Overview

overview

7

Static

static

3

OBS-Studio...er.exe

windows10-2004-x64

7

OBS-Studio...er.exe

windows11-21h2-x64

7

$APPDATA/o...32.dll

windows10-2004-x64

3

$APPDATA/o...32.dll

windows11-21h2-x64

3

$APPDATA/o...64.dll

windows10-2004-x64

1

$APPDATA/o...64.dll

windows11-21h2-x64

1

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...64.exe

windows10-2004-x64

4

$PLUGINSDI...64.exe

windows11-21h2-x64

4

$PLUGINSDI...es.exe

windows10-2004-x64

1

$PLUGINSDI...es.exe

windows11-21h2-x64

1

bin/64bit/Qt6Core.dll

windows10-2004-x64

1

bin/64bit/Qt6Core.dll

windows11-21h2-x64

1

bin/64bit/Qt6Gui.dll

windows10-2004-x64

1

bin/64bit/Qt6Gui.dll

windows11-21h2-x64

1

bin/64bit/...rk.dll

windows10-2004-x64

1

bin/64bit/...rk.dll

windows11-21h2-x64

1

bin/64bit/Qt6Svg.dll

windows10-2004-x64

1

bin/64bit/Qt6Svg.dll

windows11-21h2-x64

1

bin/64bit/...ts.dll

windows10-2004-x64

1

bin/64bit/...ts.dll

windows11-21h2-x64

1

bin/64bit/Qt6Xml.dll

windows10-2004-x64

1

bin/64bit/Qt6Xml.dll

windows11-21h2-x64

1

bin/64bit/...61.dll

windows10-2004-x64

1

bin/64bit/...61.dll

windows11-21h2-x64

1

bin/64bit/...61.dll

windows10-2004-x64

1

bin/64bit/...61.dll

windows11-21h2-x64

1

Analysis

  • max time kernel
    85s
  • max time network
    88s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/05/2026, 01:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OBS-Studio-31.1.2-Windows-x64-Installer.exe
  • Size 150.0MB
  • Sample260504-bfzb2aew4p
  • SHA256 2505c88de000799c274e8abd09743295b23a4b5c5bf5d3a3c294b2e001585dba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 29 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\OBS-Studio-31.1.2-Windows-x64-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\OBS-Studio-31.1.2-Windows-x64-Installer.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
      C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
      2⤵
      • Executes dropped EXE
      PID:5088
    • C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\VC_redist.x64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\VC_redist.x64.exe" /quiet /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5648
      • C:\Windows\Temp\{BBC8C651-B440-43BC-B46B-FB9D650D0CE6}\.cr\VC_redist.x64.exe
        "C:\Windows\Temp\{BBC8C651-B440-43BC-B46B-FB9D650D0CE6}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\VC_redist.x64.exe" -burn.filehandle.attached=732 -burn.filehandle.self=736 /quiet /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Windows\Temp\{12893824-0362-42BE-AFA6-96BF21B4B0FC}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{12893824-0362-42BE-AFA6-96BF21B4B0FC}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B7EC6B66-80A1-402B-9805-55B58BE83098} {D8518EDE-5753-4167-9565-08FEA3592372} 1640
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5388
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module32.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:5880
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5816
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:5548
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio.lnk"
      2⤵
        PID:3800
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:780
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5312
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3208
      • C:\Program Files\obs-studio\bin\64bit\obs64.exe
        "C:\Program Files\obs-studio\bin\64bit\obs64.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://obsproject.com/visual-studio-2022-runtimes
          3⤵
          • Drops file in Windows directory
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1556
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x308,0x7ffb1b1cc188,0x7ffb1b1cc194,0x7ffb1b1cc1a0
            4⤵
              PID:4784
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,14801574871984102402,8640483535235350045,524288 --field-trial-handle=2620,i,9241059721522927837,14716288052026256867,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:11
              4⤵
              • System Time Discovery
              PID:2452
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,13804840353918172284,923550927218679257,262144 --field-trial-handle=2620,i,9241059721522927837,14716288052026256867,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
              4⤵
              • Loads dropped DLL
              PID:4764
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,3159670715364441796,11754193049962771964,524288 --field-trial-handle=2620,i,9241059721522927837,14716288052026256867,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:13
              4⤵
                PID:2500
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,4792908416877070131,10677909145064360447,2097152 --field-trial-handle=2620,i,9241059721522927837,14716288052026256867,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
                4⤵
                  PID:3360
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,3807246591199603100,7658080248105686921,2097152 --field-trial-handle=2620,i,9241059721522927837,14716288052026256867,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
                  4⤵
                    PID:1412
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,9440247865858157266,2658553811654510142,524288 --field-trial-handle=2620,i,9241059721522927837,14716288052026256867,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
                    4⤵
                      PID:4716
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,10538277631527388585,7939307951462764963,524288 --field-trial-handle=2620,i,9241059721522927837,14716288052026256867,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
                      4⤵
                        PID:1036
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,7906637157849479640,15043324721866083215,524288 --field-trial-handle=2620,i,9241059721522927837,14716288052026256867,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5160
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                          cookie_exporter.exe --cookie-json=1008
                          5⤵
                            PID:2748
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,15172341280682929227,6461617669442943416,524288 --field-trial-handle=2620,i,9241059721522927837,14716288052026256867,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
                          4⤵
                            PID:6052
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,15172341280682929227,6461617669442943416,524288 --field-trial-handle=2620,i,9241059721522927837,14716288052026256867,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
                            4⤵
                              PID:5408
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                        1⤵
                          PID:2360
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                          1⤵
                            PID:2104

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                Qt6Core.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\Qt6Core.dll
                                • Size 5.8MB
                                • SHA256 16933095dac0db9be28ed7c1bec2d15dd97d373482e4758563087b358443d52f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Qt6Gui.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\Qt6Gui.dll
                                • Size 7.6MB
                                • SHA256 d5cce83d78f34cddabead240a64d6e816d9d5096b9919080ddd2bec1486a9bcd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Qt6Network.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\Qt6Network.dll
                                • Size 1.7MB
                                • SHA256 5966d71a23a5a5f825aae2aa18d7f5b8e995334974af28697565547e9f4946e0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Qt6Svg.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\Qt6Svg.dll
                                • Size 506KB
                                • SHA256 e0ca09dfb034b52e4c908abf63d09c9b4be56f680e3179543104d5bf03070e92
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Qt6Widgets.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\Qt6Widgets.dll
                                • Size 6.2MB
                                • SHA256 1a5dcc41f66a7006ab707cb99308ad8c68333b253f8a7f2808439fffc6ec6d04
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Qt6Xml.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\Qt6Xml.dll
                                • Size 147KB
                                • SHA256 5811dc4965f498d7d1ac1f450a519c90ded5bf4ee65a5413b27e1310a91104b2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                avcodec-61.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\avcodec-61.dll
                                • Size 36.1MB
                                • SHA256 b41040a961e75ec79df35725fde1cd7f091155fd83565cf510d6b1a1aa8b01c0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                avformat-61.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\avformat-61.dll
                                • Size 2.3MB
                                • SHA256 58174a80217643212846c2bebb5507f66a8f7c5477d29d520d90dad3d0857eab
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                avutil-59.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\avutil-59.dll
                                • Size 889KB
                                • SHA256 1c81137d96fb9fc630b8a6afb442c96673065df960576156804dba9470c71b86
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libcurl.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\libcurl.dll
                                • Size 604KB
                                • SHA256 209993d607ed888c3dff5bf8d7d70d75c672dfe5d426a394095c0ae2d77d4367
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                librist.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\librist.dll
                                • Size 214KB
                                • SHA256 521085fa7586d2ed98c214d6ef25c7b64d225089167ec79fd80dc905cc431456
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libx264-164.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\libx264-164.dll
                                • Size 2.1MB
                                • SHA256 3397e9acd684ace5ed1aa47ec5e1edc19088a8a2d5ec1956b77d05804bba6bbe
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                obs-frontend-api.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\obs-frontend-api.dll
                                • Size 39KB
                                • SHA256 a133541766e825939a8266b183edfef2875a693c36a70375e51c5ee410f06617
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                obs.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\obs.dll
                                • Size 1.1MB
                                • SHA256 effc57cf5c561313010964948560eff07fb477bd4cc623ec5955b12d8fe72644
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                obs64.exe
                                • Path C:\Program Files\obs-studio\bin\64bit\obs64.exe
                                • Size 5.1MB
                                • SHA256 807346b0f320b24fe1624d1de96f27082debfe417225450f9bfbf0d5cf0ae478
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                srt.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\srt.dll
                                • Size 728KB
                                • SHA256 3339135f5e26d94cbab98dc56ff3318db2f930980d99aec98fb988ea606f2eff
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                swresample-5.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\swresample-5.dll
                                • Size 129KB
                                • SHA256 d081cdd1b012fc286714940e0a3e02bf818b542edea23ee90ff228e8b1de08b9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                swscale-8.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\swscale-8.dll
                                • Size 616KB
                                • SHA256 d4c446c50f207a55fdd4c03997eaa5acffab85ae4d79643501d31a099a67cf6f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                w32-pthreads.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\w32-pthreads.dll
                                • Size 62KB
                                • SHA256 04da7265bd2858e77b37e307ab216db47c51f2b45dd44c119e78e36879e22d5a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                zlib.dll
                                • Path C:\Program Files\obs-studio\bin\64bit\zlib.dll
                                • Size 91KB
                                • SHA256 80463ea4fb039f11627ee06a0234024460a52ac7bb83c524975acdf71781f4d6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                en-GB.ini
                                • Path C:\Program Files\obs-studio\data\obs-plugins\nv-filters\locale\en-GB.ini
                                • Size 1B
                                • SHA256 334359b90efed75da5f0ada1d5e6b256f4a6bd0aee7eb39c0f90182a021ffc8b
                                • MD5 SHA1 SHA512
                                Submit Download

                                oc-FR.ini
                                • Path C:\Program Files\obs-studio\data\obs-plugins\obs-ffmpeg\locale\oc-FR.ini
                                • Size 18B
                                • SHA256 54550f5495ca78de8ab1b4d32ddec042077823cb5654808e9f9f003857125450
                                • MD5 SHA1 SHA512
                                Submit Download

                                color.effect
                                • Path C:\Program Files\obs-studio\data\obs-plugins\obs-filters\color.effect
                                • Size 3KB
                                • SHA256 c05f4ca3b03e3ab0cbaf13555dcad179a86f0b2a9460bad8c8da94d2c5b973cb
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                rtx_greenscreen.effect
                                • Path C:\Program Files\obs-studio\data\obs-plugins\obs-filters\rtx_greenscreen.effect
                                • Size 3KB
                                • SHA256 4504ba84ad99e964d99bbf6f422295a764c37a9d220bdbe53d410f990d8fc503
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                package-schema.json
                                • Path C:\Program Files\obs-studio\data\obs-plugins\win-capture\schema\package-schema.json
                                • Size 1KB
                                • SHA256 524437addbda00d3a64413b639847211054905a959786a4a5609fcbbb1f101f5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                obs-virtualcam-module32.dll
                                • Path C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module32.dll
                                • Size 188KB
                                • SHA256 fe85d507c4e39707d164c91970bf0817237b3c5e5b934ef50ba88d8518eb0072
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                obs-virtualcam-module64.dll
                                • Path C:\Program Files\obs-studio\data\obs-plugins\win-dshow\obs-virtualcam-module64.dll
                                • Size 231KB
                                • SHA256 21d05c4a7f5f7723be5a61a8ca174d2f20ed71afa3013810bcb4cd3338b653d4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                media.svg
                                • Path C:\Program Files\obs-studio\data\obs-studio\themes\Dark\sources\media.svg
                                • Size 558B
                                • SHA256 0c3127f56d6c3bfab49108c5d7f2e405f7e3c80f8ea9f5c407fa0902f02d919f
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                media_pause.svg
                                • Path C:\Program Files\obs-studio\data\obs-studio\themes\Light\media\media_pause.svg
                                • Size 526B
                                • SHA256 d71fe1d398ab1a31a0906c1054d67b022954ff3df6a750bb6c5e66375ed9a642
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                mute.svg
                                • Path C:\Program Files\obs-studio\data\obs-studio\themes\Light\mute.svg
                                • Size 1KB
                                • SHA256 ab6ea7c4f98008a19662c171a03fffd0cba96a7abca34896c67de841e81727e1
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                media.svg
                                • Path C:\Program Files\obs-studio\data\obs-studio\themes\Light\sources\media.svg
                                • Size 558B
                                • SHA256 16440c1cf957bf20c8cb01d2a490ff46d4f2812376275d35051b659b62ac888d
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                OBS Studio.lnk
                                • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio.lnk
                                • Size 1KB
                                • SHA256 df86b19ab0bcc3052db2dcd86ec4811b3cf1a018aab63f9c0aa12a19fdea658f
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                • Size 280B
                                • SHA256 4f20f916a46d879220b75412e974c6df37fba8f0e80e78f071a3124fdb665aee
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                • Size 280B
                                • SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                0239131e-9126-484f-86a2-e4c0498eea88.tmp
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0239131e-9126-484f-86a2-e4c0498eea88.tmp
                                • Size 15KB
                                • SHA256 b1d5debd1b32f84c5a0da93eac65f94db2bebbd92864229af902fd5f0c703e41
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                BookmarkMergedSurfaceOrdering
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                • Size 6B
                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                • MD5 SHA1 SHA512
                                Submit Download

                                BrowsingTopicsState
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                • Size 414B
                                • SHA256 684c468c3e843ba50d69f6c89fb284710ed5f876968da3af9a10bf5f4d92c4c1
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                SiteList-Enterprise.json
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                • Size 2B
                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                • MD5 SHA1 SHA512
                                Submit Download

                                HubApps
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                • Size 106KB
                                • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                SCT Auditing Pending Reports
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                • Size 2B
                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                • MD5 SHA1 SHA512
                                Submit Download

                                Sdch Dictionaries
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                • Size 40B
                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                • MD5 SHA1 SHA512
                                Submit Download

                                Secure Preferences
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                • Size 36KB
                                • SHA256 9f67e943e875718d2a5d46ce56c8238afcf009a665303c2602ab7465b2a453e7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                sync_diagnostic.log
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                • Size 23KB
                                • SHA256 59e5daa9a69900c90398175e92fd9535583297721b85c0197e3728e51194f91c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CURRENT
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                • Size 16B
                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                • MD5 SHA1 SHA512
                                Submit Download

                                MANIFEST-000001
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                • Size 41B
                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                • MD5 SHA1 SHA512
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                • Size 26KB
                                • SHA256 839df9baf570ae93ae1639970e28df297e84279a063f2ed9605ccf31c1d4e926
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                • Size 27KB
                                • SHA256 d7bdba45a12e208917284222399d04a56a6eae7e0a7c89a68ecd8ff5e621bb56
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                • Size 27KB
                                • SHA256 64677bd23c51619d2ec9cc88a8924486a25d5797978151886f26e5760ee0c551
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                • Size 27KB
                                • SHA256 df141781b1558d3d9474d6528b660190698c4284cdfa5e12c666de4e1f38c260
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                InstallOptions.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\InstallOptions.dll
                                • Size 15KB
                                • SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                OBSInstallerUtils.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\OBSInstallerUtils.dll
                                • Size 426KB
                                • SHA256 1d84aa191fbbd842d5eeed302195579de1256a9acb980308bf31a631ac01e530
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                System.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\System.dll
                                • Size 12KB
                                • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VC_redist.x64.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\VC_redist.x64.exe
                                • Size 24.2MB
                                • SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                check_for_64bit_visual_studio_2022_runtimes.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\check_for_64bit_visual_studio_2022_runtimes.exe
                                • Size 10KB
                                • SHA256 b324a6025986306656fc2a03d0a3e9ed5917dfa7cf14fbfca888d65b39822074
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ioSpecial.ini
                                • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\ioSpecial.ini
                                • Size 1KB
                                • SHA256 56b220a592f80d1d86369a92d9fc0a9d16407882f2aaaf3ccc78f7024ffda2fd
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                ioSpecial.ini
                                • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\ioSpecial.ini
                                • Size 1KB
                                • SHA256 09635f843d085db52e6b9b1cef220c440c5c10cff6cd2360abd8d5aaf42ad3e5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                ioSpecial.ini
                                • Path C:\Users\Admin\AppData\Local\Temp\nsy126.tmp\ioSpecial.ini
                                • Size 1KB
                                • SHA256 5e2ba5f54da9ace1a1346ca2beefb5e3c6d87f4ad498b6271533ca2e4fc5db60
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                logo.png
                                • Path C:\Windows\Temp\{12893824-0362-42BE-AFA6-96BF21B4B0FC}\.ba\logo.png
                                • Size 1KB
                                • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                wixstdba.dll
                                • Path C:\Windows\Temp\{12893824-0362-42BE-AFA6-96BF21B4B0FC}\.ba\wixstdba.dll
                                • Size 191KB
                                • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VC_redist.x64.exe
                                • Path C:\Windows\Temp\{BBC8C651-B440-43BC-B46B-FB9D650D0CE6}\.cr\VC_redist.x64.exe
                                • Size 635KB
                                • SHA256 8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/2748-6631-0x0000029952600000-0x00000299529BB000-memory.dmp
                                Download

                                memory/2808-6557-0x00007FFB1DD30000-0x00007FFB1E35C000-memory.dmp
                                Download

                                memory/2808-6556-0x00007FF7804B0000-0x00007FF7809C8000-memory.dmp
                                Download