fcdb8620ffd8c977a67b5459e02f6d436b6cb13d5bd7a7cbf94ca

SHA512
e326e599a7b4bf9e29869a551862e4550505665ec8eb728874a36862644d852df6da1dd7406f9157f1d894748c4ff8cd19f6c8b8aa65b8d6f4e65edd51989da7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\datareporting\glean\pending_pings\5a5ef642-0a43-4722-8d06-a436e4986598

Filesize
982B

MD5
b17e07218e52581862d40cbd5260b06f

SHA1
9dad4e65902dbb0af26ddd860be3d942d1d6ca67

SHA256
4e27f9d1f4b9ffffe1532abe3eeb2ef7c23031c830262220116e13cbf7e6cc39

SHA512
4c546b60998f34e4c98400c31d7339a327e522fcba8c2e7af3e9f0895a72c877d35aa7c88a2bf3586b57cb77fd01ae51384c2768e2edeeaa5b09c893dc94eb99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\datareporting\glean\pending_pings\8aa530e1-ee9e-4506-9982-9d9b64bc2293

Filesize
847B

MD5
d40b5b361e199e27fc088bc4a9673795

SHA1
dc9eb66b584ccbc9e3a3e27cc8c765aac5f99541

SHA256
21c9237861764e00cc06996e85c5f2774214204237639151304103ea4fbd372e

SHA512
42a63e5a5347a789a91cc75fd7572d375cd4e03c1e0b53d75e16d1e4ba36b85e11d9b9addc19702524f66d66076f8495ed9eb1470fa2897224f7131273fa00bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\datareporting\glean\pending_pings\bffd1fc4-56b9-43f3-85b7-18d023ec7651

Filesize
27KB

MD5
c97579501036c4cb1ab2e27ceb61bff4

SHA1
7e71e07290ecfab9f434780109a075c60047ff39

SHA256
fd6fe45d487b7beb23ab85397436a4e06aed71e1d525115398fa0b97e7c791fb

SHA512
75fcf146342c8ecb39e81734e2e07e7091941e4d3db345c4f361874f409e039c0739558ada1dcc87b31d87c4d159a3623111d53ed6d472203ad9ab41578a12fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\key4.db

Filesize
288KB

MD5
92d49a79dd460e3a8c9367f3955064e5

SHA1
8c3006c6cbb478f521368deb4362d9df774aef3b

SHA256
2072db772cb0085aec7c6ea1cfce0768e23b7229cbc5a5e8a44cb20472b408c4

SHA512
9b7c7640c2afbe70858e45112c1393f1bee5932ee5bbe995a040e84eb0b5b987ef0c1abf2b9318f02c4afd0c5516f31a3fcc82f691f5b1f4ee78c539722c5c77

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\logins-backup.json

Filesize
708B

MD5
05db6396e184c09e67acec4414f6be0d

SHA1
a5801ff28ed8a5091717b69912368f4bf64c1d54

SHA256
a9d70dee4957ab9dca095d4df46dec99655b6afde2bcb0a81f009bcb143ae8b9

SHA512
7957562fd21e119a9651faa5a5161a83d1e901be0c0a8b89f5ddfef9418ff6781d3e88a46ba356f7b928ddb468795acd8855178d8105b94ff36ba51540fa8dbf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\logins-backup.json

Filesize
746B

MD5
469d5cd40f0b055fbbe63e9f249aa84a

SHA1
3bd290f04f6ab01ed690acafb8287d99894b4223

SHA256
4542ebf43263193848d921c8b29e57dfbce946ba78b9b411ac8840bb84f583d9

SHA512
b709c468ba9031bf231ce4d347c873f6fa62a0da0f2040782696aa807be9dccb221f6dd5267822c38ea44a839ab4b060bd7598bdff6eb837443e97640201c2dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\prefs-1.js

Filesize
10KB

MD5
da919603cfe4d541d7928eb068c9a7df

SHA1
d1df7c0c2e763dda58a0c20f0a22599010cab749

SHA256
0c953534b7cfca3552e624b16cb4e686425dd772bc56579849f05ac64535b288

SHA512
fe57ba88f1ad408fa4438bd4df345ed453ee6f00557e27cfe6c5f924178acb0785bd7c9dc5281191f93728ba84a445797b436250d2322c968f13fe2a47696ed3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\prefs-1.js

Filesize
12KB

MD5
3bd8706b21f31f101a7e3df283262c77

SHA1
ffb8d177b185199c4d472753d3a47417d40be8fb

SHA256
98b7f42511b0e9f33daa07f66f95a22efb511f94ead1ab95997b95fd657adff9

SHA512
c2e83098818f37ab7e4f93bf9532986069e7a4fd26f78e2270e1a7760f739fac6c665abef689484bcf5559d08c78585e25b05a7821aaceac95186f4145a25b09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\prefs.js

Filesize
11KB

MD5
c0895f25cab9e6ba2ef12f2e8a2ec035

SHA1
9ab6e95bccbf07920459eda0c3b1d3094b94f3fd

SHA256
13748efef2ec2c2768da4efd5c7e1175cea944bc4e24d0113b1317c99a3cb785

SHA512
a95103bcfd704d4334fa9a08710795ee87ccd52f28ea6b31d0eeec8dfb2bdf28b1d8bcdd0c42d535b96990f7369dc3a90f5b2812f8ba24c47c64b77e6181e6a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
b08665996cf53371b15dcb04d8d4f86a

SHA1
f5342df53ef98911400475f2d6ca8af0a604864f

SHA256
54a7aaf02bbdfb87cd7d36f7a410e78f8d18b6d1af4f95a0d8e40e76bd2ec856

SHA512
fc64d4fabf16d86bd23fa496a5aec6b87882b24294edec9697f6281d32fb7e43fb390171e5022942770b9e23ab1107fcb63acabaca3f0c82c23ff8094f5f1dae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
096c011460e3fd9d3bebeaa75cb167cd

SHA1
226ce06c69c08d2f8ea846807c21168f13cfa6ce

SHA256
d040db9d8a58d7ee7b62d0fed53ed032e01d5e1662bd60cc0139da9d0fd21e9c

SHA512
bf309067cdf3f526e9e943e564794d16e86f3e8774fe24a56bfc7918efac74b897d149fba546ff2431b46ad1b28a3b2a12055a5ed460bacfdd687afb0b36825a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
8a46bcc70217c49a65367f85a33adf34

SHA1
5d1751293a30711540f0b8f57a3c7597788041b2

SHA256
1eac675171278a55974c4c71ad668851c44cd41d731090f50b6f320bed10dfb3

SHA512
2c2ffaebf536a6a0ebfc075e68cc2e960cf27b06415906e16b83e7bde869fadcff691d6e63042632be88d8a8a7df1725253c28c5c62789c04920494f15c44932

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
553a8ff656d18592f760f460d7b24a61

SHA1
d1d27b37308435a24542a76f8837768985732768

SHA256
9d61084b2bd50a29aec9786345fbb66d782e0ce7e03a0f3204eb1681434ef993

SHA512
b6533cee48ee1188ca96d80f7dd30c0d4a61e050ea9b3adb233256c1e65c0625acaeec792fc0d54db3593fa8a10762a5eeeac8a30f52bdf067dae969e4f17d61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
15KB

MD5
3bdd353c7caffdf318d540e12c15cd9d

SHA1
33b8fa2d1181afa32af744619585f50ce15857e1

SHA256
839c68faf30e889ad19a60e11811bbd8efdee45ad638ae75d202e2e3df076797

SHA512
26b180e3d45e670de5f2d5bf34b63e62abae4345017e6d094a5523ae7b0ef597af963f0cac6fe2916439c6ca6f2378b275983978b730f2f19f8b0ace73ed36cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
16KB

MD5
d691cae4fb8ba7c0d3425744ac28fc34

SHA1
90ba965e728f81e2a047d88598f9a7a341616205

SHA256
b456909f3efaae95f4a70d99aac67408bf960b14d1fb3e8eb49572cca6334865

SHA512
e23a2319d803392312de870a4fe5eea6002ad484693356e1d33f1952fe7525c17ac423976113d7549c6860a8f0a6bc904736d82a19481f1d72c5e335f55b6c65

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
0bd222866825542e9f31869afb435f3e

SHA1
a9c6ddd3be70176fbe7c080113fbc9fc325dae6a

SHA256
5d2ed9ac3e23edbf3cda960eed552f272f4583b951e00a9c3e5d3626b21dc690

SHA512
f25b33ceca573b4902a0345c35cdcb2919a1ac94c5dac788b16870948b2a3d6e751054875283dfcd1c065f782f7b1669840c732c0fd12d87dfb98174577aae67

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
7e3e97175ec9baaa434bf313f22ebbf6

SHA1
4c7e6273109f84518a13639d181bf530cabc4db7

SHA256
8a0ba1b5aa62823937479a40bb67c46ef8de78b86d04b9e009be99e08727bf69

SHA512
3714698cf4e2246e1c8fd75d13b1b01ac41b9f01f60aeddd6647231bb0fbf487d7f5b37d1ec79e355c1d5bd24057b71094362cef8c9233759a88daf30de30b7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
73e9357ce3a4d58a8ea5e8638b34c1ef

SHA1
4bd128b1dca01f1e7893850e867b959a2541b807

SHA256
941326b7b7e6f43731fa0ad07bbc5677ec2c72933dc867a449debcae1a5a052e

SHA512
99ee8638cb7a26717f8baec2cc2d1994cc6b9cc34d92bbb97e7b9e5666fb8d9764d626e701e396518008f31bbfb3fd229119378114937ced6ce13caec9e5b6bd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
1447c08d624c1de47c2dc53b1c30f210

SHA1
c192289c530bac84cf1a983b710ec0fd9d21573f

SHA256
a50a8dd28c766f2ac369b1254449aef7656dfcfd4c10ec32ff0ae282f6c6efd1

SHA512
62cb78adb83ef91a47504a4af3266b27b9809db81e057e55809cbee263063f0f2b2c79cf5dd40456874255b1217b073e16fa5e2c8a359de8ba9f042f243161bd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
16959c5104c246b126540535d26bc7bd

SHA1
df11e1eaedb3ac58fc3ff2de23e6bd3534365e90

SHA256
46ce166c7bcf094092a8e7067cba760225c74c7d3f76c3fb26569ab11b410286

SHA512
dc21192f86f49b89e5c7ff465644ee10df0cde24f42c632a14a348dfa5ea86db96104977a58e3e7d706aecb58d01e7b4b41467431d71be16a2cb368b6c8d8e51

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
0c5c2c4de553ead0354e68edc2203cc3

SHA1
67720f8d87e1f56d1bbf90b43b42df11f2433544

SHA256
b2464c097a6d6a61f93870dad2e83012cd615d134b7d827042c375a6635326d7

SHA512
020e101266f19f19385d64b5176b9ea9fb8f5fabb3d0edd41ce4584048f3a368fa40752022c485b6fcea33abcacd2eaec79edabe1f48c9ece50d50d50d5a2a53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
b4e6ce28fcdc96d09a54578cf3b85253

SHA1
cf8014ca70890e7e18feff6c6017e942aae8469f

SHA256
95cd7eb9d19cfd8bf800d2e5605d6353c36c184ccf6734db514ac475087b57b5

SHA512
cc8db547f61536adefb33c1efdfae575881017fa48a20571d8a4a14d2989e24f5e5ac170ef24b02bbb97bb9cb73e966367a8d0d697c57008d8b0c52950180f46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
13327371244fc9acdd964ac2f20a47b6

SHA1
8d6b8e17f35793071ffee197120b8e9a2eb72935

SHA256
a166e29c25a0ce5027984fa0df8467c862ee70a448cf1f350210224794140835

SHA512
4b99d903bd2a10edfeedf21080214ca2d8590d6a1d7d505086cd96b6908a32da54b3b4ebd5b81d4845bcc398550643350e3fd66b034756b3b5ea121b825486c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
295faf5e4bb3e8706620934bb75aed98

SHA1
ec059905151b3a5ed0689db7d1df28d412ed78b2

SHA256
03487906ab025af126c646f387803ade7e127af744ab88f3588966dc09e5ae4d

SHA512
335e5dc845082d3d0ac791eadc2494c8c7b54eea0cf62dc77553672b344d34bd2154339a31e31d37c5303d496f655f01fe90cd6387cedd112e4be69d07090193

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
2815607f9c4c467cdb552630419636da

SHA1
a0026378322a7ff4d6ded85fa2987e87a42386cb

SHA256
61a7c1329a6e7dfa0abf5b113bf49a528d20a88f970d787c72fbc8fbab1097cc

SHA512
cce735973513a91af5f2886b8ecbc68ebabc89223117f948b4480484c9be57949a9dca0969f950374e998d0de68b2de4b45ce0de0f44064e672a8c63f1a0ed1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
d735563a2349f425be10b07201d38d50

SHA1
191149b28eb93cd77e596f10cd7adc8956ed3bbf

SHA256
ce0a3d6d6a4f7b9f6a1bd4b13b72e5661a83a8f983256ad51d8a22f0c053a1e0

SHA512
1a7e1c616956b40cb12ac3910f61dc7cf5d3a9cdc8170751c0959426c50846f28e5751ade4dbed8362a0dcd8c197bb6e2f985552a8f9800a8c1b164838946c3f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
95172504d454ce9a71a1ca3fbdb70ebd

SHA1
54c77b5204f974e8b23e10a7e1d3ff445b0739ec

SHA256
8811fefa7047977e9ff0d96c065ba6c611a163c8af3cd49dd15a41db91aa44b7

SHA512
3e17d8eebcf1d448177096218134c3e939c1b208b60a1895d2fbca7bdda7a2831801a6bb91209d95c370743beaacad60b21cfd85f3aa7d553e422d848cd7cf63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
076c12a141b2dba69fdaad4b995811ca

SHA1
d31ac0e5bf2f529b0b0ac69f132a0018a083d3fb

SHA256
9bb4b51083730881290f608c0a05bf39db5270c3d527d64d40b2bb5c5d25e2a7

SHA512
ca4d2f84ecd3cedafc27809a1e8fe9c88ec366bf9d9ac77df5284d9776bead2c282db95708306bb0964cbf7f97bb4b9a35ec4b632f580866d9bf692d3ad62153

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
21KB

MD5
1d017d87edfdfaed85569c27ff734642

SHA1
02a781c20b6e5812ceebae288170692bd888baa2

SHA256
1056bb9df691f6e3aabe7086af5770a5b5607c645a9c1118be63ed82474b856e

SHA512
4dd8709288fc75aaf22a47746ea1ce4279d9eca8025ea7b4aa6af6b53df42523b51fbfc000fdd4821188b9307509ad68a03e44e099d2b8ef7b0dfe35a78584a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\sessionstore-backups\recovery.baklz4

Filesize
20KB

MD5
486ad3527ec1b11c0a360361f4d8d968

SHA1
f5acbba8342beaa313c5cb306eaee1411f322b35

SHA256
c9d99417d2d8250380f2ee9e2bf5d712138cbe01d4555ebee075753c7b513269

SHA512
2660df55c5a68177231c6a6d61b218a4d86c69f33f235ed747a3a134d256330751393652e1f505823faeb0a985d9f14fa4a54bf7b7cd4d9bd17d3e087054acb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\0\{ad29fd42-bd39-4acd-8be2-212bdd5cc900}.final

Filesize
11KB

MD5
e298b4ca9cd17d0f37217671a44352a0

SHA1
52954814158f3374f234b38d5aec0acb85cc20ec

SHA256
ffe58b1cdb695a8bb0c9f0170408555c42d9ca6981322d6ca881ae6af2bf3f32

SHA512
d4e42c2aebe2574f4fe3ad3f9f2e6e6edca1cb82b4beb252282c23af2ae64b7d88f5af2c26b4008fa4beb7d3b529047c3a43d31c0b47a459b35b271f06776de2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\103\{5ddea83d-76c1-43ba-9f24-7cf6d2a31d67}.final

Filesize
4KB

MD5
05acd329ba4fcb1943cdba3df8d6279a

SHA1
72056703395d1970d3ae811482a50a71fcc05758

SHA256
4d4b5a42a502b8da2a4b23b51232d16658a6451c9c91e9fa5a81d9b5b711a08d

SHA512
e71b5d0aeab7fa160e616024cfb13f113bdf347a3a483cc930d868dbab76417ca5497aa678c6995f535463b916958e3c581bd1de56c2c5ed108bb0ea3cad3a13

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\142\{c7fb9849-59d2-4794-9858-8812c46eac8e}.final

Filesize
429B

MD5
1c13524a5b398500722a4be231f22361

SHA1
aac17568da2c19d2d3ffa8631cff120cf2f7072d

SHA256
e9ba4392f6e8ad3b1a4d361cf0f883f2acb67355cf7c8302fbacf6c7ce0ce63c

SHA512
c5d063f409c5e88ab181bff1281cc909be53ad37641a8393865bfecbe0d99d6578cf44b6e6b949a87270f7fb2708d5f41c719aa352ddbddb0c91b0400197d6f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\14\{41eee1cf-ac03-434a-aabe-37d4ff62580e}.final

Filesize
2KB

MD5
e61a9fa8edfca5d67fc1aab53a874400

SHA1
ee5dd29c43a87bcf580d8e766c761da5ae54065d

SHA256
be7be4fab5680527d8fc31e45a568221e5b8855a7dcca7224b5c29263215c161

SHA512
151d7ffadaaad1aafb784497f5601003b71ee56d0e62f2b2d34d9a04595450ecd5510d6c45eefe0202e02262594d78379ae8678a91e7294ffdc438a88d22580e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\157\{c7201f1c-c080-4abb-aa2c-bf8c1d9b789d}.final

Filesize
727B

MD5
2787b80e3f25c25ea81d782267495d5b

SHA1
b8339f6d10b84b05b7d5ac7bfe2fd86799b8f226

SHA256
3b3eb3a9e4c970542fe254495bf07cd1644d6cd9cb683afe38218d7c4c39559e

SHA512
f75fc4cd2fb9b6dc038700104c3ecaa5aaf43bf370060c08fe05b614394892b824843b05ed4dafabbd428d74a7d109766929faa2f8167542c0abbf9c032e216b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\158\{15576b2f-27ae-4424-9ae8-551fe7d7f39e}.final

Filesize
222B

MD5
f5624c2fe6091f85effba12cb4f59335

SHA1
e375ca816ad55d099e2cd35a50ce26f3a08e24d3

SHA256
b7253a8cd19c054947c5699c392fade9d200420edf30a7c10706e67828f6147f

SHA512
1db77139515be3d17d1fc07df4f921102544f9eb09a8f9e1ef2b93b977372a37b2078319e85a75976b66905a6051f89cb12c2b121c7722a3b23facc8bd1c4e1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\162\{6b981815-f613-43b5-8207-38bd9d4c62a2}.final

Filesize
489B

MD5
89972a042e3c3f2277ef12c0c1cdadbd

SHA1
94ee153c7bc3e78089750a3ba283095d63ff7f76

SHA256
6c5bdc0251e81bd1bcbff861c7425a0ac2002bbbc7e0bf81dc84dc264cda19cc

SHA512
bced55cc0ace8326b94ffe2f932218511cddf08288f9ca1feb3f5dafc7d542e5ebbdff3e6663bb5efd6466cdadb9102b837e7dbdd7d339a1061dd824453e2591

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\203\{2472d425-b191-4db7-b3c9-daaafe4c8acb}.final

Filesize
260KB

MD5
ae1beba5f228ccebe7a8a2b0fdd78b5d

SHA1
30938c6944a76f054dedbdaebad83c657469190d

SHA256
00adee0adc28c3f8ff03196d693c7b6c71f600b6289fa408a39cdcbf503516c7

SHA512
d8c1348cf9fc98fe76927404f5fd61f602d6e1c650d14335707afeedeb71733e26140e7b071b1178244b8220eadd3024f522f717ce4e5ed6cbfa89f37f57eeaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\217\{abd360b5-5d64-45ae-9340-d0b88d2cdfd9}.final

Filesize
237B

MD5
7af69aeef80e3429577bfe32e4ac83bc

SHA1
c31a98415f98a92476063e1fcaac4c804077a141

SHA256
e5a6e91884b6a5adeab057b548ca5f500a95cca993e2498e73c61202c06dc9b6

SHA512
983f115da39bec722d51796544bca80a441c6bc3b33cfc8b86c7e544ccd6502d43b3b35006601fd7b698311014000d2e8dd2bab671cde96ca943383af6ff63d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\222\{c2b85dcf-b896-4aa3-808b-c8da1cf7f0de}.final

Filesize
3KB

MD5
a74dcc46bbfd8a7ef7072e9e43f82c03

SHA1
dd7417eb59ef6daae07e33e9fa7e4b04cab96596

SHA256
14c076e883ff95178217f1f92631760eb0fb2e3f55f5b77bb83a42d6a0bdb4db

SHA512
c750dd4ce52584f95df77cfa3d4c89b97db4785649c19221ea93454beca13d358a93b48802f802dd2578faa7c7a3e6807c2501694213556bc42ac574cc99ed0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\227\{500f1dcc-18e0-4bfc-90e4-3ef18e11c6e3}.final

Filesize
502B

MD5
459e00d43c77c2e6adab49dd2c4a6a1e

SHA1
512a151268ae8230473e417e17b4c2de4632125a

SHA256
5407dffc9bdb748b1f70991ea4696a4b8d44ea120ac30ab15343802498c1818d

SHA512
6bc027c0a27ed4ac68ddc292f0c15a40023eec5901656d45ede236491d7688fe55d701c3e7aa7ae2cb5c27d3b461dd1ef5105e019407b0b8d9e203f6f1023b96

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\31\{7dbbe702-6c9c-42a0-9e24-d5d12db2b71f}.final

Filesize
2KB

MD5
1cca72439dff1d79bd83ceb8eb92848a

SHA1
aebd073e22893ceb5428e120f4eb9400dcc2dc29

SHA256
4672af139b6ff24fd8340e3fa33414d21c594b7bcaa954021660a719649f2623

SHA512
10742f131e74dc700b573153ab7f0030cef080089064f17489a73bed32d488d8d4fd9a3ed02826f048b494d34beefe9511736132b11c80ed23b11593484a23f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\37\{9f9131bf-aa6f-430a-aaed-85e49c4d0925}.final

Filesize
7KB

MD5
cfe7c8b6452623cf2ba48c0c45de5ee1

SHA1
9ba5ef403091fbe0d1c555191805d25398c89652

SHA256
fd0343f0bb8f55f2e3fdc84d66694712813dae033780a267434e61da316770cd

SHA512
12fded80c733fa1b0d555c2fec8038b5b800a5391102cf7124396a6e437eae7b84214dd27806a9d821963bcf70661e12dbf683ef1423652670ec5364b23cb20e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\38\{ffcb4dc7-2d9f-4357-a4f1-2e0ba2143d26}.final

Filesize
50KB

MD5
8fbf727598c46bfa14f51a2d3db2cfdf

SHA1
92689bb2615db99e3128bd4f2482ee55445a2f95

SHA256
50dbc98cd463d4e4d229b03c547f89b40999fafecc8e906c6e2c75522fa67ab7

SHA512
fd40c7b5cd4514c147112cd18f3b00487d6b772febde07c9954d62e0233f6c983eaa819e8e3d36d07532740233849d20f217037008fe7276838fb8fc365f3dd7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\50\{c6b6949c-7981-4667-82b3-57b0129f3432}.final

Filesize
5KB

MD5
ec59f32b8ee999460864838de05ec179

SHA1
c0cfc98900236c56027e4548de2bc3297e3068d4

SHA256
3db4b602d5731cf3f86b109cd5aaab7168bac831cfb952f75b5ab08206b57dea

SHA512
32816eb3025ba0435a7b46951cb57fdd77cd406e7a7664c2b53ec7ee471c1795f05e283a7eecf0c0e330d2f8bcd5d5284fa0a2f738150862d3c8adfab8ef5107

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\73\{6d87fef9-fab0-413b-97eb-2ca6ee75d149}.final

Filesize
2KB

MD5
13fcb0907740ea3564e3cc9f17baf366

SHA1
9b1724c069271e25d5efa213672a98d452429a10

SHA256
541c69d91cd10c316c24b8464525ab5a41a6a54bac18cdff81675b2078e7bc9a

SHA512
b81ad20aa8077af48a87c4779a4959c46339d9c2d8143497a17c3dcd02621d7f5fbf4688b6b41787e370d364b2a680de3df88ebd7c6c7f02cd1674df469d08b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\7\{205baf0f-d9b0-4e36-9a87-d07c1594c407}.final

Filesize
10KB

MD5
f4b6a8ad34f27b8c82f00604292e50a4

SHA1
fe6ec8ffa01941629fa6fa83282c062411bcf586

SHA256
f93cf6b2fe47adcfd5c13971c7171449b91e845136f2e1545d1c0eb953eaef6f

SHA512
6bb4cadd105ac896de7ed4b0d4c0948beff22f82dfb1b6d7432faa18a5aa89c081a9b880fcbd9bb8821d60e1799daabfbdaf811d15847058c1b5b28b702e1fa8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\80\{9099f572-d123-451a-af5a-3731f5e95f50}.final

Filesize
13KB

MD5
b1ece8c143612beffb64387fc3044b55

SHA1
b7e11a77780e53ea26623a3a593c0fb5f5a52871

SHA256
64145b88358c2077704af1eb69d4a45d60067158a678aed995d4501c912cb5c5

SHA512
ba8175f86db9af8ed857613064224e540ab1614cf1f46805366db5aaa3028c14c40e58e71ae35dc009e3da60a6da2b7f16cf4955946fa33c1f034a0233f9dc97

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\91\{346c51d4-245d-4de9-8506-42e6e9055e5b}.final

Filesize
16KB

MD5
a9d0b75e65608c409b536fdc47d32e18

SHA1
e5bf85b2e48c646353f51bab3ba21b6565e40118

SHA256
4ca915d7a36a7a1f61ac3163461ad35382a8490b64e957f340c6f58ed4f54ae5

SHA512
63d629bae12660cdb76f7d1ae157fb0537963612769c5a17caa20550217d1f4965b69a979efc0546509b64d632a83aeba8fadbac1148e8a69ee9afc17708797f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hohja4eo.default-release\storage\default\https+++mail.tm\cache\morgue\99\{9c05f594-7216-41a0-866d-c5298b266163}.final

Filesize
437B

MD5
0e47a13814b06d5106dd63cd4a85cfce

SHA1
8c112d9eef21300786a03bf7b54fa5e6e4840f86

SHA256
dcf99a053065c612aba2fcbbcf7efff7049ba94c6de87afbbdbd65ca07b0104e

SHA512
899f18a9559eb084d3db10d635e1019248bbb3920c62d82266acc182cf8f64af85018aeda7f783c95afcf08700ec709c05a82e1c4c7fa17cb4d54d317c0cf662

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\profiles\Senza titolo\basic.ini

Filesize
31B

MD5
19f8cb1afa4177016ea0f2f3f8e3f2a6

SHA1
568cc203d8e10b672d60fd0f0ff8ab351425691e

SHA256
02f1208384109bd919af9ca05d01ffcdd1e9482f328546c936e18c5619de8e3b

SHA512
efa0cce53496364e0193e6c8595d92e5750de17a717a344b9a36620dd84a719851f5a9c92f6cad9fe98a9654d04c2d541934a03d0662ce5768edc3989e0f4653

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\scenes\Senza titolo.json

Filesize
2KB

MD5
90eb8b2b6f7ebdeda8fe883ed0af50cc

SHA1
e306890acf57198388700926e2da78ebf463a5be

SHA256
1a2900571e438a60e9aca8a2fc87fcbceac01828c9a8957e0628d4fdad5a5ad4

SHA512
4a5efaaf2e3c382a0406f99739e017d456834bc99a43d9f0cb1e4e2f64e73683c8f9374a4b899c603e0a84113df5cf68af0d8e4af8f3256527eb90b71846a3ee

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\scenes\Senza titolo.json

Filesize
3KB

MD5
e5dfae9ac710151f18afbe640e2a586e

SHA1
7a0480591a45495baf92dd0a7dad2262460cb709

SHA256
475914f74721bda0bea0b971a7b08f540dd532a82f94c8b0738d9048f29ef570

SHA512
f074fc1ec8e3df9f3545371db476c167481213a3bff5096ea4e2c04232bf9fa80933aeb23c90d10bbd594760f79709f6d241aa275cb4d7849199c241202028a3

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\scenes\Senza titolo.json

Filesize
3KB

MD5
711b212f0947a35341893688cee71081

SHA1
2bf6aac362d5ac0ecc2e8e09b4c96d0cb8b1f07a

SHA256
6e1bb0a7f2be54b82a8cbcd03d67624e2d46a387175fd7098a40f0810c90245a

SHA512
812b793f4c70c9a3ea351c63aa0b64bda246796e4c82dad0322a6662b2c5511c5e8955837ad062072b1dd7ac0efc4133e14f7a87b88ca819ac2031e2f04d1a9f

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\scenes\Senza titolo.json

Filesize
6KB

MD5
2ac26d1003c5772bfa79c2d7aa58dd44

SHA1
82fc36e965e4f077f65322ae7e45f16060721444

SHA256
6c7de4c6d3e485f2df1a6445891ea2077ae850e55c92ff497233588ea1020bec

SHA512
873f603dabdc37ae549c9ec37b7a6602a11ad2d7f5e186b6ee2f6b9f885c67aed1911ca37a7f023113da1cd0eebb9546acdd4be188d0acfb3eca4e13c079e3a6

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\scenes\Senza titolo.json

Filesize
3KB

MD5
2599345120826a1db9f8ca01432b60d9

SHA1
ad23c9fc5635f1055ad46b29ae42415f95ea4723

SHA256
3cfb2f224db22ce1b6ff0448d1f3172070def459745e8aa038bc8f54b65d7354

SHA512
7812fbaf3827ded6cb73c8964c59b52640ecd37a48ea91841bbc44737b5d1f233a92210dc9273ea47896d337dec479aa8e4b7a924d236c8b9bc41dff389205a9

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\scenes\Senza titolo.json

Filesize
4KB

MD5
44edac336abbf15d5218ebe6b72c2ec6

SHA1
0a4f9c4bc1565b67e1eb3e384fef559b84e8bf64

SHA256
a37de1af223b065ee49311104e4b55c926676465640163ed4f7fbf6f4a37b605

SHA512
7e77a2162ddbcc7943ecfddb8f9214299b86a2f21cdb26e1f76008231afd14061843a522ae33003ed82ac1453b763890efdb8713b014eef737e0af7fa5be6c7c

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\scenes\Senza titolo.json

Filesize
5KB

MD5
70f6aab96ed6ceee37b226358cc53d46

SHA1
b919e9e01938569de682fc77c993b0d0e76015d9

SHA256
ea2ea8f3912ada8d6ce5ce98118b941ca408f6c73a8a54108cfe54911e4a607a

SHA512
aac3b7497d449cdf188f4c84d7dbae95cac4ce5d3a2890f3c455b08cc6d88afaf5197778e3b9690ecd850c545baf6d61804c60216ecca760170d605afc3be4fd

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\global.ini

Filesize
1KB

MD5
f37dc974bb984cdb61c641657908a912

SHA1
4a8454e36014f13ab7c0b66ba5d4c1165822ec98

SHA256
926bb663b48967370cb87e1759bae33155559058b37a09c3379937c79841dee7

SHA512
db97fe784894e6d46a54cb576e89898e7591bc41537cb72e51caad42fab87014788789625968ba95b9a15e956cfa93b8b6255b3de06550b72f8b74b8131e3abc

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\global.ini

Filesize
95B

MD5
5e1a6ec63e7f3c47ee8e518eb9363bda

SHA1
7ee6c56636dc5bb77c624542dfed81cf61e1301c

SHA256
90eb7d1ad2ba1c3f742eb01a0930d3e98a5fafcdbfebe4a30a429872721ef04e

SHA512
178aa925045f84eae42846cca4d7f8a8f339a044eda2e15d2ac07c2dcbf4911a38e5df7e4e1ad288b696285daf00c630ffa79216aca9421318c0af8a220f0dac

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\global.ini

Filesize
1KB

MD5
726211063170ca9e5ba0132435935b95

SHA1
c1ab75caa22adbd48a9088e2dada396c5a688ebc

SHA256
c1622ca9b82ae4a78081962caa2a430dbfba0662bc60c1d7dd6bd3b71545aa96

SHA512
20eeff16a5e7f4318d54e8c8b3dfce980e863e31845ba39041d45193edfda7d181ff494201dd14118f55dadb67120a222fe01c6a3edefb18d2f70c0da8a1b25a

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
5c1ee1515172e9e090466c88a5b3a6d4

SHA1
7c5ec2e40903c5da1599abaf9289c34ecc8ef5fb

SHA256
0b217586a335ca0ec64ff11dffcfd98facc1f527bfe741e2d00e068028d5e760

SHA512
0938a11df480012546d6c703be234e06c129ed77a86291d5523968422bdbac41008ce9ba7f77011e459139c833e9bc7ee41cde22bcb1f3feea0a5498fa22901b

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
81a4758ca21ec7e2083eef2cb5fe16f3

SHA1
800dea1c4d24dd4bdfbbc2a090b0cfd7a0f2053c

SHA256
6605982e6408e9f4173d7737d832d44afb7d0d64464cad3c32a6a26afb442dab

SHA512
7087f73e91c57bb2c1b4740c10c1ba091ae9e4029d27206833379990ab43f80896d120cb165986a58d5b93aa137f5fe50b8ac7616bde74134a1b73a25d81f068

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\LocalPrefs.json

Filesize
638B

MD5
12ef25ed1c83411958ecfd36ec906838

SHA1
828030f99d8cc36a6eacbb9a1c5a84efd43ce8ef

SHA256
a926f2be1081af58fbfed41e3a6c2fd69398e3a081f56475e98a705e739e207e

SHA512
b36591ecc03caf8c3fabf18e31cca72b13039b24ee2b496e24c598f2b9d5912ee32b3d11d8c800e504fbdcff541f504f650a6f52dde33044024ee8343e7091a3

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\LocalPrefs.json~RFe6357da.TMP

Filesize
484B

MD5
45ee33d4ad6c50bbcadc6d3207b7a5ac

SHA1
c9f8b3d431198d5c67c1480f2d8064f71ab2dcc8

SHA256
fad55900af777ec369e6b67e61d5400267657cac18d01c3fd52de8efa906225c

SHA512
254d4a766dc375cdb0eacb018edf7b1df05903924d215dbbedf8060d90b1bc34cd773e62e574dd581701deed4b84357f4a295e268598204f83bdf7a4c7a54110

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\Network\Network Persistent State

Filesize
1KB

MD5
9991ed39b7fb49700c0e3cbf5d01a09a

SHA1
44d4c22d878f0bab4c63f1293daf151fc981a3bf

SHA256
934edefa28cfe9ee003acdca60898243b47cb1bc92aee24fd08a65bbe29bda98

SHA512
2bed0735c1042ddf2ff48a8b0cf0b37054bd89080ba7a879624f508df52136b3bb77fe0f0d38588adb03909e440e714a65ee67e049e9ec0221b1e665ab8d17f3

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\Network\Network Persistent State~RFe635931.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\obs-browser\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\rtmp-services\services.json

Filesize
60KB

MD5
6143e98bbacb4102f7fef47af60e4077

SHA1
fc7e4ceedbfe76e92518c3688d43700c7f37f634

SHA256
8c4e8d630906d0d5abc4f6111dda24b75d5fd7a6f72a89310482a3b09ad3ef47

SHA512
2c51bfd7da80199e1ba4d242e67cc56ccb610c24c88f33f00d33b74c30353a95b504de32c526be414833023a40100372ce3c4f21f405e79b51259e9f9ed51d38

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ClientPlugin.dll

Filesize
19KB

MD5
bdc8945f1d799c845408522e372d1dbd

SHA1
874b7c3c97cc5b13b9dd172fec5a54bc1f258005

SHA256
61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403

SHA512
4fa0ed4ef66e4c442f5fc628e8bfc8a4f84cb213210643996d9387027edb619c054f6104ac889ae77cece09f0304f95d5f20e14d66847e2d382ef51eecec0962

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\core.sqlite

Filesize
3KB

MD5
3732df3263fbaa868bb866bcca1f402c

SHA1
f247dc7dfea7bcbb69116920d48af2dabf85b444

SHA256
716d9992711b5b17eca841836ba5a63db0a62251bd056a92db96deccfa887b41

SHA512
bb99cfe2be9488c6d7e57991b2bbc4e593ade8c8d2c79e4b7056ec5be60fd5e0b88467f65dca71c269540b800f0c3319e4e849e7e77069a6e9b1b89a2d4807fd

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\main.sqlite

Filesize
15KB

MD5
979b65cc02018a322af902ee15d3a146

SHA1
2d1f22b65bbb29ea8d794d7525da1ed446bc6cd1

SHA256
95c5697aeeda81c0b2a347e4434c6946e89e4f4d8833fc177b32f8b8b62c0c4e

SHA512
e41fde45673c12fb7059f7a84e7e8e5887e15425027ddd8a729fa477c8b0dcefbde95aeda5783751ae844916f9f3919caa9d729cccd1d00e8b8c674fb961ba2a

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\main.sqlite

Filesize
15KB

MD5
ea522fc387e8e1c1c65e946c9118e2c7

SHA1
0d3fe3c0f59b651f4b9210ec4d7324e7686b5a21

SHA256
ae429dbfca9416cfc6832aed1190fa7b9eb90127328136a249de024349fd3b3b

SHA512
52161556c3d3a1e12fe8de217aab806ac8e8e47135d57f057c257d16576ec08b13bc37aeb7f7234042d89d6deb594a635e0764675f4e04f7abb94836fac1d921

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\network.sqlite

Filesize
5KB

MD5
b2b7a9ec117179ff2f7d4512ecf97adf

SHA1
1a7ebd4f73714e3b2045aeb18e8c508638321ebf

SHA256
3b582a80c549314f1ff4613f18e938f20f81a9c973aae2ddec6769644fc57ade

SHA512
d4a10feed97ba2448858709e6c3c62bfb6fa6457f80a822caba92a0c6999374dc005dee88433f7280b291f2a92e15bd0f8bb45657c229dc9e3939fef690e3304

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe

Filesize
1.4MB

MD5
1728acc244115cbafd3b810277d2e321

SHA1
be64732f46c8a26a5bbf9d7f69c7f031b2c5180b

SHA256
ec359f50ca15395f273899c0ff7c0cd87ab5c2e23fdcfc6c72fedc0097161d4b

SHA512
8c59fdd29181f28e5698de78adf63934632e644a87088400f1b7ab1653622e4bc3a4145094601211a2db4bcbd04ea5f1ac44129907fbb727fe24a1f3652c7034

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\AIO.ncp

Filesize
17KB

MD5
60c274ccb344da9e3d77449f6068d253

SHA1
ab25eddf3ddb61ef52104a01e5c9b8a23451c764

SHA256
0a59aaee013c57f3b6190d683160d88ca1c5868565cbf5acbb7b17d3e925c602

SHA512
9600d852b56557f31a5a18a6aa2cb76cf4fabf36ae32bbeccf82677f64737542234e2fb06ac8d917f9839120320b7db212d76e8dea24445f13096d86a474b9c9

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\CorePlugin.ncp

Filesize
119KB

MD5
7914e7302f72d330aa5f6c5c8c26df43

SHA1
8c411f3fe5297a78cb018539b44df87c0a51606a

SHA256
f66985518b1e56a04f512d110f5b79f21ed91cbcbf6bd3e17eba3dcdfb85f9b5

SHA512
8959843f282162ff0c59d890d04012c4f62dc36058aa7095d708a97a34313082cd4ca5ea5df5623cd2d6b8b91c527297168cab08ec59c1ec48fafac5983ad012

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\DucPlugin.ncp

Filesize
73KB

MD5
5eca68a8368e0e144b7016e30b85515c

SHA1
0ba48b49974156e5746958aeeb1c2a26c916b3be

SHA256
e2ce89b3e68b003cb27e2c5652ccba073c8938bef194e51830539b2464a3f676

SHA512
ea1d1363fb072a5c646ce070184855588124be42392dc492ce86c88fe93eae78e23f5de4f2df75fb5b0e8d67bf08ff192dd163ed3c62a1ccfb0b8436ae1df644

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\ManagementPlugin.ncp

Filesize
300KB

MD5
b612c2c9a6d361a5db14c04ba126119c

SHA1
d2b29e235b0f45242088b78313438bdfd51209dc

SHA256
b86fe4e126a9748a383a34d615b9598c715f2380c0aad957495c66923902026c

SHA512
194d4688935235f3ca686868c9ff53c7945d4e076d4a51fdcbc254bfa1461494766480794c65715bce314256c7cc5268bd6547c937984d3010f54f5a3db4ba9c

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\MiscTools.ncp

Filesize
66KB

MD5
78e3006fc6468eb7dfc7761072b84ac6

SHA1
e46cae768d2754f48a29b7e424a9bddf0d67bcd8

SHA256
3a3a3b105eefb45e3b70cc1592e484df02df7020d5154e8c2e5d7d439e295e46

SHA512
0daa1cc9ddae70f442ee5eed784523dc1378b9d095edfaec1df95e02f00d09b461d60ee180f716f7ba755543ef7b0c87d791a454cf254dde0033b8615b2841e8

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\MultiCore.ncp

Filesize
236KB

MD5
becb82e1e914e906be158e3f9dd658ac

SHA1
725d3d658680ca8dcb610d998db4b28733b5ee52

SHA256
5494adf651fc64e3aa6c08e38165d8dbfec52056cdf4fadae90b76b0e6816a33

SHA512
1d67e7d5686ea225262501afb572bec23e35bbd33c660a57e84b9cad7adfadbe457b128af0059ac705d53c6b65798f5525fe4ed3c16537b0c085414cdca74174

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoBlack.ncp

Filesize
107KB

MD5
794ab16c092ebf2b1d812d6cce158537

SHA1
6dd9edd26b50265d5af4642f9d1f1f8703a44805

SHA256
7919b7998d6b359d7cb700018dc2d69ff6ffb45bd01c9c190b98fb4c9ff4beab

SHA512
e639bb0f7d309344c45ddff3d7f91212b3c6a9db6970d06db35f6bac228b389ed8c32dbda75ae23ad1359bb60f678b0b891caa3ed07245aaad21dcb3ea4a5347

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoBrowser.ncp

Filesize
102KB

MD5
8b13fdc96af0a84c152f5a601dcc6b06

SHA1
1250db70fda8a2c32f37bbdc5638074c6dc171a7

SHA256
997c41b05150480bcfae9abb3132fc807f6c6b511b810b554fdb5aedf89f5db0

SHA512
536d4e1b9e7c95ebac762d0a438106a5409c69e990940d3411709364783f957015d4a5dc0651b33591e37dcda8549e689a87b853e32f3ad065391a2d8190a552

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoCoreSwiss.ncp

Filesize
49KB

MD5
fcb5afd01e75aca8ed9fbd35a46e54f3

SHA1
94b69f8612d31fc0698089d5e08aea1cafea52e7

SHA256
bf0386f6e9b4a35fefe5fe917e2be7c64867efe24521f18e4567f8af5f6dd5e5

SHA512
b587dd23eaea6de486c30864908f8603451c459153cd21b86a5e43bb9c2cca7cbc015daf620808fad76a4d56bbc4e57e127059c8e73be6c85bf958781c1343fe

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoNana.ncp

Filesize
157KB

MD5
c5d40b767bd6b97f88ccce13956d0ad8

SHA1
ef7f7fdd9d5ea0b55ffbb17c171ee6a46b347100

SHA256
a3c39444ac74bb91f14f3f2ae6918d9b1d368268e137aca310450fefbc8983aa

SHA512
3fcb5a6afdc7de59bac645d8b4dc6368b0405a51985ff86c95fc8cd579bd59bc423cab940dc0ab3de9a0cd0d9e04dad82e380ef18030330d72b2e72936a95ee1

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoProtectPlugin.ncp

Filesize
179KB

MD5
e51af633e5f5f4a817a54773fb90d337

SHA1
0cb8a7965f9f042954b1f318ea1026b76e12f8e0

SHA256
b37602dbb924bb94df0d9745d13fcace8a6642397fb738fbe02a88f667f3ab66

SHA512
6454305121597073d4ea2b8f57a4bb4a4fe7fafbd05336c91265534faea5a5cdec7504c1329ea0c8cb344a4f32d59c60af5348dfd89375876ae95ee2c15f0c14

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoStress.ncp

Filesize
117KB

MD5
ba6f59df971d6db7a8951edbd5d6691b

SHA1
ed766de1fb4ab0889b3fbc8127f1393eb3cddc15

SHA256
6b33a572e019266749a3e04966e2c57822e247c5197f6f9bd6a4bb8792633581

SHA512
bbd50d7cb2b2799055b8864da3d3d6037bbac41312ce8582c4627611ef856ae38ecff67dc4223e236d1b555bf02a7c0c7284a76ab90007621a2f2997b6bc5dd2

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NetworkPlugin.ncp

Filesize
319KB

MD5
70e5b02349742a550fbfcfb5bb78c906

SHA1
2319b68398af74fe08b6a3a7d6943cf700240a4e

SHA256
160030b8444b6fa86775a11d1be35df6a75252070fc5661055884d3f8b07296d

SHA512
bbb5d2fd6eff637da303a4ab2fdb02f781619ffe25c5795c5b9e514214227717771a98ce6c3becc87b29c15303ac4373ee3847060ad5755a2455362e6e26932b

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\SecurityPlugin.ncp

Filesize
74KB

MD5
44bd68199bb393d0eeb7ae83b56d9b9f

SHA1
c6cfa069a17ace16c651a11945bd54f4ca6193d1

SHA256
25b1b0836838740d394cd35eaefc660e9eabeb611a701a451eb1119f6427fc12

SHA512
a02b82e40f66dc925de3324c03e8a0a497bfdb6ed44549001efbf86f2e5381aaf9259978908cce9ecc7798f083d3691f007b207ea301a9dc73f2430662146bb4

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\SurveillanceExPlugin.ncp

Filesize
423KB

MD5
195fbe66986564288c3285935fe87b27

SHA1
2fe84fbbf109b3e4c7c63b414689021ba847b568

SHA256
a2ce9ed783b26d01d58e07b9c97bcfecace9ced72960cf3ecf471fbd008afbae

SHA512
552161e555d07fdf7062a4c0d3738819b13ad4c9a5c54f09db48dccf6faf49b014eb043037500abdac7af0210ed118c5232d8d54be367d8a4caccfae7904332e

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\SurveillancePlugin.ncp

Filesize
352KB

MD5
ed3edf12bac989d1dd6edf7146feb805

SHA1
776a667bf2341b43e199c3601856ac223b86d221

SHA256
3301f9fd4700458a18589956fd2bb6e5101b15c14f52d5e079ae1c3a008da040

SHA512
e6873a5d1caada8954907bdb3120aa2c60a4137fb9d04abdbb74ade58f35ada1ff87a447cf6a35f5798dbd0e1e0ed813d62e34d98de8d6402b6432746aa80413

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\ToolsPlugin.ncp

Filesize
130KB

MD5
699eb468e7d6bee9c429923b5b477545

SHA1
80bc420c3e441c9b9c3813ac05ea9e168cca1e3a

SHA256
d753bc28d842e44ffbf6cf99314febe5ed7759b25a74ca34a47fdd153bf2a6ab

SHA512
5d82a98e918ea3eb024dbb7552e5cdecc317b49635a5789029e7a0035d2f0cb2a3c47ef53e603217afd17d6f59fc78a918e2e5f70266119c619e41b3b647aac9

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\VisibleMode1.1.ncp

Filesize
49KB

MD5
37c2ef6e5214600396ee87c4168a5664

SHA1
69b6e1f612f5a3435fab05074cffd3ebd1c232fa

SHA256
4a8d45e13a38c502a3109d2ea17a81905fb9eabbf643ae611b62f62ef11f09b2

SHA512
667ad370f48470d60dbd437b0601eb05de421ab59b281adcf9c6f54b9c6fd272d3aa34c35e7e6df889771dc5fbdfa9bc683a4bf156727827595edf6eb2fe8cab

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\application_delete.png

Filesize
580B

MD5
333c3e0cc3ff3a57b9ca358de9bd39cb

SHA1
799169a02fc0ad101dad6b8d6d86c5ba76015841

SHA256
9e3de440bec32e23846a9ef37235453ea627a8aeb0a17ac0afedb433fcb448ee

SHA512
3551ad2fba75328aab0ca185290c18d44c1943fc1423f9c3c12b6f450c14be27c4fbfa548d98a664e06693cc706dce1a41c3f5bfaac245440692a25fb11b6b82

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\arrow_refresh.png

Filesize
674B

MD5
9b1a30ac871af0684baa0e4e76911d48

SHA1
c1bf620aa2e493ed63d96729842c650b62c26ab3

SHA256
6141eaf716680ef3030c0db1252bb39bf3145e4a17225d787808c7731ba9358d

SHA512
22c6a8d27ed029cde7812b5cc0442c8e6733fa00f1f62506f6f94cec48026709e0c444fb72dd123b37182c791bb9358d00cac899bd65480c9d05d4b8ce80758d

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\books_stack.png

Filesize
1KB

MD5
f85aa7e604e376846e22060f39ed5cef

SHA1
52682e511e742f72f370946a87022d00e6218e64

SHA256
e10f4dd9daaf95f3aa0f6009e2d82d5c09981cced09c253bf105931a40673750

SHA512
3ccb257db311259887b811ba217122325dc7ff443697abb875a56950be3dd0d1ba481f9ff9b1666c264c277e40938ac403df90179ff1f43749e5882897a9d6b6

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\clipboard.png

Filesize
503B

MD5
bba5acfe2a3448910760402af17b2057

SHA1
b5a17fcaa8462818cc7bab6ec28f0b394f47c553

SHA256
bc6045247ed76340995951f6fdeb18c24b8ee53db3450a3426b8aca85175b308

SHA512
2f27d130675eefb2e6586645a75fd3d0729e9050a3ad7b8dc1671ed86c270831589f9c03f6c39fe1755a7c485fab42af789bb446ee5ab7615e574fe5a0f6fe35

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\computer.png

Filesize
715B

MD5
c0dc4d56147b86b211c7419f727be0a3

SHA1
71740927a6e212b9caaf30a04eba86ad549bf63c

SHA256
b0b606f3f84b5e1f8c7f8558dd3f092adce374f5c810613845276d47a6401d58

SHA512
a1e89366800e611979fe693cc1a87d75d3e0e9629523b2d19a222b87a4f80e813319f861fd972cb861cf227de272d701f7bac508fb48c8f2d025485fe8b75a97

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\control_panel.png

Filesize
636B

MD5
49811b46491e436958be941d0e5e2bd2

SHA1
aab6685832f9de619929f7bdf288ac668f35ce02

SHA256
04030a3e3e23baaf7573e297ca0b83f5d196f905568fceefba0b1e0413d1a063

SHA512
cb078f7341c646f9ec65a2a0e9f20dd3fe83c713bd4999cd79619ba52729ac673fc1a9f24c0b7547058b22664d8ad79df14ab2a3656c5577b8ce3bc751ceb54c

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\database.png

Filesize
684B

MD5
5c58d93fc729fc2713a1b48fd9c75b13

SHA1
4cf70524c5feb288d0685cd3f4c8a47a23a4e229

SHA256
2472976a5d208572c0d535ce14bd46415b205e0bb004a74c2f1a90d82e23fa39

SHA512
8b4fce32089a29ed619b288c7d682c0b833019efd163d5890966476fb436033f0ca1ade418be2a58f8e324f5b4fd1bd8559313bff9e007eff862fbb0d3278f3f

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\disconnect.png

Filesize
661B

MD5
560aa223ee6d663270b49df9fee84d7a

SHA1
5e177aa1e3180cccc15fc81bce5d23ae32ddef6e

SHA256
d79ca587e71fa6dc2fe27b2fb678b84b01b0509a1956ee8bd852417e860d5fa7

SHA512
7a2295769cd2ed15ad9491afda427a7584fe206fe1158caf01d5d229d7d223820b92fe6b804ed0a5681f0cfd25ba3a2a7280b4180a985c0ba67cd3eca2c37487

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\file_manager.png

Filesize
647B

MD5
aa7e817a2d4f55e9873a24a1586ebf54

SHA1
13bbe5a713599e6c7fb7cf043339995e02cd088b

SHA256
4623a50fc347c3f745ae9acb1bcddf6394e18d07bb532036b7fcaef4e161e33b

SHA512
b7dd1ef3b7fdac61ad014283dd2fa6af0ba83ea4162cccbd652576bab215c474c4c1feb343117cefa20741a29390b0e6eff67cf3030af40cd5baefe85b0615f9

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\remove.png

Filesize
399B

MD5
51f8eafbfab6b02f83e24336f4bb7ec8

SHA1
e18154aabac4f28b829197666e0c156b6fe52349

SHA256
e2a8bd43684bf7955927ed689b191b0fb79552c1440342f0c6dd2ab6bccd7b7f

SHA512
56777a5b8a0e1f65c6767325d6c0527de33e19055fa9af6e4a11af4127d5f2ec22c2a957fbd972991eb754202f56effe53ee392a5cf80ccd5fccb47dfc8c90bf

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\system_monitor.png

Filesize
541B

MD5
cbc5a799bd030812570fe27b8a5c804b

SHA1
ef0be2295a7165b76785602e9bd7f5fc13c8cb6d

SHA256
9913c8c7871b787d832a3688db5623e8f72ac547d0517a5c1741e9c24d6ea279

SHA512
ec40b627f37e1c368314cfa7dd6d13adf8d4ab420c96267cb5a1f384a625ec8a4eb8fbbedab0e2b8239906e1eb1961c862a6a104fde83adf14f3fe29109e1197

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\terminal.png

Filesize
538B

MD5
7eea51d284e59c3d2b347bf0eec4c4aa

SHA1
1e5ac6ed716c5450c6330475f03575a62e093996

SHA256
5e5221e3f9e990114b5f747024bcd2c7f6916f46624e8f68d32affc88b1b97ab

SHA512
f0f846c6ef11eeaa97d13b1f7939ca48b7a20e3395cb93270c6d9f6bd4004ee372441deb76e6cafbb04258e3432e6567f8b7854874f809ecb7ce97d4365690ff

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ContextIcons\wrench.png

Filesize
660B

MD5
da4053b4dd7f25ab2f0fc2efd1ed871a

SHA1
4c5314dbb63ec94c8735bf83cccb66926f4f9d92

SHA256
0149f17649f85866d19b503c0a75c592d5e6a2bd62cac1a11cbb180ecfcb3f79

SHA512
1d039be60f312d58145eaea5d83d16b9214fdd91c13580567f1aa6cccd8dcd497aff95368d0ebfa770f79545a6626f943fea8ed9c19717e405a625269cbe9006

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\TabIcons\builder.png

Filesize
303B

MD5
d2d498dc06990b948ef42c479c4c1f94

SHA1
eb380e6d156f5cc2ab28baa5add2ba8acda088b3

SHA256
ce8e344d1975972fa3f1b54383ab01cf522217e83b4e01f5c5b8563641bf6550

SHA512
fd9f99b7489507d8208432847085507e5d1823f1eed5d3c7e644c59bc5e5b36d8705d4add01a0c291240029458b25d72894fc05efede8b795bb6872e1e5f9ef9

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\TabIcons\clients.png

Filesize
462B

MD5
0331dbac2291c05d567461b58654d350

SHA1
1f89cdf7199983e788fd1f22b873ab9b0500952d

SHA256
8d1339e002540de132326aeb1d17c66a9a60b0af7e3daca9bc40df17e9c96542

SHA512
2d12a85226a21670c49038e4347b39227b8d8bca07b8eb66f2adae0ccf1135270f5ba5f16a40bf526477c70c00c1ca572bfb973306e6eb8dd057600de38da161

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\TabIcons\home.png

Filesize
343B

MD5
0a482ce7f891fe7a64118bbb34a34b9c

SHA1
2aba3c06942273aebc5e616602620e4b2526ebe7

SHA256
76d3e6c51702b37227b73a4f84771e44d7c1a8551b4c1fdd90e341f03a805346

SHA512
0e900eff9109ac2f32137d9d18993a29ed6065299ef96554f2288128fe07d1e8db1a0dac29b39b0eb05bb8a9bdca5f083da8e25dec3c880ef155401fd649107b

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\TabIcons\network.png

Filesize
230B

MD5
48780574121d519661c2e0bc51b25b68

SHA1
89d8d5e42fbae3d95c8036c1738656b8e6343091

SHA256
28f4c682d85fb4ef531a71b7fed8f0d7ef548f1126da378aaf60349219a681d6

SHA512
7f0d9b6e18b812350b9d57439069ebb9140365830ea6fa247527f793cc58271ed7743c514d7488f026064b6d44afaf93717192bcff3ea8a3b501f2bf7718ff30

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\TabIcons\plugins.png

Filesize
14KB

MD5
3191ca0269497a9566299585d427bc15

SHA1
7db0caabd0a466730b264d07c8cceeb62648788c

SHA256
e60d5bbd1aaa36e731ef53f09dd4b010a041dd7c346c4f3ae0b824f63c37959f

SHA512
6d76f44efea93a2f43e3d9ac11bb97d279a9d3fe668382c2e747ec5bcc0e48d5decf59e2772058e804bf32bc74f4b0380db8dcd0f652073661e68abcbe5adb08

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\TabIcons\system.png

Filesize
273B

MD5
9993c66f33d16d11e701abbabf5a5db8

SHA1
415a0069f21dc5fcbb7bdaa7f17a679eb18e6b1e

SHA256
24c4edf86254f9e2359508909ba52dd683e1f6af0d8c1a52f875c472fc73bd40

SHA512
7a3f0546f4fb12e72fd774f5c4446e8bcc2a26c762aad91675c3bc10931c1c0ac2c40d66a25afd0a376ab665427164367c1cf398c22811eedf88c90ce51a23e7

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ServerPlugin.dll

Filesize
28KB

MD5
952c62ec830c63380beb72ad923d35dc

SHA1
6700baa1fb1877129e79402dfe237f0b84221b69

SHA256
2e5fbfb7932b117a2f6093dc346cdee4a5702e39739d9c40d27bfd1580f6f0d7

SHA512
5dc19d7d6ab7670ded766f357e481328c8df4a96ac3c2a00194a5ccea8c34bca0e34cfea3d9d17934db384d302446be2fec9853438371561d70580665bffe121

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\System.Data.SQLite.dll

Filesize
256KB

MD5
dd3d6f00b1aba3f1d9338d9727ab5f17

SHA1
faf9364a7ab15f27c93a6e6f97fa025030c9dad7

SHA256
f0d4beab24e94e61f219df451d90dbba3d0f48539f9b6a448f91e0c94b4e80c4

SHA512
0794d850a133a98affe627e3023114b229b982e507d366895ece6a1ef99b42d708554c64b52f0f2ed63673e1c5aeea7e794085d45f0797159e21ba4efdf23cd7

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\builder.log

Filesize
22KB

MD5
0061a98407086fb3106b61fe5d0fbb27

SHA1
c5882467e947fa1cab30dd45fe337b23bce1712a

SHA256
054dbc3e14992bea750e1f366c16f6b0c861bc9db2617be91cbf7306fd25219a

SHA512
b4e0f10067b2a5b7865b404c63be1c93cbda482ed3d20e618ede411fe7f9bc177792d0ab0bb7c13730809f9630ba5160f485a38590096ba8cb8104ab189f2c9d

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\client.bin

Filesize
130KB

MD5
906a949e34472f99ba683eff21907231

SHA1
7c5a57af209597fa6c6bce7d1a8016b936d3b0b6

SHA256
9d3ea5af7dc261bf93c76f55d702a315aa22fb241e4207dc86cd834c262245c8

SHA512
29fd20ae7f1b8bac831c0bb85da4325a62e10961989e14299f5f50776c8f7e669cc1527bf2c3868bd7230e73ac110ba8b1f0491ac0f2923d79d7a2871c7c961d

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\plugins.bin

Filesize
240B

MD5
5e709fc806e8ba3385487699004f6d29

SHA1
2f32547ed5b9db3b33969fb4858945610aaeedb2

SHA256
9ecbf989dedf1403db953fb4e5955c9f63415cbe1f6492c3246bac405a4d036f

SHA512
a6706c9f76d837a7e0ab12e3c1c6d94fedde9dc52d4fecd02befd8850752155e2bf801cdf0488a98e49c50c4f0595a3fc4916950badba9bb83a5b7a35d3ffaab

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\public.bin

Filesize
17B

MD5
602d0cc4e7246f8a3b8a5ee9c7fabe30

SHA1
e9ecc8f782cf27ae68339b0cdfd0f79c69aa4afc

SHA256
6de29ee3e660fd3ab419f568fcf65f8418484eb43d5bfcdbfac5d456fd8488f2

SHA512
ccaf306f4e4b4ee7de6a62954bbebcb52d131da49912d2d6ad39d07012dffe66ec6109dfbd5fbfd166e98e7bcb2c564b75eda0a2eda2ee815f71db5986506f43

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\server.log

Filesize
103KB

MD5
ac6285562e5e3e4e98feb7fe8df884a4

SHA1
4b7fc4ea7c39b95efa7d4e1d68b9b3994c38683b

SHA256
51d9e422386e5e64eadc212bff06b33c2a163bfe355ce98d756ce00afd76ae2a

SHA512
6db244bf0e1948626e64b2b8636b9bf71fa4b2bbe5e7c4877a444da00bcc7964efa9f01f6e4c90963961a3a8bdb3bb8ff7d28660596e6f468b53313ab5e3453b

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\settings.bin

Filesize
280B

MD5
daa76574a834b950a015d191e410c400

SHA1
c93dae186bb23e7fc052b6cbc4626c58bc0f60a5

SHA256
c4c2bb97d9abf6e224897855a0f6699d8f886ca816811ea5bfeb8e71d72b7d4f

SHA512
9cd119d3f55a172036fd625738c3ebcd45b534255da36c208b594605eca32a58470ea4d0493026d160e062806d015cd878c44521e2450247eb5a8ae203a8fe6f

Download Submit
C:\Users\Admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\x86\SQLite.Interop.dll

Filesize
792KB

MD5
9b19dcee960dc215e64b1d82348707a9

SHA1
9c1e0f76673eb385787120e17404df179316ca2b

SHA256
3515f704b0012c01fc8be5b717905c0587b29255fc9eb7ad3f2b66a130691d38

SHA512
cc1304ab171feb2ac6df941f4b35aab8ce7b503f96b5539b366b39268cce8b21ea2fdbce16eff809a9a121a60a65ebbd0f59f75360800f541b9e5f93e729a55d

Download Submit
C:\Users\Admin\Desktop\a.exe

Filesize
130KB

MD5
b1f577672592e649dab87600cae52be9

SHA1
c60c8c184c3786f5fc0a03146606acddcced5278

SHA256
6d62a4cbe57a6d67749e9ab98f0a1a8e57a960db2f0658deff9f089e76309644

SHA512
d3e2f4a65c864e882c9124845bd45844e75572c1d46a496ef902cc5f02d0e0272d7d06c88d2b79c78089f1d5e85666e6744834dde3140fb399729bc55c51e596

Download Submit
C:\Windows\Installer\e61d1c9.msi

Filesize
188KB

MD5
0d00edf7e9ad7cfa74f32a524a54f117

SHA1
eea03c0439475a8e4e8e9a9b271faaa554539e18

SHA256
e55a6c147daab01c66aed5e6be0c990bbed0cb78f1c0898373713343ef8556cd

SHA512
0b6730fa8d484466a1ee2a9594572fa40fb8eea4ec70b5d67f5910436ee1d07c80a029cf1f8e488a251439ac1121fd0a76a726836e4cb72dd0fe531ce9692f6a

Download Submit
C:\Windows\Temp\{76F0F416-7290-47B1-860D-FA04D8662F50}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{C46D7EAC-FB91-49E8-B046-AF8CF16F0777}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{C46D7EAC-FB91-49E8-B046-AF8CF16F0777}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
ae0540106cfd901b091d3d241e5cb4b0

SHA1
97f93b6e00a5069155a52aa5551e381b6b4221eb

SHA256
8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c

SHA512
29bb486bfdd541ba6aed7a2543ff0eb66865af737a8fb79484fb77cb412c3b357c71c16addf232c759d3c20c5e18128df43c68d1cba23f1c363fd9e0b7188177

Download Submit
F:\GroupUndo.shtml

Filesize
3.6MB

MD5
7a678e4d46a92ca8a09f367ef7d26f87

SHA1
22030bd01ff8e53c98b86deab5bd9824bcf529d3

SHA256
bd570b0ca3160b03c2c42a41ea0d9e51be71376955239c51f7f54e09df2b3310

SHA512
f652d04ff0df9b5224825f2e87a104ab88b23f5ab4a2e7ba7a7933655bb677acb84da679f527cd2faead264e0bf941de710eb9bf7be3f36ff99bd45e38fb73ca

Download Submit
memory/856-7038-0x00000000007D0000-0x0000000000847000-memory.dmp

Filesize
476KB

Download
memory/1056-7037-0x00000000007D0000-0x0000000000847000-memory.dmp

Filesize
476KB

Download
memory/2460-12130-0x000000006F840000-0x000000006F879000-memory.dmp

Filesize
228KB

Download
memory/2460-11959-0x000000006F840000-0x000000006F879000-memory.dmp

Filesize
228KB

Download
memory/2460-11680-0x000000006F840000-0x000000006F879000-memory.dmp

Filesize
228KB

Download
memory/2544-12063-0x0000000001AD0000-0x0000000001AE0000-memory.dmp

Filesize
64KB

Download
memory/2544-12064-0x0000000001AD0000-0x0000000001AE0000-memory.dmp

Filesize
64KB

Download
memory/2544-12060-0x0000000001630000-0x0000000001640000-memory.dmp

Filesize
64KB

Download
memory/2544-760-0x00000000752D2000-0x00000000752D3000-memory.dmp

Filesize
4KB

Download
memory/2544-761-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/2544-762-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/2544-763-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/2544-12074-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-12073-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-12077-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-12067-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-12224-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/2544-838-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/2544-12069-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-839-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/2544-840-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/2544-841-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/2544-12076-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-769-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/2544-770-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/2544-12075-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-12065-0x0000000001AD0000-0x0000000001AE0000-memory.dmp

Filesize
64KB

Download
memory/2544-12062-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-12072-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-12066-0x0000000001AD0000-0x0000000001AE0000-memory.dmp

Filesize
64KB

Download
memory/2544-12061-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-837-0x00000000752D2000-0x00000000752D3000-memory.dmp

Filesize
4KB

Download
memory/2544-842-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/2544-12070-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-12071-0x0000000001A40000-0x0000000001A50000-memory.dmp

Filesize
64KB

Download
memory/2544-12068-0x0000000001AD0000-0x0000000001AE0000-memory.dmp

Filesize
64KB

Download
memory/2992-11683-0x0000016069A70000-0x0000016069A71000-memory.dmp

Filesize
4KB

Download
memory/2992-11688-0x0000016069A70000-0x0000016069A71000-memory.dmp

Filesize
4KB

Download
memory/2992-11682-0x0000016069A70000-0x0000016069A71000-memory.dmp

Filesize
4KB

Download
memory/2992-11689-0x0000016069A70000-0x0000016069A71000-memory.dmp

Filesize
4KB

Download
memory/2992-11692-0x0000016069A70000-0x0000016069A71000-memory.dmp

Filesize
4KB

Download
memory/2992-11691-0x0000016069A70000-0x0000016069A71000-memory.dmp

Filesize
4KB

Download
memory/2992-11681-0x0000016069A70000-0x0000016069A71000-memory.dmp

Filesize
4KB

Download
memory/2992-11687-0x0000016069A70000-0x0000016069A71000-memory.dmp

Filesize
4KB

Download
memory/2992-11690-0x0000016069A70000-0x0000016069A71000-memory.dmp

Filesize
4KB

Download
memory/4740-11572-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/4740-11570-0x000000000A4D0000-0x000000000A4E0000-memory.dmp

Filesize
64KB

Download
memory/4740-11569-0x0000000007620000-0x0000000007630000-memory.dmp

Filesize
64KB

Download
memory/4740-11567-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/4740-11565-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/4740-11598-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/4740-11574-0x000000000A4D0000-0x000000000A4E0000-memory.dmp

Filesize
64KB

Download
memory/4740-11573-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/4740-11568-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/4740-11571-0x000000000A4D0000-0x000000000A4E0000-memory.dmp

Filesize
64KB

Download
memory/4740-11566-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/5252-4293-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5252-4292-0x0000000000460000-0x0000000000529000-memory.dmp

Filesize
804KB

Download
memory/5252-4289-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5252-4290-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5420-4349-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/5420-4338-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/5420-4344-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/5420-4345-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/5420-4346-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/5420-4347-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/5420-4348-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/5420-4340-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/5420-4350-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/5420-4339-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/5508-11096-0x00007FF795020000-0x00007FF7954EE000-memory.dmp

Filesize
4.8MB

Download
memory/5508-11095-0x00007FF917F00000-0x00007FF918520000-memory.dmp

Filesize
6.1MB

Download
memory/5508-11097-0x00007FF795020000-0x00007FF7954EE000-memory.dmp

Filesize
4.8MB

Download
memory/5508-11098-0x00007FF8FC630000-0x00007FF8FC640000-memory.dmp

Filesize
64KB

Download
memory/6108-4301-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6108-4295-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6108-4294-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6652-7000-0x00000000007D0000-0x0000000000847000-memory.dmp

Filesize
476KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads