Overview

overview

7

Static

static

3

OBS-Studio...er.exe

windows10-2004-x64

7

OBS-Studio...er.exe

windows11-21h2-x64

7

$APPDATA/o...32.dll

windows10-2004-x64

3

$APPDATA/o...32.dll

windows11-21h2-x64

3

$APPDATA/o...64.dll

windows10-2004-x64

1

$APPDATA/o...64.dll

windows11-21h2-x64

1

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...64.exe

windows10-2004-x64

4

$PLUGINSDI...64.exe

windows11-21h2-x64

4

$PLUGINSDI...es.exe

windows10-2004-x64

1

$PLUGINSDI...es.exe

windows11-21h2-x64

1

bin/64bit/Qt6Core.dll

windows10-2004-x64

1

bin/64bit/Qt6Core.dll

windows11-21h2-x64

1

bin/64bit/Qt6Gui.dll

windows10-2004-x64

1

bin/64bit/Qt6Gui.dll

windows11-21h2-x64

1

bin/64bit/...rk.dll

windows10-2004-x64

1

bin/64bit/...rk.dll

windows11-21h2-x64

1

bin/64bit/Qt6Svg.dll

windows10-2004-x64

1

bin/64bit/Qt6Svg.dll

windows11-21h2-x64

1

bin/64bit/...ts.dll

windows10-2004-x64

1

bin/64bit/...ts.dll

windows11-21h2-x64

1

bin/64bit/Qt6Xml.dll

windows10-2004-x64

1

bin/64bit/Qt6Xml.dll

windows11-21h2-x64

1

bin/64bit/...61.dll

windows10-2004-x64

1

bin/64bit/...61.dll

windows11-21h2-x64

1

bin/64bit/...61.dll

windows10-2004-x64

1

bin/64bit/...61.dll

windows11-21h2-x64

1

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/05/2026, 01:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OBS-Studio-31.1.2-Windows-x64-Installer.exe
  • Size 150.0MB
  • Sample260504-bfzb2aew4p
  • SHA256 2505c88de000799c274e8abd09743295b23a4b5c5bf5d3a3c294b2e001585dba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 28 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\OBS-Studio-31.1.2-Windows-x64-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\OBS-Studio-31.1.2-Windows-x64-Installer.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
      C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
      2⤵
      • Executes dropped EXE
      PID:4752
    • C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\VC_redist.x64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\VC_redist.x64.exe" /quiet /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:984
      • C:\Windows\Temp\{AC0DDD3B-E2C6-4F8C-BFFF-4AFC58CB2508}\.cr\VC_redist.x64.exe
        "C:\Windows\Temp\{AC0DDD3B-E2C6-4F8C-BFFF-4AFC58CB2508}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /quiet /norestart
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:216
        • C:\Windows\Temp\{CCF8BCCA-56E2-4066-B14D-0D102DFB7085}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{CCF8BCCA-56E2-4066-B14D-0D102DFB7085}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{41E08A92-17F7-4D53-9479-C8E44347CEDD} {8128ADF7-5CA7-4745-8AF2-AE4F84C151D5} 216
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3772
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module32.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:4540
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3920
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:2200
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio.lnk"
      2⤵
        PID:408
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3468
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4256
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:6076
      • C:\Program Files\obs-studio\bin\64bit\obs64.exe
        "C:\Program Files\obs-studio\bin\64bit\obs64.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4752
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://obsproject.com/visual-studio-2022-runtimes
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5400
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://obsproject.com/visual-studio-2022-runtimes
            4⤵
            • Drops file in Program Files directory
            • Checks processor information in registry
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5284
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffc5678c188,0x7ffc5678c194,0x7ffc5678c1a0
              5⤵
                PID:5368
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,9688039277007576711,10796939850958659300,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
                5⤵
                • System Time Discovery
                PID:3284
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,11403235232788382066,17037515092168292059,262144 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
                5⤵
                • Loads dropped DLL
                PID:4392
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,7952387715636366458,7691244101770480177,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
                5⤵
                  PID:4336
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,17950605608424632622,13785489930382133660,2097152 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
                  5⤵
                    PID:4312
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,3013880263073382879,12723203847440833880,2097152 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
                    5⤵
                      PID:4664
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,3505098203338520823,7531395189062442590,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
                      5⤵
                        PID:1128
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,3184200273362722043,18435181985032905884,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
                        5⤵
                          PID:1188
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,12566493828182933120,18334257453950646805,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
                          5⤵
                            PID:3048
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,12566493828182933120,18334257453950646805,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
                            5⤵
                              PID:3536
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,1991263122375357191,14950882035205522238,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
                              5⤵
                                PID:5148
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,2435446426603843059,4742624572290361888,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
                                5⤵
                                  PID:2520
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,10312477992977850763,7143178625797221557,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
                                  5⤵
                                    PID:4920
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,9195901871493932613,12600856763960809386,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
                                    5⤵
                                      PID:3840
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,8279899278257327459,8729459054008656915,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
                                      5⤵
                                        PID:5588
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,14536197236348480346,8791821449295087829,524288 --field-trial-handle=2296,i,12743897805142342348,11453793612334154535,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
                                        5⤵
                                          PID:4204
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                  1⤵
                                    PID:5920
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                    1⤵
                                      PID:3944

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          Qt6Core.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\Qt6Core.dll
                                          • Size 5.8MB
                                          • SHA256 16933095dac0db9be28ed7c1bec2d15dd97d373482e4758563087b358443d52f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Qt6Gui.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\Qt6Gui.dll
                                          • Size 7.6MB
                                          • SHA256 d5cce83d78f34cddabead240a64d6e816d9d5096b9919080ddd2bec1486a9bcd
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Qt6Network.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\Qt6Network.dll
                                          • Size 1.7MB
                                          • SHA256 5966d71a23a5a5f825aae2aa18d7f5b8e995334974af28697565547e9f4946e0
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Qt6Svg.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\Qt6Svg.dll
                                          • Size 506KB
                                          • SHA256 e0ca09dfb034b52e4c908abf63d09c9b4be56f680e3179543104d5bf03070e92
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Qt6Widgets.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\Qt6Widgets.dll
                                          • Size 6.2MB
                                          • SHA256 1a5dcc41f66a7006ab707cb99308ad8c68333b253f8a7f2808439fffc6ec6d04
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Qt6Xml.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\Qt6Xml.dll
                                          • Size 147KB
                                          • SHA256 5811dc4965f498d7d1ac1f450a519c90ded5bf4ee65a5413b27e1310a91104b2
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          avcodec-61.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\avcodec-61.dll
                                          • Size 36.1MB
                                          • SHA256 b41040a961e75ec79df35725fde1cd7f091155fd83565cf510d6b1a1aa8b01c0
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          avformat-61.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\avformat-61.dll
                                          • Size 2.3MB
                                          • SHA256 58174a80217643212846c2bebb5507f66a8f7c5477d29d520d90dad3d0857eab
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          avutil-59.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\avutil-59.dll
                                          • Size 889KB
                                          • SHA256 1c81137d96fb9fc630b8a6afb442c96673065df960576156804dba9470c71b86
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          libcurl.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\libcurl.dll
                                          • Size 604KB
                                          • SHA256 209993d607ed888c3dff5bf8d7d70d75c672dfe5d426a394095c0ae2d77d4367
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          librist.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\librist.dll
                                          • Size 214KB
                                          • SHA256 521085fa7586d2ed98c214d6ef25c7b64d225089167ec79fd80dc905cc431456
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          libx264-164.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\libx264-164.dll
                                          • Size 2.1MB
                                          • SHA256 3397e9acd684ace5ed1aa47ec5e1edc19088a8a2d5ec1956b77d05804bba6bbe
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          obs-frontend-api.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\obs-frontend-api.dll
                                          • Size 39KB
                                          • SHA256 a133541766e825939a8266b183edfef2875a693c36a70375e51c5ee410f06617
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          obs.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\obs.dll
                                          • Size 1.1MB
                                          • SHA256 effc57cf5c561313010964948560eff07fb477bd4cc623ec5955b12d8fe72644
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          obs64.exe
                                          • Path C:\Program Files\obs-studio\bin\64bit\obs64.exe
                                          • Size 5.1MB
                                          • SHA256 807346b0f320b24fe1624d1de96f27082debfe417225450f9bfbf0d5cf0ae478
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          srt.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\srt.dll
                                          • Size 728KB
                                          • SHA256 3339135f5e26d94cbab98dc56ff3318db2f930980d99aec98fb988ea606f2eff
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          swresample-5.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\swresample-5.dll
                                          • Size 129KB
                                          • SHA256 d081cdd1b012fc286714940e0a3e02bf818b542edea23ee90ff228e8b1de08b9
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          swscale-8.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\swscale-8.dll
                                          • Size 616KB
                                          • SHA256 d4c446c50f207a55fdd4c03997eaa5acffab85ae4d79643501d31a099a67cf6f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          w32-pthreads.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\w32-pthreads.dll
                                          • Size 62KB
                                          • SHA256 04da7265bd2858e77b37e307ab216db47c51f2b45dd44c119e78e36879e22d5a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          zlib.dll
                                          • Path C:\Program Files\obs-studio\bin\64bit\zlib.dll
                                          • Size 91KB
                                          • SHA256 80463ea4fb039f11627ee06a0234024460a52ac7bb83c524975acdf71781f4d6
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          en-GB.ini
                                          • Path C:\Program Files\obs-studio\data\obs-plugins\nv-filters\locale\en-GB.ini
                                          • Size 1B
                                          • SHA256 334359b90efed75da5f0ada1d5e6b256f4a6bd0aee7eb39c0f90182a021ffc8b
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          rtx_greenscreen.effect
                                          • Path C:\Program Files\obs-studio\data\obs-plugins\obs-filters\rtx_greenscreen.effect
                                          • Size 3KB
                                          • SHA256 4504ba84ad99e964d99bbf6f422295a764c37a9d220bdbe53d410f990d8fc503
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          oc-FR.ini
                                          • Path C:\Program Files\obs-studio\data\obs-plugins\obs-qsv11\locale\oc-FR.ini
                                          • Size 18B
                                          • SHA256 54550f5495ca78de8ab1b4d32ddec042077823cb5654808e9f9f003857125450
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          obs-virtualcam-module32.dll
                                          • Path C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module32.dll
                                          • Size 188KB
                                          • SHA256 fe85d507c4e39707d164c91970bf0817237b3c5e5b934ef50ba88d8518eb0072
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          obs-virtualcam-module64.dll
                                          • Path C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll
                                          • Size 231KB
                                          • SHA256 21d05c4a7f5f7723be5a61a8ca174d2f20ed71afa3013810bcb4cd3338b653d4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          mute.svg
                                          • Path C:\Program Files\obs-studio\data\obs-studio\themes\Light\mute.svg
                                          • Size 1KB
                                          • SHA256 ab6ea7c4f98008a19662c171a03fffd0cba96a7abca34896c67de841e81727e1
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          media.svg
                                          • Path C:\Program Files\obs-studio\data\obs-studio\themes\Light\sources\media.svg
                                          • Size 558B
                                          • SHA256 16440c1cf957bf20c8cb01d2a490ff46d4f2812376275d35051b659b62ac888d
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          sizegrip.png
                                          • Path C:\Program Files\obs-studio\data\obs-studio\themes\Rachni\sizegrip.png
                                          • Size 107B
                                          • SHA256 31582f8295152ee22f44910556be5c2280934214a0ea3db73897a4c93cef34e3
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          obs-text.pdb
                                          • Path C:\Program Files\obs-studio\obs-plugins\64bit\obs-text.pdb
                                          • Size 164KB
                                          • SHA256 72ef273fee377be2fa7f1e644bc4f24f21e6792c1d7e2007f6ef1cf110d3edb4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          OBS Studio.lnk
                                          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio.lnk
                                          • Size 1KB
                                          • SHA256 3039afd3234115c08c5fe879b0c745fc128e2b6b19c3efa5870013315f2e2676
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          graphics-hook64.dll
                                          • Path C:\ProgramData\obs-studio-hook\graphics-hook64.dll
                                          • Size 296KB
                                          • SHA256 945c312cda7b4551dbf7515c36b17907334b318f480c10f3621626e937dcb9f4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          obs-vulkan32.json
                                          • Path C:\ProgramData\obs-studio-hook\obs-vulkan32.json
                                          • Size 514B
                                          • SHA256 c16e0707ae66ad71e8a0720aeb6e6997a1017f19762333452aef692115a9ab41
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          obs-vulkan64.json
                                          • Path C:\ProgramData\obs-studio-hook\obs-vulkan64.json
                                          • Size 514B
                                          • SHA256 7b6b0813fb58b276847a8583eb5c3f94aee7d7ad0ae3a1ef6133d5d8771f20f4
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          • Size 280B
                                          • SHA256 ce180cf0fce9a4a96685bbb0c58efb5750080d37ce961b69a74ae38b49eb68c9
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          • Size 280B
                                          • SHA256 924e96ec20750cb6a5239ec6615014ae8ebb3de4d3c60595d6c95e7ccd197fe9
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          BookmarkMergedSurfaceOrdering
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                          • Size 6B
                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          BrowsingTopicsState
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                          • Size 414B
                                          • SHA256 2f93278ad19604e63aaac720b6209a7f1b7b0e72dfb10d1c654675710d48aafa
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          the-real-index
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                          • Size 2KB
                                          • SHA256 84601c9d40b8fbb28e95f976c885a1b5780d72a75dfbc50c979eea93af7a8b79
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          the-real-index~RFe5a2e93.TMP
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2e93.TMP
                                          • Size 2KB
                                          • SHA256 c5a41c9490d66251a42aaf48350e9eca75fcb594e27077e9006d83fe5680a728
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          SiteList-Enterprise.json
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                          • Size 2B
                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          HubApps
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                          • Size 106KB
                                          • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          SCT Auditing Pending Reports
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                          • Size 2B
                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Sdch Dictionaries
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                          • Size 40B
                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          • Size 15KB
                                          • SHA256 a2c0b6c556a74ac9c1407ae9e4e60ae320de64745a1a839d3ed9ec8026500648
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Secure Preferences
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                          • Size 35KB
                                          • SHA256 7a2c487f24095d9909096418494b06ae54172aecce77c34d54de257c6fb8a143
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          sync_diagnostic.log
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                          • Size 26KB
                                          • SHA256 4fa79e309bafe4d13c959c249c0de8d46700155f3d1fd24b4e596635ebe7259f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          CURRENT
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                          • Size 16B
                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          MANIFEST-000001
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                          • Size 41B
                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          • Size 26KB
                                          • SHA256 2b1ccf8d72d4166b7531c8f7ea61749d6e722297142ac08c00be33f5e3a476e3
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          • Size 27KB
                                          • SHA256 04fe89f55d44697c8f7f6a82892184aaadf96d2d1f484b36472fc3e0ba3c5788
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          • Size 27KB
                                          • SHA256 5d7363087d6bcc9f3bc5d231675c007adadbc8c7c71a166bc25c27bc60b26b07
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          • Size 27KB
                                          • SHA256 7037d7d19aad7610515d23e4ab6e35030dbe6f1199f963b23a6d47137f1475ec
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                          • Size 147KB
                                          • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          metadata.json
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                          • Size 132B
                                          • SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                          • Size 2KB
                                          • SHA256 479c6804f8f6c2ff017de138323a0acce31a210969ae6655f6d935a07ccb07ab
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          InstallOptions.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\InstallOptions.dll
                                          • Size 15KB
                                          • SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          OBSInstallerUtils.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\OBSInstallerUtils.dll
                                          • Size 426KB
                                          • SHA256 1d84aa191fbbd842d5eeed302195579de1256a9acb980308bf31a631ac01e530
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          System.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\System.dll
                                          • Size 12KB
                                          • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          VC_redist.x64.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\VC_redist.x64.exe
                                          • Size 24.2MB
                                          • SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          check_for_64bit_visual_studio_2022_runtimes.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
                                          • Size 10KB
                                          • SHA256 b324a6025986306656fc2a03d0a3e9ed5917dfa7cf14fbfca888d65b39822074
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          ioSpecial.ini
                                          • Path C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\ioSpecial.ini
                                          • Size 1KB
                                          • SHA256 06b0e075a3ca2032e70f1244e90d1ba532e7a64bebbdd4de8e3d1412499d4b5f
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          ioSpecial.ini
                                          • Path C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\ioSpecial.ini
                                          • Size 1KB
                                          • SHA256 16f4767b7e63b597c4b1944284f1b69d67a06d193af2ccf303f1caf1acb16398
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          ioSpecial.ini
                                          • Path C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\ioSpecial.ini
                                          • Size 1KB
                                          • SHA256 87b22c1308f5e75dc02e47805aa8173f8d0d5ebca93b7e52d4fe4844828bdbbb
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          ioSpecial.ini
                                          • Path C:\Users\Admin\AppData\Local\Temp\nsj752D.tmp\ioSpecial.ini
                                          • Size 1KB
                                          • SHA256 df96c19978e2dc7591ffdee9a27074a1e9c30901da9ab9caa2b3010db8b527eb
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          VC_redist.x64.exe
                                          • Path C:\Windows\Temp\{AC0DDD3B-E2C6-4F8C-BFFF-4AFC58CB2508}\.cr\VC_redist.x64.exe
                                          • Size 635KB
                                          • SHA256 8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          logo.png
                                          • Path C:\Windows\Temp\{CCF8BCCA-56E2-4066-B14D-0D102DFB7085}\.ba\logo.png
                                          • Size 1KB
                                          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          wixstdba.dll
                                          • Path C:\Windows\Temp\{CCF8BCCA-56E2-4066-B14D-0D102DFB7085}\.ba\wixstdba.dll
                                          • Size 191KB
                                          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          memory/2200-6500-0x0000000000E50000-0x0000000000EFC000-memory.dmp
                                          Download

                                          memory/3468-2822-0x000001C4DFA00000-0x000001C4DFA08000-memory.dmp
                                          Download

                                          memory/4752-6562-0x0000027839120000-0x0000027839128000-memory.dmp
                                          Download

                                          memory/4752-6559-0x00007FFC58A30000-0x00007FFC5905C000-memory.dmp
                                          Download

                                          memory/4752-6558-0x00007FF7ED240000-0x00007FF7ED758000-memory.dmp
                                          Download

                                          memory/4752-6560-0x00007FF7ED240000-0x00007FF7ED758000-memory.dmp
                                          Download

                                          memory/5920-6601-0x00000168AEA20000-0x00000168AEBC1000-memory.dmp
                                          Download