hxxp://google[.]com

Resubmissions

12/01/2025, 05:46

250112-gge8fayqaw 8

Analysis

max time kernel
510s
max time network
520s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
12/01/2025, 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

8^/10

steam defense_evasion discovery persistence phishing privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 14 IoCs

pid	Process
2868	SteamSetup.exe
5284	steamservice.exe
5472	steam.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
2888	check_for_64bit_visual_studio_2022_runtimes.exe
5896	VC_redist.x64.exe
3788	VC_redist.x64.exe
3848	VC_redist.x64.exe
860	obs64.exe
5608	obs-qsv-test.exe
412	get-graphics-offsets64.exe
5692	get-graphics-offsets32.exe
5676	obs-ffmpeg-mux.exe
6664	Steam.exe

Loads dropped DLL 64 IoCs

pid	Process
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
3788	VC_redist.x64.exe
5072	VC_redist.x64.exe
2632	regsvr32.exe
2140	regsvr32.exe
2760	regsvr32.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5af95fd8-a22e-458f-acee-c61bd787178e} = "\"C:\\ProgramData\\Package Cache\\{5af95fd8-a22e-458f-acee-c61bd787178e}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Detected potential entity reuse from brand STEAM.
phishing steam

Drops file in System32 directory 51 IoCs

description	ioc	Process
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-transitions\locale\vi-VN.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-filters\locale\gd-GB.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-x264\locale\oc-FR.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-nvenc\locale\sk-SK.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-outputs\locale\it-IT.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\win-wasapi\locale\bn-BD.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\image-source\locale\be-BY.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-nvenc\locale\pt-PT.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-outputs\locale\tl-PH.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\decklink\locale\sl-SI.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-x264\locale\cs-CZ.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\win-capture\locale\gl-ES.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-text\locale\pl-PL.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\obs-plugins\64bit\obs-webrtc.dll	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-x264\locale\pt-BR.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-outputs\locale\bn-BD.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-outputs\locale\fa-IR.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\vlc-video\locale\gd-GB.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\coreaudio-encoder\locale\gd-GB.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\decklink\locale\en-US.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-browser\locale\kab-KAB.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\obs-plugins\64bit\chrome_100_percent.pak	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-filters\luma_key_filter.effect	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-transitions\locale\he-IL.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\bin\64bit\Qt6Core.dll	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files (x86)\Steam\package\steamui_websrc_sounds_all.zip.vz.a2b25775b33d943e54c45d176558de379111ef5f_3220470	steam.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-browser\locale\uk-UA.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-text\locale\nl-NL.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-x264\locale\id-ID.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-x264\locale\ka-GE.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\win-wasapi\locale\kaa.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-text\locale\nn-NO.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-outputs\locale\el-GR.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\aja-output-ui\locale\vi-VN.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\coreaudio-encoder\locale\fi-FI.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\text-freetype2\locale\el-GR.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-browser\locale\th-TH.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-websocket\locale\de-DE.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\obs-plugins\64bit\locales\af.pak	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-studio\themes\Dark\unassigned.svg	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files (x86)\Steam\package\bins_win32.zip.vz.b309f2337257df69e130a2e74322fa9df74fe5e4_28602110	Steam.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\coreaudio-encoder\locale\az-AZ.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-filters\crop_filter.effect	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-transitions\luma_wipes\zigzag-h.png	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\obs-plugins\64bit\obs-webrtc.dll	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\aja\locale\kmr-TR.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt	SteamSetup.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\image-source\locale\nb-NO.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-websocket\locale\el-GR.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\obs-plugins\64bit\chrome_elf.dll	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\aja\locale\et-EE.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\rtmp-services\locale\fi-FI.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\obs-nvenc\locale\et-EE.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\decklink\locale\ro-RO.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\nv-filters\color.effect	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\win-capture\locale\si-LK.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-transitions\locale\sl-SI.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\text-freetype2\locale\he-IL.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-studio\locale\fi-FI.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\bin\64bit\imageformats\qwebp.dll	OBS-Studio-31.0.0-Windows-Installer.exe
File opened for modification	C:\Program Files\obs-studio\data\obs-plugins\text-freetype2\locale\en-GB.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\obs-x264\locale\cs-CZ.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\data\obs-plugins\win-dshow\locale\kaa.ini	OBS-Studio-31.0.0-Windows-Installer.exe
File created	C:\Program Files\obs-studio\obs-plugins\64bit\obs-nvenc.pdb	OBS-Studio-31.0.0-Windows-Installer.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSID4B4.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\~DF894125218A9BCCF8.TMP	msiexec.exe
File created	C:\Windows\Installer\e5bd020.msi	msiexec.exe
File created	C:\Windows\Installer\e5bd021.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2CE.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}	msiexec.exe
File created	C:\Windows\Installer\e5bd036.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF99CB184DD4F5368C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF710864F24C75E512.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF16752A8D76A2D313.TMP	msiexec.exe
File created	C:\Windows\Installer\e5bd00e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bd00e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA52337234C5759B8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF618580BA2208218A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE004F8570175B3D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID580.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID202.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7827FC1FA1C7BC73.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bd021.msi	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\OBS-Studio-31.0.0-Windows-Installer.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	get-graphics-offsets32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OBS-Studio-31.0.0-Windows-Installer.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	obs64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	obs64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	obs64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0\Servicing_Key	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.40.33810"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}\ = "OBS Virtual Camera"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\steam\URL Protocol	steamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Version = "14.40.33810.0"	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}\InprocServer32\ = "C:\\Program Files\\obs-studio\\data\\obs-plugins\\win-dshow\\obs-virtualcam-module64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4BB3B8BD01A15F4197B6AF4AF3CE17A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}v14.40.33810\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4BB3B8BD01A15F4197B6AF4AF3CE17A\VC_Runtime_Minimum	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}v14.40.33810\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\F84DEC95EFBEC084A883CF70C9B2CEF0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33810"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0\VC_Runtime_Additional	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}\FriendlyName = "OBS Virtual Camera"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}v14.40.33810\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\ = "{5af95fd8-a22e-458f-acee-c61bd787178e}"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{A3FCE0F5-3493-419F-958A-ABA1250EC20B}	regsvr32.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	steam.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\OBS-Studio-31.0.0-Windows-Installer.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
860	obs64.exe
7812	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
2868	SteamSetup.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe
1992	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5912	OBS-Studio-31.0.0-Windows-Installer.exe
860	obs64.exe
7812	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeDebugPrivilege	4892	firefox.exe
Token: SeDebugPrivilege	4892	firefox.exe
Token: SeDebugPrivilege	4892	firefox.exe
Token: SeDebugPrivilege	4892	firefox.exe
Token: SeDebugPrivilege	4892	firefox.exe
Token: SeDebugPrivilege	2868	SteamSetup.exe
Token: SeDebugPrivilege	2868	SteamSetup.exe
Token: SeDebugPrivilege	2868	SteamSetup.exe
Token: SeDebugPrivilege	2868	SteamSetup.exe
Token: SeDebugPrivilege	2868	SteamSetup.exe
Token: SeSecurityPrivilege	5284	steamservice.exe
Token: SeSecurityPrivilege	5284	steamservice.exe
Token: SeBackupPrivilege	3736	vssvc.exe
Token: SeRestorePrivilege	3736	vssvc.exe
Token: SeAuditPrivilege	3736	vssvc.exe
Token: SeShutdownPrivilege	3848	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	3848	VC_redist.x64.exe
Token: SeSecurityPrivilege	1992	msiexec.exe
Token: SeCreateTokenPrivilege	3848	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	3848	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	3848	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	3848	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	3848	VC_redist.x64.exe
Token: SeTcbPrivilege	3848	VC_redist.x64.exe
Token: SeSecurityPrivilege	3848	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	3848	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	3848	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	3848	VC_redist.x64.exe
Token: SeSystemtimePrivilege	3848	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	3848	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	3848	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	3848	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	3848	VC_redist.x64.exe
Token: SeBackupPrivilege	3848	VC_redist.x64.exe
Token: SeRestorePrivilege	3848	VC_redist.x64.exe
Token: SeShutdownPrivilege	3848	VC_redist.x64.exe
Token: SeDebugPrivilege	3848	VC_redist.x64.exe
Token: SeAuditPrivilege	3848	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	3848	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	3848	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	3848	VC_redist.x64.exe
Token: SeUndockPrivilege	3848	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	3848	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	3848	VC_redist.x64.exe
Token: SeManageVolumePrivilege	3848	VC_redist.x64.exe
Token: SeImpersonatePrivilege	3848	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	3848	VC_redist.x64.exe
Token: SeRestorePrivilege	1992	msiexec.exe
Token: SeTakeOwnershipPrivilege	1992	msiexec.exe
Token: SeRestorePrivilege	1992	msiexec.exe
Token: SeTakeOwnershipPrivilege	1992	msiexec.exe
Token: SeRestorePrivilege	1992	msiexec.exe
Token: SeTakeOwnershipPrivilege	1992	msiexec.exe
Token: SeRestorePrivilege	1992	msiexec.exe
Token: SeTakeOwnershipPrivilege	1992	msiexec.exe
Token: SeRestorePrivilege	1992	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
860	obs64.exe
860	obs64.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4892	firefox.exe
4892	firefox.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
860	obs64.exe
7812	vlc.exe
7812	vlc.exe
7812	vlc.exe
7812	vlc.exe
7812	vlc.exe
7812	vlc.exe
7812	vlc.exe
7812	vlc.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
2868	SteamSetup.exe
5284	steamservice.exe
3412	MiniSearchHost.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
5912	OBS-Studio-31.0.0-Windows-Installer.exe
5896	VC_redist.x64.exe
3788	VC_redist.x64.exe
3848	VC_redist.x64.exe
4940	VC_redist.x64.exe
5072	VC_redist.x64.exe
1164	VC_redist.x64.exe
412	get-graphics-offsets64.exe
5692	get-graphics-offsets32.exe
860	obs64.exe
860	obs64.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
7812	vlc.exe
7812	vlc.exe
7812	vlc.exe
7812	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 1656	4948	chrome.exe	77
PID 4948 wrote to memory of 1656	4948	chrome.exe	77
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 1100	4948	chrome.exe	78
PID 4948 wrote to memory of 5084	4948	chrome.exe	79
PID 4948 wrote to memory of 5084	4948	chrome.exe	79
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80
PID 4948 wrote to memory of 4612	4948	chrome.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89561cc40,0x7ff89561cc4c,0x7ff89561cc58
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,15930391788434162467,17579519226969758415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1716,i,15930391788434162467,17579519226969758415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1972 /prefetch:3
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,15930391788434162467,17579519226969758415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2996,i,15930391788434162467,17579519226969758415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3008 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3000,i,15930391788434162467,17579519226969758415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3708,i,15930391788434162467,17579519226969758415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2852

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:784

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4964
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1840 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bbf998c-683c-465e-8241-e38f46f40e60} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" gpu
    3⤵
    PID:2012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2372 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6319f86e-2d98-426f-b789-4a1a416441fe} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" socket
    3⤵
    - Checks processor information in registry
    PID:2948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2860 -childID 1 -isForBrowser -prefsHandle 2840 -prefMapHandle 2848 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b551e560-73ff-4335-9470-23d0e9476b8f} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:3136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2796 -childID 2 -isForBrowser -prefsHandle 3652 -prefMapHandle 3684 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f108af12-fcc5-423b-8067-48ce37aa80d8} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4636 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4656 -prefMapHandle 4652 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f22235f2-2008-4198-89fb-b0f38291b3de} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" utility
    3⤵
    - Checks processor information in registry
    PID:2576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 3 -isForBrowser -prefsHandle 5560 -prefMapHandle 5556 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adddb381-0e69-4b21-8f97-3654d5fbe4b2} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:6000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5532 -childID 4 -isForBrowser -prefsHandle 5572 -prefMapHandle 5568 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8bde6be-45d1-499f-b34b-50fcee87c507} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:6008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5532 -childID 5 -isForBrowser -prefsHandle 5924 -prefMapHandle 5920 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {949b463d-6b43-4ad7-a678-121f99af4264} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:6024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6232 -childID 6 -isForBrowser -prefsHandle 6224 -prefMapHandle 6220 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0994b039-d618-4d98-9b01-55fd3379e9a8} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6360 -parentBuildID 20240401114208 -prefsHandle 6220 -prefMapHandle 6488 -prefsLen 33608 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d71f98e-4a1a-4f8e-829a-5ea81ea17fa1} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" rdd
    3⤵
    PID:1524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6568 -childID 7 -isForBrowser -prefsHandle 6476 -prefMapHandle 4020 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9813bf6-3ef6-4d8f-aedd-45335d8be2c5} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:1008
- - C:\Users\Admin\Downloads\SteamSetup.exe
    "C:\Users\Admin\Downloads\SteamSetup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Program Files (x86)\Steam\bin\steamservice.exe
      "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3692 -childID 8 -isForBrowser -prefsHandle 7600 -prefMapHandle 4364 -prefsLen 28084 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71b9e2a3-d6a9-457c-be70-61a8059cfaab} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:5744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8184 -childID 9 -isForBrowser -prefsHandle 8056 -prefMapHandle 8080 -prefsLen 28084 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {915b7909-044d-4b31-8563-b3670ac7eb67} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:3028
- - C:\Users\Admin\Downloads\OBS-Studio-31.0.0-Windows-Installer.exe
    "C:\Users\Admin\Downloads\OBS-Studio-31.0.0-Windows-Installer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
      C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
      4⤵
      Executes dropped EXE
      PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\VC_redist.x64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\VC_redist.x64.exe" /quiet /norestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5896
    - - C:\Windows\Temp\{929830AA-916E-4CF3-A12A-F08C91F5685B}\.cr\VC_redist.x64.exe
        
        "C:\Windows\Temp\{929830AA-916E-4CF3-A12A-F08C91F5685B}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\VC_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /quiet /norestart
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3788
      - C:\Windows\Temp\{9BB46318-FEB3-453F-A497-9F5BD04140E3}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{9BB46318-FEB3-453F-A497-9F5BD04140E3}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{835ACF8E-80B6-472A-92FA-67BFF10C36F2} {BE7DEF94-2D79-4482-9901-0A4048BC69E6} 3788
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3848
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{C24C3204-5A7B-4986-9FC1-AC9C385DAF49} {77F45977-687A-4F5B-B588-B79720AA793B} 3848
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4940
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=580 -burn.filehandle.self=596 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{C24C3204-5A7B-4986-9FC1-AC9C385DAF49} {77F45977-687A-4F5B-B588-B79720AA793B} 3848
        8⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5072
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D9EEA59F-DC93-4A26-AC7A-B0365AD043C7} {F1222C45-FFA8-4DE0-BDA7-E317ACAEF20B} 5072
        9⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1164
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module32.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2140
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2632
    - - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2760
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio\OBS Studio (64bit).lnk"
      4⤵
      PID:3596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7464 -childID 10 -isForBrowser -prefsHandle 7448 -prefMapHandle 7460 -prefsLen 28084 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebbb708e-33a3-4307-9a33-4cf68c5c8fe1} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8432 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 4932 -prefMapHandle 8260 -prefsLen 33648 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0baa6d01-321c-4b4c-8f4b-45a11afe9bcc} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" utility
    3⤵
    - Checks processor information in registry
    PID:5608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8796 -childID 11 -isForBrowser -prefsHandle 8808 -prefMapHandle 8792 -prefsLen 28084 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee8f6588-b4b2-4fb1-8928-38ba3268d4f2} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:5208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1704 -childID 12 -isForBrowser -prefsHandle 6600 -prefMapHandle 7912 -prefsLen 28084 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95a98157-a08b-4186-aead-13095ae0ebcb} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:8092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5360 -childID 13 -isForBrowser -prefsHandle 7564 -prefMapHandle 7916 -prefsLen 28084 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d954903c-fde3-4391-921f-634b68ee60ee} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:8108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8680 -childID 14 -isForBrowser -prefsHandle 7752 -prefMapHandle 6636 -prefsLen 28134 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8020d472-cf59-4871-9e14-32ef73ae6b9a} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" tab
    3⤵
    PID:1784

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:5896

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
PID:5472

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3412

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4996
- C:\Program Files\obs-studio\bin\64bit\obs64.exe
  "C:\Program Files\obs-studio\bin\64bit\obs64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:860
- - C:\Program Files\obs-studio\bin\64bit\obs-qsv-test.exe
    "C:/Program Files/obs-studio/bin/64bit/obs-qsv-test.exe" 4fa7 50db
    3⤵
    - Executes dropped EXE
    PID:5608
- - C:\Program Files\obs-studio\data\obs-plugins\win-capture\get-graphics-offsets64.exe
    "../../data/obs-plugins/win-capture/get-graphics-offsets64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:412
- - C:\Program Files\obs-studio\data\obs-plugins\win-capture\get-graphics-offsets32.exe
    "../../data/obs-plugins/win-capture/get-graphics-offsets32.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5692
- - C:\Program Files\obs-studio\bin\64bit\obs-ffmpeg-mux.exe
    "C:/Program Files/obs-studio/bin/64bit/obs-ffmpeg-mux.exe" "C:/Users/Admin/Videos/2025-01-12 05-52-23.mkv" 1 1 h264 2500 1280 720 1 1 1 1 1 0 30 1 0 aac simple_aac 160 48000 1024 2 "" ""
    3⤵
    - Executes dropped EXE
    PID:5676

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D0
1⤵
PID:3996

C:\Program Files (x86)\Steam\Steam.exe
"C:\Program Files (x86)\Steam\Steam.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:6664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3588

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Videos\2025-01-12 05-52-23.mkv"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:7812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5bd013.rbs

Filesize
19KB

MD5
f7fc14144f8e93ce393482a459e771b2

SHA1
ac44c02cda52718f002d09a865d52f3e4523aa84

SHA256
eaf0196d2f27ee823e8b02f60af79d9cd7b250829ded9811a64ad0017364f524

SHA512
58405039e91b75447391452471bc353c37e77a043cb30ae0acb7cd50386487a7a0ddf3eb5ff3df6f9462f2b2570767c908a06268984f0484a3d0f4c3d61d1961

Download Submit
C:\Config.Msi\e5bd01f.rbs

Filesize
19KB

MD5
2b5fa1d70524bce681134a04bd7041c8

SHA1
bfa880e1fab069c9a6b59cc984b089b961a71b77

SHA256
9ca59574787d2b1e3b94e9dbb83d6dd34d63238d8b7b892059e1db3a0ccda28c

SHA512
8b5a8123ac9cde6e4968827355a27f20537dfb9042949b6655f0161dd5d9f078355f828aeb6a6e8b82bf442a03ed9a08119b5219672924ef1fd667e068630aee

Download Submit
C:\Config.Msi\e5bd026.rbs

Filesize
21KB

MD5
b46e36981767a7bb332599e27fd23cd3

SHA1
f98238809aedb8dee28421762187ec11c9e7018c

SHA256
9dfaa6f94afd9c4b1a65e14af630b7e5f6af2e5b090ddbce0314fe986655438c

SHA512
ab6f1f7466a28b7f1bbd288eb7715b789b5b571ea58b8a543818e9b59c4236cdda9964a19359ea96a884d3353a1019cc64296b070c7e93db5654b7ba73f3645a

Download Submit
C:\Config.Msi\e5bd035.rbs

Filesize
21KB

MD5
5f88bea946888704bc1255518da23257

SHA1
2c5e5c438a7803eb4c26ac8f36b18733b5152a13

SHA256
380c247a0cda243e53a3ef59902c35a78ed1ef4e9ddc728ba1677353c132b42e

SHA512
679fa440e3dd331f6b32315d442ec00343c7b57262029b78f1cb5b7001ab4ed6b73cb457a0d5676f42151c35181bc3ef559d2400f86eda4b90e43ed996a30136

Download Submit
C:\Program Files (x86)\Steam\Steam.exe

Filesize
4.2MB

MD5
33bcb1c8975a4063a134a72803e0ca16

SHA1
ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

SHA256
12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

SHA512
13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

Download Submit
C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
2.5MB

MD5
ba0ea9249da4ab8f62432617489ae5a6

SHA1
d8873c5dcb6e128c39cf0c423b502821343659a7

SHA256
ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

SHA512
52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Filesize
4KB

MD5
0340d1a0bbdb8f3017d2326f4e351e0a

SHA1
90d078e9f732794db5b0ffeb781a1f2ed2966139

SHA256
0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

SHA512
9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Filesize
6KB

MD5
4c81277a127e3d65fb5065f518ffe9c2

SHA1
253264b9b56e5bac0714d5be6cade09ae74c2a3a

SHA256
76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

SHA512
be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Filesize
4KB

MD5
2158881817b9163bf0fd4724d549aed4

SHA1
c500f2e8f47a11129114ee4f19524aee8fecc502

SHA256
650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

SHA512
f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Filesize
4KB

MD5
03b664bd98485425c21cdf83bc358703

SHA1
0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

SHA256
fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

SHA512
4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Filesize
4KB

MD5
31a29061e51e245f74bb26d103c666ad

SHA1
271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

SHA256
56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

SHA512
f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
da6cd2483ad8a21e8356e63d036df55b

SHA1
0e808a400facec559e6fbab960a7bdfaab4c6b04

SHA256
ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

SHA512
06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Filesize
4KB

MD5
9e62fc923c65bfc3f40aaf6ec4fd1010

SHA1
8f76faff18bd64696683c2a7a04d16aac1ef7e61

SHA256
8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

SHA512
c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Filesize
4KB

MD5
10c429eb58b4274af6b6ef08f376d46c

SHA1
af1e049ddb9f875c609b0f9a38651fc1867b50d3

SHA256
a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

SHA512
d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Filesize
4KB

MD5
5c026fd6072a7c5cf31c75818cddedec

SHA1
341aa1df1d034e6f0a7dff88d37c9f11a716cae6

SHA256
0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

SHA512
f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Filesize
6KB

MD5
189ba063d1481528cbd6e0c4afc3abaa

SHA1
40bdd169fcc59928c69eea74fd7e057096b33092

SHA256
c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

SHA512
ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Filesize
4KB

MD5
18aaaf5ffcdd21b1b34291e812d83063

SHA1
aa9c7ae8d51e947582db493f0fd1d9941880429f

SHA256
1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

SHA512
4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

Filesize
4KB

MD5
1514d082b672b372cdfb8dd85c3437f1

SHA1
336a01192edb76ae6501d6974b3b6f0c05ea223a

SHA256
3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4

SHA512
4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

Filesize
4KB

MD5
8958371646901eac40807eeb2f346382

SHA1
55fb07b48a3e354f7556d7edb75144635a850903

SHA256
b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

SHA512
14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

Filesize
5KB

MD5
7e1d15fc9ba66a868c5c6cb1c2822f83

SHA1
bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

SHA256
fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

SHA512
0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

Filesize
4KB

MD5
202b825d0ef72096b82db255c4e747fa

SHA1
3a3265e5bbaa1d1b774195a3858f29cea75c9e75

SHA256
3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314

SHA512
e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

Filesize
4KB

MD5
7913f3f33839e3af9e10455df69866c2

SHA1
15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

SHA256
05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

SHA512
534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

Filesize
4KB

MD5
58e0fcbee3cca4ef61b97928cfe89535

SHA1
1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b

SHA256
c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425

SHA512
99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

Filesize
4KB

MD5
9b0b0e82f753cc115d87c7199885ad1b

SHA1
5743a4ab58684c1f154f84895d87f000b4e98021

SHA256
0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

SHA512
b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

Filesize
4KB

MD5
eb8926608c5933f05a3f0090e551b15d

SHA1
a1012904d440c0e74dad336eac8793ac110f78f8

SHA256
2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

SHA512
9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

Filesize
4KB

MD5
6367f43ea3780c4ee166454f5936b1a8

SHA1
027a2c24c8320458c49cd78053f586cb4d94ee6f

SHA256
f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998

SHA512
31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

Filesize
6KB

MD5
e04ad6c236b6c61fc53e2cb57ced87e8

SHA1
e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

SHA256
08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

SHA512
0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

Filesize
4KB

MD5
56dcf7b68f70826262a6ffaffe6b1c49

SHA1
12e4272ba0e4eabc610670cdc6941f942da1eb6a

SHA256
948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

SHA512
c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

Filesize
4KB

MD5
66456d2b1085446a9f2dbd9e4632754b

SHA1
8da6248b57e5c2970d853b8d21373772a34b1c28

SHA256
c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4

SHA512
196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

Filesize
4KB

MD5
b2248784049e1af0c690be2af13a4ef3

SHA1
aec7461fa46b7f6d00ff308aa9d19c39b934c595

SHA256
4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

SHA512
f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

Filesize
4KB

MD5
194a73f900a3283da4caa6c09fefcb08

SHA1
a7a8005ca77b9f5d9791cb66fcdf6579763b2abb

SHA256
5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6

SHA512
25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

Filesize
7KB

MD5
53f7e8ac1affb04bf132c2ca818eb01e

SHA1
bffc3e111761e4dc514c6398a07ffce8555697f6

SHA256
488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83

SHA512
c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

Filesize
4KB

MD5
29f9a5ab4adfae371bf980b82de2cb57

SHA1
6f7ef52a09b99868dd7230f513630ffe473eddf8

SHA256
711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

SHA512
543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

Filesize
6KB

MD5
cadd7a2f359b22580bdd6281ea23744d

SHA1
e82e790a7561d0908aee8e3b1af97823e147f88b

SHA256
3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

SHA512
53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

Filesize
4KB

MD5
f350c8747d77777f456037184af9212c

SHA1
753d8c260b852a299df76c4f215b0d2215f6a723

SHA256
15b6a564e05857a3d2fd6eec85a5a30c491a7553d15ffc025156b3665b919185

SHA512
efb86809a0b357b4fcd3ba2770c97d225d0f4d9fb7430c515e847c3dd77ee109def4bef11b650b9773c17050e618008fc03377638c1db3393ac780b5b0bc31b2

Download Submit
C:\Program Files\obs-studio\bin\64bit\obs64.exe

Filesize
4.9MB

MD5
ff32f75a0c74f90b0d3417f65448b8d0

SHA1
53a71f037b5521a02b84e236e5bbba3f71a10ec4

SHA256
f670d51a74bb1aa6ee7b77c7c9dab42e4806b4025d5f35fb29c94425455d572b

SHA512
96dd7a3f81fc985a804b3dfb35e0a4971426dc9b6fc2a29f3e46bcaaff4026f96080777f93e1d0d77e938193960da8b98868b30b88d40c6f6ff04ceedf78b566

Download Submit
C:\Program Files\obs-studio\data\obs-plugins\nv-filters\locale\en-GB.ini

Filesize
1B

MD5
01abfc750a0c942167651c40d088531d

SHA1
d08f88df745fa7950b104e4a707a31cfce7b5841

SHA256
334359b90efed75da5f0ada1d5e6b256f4a6bd0aee7eb39c0f90182a021ffc8b

SHA512
d369286ac86b60fa920f6464d26becacd9f4c8bd885b783407cdcaa74fafd45a8b56b364b63f6256c3ceef26278a1c7799d4243a8149b5ede5ce1d890b5c7236

Download Submit
C:\Program Files\obs-studio\data\obs-plugins\obs-filters\color.effect

Filesize
3KB

MD5
4acb6776b331a70950ed97371ecc5e63

SHA1
356bd8a1a32f99ed9ed443451a1373e3f2a5243a

SHA256
868404f54ec1c0b4771dee7a139a40baf2f9e5fffa43baf3fc8e60fcd03023a3

SHA512
a5e483a85192db013aef81c2dda70a8ab8691140bad3b3b624a5ec8ae0e5ac215b4b02606712da825719086556ef11df5f41150138a70bc856adb23352dba126

Download Submit
C:\Program Files\obs-studio\data\obs-plugins\obs-qsv11\locale\oc-FR.ini

Filesize
18B

MD5
0ebd4c9db48f04f789e6254a92af4b97

SHA1
45f98976d001a97e4b18489cb73cca2aadcb1cf3

SHA256
54550f5495ca78de8ab1b4d32ddec042077823cb5654808e9f9f003857125450

SHA512
9b3ca441b80f23ff89094175bca2a2647d76e38277830420e933935a631a82ee010743410b632078750f4272cdc6b3362a56649ce9694a2c712367e0ab7f0e21

Download Submit
C:\Program Files\obs-studio\data\obs-plugins\win-capture\schema\package-schema.json

Filesize
1KB

MD5
cfc8555dce7c954555346ec0ef15fae8

SHA1
da1983d90d8bbbd3eb778ebb92d45427f1b35f41

SHA256
524437addbda00d3a64413b639847211054905a959786a4a5609fcbbb1f101f5

SHA512
4add0e8632568a665d640f63ec9eb992a3f50a21675883d48d26e784caf8b25c4bf6de706c2ab705fdad325adb02cd681779eed632976dfb042caa88a16d390d

Download Submit
C:\Program Files\obs-studio\data\obs-studio\themes\Dark\media\media_pause.svg

Filesize
526B

MD5
f26adafdd9d123f489f874c9a1b4bcbf

SHA1
228f6132d7e7abcf77fcd49409f07e68b25d4adb

SHA256
3a8ebca48196921a623b652c07344507f14fbc265a125ead876e89b28ad946fc

SHA512
3ea1adbc6d327e09418a0476971bbb4868effb171045cc0743d21dbed3535eea275518bf9aef9eecf33e9653b19ddb751d3826d53907690672583243e64c13bf

Download Submit
C:\Program Files\obs-studio\data\obs-studio\themes\Dark\sources\media.svg

Filesize
558B

MD5
7de24f4b717974d92d44505a76bfbf14

SHA1
7695bf5a0dcf4847644ebceff8564f0e5c214dd8

SHA256
0c3127f56d6c3bfab49108c5d7f2e405f7e3c80f8ea9f5c407fa0902f02d919f

SHA512
75023a1588843a5a91c12787cea903b42da052a06106050885160dcf90386cdf8693fc0323d60802c767b524c7d4e83083815cb2a786aa6c082e88bf12c45640

Download Submit
C:\Program Files\obs-studio\data\obs-studio\themes\Light\mute.svg

Filesize
1KB

MD5
a98eb26acbfc095a09a54d004bb39d7f

SHA1
2254bb0d579be6555c85d5d61818b95c6306a597

SHA256
ab6ea7c4f98008a19662c171a03fffd0cba96a7abca34896c67de841e81727e1

SHA512
fb11beabd774e87911ad38975d190f829e48dd963074c41f610842738d9938865dd809846a4e75ee9e717be67e393d612019beedfcce42bfdda67bf19a975c50

Download Submit
C:\Program Files\obs-studio\data\obs-studio\themes\Light\sources\media.svg

Filesize
558B

MD5
782275b15439d90e21c0595b28e1f251

SHA1
a40a166994402a2fe2e782864c3612dbf2619179

SHA256
16440c1cf957bf20c8cb01d2a490ff46d4f2812376275d35051b659b62ac888d

SHA512
704da362efe3ee13771d589d1c3a94a8a85836d5c26d35aa76d02f502f683417e162df4067fb7fc26762c858d708b921a5fcf6c80f6505ef90dfa68c102af738

Download Submit
C:\Program Files\obs-studio\data\obs-studio\themes\Rachni\checkbox_checked_focus.png

Filesize
147B

MD5
0ca13c84736f193c4ddc36408b63eb79

SHA1
daf222b1b08d7f2645fdc2e25e63be2aa50e9b79

SHA256
9b7da86b40e8fe9da37ba2a4337c9bce14b07153a9722dd3de7772c1c5933ded

SHA512
1f95694e920b1be5a7d9a4c4f7eabccde8326965d8b1e3211085c67e84229f76300aed6ae29e2d79e817857cfe7608919233057fad6fda3bf515c59f3604099c

Download Submit
C:\Program Files\obs-studio\data\obs-studio\themes\Rachni\sizegrip.png

Filesize
107B

MD5
3cc9de00b77ffe788eb826b8608cad0c

SHA1
d7ea0e97469cd971b8e00ee564a540f24a9f1752

SHA256
31582f8295152ee22f44910556be5c2280934214a0ea3db73897a4c93cef34e3

SHA512
ed0f66eb14fd12f5a6e52825d209cf74e48be44933e2702f790ad0024b31d2f4c998d87e04f14fc80fb56bc6b2a257907a2a143334e79ae0cbc07e264ebb0c96

Download Submit
C:\ProgramData\obs-studio-hook\graphics-hook32.dll

Filesize
232KB

MD5
9ad7613871b9ea354e594279d0dd5cd7

SHA1
cdcd39b360749ee5ff53f6b81622551feae5bf5f

SHA256
2862c90e59e0544320f033d52c178b3adf2275932058bc9d342ca73b00a457aa

SHA512
395d459714687b0266c4787b4013f63acffdfaf2325342f0d9d458e1645e2c43e2c47c1fb1bff21442e38cec085a375c4ee159fe96a16391cc4f6b26746b7c5c

Download Submit
C:\ProgramData\obs-studio\shader-cache\1ab7aa1b854459a7.v2

Filesize
840B

MD5
0b2301660cbb980468bf1b8b4eda87c7

SHA1
ef3c7bf64ca477dad586d5ca3aa16318b27f4e72

SHA256
d913ce5b4ace04b97bb8f05bf49d777a5c231ce0737dd5a63bcd3215d8c63bd9

SHA512
b392bf58b9da599c8896f233c4a01e61e23546daef235d279b771a8849ea718a13b457b768b7196e3800ab82d24b946e066d334299142551bf3565d96673cf80

Download Submit
C:\ProgramData\obs-studio\shader-cache\4545d6ee7b176b7d.v2

Filesize
964B

MD5
925008d85689f03f9c2c19b2a58864ef

SHA1
9707491fe67342b0428924976a5d4d4cca787fef

SHA256
b03ed79f9d040f865ac250b25a7a99ccebf244c5bb9d2bae4287f025bae8edc1

SHA512
097e0733c12a57d148ffbdc844f9444026fd13359a52d8fe73d172e8ac8479d4e23dc1a00be3b04f2880e2f094a7a322fcafc3ba00603ee7f89c586a75cf84fe

Download Submit
C:\ProgramData\obs-studio\shader-cache\62281a72182c4ba6.v2

Filesize
908B

MD5
a09b098bf807333abd23734e543dc2e5

SHA1
972a560bbdcad956b41b96d5a5d98b74b3744aeb

SHA256
5e7044f39d34e7f45770264f93647c2701bed73c904f8f233dc5ea94870b4403

SHA512
bfced55e2eeeff8f5393a84b23ca0bec0391411a1b649be153cc1563c1e736e3e124b502fb6df18c5bab5ccb9f6dbd6369cbb5251dd03acfce8078ee96d8eb05

Download Submit
C:\ProgramData\obs-studio\shader-cache\6a755cdc9e6092ae.v2

Filesize
840B

MD5
a301b07b443e54d2763c6cdaf88ffcef

SHA1
f2da06b9dd608eb5786ad2fbbb42aa77f351c39e

SHA256
fccbe79d93005236718ff168a3ba2267d228b4f93cbc848a95eda3b8482b6697

SHA512
db51188f09eb3b13baeb726f80f06dbe36d1ae8c960aa75a7f88eedf42e67e286f3e7f33034fbe9a16c7cd339058dc4782e58467b0c033e94073bd326dcbebf9

Download Submit
C:\ProgramData\obs-studio\shader-cache\7a6e3fecabdd460d.v2

Filesize
888B

MD5
b1695633020889910efc1cd4fb9b02a0

SHA1
09eb2ec232b08bb092fe2cfcee795ee57275f93f

SHA256
3b625049381ef7d97538364c28efbbde8e5eb28f010f077afa36ef5a74778333

SHA512
2b4be7f4c6c8182a119d440204505e1022d017d9199933a9162a35ad5b2092efee29be847caddaf7e73d310a320f69481381a4527a59a9847ded132fc42946bc

Download Submit
C:\ProgramData\obs-studio\shader-cache\7f0084f9c4106e16.v2

Filesize
1KB

MD5
15d39c0e4271b5ccd51d06dd38ea848c

SHA1
beb07872ec6f978633df7a92ad12e239a41f0587

SHA256
ea9109f443a204812899fc727c2e3e779a9114136db0afd729deec2e817a2db0

SHA512
16ab1fb86f5ac7dd412c1e3f87668a8ced4881a578739077ef74f68869e3be4d802fad72232aed270be0be25712de494473b2f883a94acccd1dfa7342a83bf7a

Download Submit
C:\ProgramData\obs-studio\shader-cache\8d390f4ad08d5c53.v2

Filesize
936B

MD5
edac8cc11ee6b2f4eedf0767d9bd1a25

SHA1
816ae2f8507a2dd7f87da5645e5a28f144811539

SHA256
442e3643bab4f98c14485a18e239d2580f18989831f9cadd19129e3df30789e2

SHA512
666d64b4caa7229b888bbffc58db1995c791c8a6b1518fca195f466b6e5f6062f5928f897ed5ff14b02518df6fc078dd45662bbddb5d5805a6cf34d58e4026f5

Download Submit
C:\ProgramData\obs-studio\shader-cache\9ea4a251d7aa3c18.v2

Filesize
624B

MD5
e8f1aac1454a9411ecfd28bdf322b910

SHA1
12ca860dff45487c176212e2e4db4ced5112991e

SHA256
6c40664272501dab61c1507f87b612d40819510781d05971735443cef8ebc95f

SHA512
677dfc0140b6a75fbe9ae6e2c59dc0f305c8d5d7e34f858caad917893614c95c7eed8ddfb280d2f913117e3b02dc6613e369550ba38f97102fd6c4b197930254

Download Submit
C:\ProgramData\obs-studio\shader-cache\cd9cfd09db70c3cd.v2

Filesize
960B

MD5
a36fa067d5417109e7c2a79fa47109e8

SHA1
2cd916c1a5c0a21b021ebc424ab316be4cbcb499

SHA256
c0d87fc26b604a942bb03b1349794cb397ababfb1a14eb09fd8ea1de5144aed2

SHA512
d826b76826b10f675fd40fc36ebf3aaa8b5b69c41090282b491a7ffa77b853db80a3473f6032bd1afe406e5272d671585a93d0bca29d7cf9029ab50a140cd1cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
a935ce1415ad605b6a5f61071370a3c1

SHA1
60c7f24aa8ea687c87dcd0a95c326dab7a8984b0

SHA256
d85b37c12cb65ac8851b3f93c05d5e7ff5c44a2c3e244b22b0e0d324a69186d0

SHA512
716cdf5e099542924bdcbcb24ceded33a5996137da667c1d4bf25fe8afbf5031648ad6ccaa4134bac22314c919ffc252c0ad515ad2a001d8ef22eebcea9f44b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
78eb3da7c51b7ccf9205665eabcce6d1

SHA1
28f93380bde53b040832860119c1cd1e5235459f

SHA256
2cdd2b0275a0b41493729f8091e87f706ad7a984e5349d19ec4abadf398195ef

SHA512
9ea748eb663c0927a53eee0b44598768895cfefaf611ff3478c9223380c801c5d64d704c340cd997d83ddd6992c766d1c9a510a98b71ee99c3a5e30a6ef34573

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
bef2de515c363eb3f84e4fb5ffd863b9

SHA1
99af7073c3208951c2ec449a679ddc45628757bb

SHA256
e88c8e4986230d168902512c930b1ad78ffc0e82212ada963acdeb6c7c950913

SHA512
25a6abad68b77702d5ea4e693bc816bca967920058d502c2404101a96bc1b46915212a8d0882e449c761a4e220561f8c82b07c49c2720b4c004eb433866094e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
e03424e3369d69de6ede5b5944e44505

SHA1
051cf07b0cce9706e8d4c5e7bbf34e8446b21d15

SHA256
ca2b8eae0994d59fff9cb1b02a75c1993b581567de302258e13c3e3315dc40fb

SHA512
3d9daf58b01000da6f707198fa75342d7ba10201bd17ee036e675e2b6341f3e79e5cd8f8753dab883bfef835eec645c1730b5b4c1ad8ede41598741389440541

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dfn8djy7.default-release\activity-stream.discovery_stream.json

Filesize
27KB

MD5
8b457bcee746a775536191fa57a93096

SHA1
3acf50e6f6266a52a68bb7c69b0ebfbf511ab163

SHA256
1944628ab01f98a22c8153b7a73bbc58c5db8f53b4874d4750cfaf98cecb722a

SHA512
b4b5c7f2e506add31f9766b978611ed1c845c227b8afcacd4f29d94511995caadc1cff130273f947d3ec2e9d29d2d883a7aada0c71bd1e9d30b4759a34a11e55

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dfn8djy7.default-release\cache2\entries\1028C0594A2905A51C9BE4B9198A912DA5F01823

Filesize
49KB

MD5
6ee3304b973eda5619010d315d18d895

SHA1
061b5fcd8079290e3752d71dd8fdbd876b4b712c

SHA256
a57aefc14cde8744a5a95522269f82d106809fae9d36caffcd3875cef23cdd89

SHA512
365d8dca71740748f6a00f1d2264f6406f510baaaf75bf624d058b76badd84d1fd4ba1a4615b954206cfdd446b8069b5d4b9fa17be7a75bc3bb3f8b554897fe6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dfn8djy7.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
12KB

MD5
a7cdaa394785d9a8e398ea46267ee51d

SHA1
ca9e92d0cd66d7ec5271c2cd8fad1ce57eb5abfb

SHA256
d4ec20c43498c063a05deedc10ba397b3a8c8749834fb3ddb282788178c8f6e0

SHA512
5c2d7b72f0e6066603ef8ad97176ab371418efbdcd88de6cd0ba739c52b18d23228fca43c3465440c5782340feffd69b4185e532a7d271a01747a249decfa554

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dfn8djy7.default-release\jumpListCache\w+gO0q3x1Zd1ikRcqIhg2fGDT2GRR_v+kKstUFhAMWM=.ico

Filesize
691B

MD5
42ed60b3ba4df36716ca7633794b1735

SHA1
c33aa40eed3608369e964e22c935d640e38aa768

SHA256
6574e6e55f56eca704a090bf08d0d4175a93a5353ea08f8722f7c985a39a52c8

SHA512
4247460a97a43ce20d536fdd11d534b450b075c3c28cd69fc00c48bdf7de1507edb99bef811d4c61bed10f64e4c788ee4bdc58c7c72d3bd160b9b4bd696e3013

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dfn8djy7.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\9a9a3b44-3e3d-481c-9127-a8201a42a444.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
d76a4e28a52f817130cf0f60b5a25a85

SHA1
906b5d9ef96f5660796760d5fc327815aaa1a9ec

SHA256
4837c910c48d3af736fcc3be06f367e8b2192e692acf53f54dd1e87839b44ee2

SHA512
a0ab74331b1a7785ec473cf15cb4a70d662598fcc74207b721048562492f53baa3871376235fd5a4e076978699b5dbe0b5e58dc65469415b4520bb88d32c04f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgC3B6.tmp\StdUtils.dll

Filesize
110KB

MD5
db11ab4828b429a987e7682e495c1810

SHA1
29c2c2069c4975c90789dc6d3677b4b650196561

SHA256
c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

SHA512
460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgC3B6.tmp\System.dll

Filesize
22KB

MD5
a36fbe922ffac9cd85a845d7a813f391

SHA1
f656a613a723cc1b449034d73551b4fcdf0dcf1a

SHA256
fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

SHA512
1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgC3B6.tmp\modern-wizard.bmp

Filesize
150KB

MD5
3614a4be6b610f1daf6c801574f161fe

SHA1
6edee98c0084a94caa1fe0124b4c19f42b4e7de6

SHA256
16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

SHA512
06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgC3B6.tmp\nsDialogs.dll

Filesize
20KB

MD5
4e5bc4458afa770636f2806ee0a1e999

SHA1
76dcc64af867526f776ab9225e7f4fe076487765

SHA256
91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

SHA512
b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgC3B6.tmp\nsExec.dll

Filesize
17KB

MD5
2095af18c696968208315d4328a2b7fe

SHA1
b1b0e70c03724b2941e92c5098cc1fc0f2b51568

SHA256
3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

SHA512
60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgC3B6.tmp\nsProcess.dll

Filesize
15KB

MD5
08072dc900ca0626e8c079b2c5bcfcf3

SHA1
35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

SHA256
bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

SHA512
8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\InstallOptions.dll

Filesize
15KB

MD5
d1eefb07abc2577dfb92eb2e95a975e4

SHA1
0584c2b1807bc3bd10d4b60d2d23eeb0e6832ca2

SHA256
89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a

SHA512
eaffd9940b1df59e95e2adb79b3b6415fff5bf196ebea5fe625a6c52e552a00b44d985a36a8dd9eb33eba2425ffea4244ed07a75d87284ff51ec9f9a5e1ac65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\OBSInstallerUtils.dll

Filesize
426KB

MD5
e1f825260e7224ef0526514754f7d0e8

SHA1
553d67289b039ffea5d8b59f509b9265dca2ba19

SHA256
1d84aa191fbbd842d5eeed302195579de1256a9acb980308bf31a631ac01e530

SHA512
b9453eb4ae6edbfd86e438ed0825725ab91100b8403a933bb0e359703be462f6d3d37f8bfb32eeae375a46512c619370f9802925ae0d8898f540f933b05b281f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\VC_redist.x64.exe

Filesize
24.2MB

MD5
1d545507009cc4ec7409c1bc6e93b17b

SHA1
84c61fadf8cd38016fb7632969b3ace9e54b763a

SHA256
3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a

SHA512
5935b69f5138ac3fbc33813c74da853269ba079f910936aefa95e230c6092b92f6225bffb594e5dd35ff29bf260e4b35f91adede90fdf5f062030d8666fd0104

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\check_for_64bit_visual_studio_2022_runtimes.exe

Filesize
10KB

MD5
9baff51bb8539498c81d0c2ed0034d9d

SHA1
e85ff796a54221f723ad36412329d8c650b7717f

SHA256
b324a6025986306656fc2a03d0a3e9ed5917dfa7cf14fbfca888d65b39822074

SHA512
cc4008bb5586840c1f031f09ce04904b22ae5ec43c3331586593fefffa22725c076835627253d6aa0468fd24124068603b82eb45490cf96e20a6c4f1d5472576

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\ioSpecial.ini

Filesize
1KB

MD5
7e96f93a6a1b88cb6153e7d590f62daa

SHA1
a8c488e75800ce69842b994296bdb8cddfd20fd0

SHA256
10acbc338b1894d7d7159ed162ed6e1a3675ae687da4a1c66940521d77483d96

SHA512
dbd0d906632b5e0cef83a4c0ba63fd76c20e8c405b1e30e74d53048280c533bf672ef95c1d03d943b4bf438c010940deb1bbb2b2369ad00058ec2a808356a40a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\ioSpecial.ini

Filesize
1KB

MD5
55a0fc61d60e65a096507998da1488e7

SHA1
48180608f315590547a18897a6c576d097b12fee

SHA256
e6d4a2e49607610ae79f65949d9b4ccdf7a3196994d2a7575f4694a8de38103d

SHA512
d3287a81baf5f13cd1ec6613dcb19e9b380106a38552c15150ccba4956605d5c2af3a7d092ec260478d0fd25d54dad29b0dbf5cbb46dc1e0d96528fcd2a8db11

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy6020.tmp\ioSpecial.ini

Filesize
1KB

MD5
1bad7f6f4dfce7bce2c178824c24f44d

SHA1
99bda0080c1ca913d3b2e72196862fab01370c35

SHA256
24f95fe32192806373ae0b3bd6084a0b6a19ba6ecee1a1570f7ec7d75eb68b00

SHA512
8312bfcc3a1fecf1212c5fd6d5309d13481c034ed9c6969b2887bb934ceb0f820c4df093126c259b00ebdfa2d7025002694e76e604fdd422a68940f19e11ea8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
a48d3ab15c17dbd9f6ce0beb55972294

SHA1
b0f6240e241aa64cd74ef31370a47c92ed5e6814

SHA256
d42a4f67403aed1273db33985fa952da13f8f5eb644df38afb17b226e9680b9f

SHA512
dff2605e9111ca6bde1d2504d79128ee59eb494405f1fb11f9a7bc79023201207b4b5ad34eef1b97570275ef3220e2a3450f98fd17126039725a45ea01d904ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
13KB

MD5
80ca990436492144e5108d90bfb0adbd

SHA1
7f80728001e225b0c9b94aa3ce668829bd097c4d

SHA256
69c11c4d411d6c0b9aa868424074abec9e1f4ed058a67ad74689c167f8f91c74

SHA512
fcdd97eb64ebfa63759f6a3ab239bbc9a62b5ae9972da6c9ff024aea49494df4f41f59ef7ce5396216da8f2a31d1997ffd608bf26751391fad3e0b5f12be32f3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
9507cb494da66df9892e13ccd3acdd2f

SHA1
c7d7efd9718a67ca6977a1b44a8295e2ddf5bb3b

SHA256
534c6fcfcee383444a129b2e6e6c0bf4a0a0a5642ae329f37e1858e3282e4fd4

SHA512
44ba9122da2eaf53c076b203d700af335dca39db1daf8da24358574873442774679035d905cc00896f072f2e41b82e1d9ed4f3dc0c1a9a25c1c56d016d5e0d2c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\AlternateServices.bin

Filesize
8KB

MD5
d5e706e5882c33b11ecc66bbd116a276

SHA1
3957826344259b84912b2f5e606212dc4faea44e

SHA256
a40ca4030dc1d0a5a2caab20d0a75529cf885047a5d684772e1efe36f01c8644

SHA512
3cfc86aa9cb4cfddb26dc87c5b011dacd769b7d950024a33c303187999679af7e1d39d64b92d5698eba4869fccb7094beb233cfa5c1763598a8ab3e64433a259

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\AlternateServices.bin

Filesize
30KB

MD5
3f1ab39e18655029fb5581c6f66406da

SHA1
2d1ac62418f1046cdffe9c8a8b37c2857587831f

SHA256
8da1cd18e48dbafbf451fed14ea93bc81c7522c745589780d942c0933bd6bb95

SHA512
0c15bd999a2e7fe5b52a8b9c0f6ce9b97a3cc8087ab599e34e36eb62b0103a637ba811759b1108d43c31fc0dce5e318cfb017a8cd7ff31e19ea26a9bdb47341f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
50KB

MD5
4bcdc78d68d2ded68164ec9ff18d8091

SHA1
6b93fd531ca490931267aadb99713ab4f4f962cc

SHA256
835afd35850a7f3f21b7b650f2398eb92abc841fa62490cfd636e4a80bfef40d

SHA512
760ca9a7c0a8ef8b2acc847f4d7cab13e5fd58c64cfc46dc6ea199ec7d0bd7604a02a7b147e2823f3351e952269991cfa1aa8e8bf88ebbe1fe4f480f4378a1d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
27KB

MD5
e71aa5ef6551e053d9990ffe9f20cc74

SHA1
f16fc94e20db1b2e5cfbabf4b2161a70914e42bb

SHA256
5b9cc82dcee6cbeaa5e00070545cd1a3a13dc2dbb33d6f64767155c655469c63

SHA512
9d031c4301ca6c5421b225dc329a960df1521c14b44aee03a38b7382ebca63303f86d9d5a8523087a65dcb07f2f5ba031465a19047c42848ab7d949d00d9c63e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
26c39b04b07434d237ae26212d43caee

SHA1
ee25fc20b39fa6e7c90d09b2eba117aff6dbcf2b

SHA256
f3c1d46332527a657174e9c623c7363c6c2e1343e18f441364aa9b3642f02b00

SHA512
c1830b7c82c6d08ddfd624680b6336ad718b716770c8cbf5ec4ddad66d23691d385301d872660b6aa425ae4e534bf5b642c7231a2acaf479095433618627592b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\pending_pings\08e3c452-8676-457d-a1cf-8b2772259c2d

Filesize
982B

MD5
6f807bc9c21dbe5eb3b3da442c0f5722

SHA1
380245b957a386d8435678286cd986814e784656

SHA256
15bda937dff63d0e6f808e3ae66849d5bfd889b3fc3eecb9cff90cc5d70610ca

SHA512
3fc1106d461d993a20fb97733c5f269f85d3c1a205bc718bbd840f6067c6a2786cdf3b33d0f80c60b97f0e15755a537fc4d5dd72a13ad50bdc2cbff6b6c39029

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\pending_pings\cbd25892-bbdd-4e9b-821d-3d7bb2140683

Filesize
26KB

MD5
42e677fa78a99eb5bff8d65fe03b4aa9

SHA1
6bcee54d55cd0b2493e910bbe8dbb31a5c3ad836

SHA256
419043fd40ba7c10b3869fd3950929f3389f2f57c80f941b036c5409d4edc33b

SHA512
eba2f2b3ca78855b715f9bb1ceb1dc8e96e2d1b28217b3fa9d037432d069de7cf4499bee3c85eccf662254e55462cceced660cd2b7764f2d39193a74f120aee1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\pending_pings\eee84fbb-042e-4c6d-817e-8e4fe7b76bc0

Filesize
671B

MD5
bb432e5689a9da2bdb96d5ed985fbba3

SHA1
55c1369b2a565d638e6137e3fcca66806326d786

SHA256
803e3e0aaa31924c7c18ee10c7f370076dc02b12c151bb0efc4b57b39cb88ba2

SHA512
9b1daa93f0661dffde2defb25c7cade730f15192dd3f157a7fffe8f392ffe29d817cbe69a7a5e6d3bb89ce9ab11b7b2656cc5cc70c5afdcc6acfb9006a8ab8b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\prefs-1.js

Filesize
10KB

MD5
395f09b6bc1b290473cb2c7d93a5fcb9

SHA1
dc3296b302a3098094880048af770f0ec0ea5b01

SHA256
6a89dbb5e835ea3fc5b377276c04d7728095976805cc932c9db3d1f2f51256e5

SHA512
43420ac9e133e2986a418efebc6cedc8b94065f38d5b4399c474b433571845488aab2977f450fe2bb4af7be290610afa406937f470d3ad55813f155c1da46bc8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\prefs-1.js

Filesize
9KB

MD5
c73a92ad159d53d60a149a5b3e84752e

SHA1
35f9033322a9f055fcbec8ed8d478ca39f696fcd

SHA256
c4e523074d4047381eabf9221806454f850f600e9a6190704f67989ca62ea453

SHA512
77a5533dfe42890d471beb2b04b4ee7eb65c119dda9846943c84e0420af3231e5d971264d93c34f4c00039fbdbdf4e16fbec69d90d9a5ea0cb1118a5bd4bf359

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\prefs-1.js

Filesize
9KB

MD5
826ccbed9fc23094dd174199782294c3

SHA1
f4e4a9c928ce7a1e6e26d84429f8ec3e925e354e

SHA256
a3725af96802042a9e6107068faea92d53ebf565a59b96ab1b6bb9bf63fbb524

SHA512
1775b3749ee5b5097e15aee87b8c1ebda0d5cf5485c9ca9d40e1dc4327a36f9987322e33e41ab4cfd439f4a9ff6783cd4bf4e16aa6153571a03260ba22c3303d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\serviceworker-1.txt

Filesize
164B

MD5
062d999844806e17b88773c4a3f1112a

SHA1
e1e0d8a6051831196aa4eda5fe5e3461c7d4e16e

SHA256
9768e50c46157ba4f426fbfe4913709bbfce6c70c3434c7866be067916eaaeb9

SHA512
bd291d52b04ceb1be8880848f2c6d13b12eade8a06e82887b7f4f3f007b9030de0d7964d7ef89fd14fcbf89acf7b51dc2b3de1948ef61af3d8f5188347ef73f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\serviceworker.txt

Filesize
149B

MD5
5f778c56207da4f318c7aa99373c70ac

SHA1
40a27426fe1babdd2d5c554822e656d618d3ba6e

SHA256
ea4939019159b42ca30e25e2766278baaec23d4019a33a8de610a2db93546fd4

SHA512
2d67c40a36cf81b7b7ab167febbcc4bccb86c6db4aa7eb3adb710b656ed5329ddfe9f890c72b395a277c3793457273c918766eb9b39230b8263432119ce21f6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionCheckpoints.json

Filesize
228B

MD5
a0821bc1a142e3b5bca852e1090c9f2c

SHA1
e51beb8731e990129d965ddb60530d198c73825f

SHA256
db037b650f36ff45da5df59bc07b0c5948f9e9b7b148ead4454ab84cb04fd0e2

SHA512
997528e2ecd24a7e697d95cd1a2a7de46a3d80b37fd67fac4fb0da0db756b60a24648b7074255dc38f7651302f70894a53c3d789f3d7cd9f80fb91bd0cade4be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
43KB

MD5
1f1fdd13dc3754d2a57b2ce616fe0f30

SHA1
29d941004ff06e0fa0c1bbe9e7d430a19a69e01f

SHA256
1b016aea0ac863d8d64128f3f8ce1abf6fce12e8113105d8a03e88cbdbdff20e

SHA512
09bf060ef43633aa621756d9e923c5422683045eb5102e2d658008059193693ab2d70e6d5eaf0bd2fab3f1a0c008ad0f9ad1fe35147a76a4663fa2aaba248ce3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
0c5cb9f673a0aaf665d901254bfe7c73

SHA1
7022457c89a97276fe1bd0aa8b00bbb193e7084d

SHA256
2530b175b76ae7908a2337d9579bd5c8cb0dff9f15b9d5462fefe1121dd8f873

SHA512
0c68d0917e7755f3a85561604d3737fd4e921f3f2bb4ce482165e4187d8a00930aa85368cdde9245a084959fb8502572140e6dd535eee84ced2463376e2102a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
49KB

MD5
95c3ad8503fd20ef719374b7506e7c9c

SHA1
db6466897c18b0e61afea603c1d2ed13698528c1

SHA256
f854de00458efbea83fe9bb99d043bbd4be0d7fc7a0c8546b22f1985cd4957ac

SHA512
9d368bf59b088bc6e787c0d01f3b57ba550a05e72f96c13d077aeadb56ac5c7e185116a04c07209271703694d6e0121bb1cf8d0f036bdf22aad046adac0af125

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
e57859ee03188f7c690a8612a5fe7329

SHA1
fb225784a8647737585938e07b2c851347cf3647

SHA256
52ea8de7b409c1702246257a21a80d582646a89bb5d8fef1ef4fe81612950802

SHA512
8c6faffb3f19f0fbe044bcd27112de153e45742b114bea36dded34ab68063c79ff02fd50bce16214d35a875867a7f587687d4c0a29a07bfc9334bf9da48c0028

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
49KB

MD5
85c5eadfe5a79437745b68c6530acf6f

SHA1
aa5a2eed0b052aa9a7b278716813be392db7268c

SHA256
315a79afc5f752aafeadbf6b56a46fdf20336d0d04677df5ee836e054e8b7889

SHA512
56c5deb4a90d1c8f5bbff03c29234e230eaa2c291c272ec2aa94dadbf2a2aa19107dad30ba9f51f1cc5f80857ee7632f1ae1795bf98b495e849448b20b4f583d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
42KB

MD5
5813e2c0e39d200a7c08335a6a3e18d1

SHA1
65721eb98ef5f28a39324deeb5010b9d7ab2b047

SHA256
b721d184ceda1b6fd3e9bae2a28b6d35a1978f0020e41d953023cb592079a24f

SHA512
3434ffb46ad65ce85df62c6e3e19a3b18b60d3c9df28d878084ec482384b8f9a3239b58665996c8b097ec5b7ef6ec2b240be883d58bf13706607d75ab8714a0a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
6e7acc4b462812900cef5fed730d3fb1

SHA1
737683b76830b3800378781072b1660b4cfa7b87

SHA256
7838ea985f786ff22889dcbe1ad83d965d80ffa35a7c00bfa93c6b2870026daa

SHA512
b416e63404a22027046b5ccf3ad55dd614a2dbcb30d6fe21109a8d6c30f36504525b215adb6d47061aae28ac9e6b2d2cb9b6f729ed1c9a14678501ff9006a543

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
54KB

MD5
684a7407a49f40d05c4f54aab5d21730

SHA1
b2198c3a14eb781a691bb45571c67a04f03f2c83

SHA256
1fd2405f083fe22d4d4ee72666de959c66026702b7a1ffe153648caaadbc359d

SHA512
5fe3c86ab4d6abbfebcbd5e94988e7e36b1d581e556a862a20a41361fed8c08bb883e257ec4410c8d50f889ad45822de189725e94896f5f9ff2a2ada44a2a5ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
43KB

MD5
b8e33356c026b6535d3fb2fecf009ea6

SHA1
16ae077ecb84a768460e7554d6f0eddedb7beb5f

SHA256
37f98ac30570601ba7266a51af76b180b2dcf26d1cf69f0a5f8b486f57af46ba

SHA512
2a0f2058c7fbc86ee2a2151f622f6fb7c95d47e83c6f42add289ef64de9451090f767785d387b0a5a9751c4129cefb56942110b1b70da714557bf2639dbec06a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
55KB

MD5
f6f07b7585284eeda48af3d09b243557

SHA1
32064029ff404079c16b865f5612cd4287cee818

SHA256
13a43b949a8a24c05d294d010f99ac850f0351d7fb6d356ccbd68a91f3f22c96

SHA512
6e98fafdeec404f4ce370991cff3f7fa0133583e3caceaa7936d89ba1797a2916d756760baddaab40b3994a3e41364eff2d43b5a03114b4c7e1bbc86607abc4c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
46KB

MD5
8deba0c0cc22153262c6cdb539bed42b

SHA1
bb3b67f85a96508862bba62f78f09bccc7f4dd3a

SHA256
0fc896e2fef120426d38a2be01bb3bab9921cb525f12ee742c897e795a9f57a1

SHA512
19ed9d43cd60edf337fbd8aa5e289752124a0d78dc745a8300cee25ab494f57f0fd71dac50ba4476b3d20463f824e59113524205166198e62903491d88dd71ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
53KB

MD5
cf76fb2cfa73aa8f44ca36fcec6b9790

SHA1
647effca3c1b8fdf104005195b9b08a6fefd4576

SHA256
6ead2e013648ad9303662daf41f0c8c9ab212dde8d3a7009a5473f05ed7270c5

SHA512
01ed726fb0c546c89b266855063e2a7b097df137d2ef2cc6859f51d02b14145403da6bb4d99273287f3e909a20df8fcf8a7cecc6cef8bbc120069239c265496c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
55KB

MD5
ab7bc59c398fc8b3b5b6607538511c35

SHA1
3efbd6c7189fbfb281328ceb27081f09d1368d27

SHA256
bcd93afb5aede596ffc92115d4842cc2098a52d96f023636ba37108775b6d336

SHA512
6f506ec9b004ba732df614829c0f20b61e2d1ecfeee73a68589a79936fc4b40f3866e2f77621d427eb02dc27d165c64880832f767c7b299c62310c3f447a7020

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
d7f4b7071300200607cd428affd34616

SHA1
33fca2e314a6b2947d7da30936a887c4022da14a

SHA256
f49ded915ef5d30ba4289383fc7ce0b37bbcf29b68c62694d17708942a08c1fd

SHA512
d2d19e38ce74c878b1f8dde2373a9c8ef90956e082842ec7896e41a1bf1507a063475de270add916bd5b26ae440608584e3f58f26278553fc5d09262f119e5ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
bcc4cc2008f5263b7f12169d4828ebbc

SHA1
42e0be929a01b5105596e7c4b97cf0937f086b6a

SHA256
2ef0409d76b7e28c61f7565da92ed5aabccd47aae037a2c99f175814d836df28

SHA512
849ef49eda9b13d345c45ebfc6a35c6e4ad2b4e600575deb58c0dca787460d32d107c77fc4a0a53c6efd66fd33b3c9797fe2d092f78b12f16955f47b63cb209a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\101\{c8472e65-1106-4ccb-84dd-a55f31491965}.final

Filesize
179B

MD5
276cbe7276c7f3a0fc88eafb5ec6e68b

SHA1
de67587eaf19b38f2e9f02fa238219c2469605a1

SHA256
8f2a87983ce99d8418be2ccd1a0a69aaa0753c5086ba37d627a272b2b97e184c

SHA512
4f0d71b0dc2b94016e4983ef8e6288a57a2864f174b3be96809f0a6c4a755115cb198a22988f603e4dfe89f97616b39dae6c47662b2dbc359d40f184122611f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\103\{d3e102d4-6583-40cf-8d02-a265c1a32b67}.final

Filesize
283B

MD5
9f99c5db53c5fab1bcd32e05ca06def3

SHA1
6b898b3b757218e0bb43f98266f14ab2ecd922af

SHA256
99daba8f81f9cff4feeea76ecec876840213816b0b53a16c60b9077c640e6831

SHA512
36d66379ced9bb670957e4a1705b8edc22ff433c601c1acd34b96efa900d58f1971b73ef8c7ef0ad7e07d15fadc97b68ac182d4ce5f592b67cc5134976be4b9f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\109\{e47a3e1f-a574-4a8c-be1c-920e78880e6d}.final

Filesize
208B

MD5
c39ad8422f2a033a19029e992171863c

SHA1
d4bc0db91f8b6a7e562632cdbc47238bf7074311

SHA256
d4b92610c82ebb2fa1beecdec652dd1b40731ced23e5281a1746739bb9636783

SHA512
abd2d36b411db7e869da2fa6434644768801ee8db91c4b06a15b8af4e3bcb8b58721d654a7208809eaacceb2d17a91bccf8d40aeb81c2ebb0817eeeb0a9c31b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\109\{ea0b01a2-e9eb-4555-ba23-d098c1e19d6d}.final

Filesize
881B

MD5
184e8de5f2d1b10b1cd688026dfec0ca

SHA1
dd632464c3ad026e57bac8efc3348eb7349dad84

SHA256
e3aaf869118c6db298d843c5308262f88ce5ba474d88e7043badfdea4471c93f

SHA512
e3495544032b7f6760967b0ccf57861ec5454bb32e8f5f7d2165fa63e6ab580e278275a1f719fa55fa17fc0a3aa9788e15ba60ff2ea0e25557f0160607066143

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\116\{b9488e58-10bd-4924-acc8-64114bdada74}.final

Filesize
557B

MD5
329d8ae08d8dc87f86a511b55ecfc6ee

SHA1
46a40fb3e9c046870707b0a98fff5a53cb4857f8

SHA256
a61773d79b8fc91cde32c678a7e7b10cd7ee94c0023a83cce29180c032f5472d

SHA512
6940b02abfbf4cda7439f2b0ddbfb7b63fcc451b12d2a3fd4dee2e0d1f2fa3c23af1b5177d7e6f68db6252d5aaaa702838bbdfac9cbbb12b6588e9db535324ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\120\{c57a6bd0-cc3f-468a-ba36-a491eca14678}.final

Filesize
578B

MD5
ff1714439da5865eda7a26d7366ecd42

SHA1
d05ac8350fa53bcb01c187b349b9c0b6cd990da7

SHA256
f2406a6799cc1538f17a8ae8eb0f6b053fc8f8cc37f77429de1fb638bbbebffe

SHA512
4d76e9d3676913d82fe7c85f4f481c2508eeb7bdc76f61507353e6af12c70dd2721d43d3405809d518f29b87c0cfdc1658ad688453e37aaceb4e6cb68669204e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\124\{126ca4ec-a925-4db4-b17f-1318b7c4007c}.final

Filesize
244B

MD5
5ecad04347c2a8c59c4b6a885e947fcc

SHA1
ddfcb94ac1af832b6a831dfabd66b47138534ee0

SHA256
9fb212fc86221efff20faff19c616c41932108a588078ed6a6377cde48e81d4d

SHA512
9a79703298ad64b902f6a0328f6c80031f540a7267ce4f4c96cc33b6b9ab2ba23f1b190f0ed1a51da1ed7306dab020ef30f87331da5cd77d01789c5e8887faf4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\128\{4bee9ab8-bd2e-4f7f-bfd0-db5b7b8c3a80}.final

Filesize
418B

MD5
a16ea228c26d9635887c0f16939633fd

SHA1
4296ff50e58e69f667e69a5eb0e4b33d5584c011

SHA256
1147a378214d10a08296484419be2cfe7e251bf90f5f0ea9897ec1b79e195664

SHA512
357c2daf556aa2471b6f0887d32000939044ce584534fa0fba618fbec99031d0569c5ce662a9f3c1235785ab3fc9116e095e99396a082cb60e1c763f9e561c74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\128\{5955f068-a86b-443c-8284-030be4d1d680}.final

Filesize
369B

MD5
2d5401040d875e10273c9d8ca9fc511e

SHA1
79ba0a97214692e52090f4d2063deb4f20ade88c

SHA256
31342b78121940f85212b9b664588235affa0cc7fa398e80d5f3914ea12efe88

SHA512
b82ca313bc8e3daa966316e10c8303d144aebce1c00761df10790b93113b6eac2ebca429f099d88750427dff8de2a7448fa470e5cc2eb000c7cf71ee73c3edc6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\12\{5d5deb3a-85bd-47bb-bfcd-3a107e08270c}.final

Filesize
589B

MD5
3642d5820ca7ce4525164aa44f5d6beb

SHA1
b8d4c651b067c3bd08f2fefbc9cee8fda03c9354

SHA256
9624b4751a170b67e592dc6b20f93a13ad959ca57a74bdd0998871414f05e512

SHA512
3cd72c8df0f244da5aa0ae250bb9ced273a45c30374864ea662b4e518dd03c6b7ff8030bbe1ae5ffd078ccb8b8338d43b7ee61ef7545059e87616c56fd3a079a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\130\{e87fa2ba-bd13-43d2-80e1-b37bd2161682}.final

Filesize
387B

MD5
fb3d6634360a9125ce7edd27c987c8c7

SHA1
d3b094de4065f9302bc48d57637bbe04cca19d0a

SHA256
e75d4b40320638f498c0e1b2daf9a4c9f2ef1f09010d48a88740c48b43d306c3

SHA512
c880e7c9a5174e0e31a733393744e19c82e6a7f424be9e35a6736cc1209d17552e0c5a6cdb8cd725a77a00f15d2e4065b21db78a99abb5f35758d32adb52a53a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\132\{6fa8abe5-6965-4fd8-9a9b-4f03b12b5384}.final

Filesize
208B

MD5
a8ac2b1daf1197439e18577f9341b301

SHA1
7c6e18163d4915ae57f27df9cfe607834bb998c8

SHA256
de289ef6a8ba393577207b6a036d9bb0462b56479d9fceec6b4c094c8891a72a

SHA512
617ac8779a29725613666c729e3b0976f0bbfda6bfc358f7e606a552dd0ebf712de791d483965a72b225412fd7532764a2ccb2df1b3b91666ff25fb841cd3c93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\133\{791ee604-68ef-41ae-afc6-6b7afa441c85}.final

Filesize
4KB

MD5
b321bfd04d5e568507230193ba74f054

SHA1
b4e213b84ec46aa266da1088a80a289598d1975b

SHA256
ec1bae71f33680f4e4f349d3e8b218d38c683f4b3d8cfd6772f2997ceaa3fe20

SHA512
6d9b324023b81d1c5e20b4f79adeb4e248cc3b9660a78c3694cf921a0a8742b6d08d6308566f63a1260cbf86d405252b4e2f46c1ca304454464f9706f64dc7f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\133\{dd856e49-257a-4fc7-a4f1-be5133a77485}.final

Filesize
549B

MD5
7732897c3667adcbaeb632ed111b170e

SHA1
eee532cc36738b7e586c193db814a088896038ad

SHA256
ea06cf7afba50fefdb6b8ef1a084dab27ba0d9b578814b3b79eecf474b200b67

SHA512
08a7130e9b36e13b2cf41be54a7eef19d209c494d177dea1d11e2e224f17a611c649683fc5b49976e244dfc4d91944ef481fe1cbe08d130126817180b97a0717

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\134\{f91ada6e-6e10-483b-80a5-6b69f00e7786}.final

Filesize
204B

MD5
f5ec5b6fdcb0fe6f76aca19310305268

SHA1
46d30ca75e110987809f6cd78f52b5cb35302754

SHA256
c9f94f5a2384b5a253cbc563cae021fb1d15762412fabef25d90b4f0c60814d0

SHA512
d22ba260c9738129d976df698208c8cc7a9b70dd89c0f81f995f0105940a2956e3097adfd2c300c94387ebbff54af720429795ee1bf4d81f3a1b6a6cc666940e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\135\{63edf346-57ca-4169-bf4f-32f7ce206a87}.final

Filesize
334B

MD5
5a85b3ec969004ce7b23e6712c04860a

SHA1
dad284278108abf777290add4971eb92142d52aa

SHA256
bfa4bd5ff49d8418628f3a3c0da5b6d8a95d5436168b9482d6de954c0fea74b5

SHA512
37d836d572226967995b3f20557f98e4e55b89c08fdfbddd4dc45a6d4ee90a24e5dc8276d0e1971d7b366712bba3382086183e1498b006905169b758e44394a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\136\{77f4e1fe-51bc-416a-b0b9-1fee900cee88}.final

Filesize
209B

MD5
103a3bb224f38cac909b8f5719ac61fd

SHA1
a2f0ca0141add7d8ccf18e2cfb38acfcee45a0fc

SHA256
63f1c1eb498439212024b5bcc18287e503b28cf7d84c3723d153a78f1cbde45d

SHA512
00c640a963ab78076b97323b51f2a3e8fbcfe288bf3cb52c97d4c3e5cb8e62e29affc9f616ed35d3ee978027ccc9d8d23dbc9d7e78f48abe8dc707fc6fb215c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\137\{638a505c-2c08-4c26-a08c-b84825f17a89}.final

Filesize
483B

MD5
41d7c0ee3ebd3ecf60e8f06238d8976a

SHA1
313d08e7b04eefdb0ec87504462f522d7cb94d4d

SHA256
7b48b7ea9af7535de272491304ba8988db28c4cdf0d50c800e7d461666e73efa

SHA512
9619b290dd7e07d7a4d9768ee35dd564e37f1b0f4357bd2cb8a39c1289772f275f23f260114fac395974f544ff70efc168285a34611f40950eded0735d2ca6ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\139\{81cb7222-2798-4f33-ae35-d7e55b09688b}.final

Filesize
185B

MD5
a5a12471c60b1660512fce9579675a2e

SHA1
d702b7183c27a6b08b626c9bba460ce0e20a7395

SHA256
2b8ad66d9eb14d6020cc86c9472a8d32859faec20e5bc971bbbe068753b378c0

SHA512
ec69cf09ef623b7971bf8a42267e23c4f5265127608a70d1ea8ee7a910982e075723a0dabd7053022905c9d0e44cbecb4fe2fb1005258fac9a0bd5a33f3b6014

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\13\{d2ab30de-cbe6-4ddf-8477-1cdd49a2780d}.final

Filesize
196B

MD5
c4e0cb3d3de8b6bcac527d2f0e5ed241

SHA1
2425b0c4ddb89f31d101257662629cac0c3cf0af

SHA256
3135abfbd2020a12ee327fd81c3739da37a6fdfc11d2032634ce5d33e916505c

SHA512
29e026c7ece58ce6c56d64073f3b0f6a008286edfef920973b7e399ef57f042780f8cb5a940d8654c41abe2a6fc8f60e4427d70fc285fa7fee5fdf473ae66fee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\143\{1610ffd9-08f0-4a33-b3f5-423b7b9da18f}.final

Filesize
671B

MD5
3a412424ac9e9e38359ed78efdadc85c

SHA1
efed1bcfc57a1a6b9917cd3bc20d59f767adf5bc

SHA256
8cee6015ffd0f547e1bdfc958c906df98b64e24cb6dd5d89cc1aa3b38bd62bd4

SHA512
244689ba698e3c6323e8b72acc8ee5672bcdca4f859dc402e463d09b631861c996d90f8740b75d7e1668abc27ec447a1cdea1aaa30434ba56da1f7b06b84d57b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\144\{658d19b2-5160-40f7-b3b5-df7f8507ca90}.final

Filesize
322B

MD5
a601665adcb4c6be23f3f43db3ecd713

SHA1
daf1dbb4c74201e6e986283fba3603b508d576d2

SHA256
38f281885066fb223a840e11199c5fe053ce470857cb8ffe5fdee25e226e2e7a

SHA512
b60b5afbcafcfb4d4751dda855ce4e40674ba635a28dee30b9ee8dae0cc1a751623ebcc3f1657aa1e847ba317dbb4bcdf44e73fd68b96ddb9ebc3d0a73bb5ae8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\146\{4a897061-5ac3-4b76-be9b-5e5851dcdc92}.final

Filesize
294B

MD5
b719a3c8378a40cb900349ad2a922921

SHA1
10a71eded94cf7fcf70bb4952a35434526264e88

SHA256
7d6082dff0e7a043a631ee1ac1c1e094458d7f7607d075db809ca60f531539ba

SHA512
5bbfe366cc072b80c4d35c45ec91c4ce60a6f5140e6ad7109554ca3dcecb765336ffe938bf490e99c8edddbc3571d41c8e2a34e1becdbd9adaf334b15207e167

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\149\{892a0126-0487-4e05-8a9d-a94d121e2195}.final

Filesize
438B

MD5
7b4110fa3efde7eaa286ecb28002c24e

SHA1
ef18905bf90bcec8d651b137f902e2d70968b960

SHA256
3b339433141e9d91736ec678e692c2ec5890be7d216f4ba576461109835b802b

SHA512
bfa6025d1b2638ec2aa85188c52d1d15b9fe8c85f1e431da724f9a28bf6fbe78299539497a24fce08e48985430e713c5982aec2cc5b5c137f5b611be77767fac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\14\{82206d6f-90cc-48ce-b2b6-5d697989930e}.final

Filesize
311B

MD5
1a840973aaba0bc8aa82cd789f229983

SHA1
dcdad762a070027acd4d167c919a8b12eb7cd4f2

SHA256
fbefd71795c1a773b199567dea99ea28a5bd85ed96abffee7e3f4c1cf6f57c6c

SHA512
871508335ab32879d045ed3309d52512edd03c69e3da9813de212b19ab3ef2e4939f7f108262f12bbcfb593cfff2f1b3774bf4a84076111569fba0f306dcb773

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\150\{b956a0db-a3e1-4936-8f52-675bf47e8196}.final

Filesize
192B

MD5
2a252393b98be6348c4ba18003cc3471

SHA1
40f75302fcbe4a8ac2e33a8d9daf801abc2a9598

SHA256
04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee

SHA512
07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\156\{70c90b2e-f505-492a-9ac6-0dcc29c68a9c}.final

Filesize
179B

MD5
fcaa7f35d0b6f5dcc3edf6ea35b7ef98

SHA1
37eab86381cd122095b712d205eefd4c15ff49c1

SHA256
67b688b893251d9e52650b3cb720b6f8be62c6e1afec8ea4b223a8e975d27b1f

SHA512
becd339b63fb55676cabeed67fbf4e28740feca0995b8734a430359c96e14b8591d4242a526d920ac8893d9d22ac125288e8ae8dbfb0a0fb484ed8544774958d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\159\{d23b5e53-a28a-4049-afda-e7132dd0bc9f}.final

Filesize
132B

MD5
be203547ce77fa7a91259437b55c0d1f

SHA1
cff2ff2c9469ac96eff7baaa308cdc886fab804d

SHA256
e5f9c781a4756c64455652d9b4bd944aab9ecc1eef556814c00b1797209f4840

SHA512
adf00778a63ea8a143f8fbbf61188392a87a376234e17856339036854cff3a5247aed0b1c0b603332e244d348d58402ba58b32f6df6cc8e18f9d8242f6573f71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\162\{e804490e-5d5b-4ab5-9f88-a339c3e270a2}.final

Filesize
321B

MD5
93fe42b9cacad9a58418d5702e29918d

SHA1
fc31ea0118b5b0999dc102efb09ed974b0a6ef9f

SHA256
10a26c50074171def0db39d8343ce1b08c398e77336f87dac2707492053f891a

SHA512
9248b47c5b621c6dcd9792b25c765c6bf7dbab2a03eca1f4507ea42c1aff3f08ca165f89c75f43c2bb1f35514845ea7ccea5199bbf57ddaaf631d0a4bb2ccd7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\163\{3d6144f8-0b1c-490b-a8c6-f59581e322a3}.final

Filesize
192B

MD5
b0e3a03d13d45c1f130df30ee51eea72

SHA1
ed19adf38b3978300a958e5287546be08c8fb371

SHA256
ab156c3358cd6b946718508bda5099c8cba2e4583e3d03fbe0401c0e6f20e5e7

SHA512
3fa2fbaa7f78f69d0df8e3b8211ad56532cb0a68a9ac89c37fa5354fce51e114babd0673f2f44d109fe2e518ad7806b7ff3040a840e3099be4cc5f6dc07f8154

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\165\{c6c9fe6b-a0ed-4d0c-afe1-0aae556b9ba5}.final

Filesize
271B

MD5
5409f7bf4f5bee52df75c2e72dcc9f36

SHA1
7d03d02ac3127b6d3bae88725b830f05e2c19b92

SHA256
1e026c82f67c10fc4746f558ac948fa6549402b7331d97fcf7b22690cb8a6696

SHA512
b3b6a124599c979b29f89ecb3d28f494e1d9046e373539f94acd3d89de284dcadf860c38067bb496e0d8a9d6f1a4e54e15a82d0dbabfcc6280543a25b7bb86f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\167\{67291e12-b65e-4106-8ea0-d86112df6fa7}.final

Filesize
99B

MD5
3e7dc63be6da02f295c1b9a5c56dd322

SHA1
0aa6083dee17a265efa6814d10f0171753c5f042

SHA256
6ccac4a1dd37f1f6d1bc68aaa92f48f02d92d3a23be15dee4d83c0b892fd09d8

SHA512
3ee1d46e61646303fbe77cfae5231366edd2862e9c2bfa45529fd7e90d7bf8fb62969c95f4125a17760ba6f934e5d51dbb5ba42bb43e24af33b43ffc0faf53b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\168\{30a72dac-75e1-4383-9441-f8e5049f02a8}.final

Filesize
224B

MD5
63c7f2fc0ff6a57ff3d98d003b00abc5

SHA1
7eff871879b328e59dc2a5e959c9efdb9e93c91e

SHA256
d750432333b0cf3e88461237110ce0718e2118f3f65d368e9e0d798b9986c440

SHA512
b3eb057cb9578836664bc1d73ff55a40e66eb48b8a210587dcb2adbad404c99a324e388b2d88a77e61f67bf25a3825a4768e7cf6f126008637feb3dd01255d63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\170\{a6faba0e-af17-4146-bd68-f234c90a4daa}.final

Filesize
385B

MD5
a5b6e175f5a577af3302c7029593adfc

SHA1
7b21982420c602f2678b28d3eeb7172d5c491903

SHA256
02240202d841f7910cfc4d17aebdef67a1084e704359fdf544d80dec3809a8e1

SHA512
9e62f4350403815e642a70d746bac7c8862238a8f108491f6e33031db7ebef4ce91a9a97d83f9fe9c15dd70333bda1229dd7d1ee709f964dd8c65071833b6544

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\170\{f0bdeeb8-5204-4daf-8f11-6b661ae9e5aa}.final

Filesize
234B

MD5
bc7d8425fe4aaf118642e9a60d1b764d

SHA1
7456f9cbd82c691a2832ca856873d8e00901fe1b

SHA256
0ef51d3deb46884c157b25b78667241a8809dee794e3402c07b3c5fe972c1d92

SHA512
0a2dd57fb2ea736faa79c3127af31ad0671a06653d5bd152597fff5275c38d816ad1633cfee6e870c2de82aaea14a976d627fac4458c688d3650ad8197173301

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\175\{75d55e77-cae4-4222-972c-76fb419d90af}.final

Filesize
197B

MD5
5525a3d889a5f2b22309572b81eb632f

SHA1
75570ecf4e74c8094526263c3f8fcaf09d4ea87b

SHA256
82b1f81789c3cf58f4985bcf3dd14d3606a9bda013bc08501e36bf46c4fd4e52

SHA512
d1e9153d5da3549d63b5833648191ec199a616e64c343b2985a11626465bcb728e39a3a04b906ea5bd42bff8b7376ef1a26e65c4e62b689af0cba19487fe982c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\175\{78269723-aa2e-4070-8c07-3750c08439af}.final

Filesize
470B

MD5
8c366ecb84c70e347b29a3a7d4481aa3

SHA1
10d4652278f842f021edc0e3236a6236c091423a

SHA256
6b05f1c42868a41e00179baf6ccf28dce77c03484e47c547e55841143607be15

SHA512
031a9f94420f7d0879313d0af17d6d4cd0ab7e640a3e4da608f1c06da6f6cc945f372ab6c26b582528f64e14875eb1844c659932557ef1a85dc7c1562eec4f56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\179\{0b1cc833-3884-49d5-bc0d-2beb6fe8e0b3}.final

Filesize
168B

MD5
51bb0fe00991a2ae6707b3aefc583918

SHA1
21ec201ebf41ad57faaab02f7961ce5a746e6dbb

SHA256
97dc140355b2b45b54c3dab1ac66b951afae0bc742402cbc342be117f4424e0a

SHA512
41863cc0f1252366a5514dd62a06f4bba493029b8c7a35e19173b6d7f9114e7098fa35d284623b6641d28f7d7bee1ce99064987afc985dbf0354368f71f9a39b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\180\{22c3cf16-459c-44c0-9362-65681327d6b4}.final

Filesize
197B

MD5
c6993227cd75c082eb25aee8332d888e

SHA1
a2e27914baf9a1a4b8579506f419bc7167dff937

SHA256
75c2bda8599570de972a83352d94cebc61a2bf66c8470a0461f0803c59dd8223

SHA512
bc37854e6471273085bd3ee362ede016fea6eaccb11194f749c3a092bc803df07c7dfed2d0a3fa538cd447a21d4875f95ccac3ff4f278c96249e7110cb968b39

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\182\{39404c72-ebbd-4933-a572-6cfe264668b6}.final

Filesize
477B

MD5
67303b1686c6123ec1993a7973dd2757

SHA1
c39df2ca0805f5e9f640554f92ec61df8d04917f

SHA256
aac4f7cdddc0c2a0ec73c0cc01664ef6ba0510f5f047045598f681c4ce8b5c3f

SHA512
40e2e2e0ad6500526fbe5e588491e55ae8d27bd80bf23e41d5158f48a50a0e9ba430a8b0852f71f625428fa3f5050130e057edfcb962c30305d86488ff0e6be7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\185\{cf385de1-4a9a-4037-a062-1829245511b9}.final

Filesize
264B

MD5
887d18f5d2a951296bceeccc0a2908bc

SHA1
d9ea3e25c31f63fa2b5c234df3f4a22c87b7abdd

SHA256
47c2305553e87db8d59361705090fda372c32938564297a6db1dec0e5dcbcf20

SHA512
ce858e1c6730655d32e099d8c2804288a654bf2f7629c9bff0a28636473c1834fc9f8e437e04b0b985998ee7cc499abc3b474ab292f3d7180e5e6adbb4d07956

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\186\{9b11af1c-148d-4a3e-824a-9319eb5799ba}.final

Filesize
395B

MD5
8d9443186ccb116d608c8970023a6c4f

SHA1
c280277c0344161167dd348d9267548041e95124

SHA256
70feeade7e05a69d4604df99cf1ff6793f7aed0879ae06b50a69b86906a892bf

SHA512
66240fc8a36102b8d3cc7cf157dc80981bb05ff707efa775b82ad6219fcb72fca9a3c45f30aed6147b222356a06a9b4063c9967f41f1a246735d68bd502eca51

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\192\{04968a5c-e695-4f5b-81bc-c76088382cc0}.final

Filesize
593B

MD5
0c93d244125f8056cc0a69a4ca53f049

SHA1
e35678e1a49498e40e1ed508b521e79779a6d25a

SHA256
f286ce18e4e82f60816536d23dd2b1708cc45a3d1850b132b282feb1d5aec4f9

SHA512
198952bcd97b9497f6cabd7c9dd6cf0b8e75416fe5a2eaea15ca1e30919b7219be5b28985752834f0b8d501b9d6f6b637ac799db078a16f1e7e95480dfedcf5e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\197\{4888a298-8abc-477f-8253-4228560d73c5}.final

Filesize
2KB

MD5
5bb91431fd034c035d8d1457c752c8f1

SHA1
26c815553a8a3b7729d2096fbe111ed2e835bd15

SHA256
9bc714e5306d673cea8a5fd4a58851ceba71a42c3ff760291992d5b78c2708c6

SHA512
4ed4f3f40c0d7725af78eb1bf136ca4edeb14c34c1aaeac023fad838b286fe255a10deb2e0d5c0d71f7d2b55c8c8303b8e1e0813a74bab0fe204c4b6e805c4e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\198\{01631af6-a0d3-4c4a-890d-719b13e41fc6}.final

Filesize
291B

MD5
3f7a4ebdd9e533cda0125618ad02dadd

SHA1
8f024e90ae75e5926e0f9d0847e2a1520b4f8eab

SHA256
3408ed8bd0781a9ee0576ff0ddf30150456e0fa59b40406b21248613602c1043

SHA512
6257799dd555ca13833a2320b10056a966f1f384d474cc66e6ead51a76b726e66ab64add92d9bf3a85456ec75b5b97404bf7574eab7d3e6090b8f60d2799c1ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\200\{f1f6b512-4a8a-488d-a959-4a2f41f8eac8}.final

Filesize
197B

MD5
f8a4486578289f338eccea68bf578c6e

SHA1
6cbd17168a35b3f10b74a28f1fa3a83e161a7e35

SHA256
264c3ef4f7bc3f390875ca49d87ec35f9c4f0bbb0eabfdb38073951253ca721a

SHA512
e896ce1bbfd145a4c38f7e81a8afb12c3f354d5632f24f26cf19e8b5f1a466fca8d098e7277a4c0979170c37be25b6cdcc0654ae94f46908bde1810d4c03c3c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\205\{e4b84f6d-ac13-43bf-8b43-dad15eb3b8cd}.final

Filesize
232B

MD5
25bc26013ca16ec022cc26f5370c3769

SHA1
0b959045667e2ab2efb992cdfe8abf8d833ffa83

SHA256
8e291ff624d1139db9423256f8b7637e909580a54b8838c81119b12cc631b84b

SHA512
ed775d60df5dfa9d6fcabeab00e46d6ddd421f19c8de2ba3d1a78786cf70ddcd86e3dfce18519d916078a36a23f64e9db42149a4e3c26d58ffdd565f3dd9afdc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\206\{74b4ddc4-3920-4ffb-a219-1545f6ffd5ce}.final

Filesize
148B

MD5
be912f4bcd3b478ace5df6dc46d82aa8

SHA1
2485e534279a5fa834a6e099cccc92f20c91052f

SHA256
8a3103971412691de6ca0bf149f63e274d5347e8942210e0b14470bc2c74538a

SHA512
8d082b4bbdc165115c47454a3d641a6d6fc9ac732a6f2bc511802fae3ebdba8a84ecf64d1acfe1fc9c023cf40ae2520cd74d5cc428dc9eba7913a2323b27d59a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\207\{d072fe2c-f6e0-458f-88e8-12d130fc94cf}.final

Filesize
386B

MD5
93215d67966bcb26afdfaa76aa00aa91

SHA1
aa3252645abeae4e228d6595c93d829afad380a8

SHA256
aaf4281ab5534bf37010c4e3ed86dab18a9f4cf8185f85ba7b0e6ac59c844849

SHA512
52df1847b0b802417b245e1fd51197349639fb25ece34a48003120b2920255b52848b3318f0f9602f8d8bf22bc7e761082befcd21b9d06b6a1e882a23f8c9ba6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\209\{f98a0483-f752-488f-a5ab-c0a689c7fcd1}.final

Filesize
374B

MD5
92ccbe6108327dd051d1bce36c574f6f

SHA1
21f4ae2144eeb51f674755301d63e946639e4e90

SHA256
2230108c8dac0c35044696b98f9ab09344f109feba9bb62289a10f5aeb3e8dd7

SHA512
e7bc3ec185886bda2c05c46b1bc99a59587a684f66242f4749ee8cb2f8324aba90761a901e3d1b1186d0a2faa65e9a71fbb9072b276ed19ffe55a8b878222c71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\210\{5b4a415c-11e1-4c95-9e40-141cfc4822d2}.final

Filesize
433B

MD5
abada082ffc6679a2067c452c7cf2afa

SHA1
99a4e6c70bfe85066f09c2ac1b2108d05f129c52

SHA256
fdd42399b41bbb74565be3da15f861b96f044ddee74f6f2ba29940a96b1f2031

SHA512
a4db103b9409b1a544ad9e449a3cd65db72937fa325f1d08419450997f0de9b1481fc7c31ec915b89dfaee13f42f4e50bed68155d2e39d42332c01f4f4e6fbfa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\213\{be444ff8-8810-4da4-ad30-75f8240bc6d5}.final

Filesize
315B

MD5
440b8569f0166adb464f65b587fc1864

SHA1
bd9ec70774c72144b24d6b025169adcf97f4100f

SHA256
7679aaa38924228f58794ffd76387e65f03fb1a7ed42ba79a369069f2da4c13a

SHA512
2a4d57dabf61b213de49a46569ad00401afeee417d28936851c1ea346d65d5019be0b8092d1857b58ca0bd0f2a1407452920a2f3e0a69688d61bef25b419fcbe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\214\{2d341795-d752-4f76-8d07-f105917145d6}.final

Filesize
622B

MD5
0ef1f531ef723ae794070d8fb9f22e7e

SHA1
359a185e7e59e52162aa084fab2f31d2131d2da1

SHA256
7b92f7b90080f024b9f265b888631c058878628e569fb1301c8dc93ecafc90b6

SHA512
876120bfdb112bdbbbeb2a87140af386ebf91d13b9bbc02cf7e96fa0f9f10d66c4a7265811b7ca79223a61fe141712ea64c5c2773aad6199648e3bcd496225eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\215\{8880fd91-60de-41a6-8462-22ed4438ead7}.final

Filesize
446B

MD5
830028a05fd627d68ab70e41825f7f63

SHA1
721199e2f117990f999b2a41d91536aa4790fc76

SHA256
d7f263bba51f160914640b1310d713268e564d9bb1bbb878e67d442589edfca7

SHA512
7af9479e45a89cb49053df5657133a83b86553cdbac5be5fa18ed069c111021ad7d82b02404bb3c35b9e8dc1ed66c3c05bd8a5e8afd4c0d66a598be3ba24641b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\216\{21a6f98d-3667-4370-9b0e-8336c8020fd8}.final

Filesize
338B

MD5
4281c6880b38580a12983db6afe98254

SHA1
052f3dbcc36e439f4f23b1e1b608d92ee8e72654

SHA256
98cdb9a3eef1764f2034497868bc60328364b1a414eba55860fc1756aa5f85b3

SHA512
6b92b3ccf7ab00db56c0cd6c7c180741e1a154be3cc04199b883e7c350a818a6b0357454116ddc86af433f3afd57cc8dd89efed7cd0dfda6c3d9bbb270dba533

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\21\{8c849afa-c676-46a9-a3b2-e4609f762c15}.final

Filesize
233B

MD5
b6c6d354eb2e7e52adb948c0366f0053

SHA1
d7f4586d41fcee9be681c70bf002d36f6d2ed624

SHA256
8383e636c9249a611493d7c83a9f02bbc0d9566d5d3389d8082ad6042271ef28

SHA512
9a08680e4aef9e54a24e7956858ffea9871f874966cb36fef70b5e49f6126b2662c443b4049a3c4d74fdcc00c83d3af12072fadb11a96ecddbb87280a0a2303f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\226\{807ae56b-eba7-4df4-9c90-4312e32ec1e2}.final

Filesize
205B

MD5
fe5981f30c81e299a4b3cbb8d54c236d

SHA1
86d257366f84c5da701ce39084e8bd6b54a644c5

SHA256
d94c2ef736a7e46e3c6da5ce1b0f4ae07d1aedf5de035104fa48c3804f5cc86d

SHA512
51bc339682768b4ab038325bc12186aa16836e7179d36ecacdc8b4559b70e76e7868bfbd1ae19af5fc35ee36299060166d5c4da74f70c0816849510f93e2a403

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\226\{9470e0d3-6471-4648-9cee-af86b0883fe2}.final

Filesize
168B

MD5
df74de9b9890000872199833e120bb06

SHA1
9514f328171b10d04003469f6dc8a7a4f7daa741

SHA256
3756c1dee77d8250d1431077670e560f38dd9081ec36fa0b5f7f17ad58aa1f84

SHA512
73b313870183d2fa4ca5c38d2192b902c7a79796af1fdbe5e64d8b2d212d2ef85d0bb57f2ba486ff8610f22a9e952bb15947289107ac0d1d307c00015f4baed8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\22\{bff5d6db-1205-4e47-a469-1ef93a95e716}.final

Filesize
659B

MD5
6593c3cd0cd304b103124a65062a274c

SHA1
aba82966f9eebb81bcb05ab9eadc5f9ec7087f38

SHA256
89e8c95a42b02e26e31e55e66381898d19e3ad9e6da3f27ad837c7470f9b9324

SHA512
ac4026f5fe5346f518171c3ce08c0ba5652382f1ef83b1358140e5696ae1721d980b925925ca24d2b84cc6a84b5fddc9433ac492c943d09ba2f8f2485e892768

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\232\{96767339-fb9c-476d-98f8-6eb6f58722e8}.final

Filesize
528B

MD5
da8e7790bb2c0680d5a9a526d7474a08

SHA1
3279d1b1f5ca2f2a2b9e5b7a29e2f9f5ab61a4c4

SHA256
8b9eb35aeca66ee8f955adae46f47e61f8f2440956f55efd1dc56719ce039033

SHA512
8b2012e93e957f9d6386e3d736345dc63e47e568fde53f763b96341c5195246a0779abbe4d8e6e8e0ebdcce37fe8a76c50e57c4935768cca5e341e94d06c54c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\234\{a0d68bdd-cbc3-4465-8490-8af6990245ea}.final

Filesize
358B

MD5
a975d247eb217c175e9104e649cfa5d0

SHA1
d85ba5f059f8b624aabbdcb974b16d05fad94b1a

SHA256
3165df152edec50d78e9a54edb28e74682976dd15e4bc1e7ae72a5838a8436b4

SHA512
cd11924a023f8c57315aca37f3b77a90b2ddc2db55417c4002e916c917fa7826c521240a646e24b94ce72192bfcc2739b1ec0edcb790ae33960a3329c2af22c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\236\{56698ad8-4bf7-4e81-9b5b-59c44ab109ec}.final

Filesize
364B

MD5
9d8bbd70725c7ef1461172bcc4e85c13

SHA1
a4c4db2ae4f58c81ca1de7fced23b522d6bb8f73

SHA256
4fd302f56fcfae608964aad2038a1570e38e96b82d52d590387ac91915a8c8bd

SHA512
fc90e23b5e86c1d6aab537069159ce5eeee5068817b6923bcfa33d93e54358fc38c5dd8ec4638b9eb5349da1fed4679af0159ef958cf48227efb14dd67511811

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\237\{e8dd3687-c81d-459a-b188-31cfabb7d8ed}.final

Filesize
329B

MD5
06ce5d1f93456bf84d4fbc0a21d3c723

SHA1
e5af6cbbfee1f0f6664598bc5857bf8cdc1babfa

SHA256
0495e9f2a6dd37a787587b96429e7e96a5821085f53507861063e51832f853f0

SHA512
24380f9c2f3945dcaa3ef376c8c0d809ef73d5d88ff16bfc85b8f63cbfc9cdc21c2584f9866e835d93eefbc50ac7b692683c5073c6f92903a1f83b8181b8ad0f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\238\{1e9d4ff9-116e-479f-a983-52cb41ad5bee}.final

Filesize
210B

MD5
6034306070954b482117c7883f153714

SHA1
dea03382c66843d3b2f548bcc628dbfbc3cab661

SHA256
dacb173c166fb4640953753914c783a1c8aecda2eac07dbc30ca70804bd8c029

SHA512
dc178d0f42734ca82160a12caabd406b1b16f414e09d67fee35092249aed61f570702bd1716a169c1e97e33fcdace6709e98044884e7459e453377f103946e62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\23\{2c4939c5-4a29-46f8-a7d5-fbaafdb09517}.final

Filesize
465B

MD5
2300eafff09d478fbf68f49fdafbff49

SHA1
12f127da15a69beece4f71f600975e0503c77ce1

SHA256
f8c94c9f9dd4455eb89053d024bfd28afa482a9c697732ce5acb2df3144e885f

SHA512
93d447b0a87e4c25dbca71a80a198693b12c684c0a96b370693d693899230460bbd8c85c137dcc0b4872bd2d85fd0d10bfe3f4137c1b08f01da3a9bbfa481447

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\240\{8b886d0b-7773-4345-8620-2a6e8e2925f0}.final

Filesize
282B

MD5
3183686d3a59ab0d15fab2be7411e186

SHA1
22d29c6b9fcfa649773e12680f00d868e6714485

SHA256
2a1c50b6d5014af422db7ff5661a5a68cb0c27ee9cc4768c99502ada0eb63867

SHA512
eb7dcb18d20e28d283ea7d4cfdc08c0da81e0499089117ac068194b1ca2be661d380fe7d938d5828c42d711842bd3793b2dc2a3fe6285fab83b90be4fe3c7b16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\242\{c9d89f9a-ba70-4a5f-96cf-3494ea704ff2}.final

Filesize
228B

MD5
590de80c94ccf9eadb9c7d51be8e796c

SHA1
e2c967e833e34a61c7bbb2cacabad6743f3d48c4

SHA256
75b7670458b285925b57d33949d24b515dd8fe50466ef7e4a4cbd9a402f168d0

SHA512
d06068e443b20e3778c98441fd8fab3bcda4fbba3daa683e3e7c18c0de280d59d4261de63ef47ce8fb9a819b3c7f8d612f7d6b7c6fed591be25c19421ebd7a91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\242\{ca2ea461-4aa1-4f29-bb9b-94e22a55d3f2}.final

Filesize
390B

MD5
b85f318ce844cd0ac2d4ccfbfde4d2bf

SHA1
f3eea534e7b991836ce9eef594480ddb1bda1987

SHA256
480677e695c4b197a66db44b3d42f937f304e44fc560c6690885827cc99f4a5b

SHA512
1f8ed38e5dcc51daab4e6bc8af64e6b1b8316436519ccf21b2a8414f493efd374bc541a4de3a00fca1b9f48d113b235b657a94d9bb8aba4eee58d0802c1e10b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\246\{dfc5cf06-a872-4b23-bd03-f7d383a34df6}.final

Filesize
287B

MD5
4a514bed69506c494569d2de079a4565

SHA1
cfbcb0c9ef303e49adb4f8c85191593dcbdd95f6

SHA256
9b16a083b682783c5014b9a1f4f6914ec9399100e86fd5e56a82fec41ea96a68

SHA512
c2d81af256d7d5e8bf9b4c2ca467a1972aa625511ad0d63c5da573d0916b85b1b09babf4a606d94f6b79f3db26bc00ff8c4b08db485224383d487749881b88fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\247\{47ab081d-1876-40cc-8efb-6ad8cfc914f7}.final

Filesize
173B

MD5
32355676adf4c64f1fe47b92f9500b6f

SHA1
cc2a0c3f0da02c1a1ac32a3a5ba417010f89f73f

SHA256
f4b28298d53a353c23a88b0c82002f1036c376d22154ed21630a8c1d04e2a841

SHA512
1945dfb8bf90df999cf7aaed9c881b2d10df4a3550f2bceaef655b2379e79d8128ebefdcd4f37705c7b42dcabbbc4c25dec1c1f9559f4e727c6df45f769a2f95

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\248\{08d3e8cb-81ed-43ee-af33-b26e69e6e5f8}.final

Filesize
197B

MD5
ed6fd5e11dfc8e4cf53ea851ea9ede04

SHA1
fc392e8d4f64aec77d892182f63fedcd543977bf

SHA256
478c763f896d5b271626a85070b75e8d66dd1eed1dcd244d9d6874bb1c24e6b1

SHA512
5da78d681d8feed8958b8fc60c4bc7975e9a4cf3e94e884e2525005cc1852c5643cac43cfc0c387381ab6f8d97d90a1d22b31faa0a1ee3529117b471cf6ff21e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\249\{316cc583-7832-4cbe-8dec-c195e2e3fdf9}.final

Filesize
231B

MD5
45e25bb134343fe4a559478cd56f0971

SHA1
79f18ad0b7e3935c3231ced0edd8ea3c7997ca93

SHA256
dae4dd8e56ccc952312b3b238a1db294d4d7ad4f532c31cd1c2e5f9dee881678

SHA512
9b32b125c4183fe992630bc6ce9a511157959556fdce53f8264aba2aa8fb7b0e53b408b505da2cc96cdec771470927e74cba3bbd6eb71a5077e9f933cdc85292

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\253\{1076c521-7b93-484f-a1ae-75f1f3e831fd}.final

Filesize
860B

MD5
a2359dd14ab60b6ae0cb3de77ae2204c

SHA1
68a7d0619712a6b39427822c566995961903aadc

SHA256
fc224a0ec6745ccd78824a367f32ea4fbbfadd69e509579410eb8572d8e19db5

SHA512
ef69bd0578175d500ba1f0e2dc852de6feab7ce78d55506a64eac9438e89e7be673e540cba40b89162f2346079d99e2f84ccddd65ca61870dace29260e8381d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\25\{4d5f0906-43d2-4aab-87b1-3418cb6fd819}.final

Filesize
1KB

MD5
41ac5330ad29447b8df7fbcd77d3560f

SHA1
e883b4f25097c82ac74adadf9411a389c93464de

SHA256
5a2a0a377651fd208b769efaddc27a0393edfa6df9f57f42b882e3e629a08658

SHA512
5f01c7a53e232178f8429fe8d5709fff90ba48c4eb9f0a5d206d4d474823a8c05388b6985ac057aa759e7a386cec0083e2df5894a2606fc03a465813cfecac8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\33\{4bb9ed6d-f5a7-45ed-b695-45effd494b21}.final

Filesize
8KB

MD5
d53cdfdc78bbfa83f76b88fec1baf8d5

SHA1
44fdfb015f2e0ef773b74c91e7aa3084f86be4b4

SHA256
b60f85072330edde455cf9a62c94958d66793b18f461289da8a88b6bc0e29621

SHA512
07f7f09c3828e81d79f88d768dcee3d8f91aded0b408bde57daf82593eee49a1ef2dfde683b0aef1059031b5f9d701dd6a20673020578801a66555eef720f023

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\39\{bf1518c2-9b3a-4732-8259-b4d48b0fd027}.final

Filesize
208B

MD5
9aabec02bb846ee3fab89838fc80448d

SHA1
8b0f294de64204dbee03446885a8f31f03a22b17

SHA256
31afb122c87ea568cbf6b96fc5bb8ce12eaa379581d41c269ecc4674d452d72e

SHA512
198e2db29f6cd3807e92fdc6fb2fce689ead581fec734e414f953595d1d4dfd0de8a23a364d3665380b99e58c4146d4899ba0ba6e3e818dce29bdf809ca00b73

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\3\{05127b91-9cea-4d02-a91b-2b72e74f0703}.final

Filesize
234B

MD5
ee0078268c18aacfbb32f121a2bc2902

SHA1
413487a0a575c27405b739fa8938a66b61a24149

SHA256
9718aa5eb454fe31d59fb6cb2d7bff3ba1f7e73b171c76390ed97b749493a85d

SHA512
2d776ef4276e4f8cbe7782e1aaa91d78f1154cafe818b8fb507e7e5f823c1ace750e8b2214a82448fe0d3be43fc25f1c15eb93d9198ca4c6b1962d19af45ccf2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\42\{1993ae41-453d-4a7f-a12e-062f4df9c02a}.final

Filesize
645B

MD5
50af989865f9dad63f573c5f2bb66321

SHA1
91c2c613fe2faf799d1916e3245c8f7672926d28

SHA256
d36552977b70782f63c9fd0ebbadce131eb78616c7c5f0e0274746cb0adcde8c

SHA512
074f69af44958bf010198bdd2a37272d30da53a22d58313606f5c1f19d67597b98c6cff376bfebf63e199f3965bee93a0588cca0ad70a8eb9e9de3ad9afe5d29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\43\{29c67961-c6a5-4fcc-9d6f-600f19b6932b}.final

Filesize
234B

MD5
b3a912f7ad1772f6fe5812fb79fb8f4f

SHA1
00443a5067e504d2b102a4358ddb6f0484d464b0

SHA256
7663eca944129445deb2757f49ef731ac2a95ac01080067f5938dcc0904fcd7d

SHA512
58e365169f36ce049bdabe6c19ef7788684a68b2b38fc499f0cd7ea8232dccf0708d585ecd249d9a92b2023fed544145b967848e50ba44b0d2af5447abb0b761

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\4\{2333ad40-9930-4347-9b05-8b2f977d9704}.final

Filesize
406B

MD5
34eabb6d7873666c4dcd0f6e2c379fde

SHA1
e6dceb2fcd82d2513d383afba73625a4822b44cf

SHA256
2f6cdfea39358c552286c9a055d5e364e27d8a1e6700de932fd8f406446d7048

SHA512
ddd2d6d1c98d67ce10e3c4085fcd33499767b0a158de2975cc6993f2cc06c8c09cb1daf1ff628e4cf9127c973e87a6f3559e3459de1ffe4c8685e40c1998ece9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\56\{b1cbaea2-c633-4a7a-b4a0-239a3d267538}.final

Filesize
406B

MD5
18ea68569ded72b5f8f681906febe6a4

SHA1
5797e923cf4e23b0c5b834923ed11b3fd101ebf4

SHA256
3f7e5effbbc5b1d293c34e82334eef3f6f20195436b46a97c9322a406af63cc6

SHA512
e32bfa8081fcb47042097617f10454358b0fa206db22cf3d4ceb09c7134ca97c4cc3d8d283e1dfe7b4db13c0254ca9aae2fc2dad38d50cff4375373d76d9e060

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\64\{619060aa-1be3-4c2a-a74a-996db859e340}.final

Filesize
557B

MD5
61fe63358ed5c171881bfffc422a3d0e

SHA1
aa75bd2ab0c3337649e0c8b70bda7f026c873854

SHA256
b595399f19902bc6fd474a33408fa74f5f4f97308c2fc8f8e6226897241e5cb7

SHA512
8f8de25ad07e2b76f2e8366d6be5c636cd40e1ea3a36c82595abd42113816a0c7668d1aa6af84b23c57644710cb607d166324330e8e095613190de5159b3b3bd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\66\{66623d96-7195-4e99-aaba-04318f3aed42}.final

Filesize
297B

MD5
004c0529776665be8335ef4beb8d0eb6

SHA1
8b1fb58622c92f0ce3e490bbf21b532818797f8c

SHA256
493593022b630c1c1bdfc20479ebd34465a1bc79e066b04f388c6572375b0005

SHA512
6ee9bb5cddee2ae52ad1d3f068d08011ca5696975783fcdc816c0e16dd27c87ec0957d6c4b63cdbd76664899fd8f8df087db375a5eaca8b9d494430a6ae09efd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\69\{52ec37a8-5a90-43dd-ad2c-ce45abf26845}.final

Filesize
244B

MD5
31f682f3d011c942f1c41b7f915eec10

SHA1
0163e4cb475138b8f6ef221cf0bb15055f628f4c

SHA256
00392c87ab0206705a7f066ab9b2cad308eb3b2d0b538fa535d053b0c662c48a

SHA512
da32317bdc01471cf7fe107c80d3b69646aafbde3ba9ef7d4fc674c56034d78dfc08ef33d8c133cdf198e4ce265625c8411cd85b2cc6d57016af360129db733f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\71\{b22101aa-f6b3-4259-9a73-cdf6b1747b47}.final

Filesize
287B

MD5
977788f7041189490d48fe8cb2db70b0

SHA1
896bbafbc1f4a310ab867f215c6b4c4494847f60

SHA256
02f5dce12d59393d9d124cf943957bb5eb8a21d12c9393e4a5e17142d78edc80

SHA512
f72744f7c9e77107fc48cc156610acbec7ef5d10aeb0a7e4319c4d771c63df47be77555e1ef057d07c6f6f593e2e7432cf529d337c1d97b111201bb01c056a42

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\76\{0e21c9c5-0759-4132-8517-97ccd8d0c94c}.final

Filesize
216B

MD5
321ea72e49df8692233391c1f36451e6

SHA1
2f016758fc5830a806ed9891e574936db521c034

SHA256
8113ef313d8a5519df57034e29db538c65721112804bf1a1a446b8302ae7e0d0

SHA512
86d5a408e472a62c2cfcf69a5fadc122f7a62dae866a36fdc4a7381de6cc8028af4ba51cec9c827b9815c26f75db82c4813ab25682c728c1f03d3bfc7ff21114

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\77\{dc610e53-0270-4d38-a324-fa3d878b6a4d}.final

Filesize
238B

MD5
253a9d7dbf4f2f8141599d38f58f86ea

SHA1
0766863065b6c57e98fb00fad0e6d8ca1c1f6aca

SHA256
fb659afa77a61d064962153784f63ba71e453e597d98b770c02aa31d1cdfa7d1

SHA512
379424e9196ca464ecff6e513cb32a296a63afa9fbb8d19561d0ce9cac304440896f4efb71956bc781cc51eedbda4f6d0e588e075ecba82e482ea2bf6aeb7371

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\82\{24290f40-e714-4d8c-8641-10e707baf952}.final

Filesize
329B

MD5
bca3032426d23daed1b2d997b7bd5fad

SHA1
76a4776fcca6e6add4773481b6b3a82a7c3f5a34

SHA256
41b63a851c63d3c6ba8bd92548013e1a472973011f0be1b95eb2e29697b32b34

SHA512
67b6c14e89be76624f964eca71653977f3e4c5d8364fa9e008a6810efa9d0ba359aafa79570278bd80e57b6e31820d27dda06a588873c181ee96d8c868c4b822

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\83\{1a2d02d6-8272-455d-8f65-d40f07b5ab53}.final

Filesize
282B

MD5
680103ce64ae5c8edff61a1e3240326c

SHA1
03038ee24f31ad0b8da727f0c3dc3b5879b26c8e

SHA256
3c24065c3b89ce87c07f724caf59d270c80b7a072d751bd51e2f0b27b594442c

SHA512
68c0beb28e4050858d9ed8f79e0bc4a24abc99b9776faa392aa7d412a83b8d7320645ed498b7de7f1d712ec13abb554862d6c2b01d7223a229a96f27c9e130a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\83\{a312903e-5697-4783-aad0-f283f0809953}.final

Filesize
586B

MD5
501e302df1cacf7ffe388900064433f7

SHA1
d044ddda684b1a7b8acb5d9a887f1b92f77f10de

SHA256
baad1d86dab561f7abf009b62005456a15797550fd0dd565328f8c1e7e7c23ca

SHA512
8a75f975a60c979627e4f325e7ca6b8af17df51e425b7df27ea45ccb45b0b37b8ff339a7cb1a22108f1085854c4bdfe8694a6009a41df07ffd93aa7c6766c80a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\87\{c10b4db4-9806-492b-ad34-998e16a81057}.final

Filesize
669B

MD5
5dac736054f1bfd6efddc9f8941f6513

SHA1
8d333e22dc6fa20e26c4732d5ff91c954433185c

SHA256
e1f390622425670904099ccdffe9b808e555fc402e7015697d49f9f22abf9175

SHA512
3ea570e7041a136d250e5e94c215b468991b70a6d6609ed27907aba24123e068e08559bbd96ca39a615a52dceccd524e3aa52702a8ad544f8a7b952fff935577

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\89\{50aa24b9-a181-4d96-9bfd-796f95fe4759}.final

Filesize
225B

MD5
cedfd917c042bfd5faea22058d451ad1

SHA1
5a98904fbf1c9bea6d27f75c42aa49c66db8c54f

SHA256
9cfc9e25c7e723abf5c14049886f33d836c6ab91b40218920efbdc864764f3f2

SHA512
5f7513b881549aba1fad170019ddf45e780ddb6a576e08365f4c9ab2c8bf4e7d2d5053b1db4ec6a2af570de21a182fc8981a0790881172d8605c023fbbbba4d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\89\{721a02c1-a229-476f-bc22-76bd5f199059}.final

Filesize
232B

MD5
030dd07949fee4d5e67e6885b76ccedf

SHA1
a83002727b38d84882fdc444a3f5d7fd7963acae

SHA256
95c8349deca56128ead6daceb682594a737a5af8a03b70065e1f2c6c4fb84209

SHA512
f094815a8ed89bb7e6376238142cc13887694fb184d9ffffdac56b7fae2bde2ce7acf3d50c0431d14ca2e03620526cc21bfe1b6c44b467e079e30e9dc3a8e87b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\8\{9de72f05-b558-4b86-95d9-c97c7c7e7308}.final

Filesize
258B

MD5
d0d1672cc7d147f9f802ebefdb01e914

SHA1
22ed7eb147f695ec1df8ae6f43cb7787dd0ea652

SHA256
62efa98b135e5ef8779b99489ab8200b60026a5b1000ff3c997f3be230febe2f

SHA512
7f8ef8af3f57a6aab90ccda6ab1079e43630de11d14a780786a1b0f1ab057d7cfd5ab512b53ecd8ddd1bcc669fa56a0c260b2df421db64e3855dee7d63251a68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\98\{131089af-9430-4744-9e4d-5ed4b0548e62}.final

Filesize
423B

MD5
a57c59c5082da22125cfc69197546e95

SHA1
ecbc238d1f440562832601a78bc3fdc052df1e0b

SHA256
aa70e89647f51593908420aa5856e5ae4f663065bf8a12cc4ee1aba1a0916a9b

SHA512
ca88eb897f8ef1fbc65b1e2e426a2e8274a7cf8c225e02e5406c39ef5d1bede11a732673162e21379773622207b28c9a45de83a64aed110ca82218e7097e7cd0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\idb\1029256331yCt7-%iCt7-%r3e9s0p7o.sqlite

Filesize
48KB

MD5
7448fbdffc64299ba9afbbe8f593bd3b

SHA1
2c6212ea0ae37757f4af20c0fb4203d8a2b52c1e

SHA256
86c4ddeaddcb6ad6bbcadfababb8e86bd2cf260ec8fb298f9d06245d2e6bf972

SHA512
fc4566a6f38914036eb8a0ef725d11bb74d2968062edfe35ae84604e2b392cd1665cb33f21359be417c34dd01c88aac85393f54a2c6e573ef573310dc0f1a6a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
376KB

MD5
5d0a485c6575ffa77a45a9789921f9f0

SHA1
207468b870c413099bb675a3e162346ee2d417bc

SHA256
728b08f74ada44e54c1b8c28beb43047e7f2c34e6abf27484626975807a5a17c

SHA512
fc94ec23d20863fad9ac2e97d919efb4d40bb9a914df7ecaeb063e6284cb008bb5ae1ec37eacc25aa3ea706ef1f00f769632314bfd5ff615b4dc217c3ebbc279

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\profiles\Untitled\basic.ini

Filesize
27B

MD5
d785072bd43717886593f737817fff15

SHA1
8c7ef0936b7f5a5cec10e9b5e1278400e276e6f7

SHA256
7989006d0b1b17f5e4f4e20960713600d80612c3799963454e463f689a3cf613

SHA512
8bcd4ed11b248d2934bb7fed91cd8645b77f89ac75f357277a9de04e1121ef4217e982783d61c32b1e8e04d2c14eb82fab78926dc46861db511a8741a62c0c20

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\scenes\Untitled.json

Filesize
7KB

MD5
b3d205a0554b8ece851c9cca706beee2

SHA1
d520ba9b8d58751203b5179684cc8a68e3c929ce

SHA256
b29b8f2450bf2e2ae32568231f0ca1ac8b47658d7997aae8a46fb84cdec1faeb

SHA512
06ecb5ae789f13d82189663cb61443d24bcc2781c219f7cbd65a88a94631714ff7c7665f5f30ff018613c769971a135ff9591481fcc32479fa41ee994f5ea77e

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\scenes\Untitled.json

Filesize
10KB

MD5
6652f2f91a65084adac0058b30119da2

SHA1
68f81a6052165d357641b0839caa30596b7e99ed

SHA256
0338547a5f6568749673cc65e9648263c8c3c27e19c15c7ce65d43f83c11b432

SHA512
33a81ca885ddba1b848d7e12463b71d3d7f74659519248cda6ac2c6afca942d56139dff077448214db687f1e97fb97eafde757560707c30d4f08554ef831107f

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\basic\scenes\Untitled.json.bak

Filesize
4KB

MD5
73ff79c80f1c175e5ff1b21f465de2ee

SHA1
1afa72c83e949623babd5f7e5bd22fa6824d129d

SHA256
e4f0b25fdfc72230fe03849f8fb90fdab817fbf71b6a6d2a7227d02882f50945

SHA512
73221fdc35013657efc2923d8e62d15e4a6a73c966f38b37bb50b918718d124a5578923bf806a9b8b56a011438d6de8799b61cc01fc518655ecc511d58652713

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\global.ini

Filesize
32B

MD5
c5b18abba904caf48ae474421b4b96b3

SHA1
8326d2f4c21ac4b9c9bce74f1d3a8941da08a7e4

SHA256
e29fd68cdd32057471cb8fe02f07263c329a98635b7f0b6b5296d859f7c01ff2

SHA512
a960d38a07d1109e7ae595d39447077d9bab701bc11d95ac578f28fda1bc750a80509d31396177c1969bb10c8b546e952fa513156b66b37b5493bd68d930ea78

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\global.ini

Filesize
475B

MD5
5487eb7829ecacf99146612e3ffeeb3b

SHA1
71519feb036f0eb4fd8f4d7065f82a14d0cf478a

SHA256
203d49249b93c7892e4d9f79bf9f98a949cf5d7a957a6478c0411e68f3111a98

SHA512
33bb4fe9f6447aae37db6359a80c3581cccf1b382b56c05d204542b16fae2ac48146958b3c989ef294fcbfb7c9e2ae4c5fe9fb037689751640111c520016c4a3

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\rtmp-services\services.json

Filesize
124KB

MD5
dc0d36a2fb3ad59469e88c317bcc61f7

SHA1
43e6e71e1b614be62e2ebabe3a46af54bd72e1c4

SHA256
10ff5a87d4b5f693a816cd2f5929bef1a771c6715f4d17a4a363c2d228c07468

SHA512
10536b27aee419277474de928baa9ca13f7d99f74cfac0721ec5dd02d3d3dc5279103ea8da9b3d2b7b111173748d2dc39bbb2ff7275e43d289dc516c1927e050

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\user.ini

Filesize
95B

MD5
5e1a6ec63e7f3c47ee8e518eb9363bda

SHA1
7ee6c56636dc5bb77c624542dfed81cf61e1301c

SHA256
90eb7d1ad2ba1c3f742eb01a0930d3e98a5fafcdbfebe4a30a429872721ef04e

SHA512
178aa925045f84eae42846cca4d7f8a8f339a044eda2e15d2ac07c2dcbf4911a38e5df7e4e1ad288b696285daf00c630ffa79216aca9421318c0af8a220f0dac

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\user.ini

Filesize
897B

MD5
1211d0f5bbbba0bc99867cecac2a27a6

SHA1
0172cc3f6d12c160e8f6e644c91bb67427001cf4

SHA256
d74dbeb423126f15cca2ed420913ebc43c605359b694759f00cccd6e4e793819

SHA512
2274e93c72499eb6032df4672e7e1d111190b47191a02f296da11d6fd0573cfb3ee713c9b77710edaac372dd5934eb7e3ff168836a4072dd952ac0c119893510

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\user.ini

Filesize
939B

MD5
69627f1823eccc764bb91879718baa28

SHA1
561474f66695a93371b78ed6c53cc405900e09c8

SHA256
cb5491e7d79dccab403b459d2c50fdbd56732c333d0988e8ce65b5986fcc1090

SHA512
b1c59c71ad9634f84eb394c8fdf92007d878ad34eb2655070637bc02a2943261ffd416d6acf222fb0fa673df2f908977c819e50551e41cdfef8c73dfe485c7f2

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\user.ini

Filesize
1KB

MD5
0fa56b96f3e848d7a916d1e3c120908b

SHA1
dca946f65aac688994243c1835f16cb1aabf50ce

SHA256
de694fd5d3ef4cbeb4e87540741e68d125a62b4930ff3e7728966bd2397156b0

SHA512
e263735aff8e403282ee726bab420f6adb6038efcc2eacb238c911c84dbe36c4007268c3cb70f51ea0341b087d712a13c4598e6a6be0b5d98e81a49c2bbf5250

Download Submit
C:\Users\Admin\Downloads\OBS-Studio-31.0.0-Windows-Installer.exe:Zone.Identifier

Filesize
156B

MD5
f34a6dea69a3bff5ac11de8458cb8457

SHA1
63150a7a12a4611061f9e33cff10c6be5e50073c

SHA256
e4da18a04828afc3eb85ca531b08056480057d5c76b00cbf48fea87946fb8788

SHA512
461fa1172dde86ae79ed52e38af8e11f97260ab72bc5928dbbd5d68c546eb84a6ebb579865061d1815b6403a865cee72e82a5f4c1d0ada16a7fbc0dd70dab3ba

Download Submit
C:\Users\Admin\Downloads\SteamSetup.bpSgNePG.exe.part

Filesize
2.3MB

MD5
1b54b70beef8eb240db31718e8f7eb5d

SHA1
da5995070737ec655824c92622333c489eb6bce4

SHA256
7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

SHA512
fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

Download Submit
C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier

Filesize
151B

MD5
08099574fcdc80e39b073884dd0afeef

SHA1
c65a4de2d471bbf0a6d7b2e024ba06200028c70e

SHA256
2d5e628b53fa6333f48c97b65f20dbac3af661e52b3d1cc071b6f0b0c5bd2b84

SHA512
724565be26f1bdd9bbf10dc7531015dab0e2540d71c2f688c1a29ab45c83e7d9a21b64c60d8997203ae1000a85ee26a252855591775f0270306bc54fc154b7ea

Download Submit
C:\Windows\Installer\e5bd020.msi

Filesize
188KB

MD5
0d00edf7e9ad7cfa74f32a524a54f117

SHA1
eea03c0439475a8e4e8e9a9b271faaa554539e18

SHA256
e55a6c147daab01c66aed5e6be0c990bbed0cb78f1c0898373713343ef8556cd

SHA512
0b6730fa8d484466a1ee2a9594572fa40fb8eea4ec70b5d67f5910436ee1d07c80a029cf1f8e488a251439ac1121fd0a76a726836e4cb72dd0fe531ce9692f6a

Download Submit
C:\Windows\Temp\{929830AA-916E-4CF3-A12A-F08C91F5685B}\.cr\VC_redist.x64.exe

Filesize
635KB

MD5
ae0540106cfd901b091d3d241e5cb4b0

SHA1
97f93b6e00a5069155a52aa5551e381b6b4221eb

SHA256
8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c

SHA512
29bb486bfdd541ba6aed7a2543ff0eb66865af737a8fb79484fb77cb412c3b357c71c16addf232c759d3c20c5e18128df43c68d1cba23f1c363fd9e0b7188177

Download Submit
C:\Windows\Temp\{9BB46318-FEB3-453F-A497-9F5BD04140E3}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{9BB46318-FEB3-453F-A497-9F5BD04140E3}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/860-8073-0x00007FF87E3D0000-0x00007FF87E9E3000-memory.dmp

Filesize
6.1MB

Download
memory/860-8075-0x00007FF864670000-0x00007FF864680000-memory.dmp

Filesize
64KB

Download
memory/860-8074-0x00007FF69ABA0000-0x00007FF69B088000-memory.dmp

Filesize
4.9MB

Download
memory/860-8072-0x00007FF69ABA0000-0x00007FF69B088000-memory.dmp

Filesize
4.9MB

Download
memory/1164-3777-0x0000000000EF0000-0x0000000000F67000-memory.dmp

Filesize
476KB

Download
memory/4940-3815-0x0000000000EF0000-0x0000000000F67000-memory.dmp

Filesize
476KB

Download
memory/5072-3814-0x0000000000EF0000-0x0000000000F67000-memory.dmp

Filesize
476KB

Download
memory/7812-10217-0x00007FF881FF0000-0x00007FF8821FB000-memory.dmp

Filesize
2.0MB

Download
memory/7812-10226-0x00007FF888140000-0x00007FF888151000-memory.dmp

Filesize
68KB

Download
memory/7812-10215-0x00007FF890AD0000-0x00007FF890AED000-memory.dmp

Filesize
116KB

Download
memory/7812-10216-0x00007FF88B0B0000-0x00007FF88B0C1000-memory.dmp

Filesize
68KB

Download
memory/7812-10214-0x00007FF898450000-0x00007FF898461000-memory.dmp

Filesize
68KB

Download
memory/7812-10213-0x00007FF898560000-0x00007FF898577000-memory.dmp

Filesize
92KB

Download
memory/7812-10212-0x00007FF898660000-0x00007FF898671000-memory.dmp

Filesize
68KB

Download
memory/7812-10209-0x00007FF882BF0000-0x00007FF882EA6000-memory.dmp

Filesize
2.7MB

Download
memory/7812-10211-0x00007FF899A10000-0x00007FF899A27000-memory.dmp

Filesize
92KB

Download
memory/7812-10210-0x00007FF89D980000-0x00007FF89D998000-memory.dmp

Filesize
96KB

Download
memory/7812-10207-0x00007FF7B3C00000-0x00007FF7B3CF8000-memory.dmp

Filesize
992KB

Download
memory/7812-10221-0x00007FF888F70000-0x00007FF888F88000-memory.dmp

Filesize
96KB

Download
memory/7812-10229-0x00007FF8850B0000-0x00007FF885117000-memory.dmp

Filesize
412KB

Download
memory/7812-10228-0x00007FF887C10000-0x00007FF887C40000-memory.dmp

Filesize
192KB

Download
memory/7812-10227-0x00007FF888120000-0x00007FF888138000-memory.dmp

Filesize
96KB

Download
memory/7812-10208-0x00007FF895660000-0x00007FF895694000-memory.dmp

Filesize
208KB

Download
memory/7812-10218-0x00007FF87D940000-0x00007FF87E9F0000-memory.dmp

Filesize
16.7MB

Download
memory/7812-10225-0x00007FF888160000-0x00007FF88817B000-memory.dmp

Filesize
108KB

Download
memory/7812-10246-0x00007FF7B3C00000-0x00007FF7B3CF8000-memory.dmp

Filesize
992KB

Download
memory/7812-10248-0x00007FF882BF0000-0x00007FF882EA6000-memory.dmp

Filesize
2.7MB

Download
memory/7812-10247-0x00007FF895660000-0x00007FF895694000-memory.dmp

Filesize
208KB

Download
memory/7812-10234-0x0000020F14830000-0x0000020F14892000-memory.dmp

Filesize
392KB

Download
memory/7812-10224-0x00007FF888180000-0x00007FF888191000-memory.dmp

Filesize
68KB

Download
memory/7812-10223-0x00007FF8881A0000-0x00007FF8881B1000-memory.dmp

Filesize
68KB

Download
memory/7812-10222-0x00007FF888E40000-0x00007FF888E51000-memory.dmp

Filesize
68KB

Download
memory/7812-10233-0x00007FF881AB0000-0x00007FF881C30000-memory.dmp

Filesize
1.5MB

Download
memory/7812-10232-0x00007FF884E30000-0x00007FF884E87000-memory.dmp

Filesize
348KB

Download
memory/7812-10231-0x00007FF885090000-0x00007FF8850A1000-memory.dmp

Filesize
68KB

Download
memory/7812-10230-0x00007FF884E90000-0x00007FF884F0C000-memory.dmp

Filesize
496KB

Download
memory/7812-10220-0x00007FF889F50000-0x00007FF889F71000-memory.dmp

Filesize
132KB

Download
memory/7812-10219-0x00007FF88B060000-0x00007FF88B0A1000-memory.dmp

Filesize
260KB

Download
memory/7812-10249-0x00007FF87D940000-0x00007FF87E9F0000-memory.dmp

Filesize
16.7MB

Download