Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://obsproject.c...

windows10-2004-x64

8

Analysis

  • geolocation tags

    eueuropelondonukunited-kingdom
  • user interaction
    yes
  • max time kernel
    91s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/04/2026, 01:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://obsproject.com/download
  • Sample260420-bd8spaez2p
Score
8/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://obsproject.com/download
    1⤵
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff7d15c188,0x7fff7d15c194,0x7fff7d15c1a0
      2⤵
        PID:5404
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,2391078119551975369,8694206115334331339,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:5060
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,15726478708716049139,10662970694910980158,262144 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
        2⤵
          PID:3808
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,17072143702680156426,14500168851769285923,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
          2⤵
            PID:5052
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,15796941589399377150,7237826566831699274,2097152 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
            2⤵
              PID:3384
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,176005765643741148,10278002621482684030,2097152 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
              2⤵
                PID:5396
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,17949546804923495185,13751485011051436343,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
                2⤵
                  PID:6076
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,17255941097870558125,2219276910468750792,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
                  2⤵
                    PID:3812
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,3384082618268204467,11715386191569406331,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
                    2⤵
                      PID:3844
                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,3332947264246038044,12231805663108239014,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
                      2⤵
                        PID:3000
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,3332947264246038044,12231805663108239014,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
                        2⤵
                          PID:764
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6000,i,10934797249577775806,6814722162247111199,2097152 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
                          2⤵
                            PID:4088
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6392,i,8155512896480995250,13502378209231152533,2097152 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
                            2⤵
                              PID:2192
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6476,i,12429027552268182575,15256657942811433690,2097152 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
                              2⤵
                                PID:2872
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,2083589321704687035,2757263467269291545,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
                                2⤵
                                  PID:880
                                • C:\Users\Admin\Downloads\OBS-Studio-32.1.1-Windows-x64-Installer.exe
                                  "C:\Users\Admin\Downloads\OBS-Studio-32.1.1-Windows-x64-Installer.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Drops file in Program Files directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3892
                                  • C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
                                    C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
                                    3⤵
                                    • Executes dropped EXE
                                    PID:1880
                                  • C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\VC_redist.x64.exe
                                    "C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\VC_redist.x64.exe" /quiet /norestart
                                    3⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:5276
                                    • C:\Windows\Temp\{44F124C3-B476-490E-843D-D23362C6FF65}\.cr\VC_redist.x64.exe
                                      "C:\Windows\Temp\{44F124C3-B476-490E-843D-D23362C6FF65}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\VC_redist.x64.exe" -burn.filehandle.attached=684 -burn.filehandle.self=712 /quiet /norestart
                                      4⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:1828
                                      • C:\Windows\Temp\{2AD45CB5-7D87-40F7-BCC9-D5F2455707F6}\.be\VC_redist.x64.exe
                                        "C:\Windows\Temp\{2AD45CB5-7D87-40F7-BCC9-D5F2455707F6}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{80CA6546-863E-4877-BB62-A413034A7C92} {7CFDD840-9F5F-470A-A5D9-5A799B25FF5E} 1828
                                        5⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:4548
                                        • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                          "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1260 -burn.embedded BurnPipe.{32A3A765-D14D-41E3-8C5F-54D2DA907E0F} {B881BA69-6B9B-4A54-89E1-D5996AAE4A1D} 4548
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:4696
                                          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1260 -burn.embedded BurnPipe.{32A3A765-D14D-41E3-8C5F-54D2DA907E0F} {B881BA69-6B9B-4A54-89E1-D5996AAE4A1D} 4548
                                            7⤵
                                            • Loads dropped DLL
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:5704
                                            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BB51AC57-00E0-47FF-8DF2-EFE2F7358710} {ADC55358-8584-4F96-BF47-9FD304919D13} 5704
                                              8⤵
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1480
                                  • C:\Windows\SysWOW64\regsvr32.exe
                                    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module32.dll"
                                    3⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    PID:3440
                                  • C:\Windows\SysWOW64\regsvr32.exe
                                    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"
                                    3⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1016
                                    • C:\Windows\system32\regsvr32.exe
                                      /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"
                                      4⤵
                                      • Loads dropped DLL
                                      • Modifies registry class
                                      PID:2784
                                  • C:\Windows\explorer.exe
                                    "C:\Windows\explorer.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio.lnk"
                                    3⤵
                                      PID:220
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,11704611921898216188,8837892590466334645,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:8
                                    2⤵
                                      PID:4256
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,4600605422793092925,5615804574870085470,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
                                      2⤵
                                        PID:824
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,10827681041741276010,3735137957386299157,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
                                        2⤵
                                          PID:4340
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,13413738555633937342,6929654478023812725,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
                                          2⤵
                                            PID:4840
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,17702239373270674417,15605011295967649609,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:8
                                            2⤵
                                              PID:5500
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,6521312139420320599,2997192266877094581,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
                                              2⤵
                                                PID:1584
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,4823738486673110031,9943588887849837260,524288 --field-trial-handle=2396,i,14612844629293397722,17744375752054243508,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
                                                2⤵
                                                  PID:5452
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                1⤵
                                                  PID:2432
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                  1⤵
                                                    PID:2100
                                                  • C:\Windows\system32\vssvc.exe
                                                    C:\Windows\system32\vssvc.exe
                                                    1⤵
                                                    • Checks SCSI registry key(s)
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4756
                                                  • C:\Windows\system32\srtasks.exe
                                                    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                    1⤵
                                                      PID:1080
                                                    • C:\Windows\system32\msiexec.exe
                                                      C:\Windows\system32\msiexec.exe /V
                                                      1⤵
                                                      • Enumerates connected drives
                                                      • Drops file in System32 directory
                                                      • Drops file in Windows directory
                                                      • Modifies data under HKEY_USERS
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4068
                                                    • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
                                                      "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /burn.runonce
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5300
                                                      • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
                                                        "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420020409.log"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1044
                                                        • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
                                                          "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420020409.log"
                                                          3⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:308
                                                          • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
                                                            "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9D14255B-50E0-497C-91F1-4F96BE6517A1} {5CB29621-1989-49C4-92D4-E74B770F55BA} 308
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            PID:5244
                                                    • C:\Windows\explorer.exe
                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                      1⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1728
                                                      • C:\Program Files\obs-studio\bin\64bit\obs64.exe
                                                        "C:\Program Files\obs-studio\bin\64bit\obs64.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks processor information in registry
                                                        • Suspicious behavior: AddClipboardFormatListener
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3292
                                                        • C:\Program Files\obs-studio\bin\64bit\obs-qsv-test.exe
                                                          "C:/Program Files/obs-studio/bin/64bit/obs-qsv-test.exe" 4673 471f
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:2516
                                                        • C:\Program Files\obs-studio\data\obs-plugins\win-capture\get-graphics-offsets64.exe
                                                          "../../data/obs-plugins/win-capture/get-graphics-offsets64.exe"
                                                          3⤵
                                                            PID:4516
                                                          • C:\Program Files\obs-studio\data\obs-plugins\win-capture\get-graphics-offsets32.exe
                                                            "../../data/obs-plugins/win-capture/get-graphics-offsets32.exe"
                                                            3⤵
                                                              PID:4820
                                                        • C:\Windows\system32\AUDIODG.EXE
                                                          C:\Windows\system32\AUDIODG.EXE 0x494 0x2f8
                                                          1⤵
                                                            PID:4288

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                e590422.rbs
                                                                • Path C:\Config.Msi\e590422.rbs
                                                                • Size 19KB
                                                                • SHA256 8ab239935f007f3560f74794b9668c8612053cc9cc85da09381996101306bdba
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                e59042e.rbs
                                                                • Path C:\Config.Msi\e59042e.rbs
                                                                • Size 19KB
                                                                • SHA256 093ac3106f3532f5dd6f66a9a4d92e3cd71db3a3f97a933ff99287d7c26a5b9b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                e590435.rbs
                                                                • Path C:\Config.Msi\e590435.rbs
                                                                • Size 21KB
                                                                • SHA256 d36c97a54cc929462116a60e6f028be6fa206f498d3a7cb56708860cb4d12138
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                e590444.rbs
                                                                • Path C:\Config.Msi\e590444.rbs
                                                                • Size 21KB
                                                                • SHA256 5b432bca8adf76ea365f5de6a3be31fbb0bfdbaa3918313e77ac07287a3b94cd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                keys.json
                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1000552327\keys.json
                                                                • Size 8KB
                                                                • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4748_1000552327\manifest.json
                                                                • Size 79B
                                                                • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                avcodec-61.dll
                                                                • Path C:\Program Files\obs-studio\bin\64bit\avcodec-61.dll
                                                                • Size 36.1MB
                                                                • SHA256 fa26d83d428e6d54b63063dd87457a6325999db0ec96c485893ed2e67ec9924f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                avformat-61.dll
                                                                • Path C:\Program Files\obs-studio\bin\64bit\avformat-61.dll
                                                                • Size 2.3MB
                                                                • SHA256 fbdb503ab5ec037d7df3418c8fad2c1cc6d1e60f4f25a8315a5b9b1870830aff
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                libcurl.dll
                                                                • Path C:\Program Files\obs-studio\bin\64bit\libcurl.dll
                                                                • Size 604KB
                                                                • SHA256 d487631e3f89195409ce1daaaa1561088f4d2ec8c8fbad0d0d5a8c0be1849709
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                obs.dll
                                                                • Path C:\Program Files\obs-studio\bin\64bit\obs.dll
                                                                • Size 1.1MB
                                                                • SHA256 632ff9eb4988a4736c0d5d9b7840af75e13d8f22e3664def55c794746771f013
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                obs64.exe
                                                                • Path C:\Program Files\obs-studio\bin\64bit\obs64.exe
                                                                • Size 5.2MB
                                                                • SHA256 d71dbed6e15c4497c212c7162a0c6a6346aff52f17cabe61ce2de5ed2877dfb1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                en-GB.ini
                                                                • Path C:\Program Files\obs-studio\data\obs-plugins\obs-qsv11\locale\en-GB.ini
                                                                • Size 1B
                                                                • SHA256 334359b90efed75da5f0ada1d5e6b256f4a6bd0aee7eb39c0f90182a021ffc8b
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                nn-NO.ini
                                                                • Path C:\Program Files\obs-studio\data\obs-plugins\obs-x264\locale\nn-NO.ini
                                                                • Size 18B
                                                                • SHA256 2a350d4fafb4a2c11614f7cb1bd9e59b305f1bf7446498ef11bfc6e8f25c12d7
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                obs-virtualcam-module32.dll
                                                                • Path C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module32.dll
                                                                • Size 188KB
                                                                • SHA256 d6976d7fd97558f889baa2fc56bf892070e342689f99283b57766bf5e128724c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                obs-virtualcam-module64.dll
                                                                • Path C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll
                                                                • Size 231KB
                                                                • SHA256 0ded56073d853f8c83e8b0cf57ff4e3ffa155554bb59f00522d58bb0f20c5632
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                media_pause.svg
                                                                • Path C:\Program Files\obs-studio\data\obs-studio\themes\Dark\media\media_pause.svg
                                                                • Size 526B
                                                                • SHA256 3a8ebca48196921a623b652c07344507f14fbc265a125ead876e89b28ad946fc
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                media.svg
                                                                • Path C:\Program Files\obs-studio\data\obs-studio\themes\Dark\sources\media.svg
                                                                • Size 558B
                                                                • SHA256 0c3127f56d6c3bfab49108c5d7f2e405f7e3c80f8ea9f5c407fa0902f02d919f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                media_pause.svg
                                                                • Path C:\Program Files\obs-studio\data\obs-studio\themes\Light\media\media_pause.svg
                                                                • Size 526B
                                                                • SHA256 d71fe1d398ab1a31a0906c1054d67b022954ff3df6a750bb6c5e66375ed9a642
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                OBS Studio.lnk
                                                                • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio.lnk
                                                                • Size 1KB
                                                                • SHA256 986e3663ff2a3104fb61fed56c7f7a7f8e7caa02ac7d38c4ac787c80a8d50d0c
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                state.rsm
                                                                • Path C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\state.rsm
                                                                • Size 960B
                                                                • SHA256 b5b91d69f2c8a83ed39c78d2aefa6a980ba20051b9ebfafe3e4a6dbf1ae8ada4
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                graphics-hook32.dll
                                                                • Path C:\ProgramData\obs-studio-hook\graphics-hook32.dll
                                                                • Size 242KB
                                                                • SHA256 5bea21ab3a4df3fa35af3b203eb59feafc4a193a4ba121ea0f8d42833e6cf104
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                graphics-hook64.dll
                                                                • Path C:\ProgramData\obs-studio-hook\graphics-hook64.dll
                                                                • Size 296KB
                                                                • SHA256 f89ade59480de0d55fcc100495d78e8e491bed469fab4dbd3d430837b58b27a5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                1ab7aa1b854459a7.v2
                                                                • Path C:\ProgramData\obs-studio\shader-cache\1ab7aa1b854459a7.v2
                                                                • Size 840B
                                                                • SHA256 d913ce5b4ace04b97bb8f05bf49d777a5c231ce0737dd5a63bcd3215d8c63bd9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                4545d6ee7b176b7d.v2
                                                                • Path C:\ProgramData\obs-studio\shader-cache\4545d6ee7b176b7d.v2
                                                                • Size 964B
                                                                • SHA256 b03ed79f9d040f865ac250b25a7a99ccebf244c5bb9d2bae4287f025bae8edc1
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                62281a72182c4ba6.v2
                                                                • Path C:\ProgramData\obs-studio\shader-cache\62281a72182c4ba6.v2
                                                                • Size 908B
                                                                • SHA256 5e7044f39d34e7f45770264f93647c2701bed73c904f8f233dc5ea94870b4403
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                6a755cdc9e6092ae.v2
                                                                • Path C:\ProgramData\obs-studio\shader-cache\6a755cdc9e6092ae.v2
                                                                • Size 840B
                                                                • SHA256 fccbe79d93005236718ff168a3ba2267d228b4f93cbc848a95eda3b8482b6697
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                7a6e3fecabdd460d.v2
                                                                • Path C:\ProgramData\obs-studio\shader-cache\7a6e3fecabdd460d.v2
                                                                • Size 888B
                                                                • SHA256 3b625049381ef7d97538364c28efbbde8e5eb28f010f077afa36ef5a74778333
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                7f0084f9c4106e16.v2
                                                                • Path C:\ProgramData\obs-studio\shader-cache\7f0084f9c4106e16.v2
                                                                • Size 1KB
                                                                • SHA256 ea9109f443a204812899fc727c2e3e779a9114136db0afd729deec2e817a2db0
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                8d390f4ad08d5c53.v2
                                                                • Path C:\ProgramData\obs-studio\shader-cache\8d390f4ad08d5c53.v2
                                                                • Size 936B
                                                                • SHA256 442e3643bab4f98c14485a18e239d2580f18989831f9cadd19129e3df30789e2
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                9ea4a251d7aa3c18.v2
                                                                • Path C:\ProgramData\obs-studio\shader-cache\9ea4a251d7aa3c18.v2
                                                                • Size 624B
                                                                • SHA256 6c40664272501dab61c1507f87b612d40819510781d05971735443cef8ebc95f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                cd9cfd09db70c3cd.v2
                                                                • Path C:\ProgramData\obs-studio\shader-cache\cd9cfd09db70c3cd.v2
                                                                • Size 960B
                                                                • SHA256 c0d87fc26b604a942bb03b1349794cb397ababfb1a14eb09fd8ea1de5144aed2
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                46c043a7-6078-415d-a300-a0d9cf721a76.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46c043a7-6078-415d-a300-a0d9cf721a76.tmp
                                                                • Size 414B
                                                                • SHA256 3cb61f12640b1700e8b63d44af5d096b228104277644eacf04413bfbf1946d7b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                BookmarkMergedSurfaceOrdering
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                • Size 6B
                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 3KB
                                                                • SHA256 5433a2909933a5e630bc0c4eb5aeb6248e6e3d54a712ef56a3a6849caadbf1b0
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index~RFe5887b9.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5887b9.TMP
                                                                • Size 3KB
                                                                • SHA256 f87a2308f96d45843199910214c751ccd65a709f562cf52d7b6300d4cfefe7dd
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SiteList-Enterprise.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                • Size 2B
                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                HubApps
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                • Size 106KB
                                                                • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                27aadda7-e960-402b-b6a5-221b2df94d6a.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\27aadda7-e960-402b-b6a5-221b2df94d6a.tmp
                                                                • Size 2B
                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 3KB
                                                                • SHA256 e2f164647219bbcd306ec2a5c1ad0e346fa7abcc8450e933e8baca38087f0755
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                Sdch Dictionaries
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                • Size 40B
                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 15KB
                                                                • SHA256 dacc64fa65b0950988c03c39a28aacb569d36daca4ac5febf3bbe8032cee8048
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Secure Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                • Size 35KB
                                                                • SHA256 87c26bed9224f3f3b0329f7394d14301ae45bfdc34eb33f73c750758684fff74
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                sync_diagnostic.log
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                • Size 23KB
                                                                • SHA256 ac288d2f26586692d363b647aba7c6db0fa83eedc61f667ac33a9925ab19d880
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                CURRENT
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                • Size 16B
                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                MANIFEST-000001
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                • Size 41B
                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 32KB
                                                                • SHA256 f2e4a0a334527872e2a40b3f7cee065211b3e71cd40cd3cae3e288be99caa7a9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 32KB
                                                                • SHA256 aa69c98f0a30073030c8501a6491658bb9c2de9e7c418f7b9a6e056d10e727d7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 26KB
                                                                • SHA256 fe5f1839782c67d67644c009e2489a706d8d9b58b4624d038ed1838420c15d76
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 27KB
                                                                • SHA256 92e47196699c7511ef0510ce09e1b85a6506f263507e1abf0ee39e4375cb1364
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 27KB
                                                                • SHA256 9a9a29d8358a92e79cb8125758e9cdb148b2fb6e15a626af796c3fdfc7569716
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 27KB
                                                                • SHA256 869a7043fb6b1d4f744a30dac0a0b8c1f9a651f96916ea1d06a9d80d4ceca189
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 27KB
                                                                • SHA256 3ee3a6a6dc1ea5366bcdb83a009383e12e5cf19277062a62af019e7a9acdfc16
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                • Size 1KB
                                                                • SHA256 2b5b026e592243181bedb6012f4eba79453b5c8b53256f4408732c96409fa588
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                • Size 147KB
                                                                • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                • Size 132B
                                                                • SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                • Size 2KB
                                                                • SHA256 b2fc2b55a84032e84615e3a5f5eefbfbd366a67b7ac15735c7775ff8a4ddca4f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                dd_vcredist_amd64_20260420020409.log
                                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420020409.log
                                                                • Size 18KB
                                                                • SHA256 c46c5341851f15dd8d7f313f13dac40fe35e53bc095600dd1a63ad0f0efd0ebb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                dd_vcredist_amd64_20260420020409_000_vcRuntimeMinimum_x64.log
                                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420020409_000_vcRuntimeMinimum_x64.log
                                                                • Size 2KB
                                                                • SHA256 3f20bf453e936dcf5b31d5f70f8f5aed959639df9f3a1156619b93fb9911ae0d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                dd_vcredist_amd64_20260420020409_001_vcRuntimeAdditional_x64.log
                                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420020409_001_vcRuntimeAdditional_x64.log
                                                                • Size 2KB
                                                                • SHA256 30d1fe9df0791251d12cfa816ad7ab5d48b53cab86d6639d128856a754815589
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                InstallOptions.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\InstallOptions.dll
                                                                • Size 15KB
                                                                • SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OBSInstallerUtils.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\OBSInstallerUtils.dll
                                                                • Size 426KB
                                                                • SHA256 1d84aa191fbbd842d5eeed302195579de1256a9acb980308bf31a631ac01e530
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                System.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\System.dll
                                                                • Size 12KB
                                                                • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                VC_redist.x64.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\VC_redist.x64.exe
                                                                • Size 24.2MB
                                                                • SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                check_for_64bit_visual_studio_2022_runtimes.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
                                                                • Size 10KB
                                                                • SHA256 b324a6025986306656fc2a03d0a3e9ed5917dfa7cf14fbfca888d65b39822074
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ioSpecial.ini
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\ioSpecial.ini
                                                                • Size 1KB
                                                                • SHA256 757eb60066ded774aa402323c361f9fbe27e2c988eb62e6d1c06956217332c7a
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                ioSpecial.ini
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\ioSpecial.ini
                                                                • Size 1KB
                                                                • SHA256 f70d68513c7134207173171931b204bda7fe0092a4427461d79a79c28c015622
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                ioSpecial.ini
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsd4BEB.tmp\ioSpecial.ini
                                                                • Size 1KB
                                                                • SHA256 2036d6283785b8fc04a4586af7ce3a31520db0f0a118715b0e9602b8f4300c5a
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                basic.ini
                                                                • Path C:\Users\Admin\AppData\Roaming\obs-studio\basic\profiles\Untitled\basic.ini
                                                                • Size 27B
                                                                • SHA256 7989006d0b1b17f5e4f4e20960713600d80612c3799963454e463f689a3cf613
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                services.json
                                                                • Path C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\rtmp-services\services.json
                                                                • Size 127KB
                                                                • SHA256 018f4ac62587809802e0593271b2581ff09da898f8ac64f02d1df5a8e4f8f976
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                compatibility.json
                                                                • Path C:\Users\Admin\AppData\Roaming\obs-studio\plugin_config\win-capture\compatibility.json
                                                                • Size 26KB
                                                                • SHA256 07a7d259d149c11219c1cb77ca293de495d32d6fac0f8e9cfb13ae29ff8d5db2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                user.ini
                                                                • Path C:\Users\Admin\AppData\Roaming\obs-studio\user.ini
                                                                • Size 1KB
                                                                • SHA256 df14297c3e6f3d25c84df8d769860059992c5601b775cd3c6b68149e516c32df
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                user.ini
                                                                • Path C:\Users\Admin\AppData\Roaming\obs-studio\user.ini
                                                                • Size 95B
                                                                • SHA256 90eb7d1ad2ba1c3f742eb01a0930d3e98a5fafcdbfebe4a30a429872721ef04e
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                user.ini
                                                                • Path C:\Users\Admin\AppData\Roaming\obs-studio\user.ini
                                                                • Size 1KB
                                                                • SHA256 7dbf2094f12ba194fc7234e8e36db3f6de0ffae6abd25bb5f26d422c987ce129
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                logo.png
                                                                • Path C:\Windows\Temp\{2AD45CB5-7D87-40F7-BCC9-D5F2455707F6}\.ba\logo.png
                                                                • Size 1KB
                                                                • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                wixstdba.dll
                                                                • Path C:\Windows\Temp\{2AD45CB5-7D87-40F7-BCC9-D5F2455707F6}\.ba\wixstdba.dll
                                                                • Size 191KB
                                                                • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                • Path C:\Windows\Temp\{2AD45CB5-7D87-40F7-BCC9-D5F2455707F6}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                • Size 5.4MB
                                                                • SHA256 cc001c20f85e16015e0d23eb0c3a9bc3c3cdcc1adda53f88ac77dd29705ba01a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                cab5046A8AB272BF37297BB7928664C9503
                                                                • Path C:\Windows\Temp\{2AD45CB5-7D87-40F7-BCC9-D5F2455707F6}\cab5046A8AB272BF37297BB7928664C9503
                                                                • Size 962KB
                                                                • SHA256 8fafd6d0754ee53125902df1b67ef2db86eb7af4c097522f2fb58443501fecdd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                vcRuntimeAdditional_x64
                                                                • Path C:\Windows\Temp\{2AD45CB5-7D87-40F7-BCC9-D5F2455707F6}\vcRuntimeAdditional_x64
                                                                • Size 188KB
                                                                • SHA256 7489cdde6a0c8aadb3253f22c460c2dc8099ba677f42d46b277f7040327c9b28
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                vcRuntimeMinimum_x64
                                                                • Path C:\Windows\Temp\{2AD45CB5-7D87-40F7-BCC9-D5F2455707F6}\vcRuntimeMinimum_x64
                                                                • Size 188KB
                                                                • SHA256 e55a6c147daab01c66aed5e6be0c990bbed0cb78f1c0898373713343ef8556cd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                VC_redist.x64.exe
                                                                • Path C:\Windows\Temp\{44F124C3-B476-490E-843D-D23362C6FF65}\.cr\VC_redist.x64.exe
                                                                • Size 635KB
                                                                • SHA256 8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                license.rtf
                                                                • Path C:\Windows\Temp\{7FE4EE6C-F6F6-4AAE-93A8-08D925B5F4BD}\.ba\license.rtf
                                                                • Size 9KB
                                                                • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                thm.wxl
                                                                • Path C:\Windows\Temp\{7FE4EE6C-F6F6-4AAE-93A8-08D925B5F4BD}\.ba\thm.wxl
                                                                • Size 2KB
                                                                • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                thm.xml
                                                                • Path C:\Windows\Temp\{7FE4EE6C-F6F6-4AAE-93A8-08D925B5F4BD}\.ba\thm.xml
                                                                • Size 8KB
                                                                • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                memory/764-225-0x0000021F098F0000-0x0000021F0999D000-memory.dmp
                                                                Download

                                                                memory/1080-6415-0x0000016959160000-0x000001695920D000-memory.dmp
                                                                Download

                                                                memory/1080-7450-0x0000016959160000-0x000001695920D000-memory.dmp
                                                                Download

                                                                memory/1480-3044-0x00000000008D0000-0x0000000000947000-memory.dmp
                                                                Download

                                                                memory/3292-7476-0x00007FF643910000-0x00007FF643E3F000-memory.dmp
                                                                Download

                                                                memory/3292-7477-0x00007FFF6A200000-0x00007FFF6A82C000-memory.dmp
                                                                Download

                                                                memory/3292-7479-0x00007FFF4C250000-0x00007FFF4C260000-memory.dmp
                                                                Download

                                                                memory/3292-7478-0x00007FF643910000-0x00007FF643E3F000-memory.dmp
                                                                Download

                                                                memory/4068-6811-0x000001C6AD590000-0x000001C6AD59C000-memory.dmp
                                                                Download

                                                                memory/4068-6813-0x000001C6AD7C0000-0x000001C6AD86D000-memory.dmp
                                                                Download

                                                                memory/4696-3047-0x00000000008D0000-0x0000000000947000-memory.dmp
                                                                Download

                                                                memory/5704-3046-0x00000000008D0000-0x0000000000947000-memory.dmp
                                                                Download