hxxps://github[.]com/SysAdminDoc/VideoSubtitleRemover

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/08/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/SysAdminDoc/VideoSubtitleRemover
Sample260817-ese1psshpg

Score

8^/10

defense_evasion discovery pyinstaller

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
33	3736	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
3460	VideoSubtitleRemoverPro-3.31.0-Setup.exe
3248	VideoSubtitleRemoverPro.exe

Loads dropped DLL 64 IoCs

pid	Process
3460	VideoSubtitleRemoverPro-3.31.0-Setup.exe
3460	VideoSubtitleRemoverPro-3.31.0-Setup.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe
3248	VideoSubtitleRemoverPro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	camo.githubusercontent.com
1	raw.githubusercontent.com
14	camo.githubusercontent.com
15	camo.githubusercontent.com
16	camo.githubusercontent.com

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\_tcl_data\tzdata\Asia\Hovd	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\_tcl_data\tzdata\Asia\Katmandu	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\_tcl_data\tzdata\Pacific\Saipan	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\backend\release_staging.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\_core\lib\npy-pkg-config\npymath.ini	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\onnxruntime\capi\onnxruntime_providers_cuda.dll	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\pandas\_libs\tslibs\offsets.cp313-win_amd64.pyd	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Africa\Kinshasa	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\_tk_data\palette.tcl	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\backend\encoder.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\backend\inpainters\__pycache__\__init__.cpython-311.pyc	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\lib\_ufunclike_impl.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\polynomial\tests\test_hermite_e.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\America\Argentina\ComodRivadavia	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Etc\GMT+9	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Europe\Volgograd	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\backend\__pycache__\inpainter_registry.cpython-311.pyc	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\f2py\tests\src\cli\hi77.f	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\icon.png	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\conftest.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\fft\_helper.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\onnxruntime\capi\onnxruntime.dll	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\_tcl_data\tzdata\Atlantic\Faroe	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\backend\inpainters\__pycache__\__init__.cpython-313.pyc	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\chardet\pipeline\structural__mypyc.cp313-win_amd64.pyd	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\typing\tests\data\pass\ndarray_shape_manipulation.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\pandas\_libs\sas.cp313-win_amd64.pyd	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\_tcl_data\tzdata\CET	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\backend\__pycache__\region_keyframes.cpython-312.pyc	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\_core\include\numpy\arrayobject.h	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\ctypeslib\_ctypeslib.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\matrixlib\tests\test_multiarray.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Asia\Kolkata	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\backend\onnx_model_info.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\backend\__pycache__\encoder.cpython-312.pyc	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\_core\tests\test_arrayobject.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\_core\tests\test_strings.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\f2py\tests\src\return_integer\foo77.f	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\typing\tests\data\pass\arithmetic.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Asia\Samarkand	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Europe\Busingen	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\_core\tests\test_arraymethod.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\f2py\tests\src\assumed_shape\foo_use.f90	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\pandas\_libs\tslibs\conversion.cp313-win_amd64.pyd	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\America\Creston	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Pacific\Pago_Pago	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Pacific\Tarawa	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\_tcl_data\tzdata\GB	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\_tcl_data\tzdata\Africa\Douala	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\_tk_data\msgs\pt.msg	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\America\Caracas	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Asia\Ashkhabad	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\__config__.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\lib\_datasource.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\typing\tests\data\fail\array_like.pyi	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\typing\tests\data\pass\ndarray_misc.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tk86t.dll	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\_tcl_data\tzdata\America\Santarem	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\_tcl_data\tzdata\Asia\Dubai	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\backend\__pycache__\quality_gate.cpython-312.pyc	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\_core\tests\test_regression.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\numpy\lib\tests\__init__.py	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\MST	VideoSubtitleRemoverPro-3.31.0-Setup.exe
File created	C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\America\Inuvik	VideoSubtitleRemoverPro-3.31.0-Setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VideoSubtitleRemoverPro-3.31.0-Setup.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x001900000002b5d8-3532.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VideoSubtitleRemoverPro-3.31.0-Setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3736	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314135357351556"	chrome.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi\shell\OpenWithVSR\command\ = "\"C:\\Program Files\\VideoSubtitleRemoverPro\\VideoSubtitleRemoverPro.exe\" \"%1\""	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\shell\OpenWithVSR\command\ = "\"C:\\Program Files\\VideoSubtitleRemoverPro\\VideoSubtitleRemoverPro.exe\" \"%1\""	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi\shell	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\shell\OpenWithVSR	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.webm\shell\OpenWithVSR\command	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v\shell\OpenWithVSR\ = "Send to Video Subtitle Remover"	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\shell\OpenWithVSR\ = "Send to Video Subtitle Remover"	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\shell\OpenWithVSR\ = "Send to Video Subtitle Remover"	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mkv	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.webm\shell\OpenWithVSR\command\ = "\"C:\\Program Files\\VideoSubtitleRemoverPro\\VideoSubtitleRemoverPro.exe\" \"%1\""	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\shell	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\shell	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\shell\OpenWithVSR\command	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\shell\OpenWithVSR\command	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\shell\OpenWithVSR\ = "Send to Video Subtitle Remover"	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mkv\shell	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.flv\shell\OpenWithVSR\command\ = "\"C:\\Program Files\\VideoSubtitleRemoverPro\\VideoSubtitleRemoverPro.exe\" \"%1\""	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v\shell\OpenWithVSR	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi\shell\OpenWithVSR	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi\shell\OpenWithVSR\ = "Send to Video Subtitle Remover"	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mkv\shell\OpenWithVSR\command	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mkv\shell\OpenWithVSR\command\ = "\"C:\\Program Files\\VideoSubtitleRemoverPro\\VideoSubtitleRemoverPro.exe\" \"%1\""	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\shell\OpenWithVSR\command	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\shell\OpenWithVSR	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\shell	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi\shell\OpenWithVSR\command	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.webm\shell\OpenWithVSR	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v\shell	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v\shell\OpenWithVSR\command\ = "\"C:\\Program Files\\VideoSubtitleRemoverPro\\VideoSubtitleRemoverPro.exe\" \"%1\""	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\shell\OpenWithVSR\command	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.flv	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\shell	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\shell\OpenWithVSR	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\shell\OpenWithVSR\ = "Send to Video Subtitle Remover"	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\shell\OpenWithVSR\command\ = "\"C:\\Program Files\\VideoSubtitleRemoverPro\\VideoSubtitleRemoverPro.exe\" \"%1\""	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{C55D3F49-1B26-4FCA-8819-8C50312FD325}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mkv\shell\OpenWithVSR	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.webm\shell\OpenWithVSR\ = "Send to Video Subtitle Remover"	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\shell\OpenWithVSR	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\shell\OpenWithVSR\ = "Send to Video Subtitle Remover"	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\shell\OpenWithVSR\command\ = "\"C:\\Program Files\\VideoSubtitleRemoverPro\\VideoSubtitleRemoverPro.exe\" \"%1\""	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\shell\OpenWithVSR	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\shell\OpenWithVSR\command\ = "\"C:\\Program Files\\VideoSubtitleRemoverPro\\VideoSubtitleRemoverPro.exe\" \"%1\""	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.flv\shell\OpenWithVSR	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mkv\shell\OpenWithVSR\ = "Send to Video Subtitle Remover"	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.webm\shell	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v\shell\OpenWithVSR\command	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.flv\shell	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.flv\shell\OpenWithVSR\ = "Send to Video Subtitle Remover"	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.flv\shell\OpenWithVSR\command	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.webm	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\shell\OpenWithVSR\command\ = "\"C:\\Program Files\\VideoSubtitleRemoverPro\\VideoSubtitleRemoverPro.exe\" \"%1\""	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\shell\OpenWithVSR\command	VideoSubtitleRemoverPro-3.31.0-Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\shell	VideoSubtitleRemoverPro-3.31.0-Setup.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VideoSubtitleRemoverPro-3.31.0-Setup.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3460	VideoSubtitleRemoverPro-3.31.0-Setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 796	3536	chrome.exe	80
PID 3536 wrote to memory of 3736	3536	chrome.exe	81
PID 3536 wrote to memory of 3592	3536	chrome.exe	82
PID 3536 wrote to memory of 3592	3536	chrome.exe	82
PID 3536 wrote to memory of 4736	3536	chrome.exe	83
PID 3536 wrote to memory of 4736	3536	chrome.exe	83
PID 3536 wrote to memory of 5024	3536	chrome.exe	84
PID 3536 wrote to memory of 5024	3536	chrome.exe	84
PID 3536 wrote to memory of 2160	3536	chrome.exe	85
PID 3536 wrote to memory of 2160	3536	chrome.exe	85
PID 3536 wrote to memory of 4968	3536	chrome.exe	88
PID 3536 wrote to memory of 4968	3536	chrome.exe	88
PID 3536 wrote to memory of 5076	3536	chrome.exe	89
PID 3536 wrote to memory of 1616	3536	chrome.exe	91
PID 3536 wrote to memory of 3036	3536	chrome.exe	92
PID 3536 wrote to memory of 3344	3536	chrome.exe	93
PID 3536 wrote to memory of 3844	3536	chrome.exe	94
PID 3536 wrote to memory of 3460	3536	chrome.exe	95
PID 3536 wrote to memory of 2908	3536	chrome.exe	97

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/SysAdminDoc/VideoSubtitleRemover
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81168c728,0x7ff81168c734,0x7ff81168c740
  2⤵
  PID:796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,16184273567288752090,856984913315040425,524288 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,4932609576653072977,10723334416525958809,262144 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,2521975993478628417,9982078121598250787,524288 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1812 /prefetch:13
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,14767446300033468499,4378618939884370740,2097152 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,9968158536059221140,453367887769406063,2097152 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,18309526869155785629,13061936915559262161,2097152 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,4196488432341259665,14394841620428221356,524288 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3900,i,6199302554552543315,6313583814675411912,524288 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,12997023423810208426,6359654021966347237,524288 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5000,i,5131700243456543418,3710709562726132266,524288 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4968,i,257047276542828302,804977833332819447,524288 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1064 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3844
- C:\Users\Admin\Downloads\VideoSubtitleRemoverPro-3.31.0-Setup.exe
  "C:\Users\Admin\Downloads\VideoSubtitleRemoverPro-3.31.0-Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5016,i,1103106294552351926,12858664201528972346,262144 --field-trial-handle=1948,i,4805467417985267167,8804458466744602219,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:10
  2⤵
  PID:2908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1476

C:\Program Files\VideoSubtitleRemoverPro\VideoSubtitleRemoverPro.exe
"C:\Program Files\VideoSubtitleRemoverPro\VideoSubtitleRemoverPro.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VideoSubtitleRemoverPro.exe

Path C:\Program Files\VideoSubtitleRemoverPro\VideoSubtitleRemoverPro.exe
Size 24.7MB
SHA256 0e5d7bc2868c97df833f2c411a1850f6e7f7b220f74b726be048890481875665
MD5 26399314fede03cdf8164d0d227809d1
SHA1 2dc31fcf41908b0baa3dab7021b7409c1e711cf7
SHA512 28d2722cf52f12ec93c5d10227ecb34e2d296495d7fabbc5b04ef06744a7ace814be293e07222127da1a94f094fba795c64565b91b7749864b92cbfcf0ed94d9
SSDEEP 393216:g2YksNwlnbfDM2kkrDHHsooIoeTBKqX/8D+F0iz7QrQhwKNyzHPX4g:g2YLNAbfA9MworoelH21UKQhJNMv4
TLSH
T14D473369AC9308E7E6E6013DE477D479A2B538DB1372C8BF057961B72E635E42038336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
Size 213KB
SHA256 ba7fc544994f126cb7485ce52d265d2f32e93c4f1ea1fcd6fcdee3918f271979
MD5 d6b2c2d2851a63b90e7210a943d0fdf6
SHA1 642bfeae924b9d4e6ed642b5946ac8e745cfc531
SHA512 64b43766740e11a9e5cb370f9ca26f80c5a379015e1804128e0b4f206c5e481cc14bce541c9caf99482eb334599c6aba34c22006fa6992dfe1fe842efdec132c
SSDEEP 6144:sjTLQQOvUVTTPDlxkP8VXaVHaT8fyFmiGJZMzEKAqsCbb:sjTLTPGgn
TLSH
T14124193A52580061DD7352758C63A423E5F2B262073256CF09E0C7756F27BE9B7BEB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\_bz2.pyd
Size 84KB
SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
TLSH
T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\_ctypes.pyd
Size 131KB
SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
MD5 744a8886e7187cb632da61e2d48ebafa
SHA1 e105fe498617813f2d34e578d48b82e23e56a972
SHA512 a362fc3eee1a7f71d9b82dc3b6b268e1d3115d20733b40e3891ab04469f9f8fbb1f6ee07d6a92a78cba82c7c53101bfde13c99f9a3feffa5430b94791ecae30c
SSDEEP 3072:/uZHKSoKYGYzZkdf/F2zy4PK8fUSlIFyPAT0:moZAf/F2zyIK+USC0
TLSH
T10DD37D0B736800AADAA79178C533AF47EFB1B453161057CF02A4C59A2F63B926E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\_lzma.pyd
Size 155KB
SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
MD5 a6bd469ef44eb08284a417fd5aaa4096
SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
TLSH
T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
MD5 9f746f4f7d845f063fea3c37dcebc27c
SHA1 24d00523770127a5705fcc2a165731723df36312
SHA512 306952418b095e5cf139372a7e684062d05b2209e41d74798a20d7819efeb41d9a53dc864cb62cc927a98df45f7365f32b72ec9b17ba1aee63e2bf4e1d61a6e4
SSDEEP 192:xt/cOTWthWfWJWadJCsVWQ4OWKNVAv+cQ0GX01k9z3A1tUXj:xpcgWthW2CsjNbZR9zOtUX
TLSH
T137A219D38EAC8546F8AB9D7046E8DA437C3E6BC71950615525F8F55C2CA33C1EB20B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
MD5 8f8eb9cb9e78e3a611bc8acaec4399cb
SHA1 237eee6e6e0705c4be7b0ef716b6a4136bf4e8a8
SHA512 5b10404cdc29e9fc612a0111b0b22f41d78e9a694631f48f186bdde940c477c88f202377e887b05d914108b9be531e6790f8f56e6f03273ab964209d83a60596
SSDEEP 192:xVIWthWWWEXCVWQ4OWGwvNVAv+cQ0GX01k9z3A1tUG71A5q:xVIWthWJoNbZR9zOtUG7mq
TLSH
T1A4A218938AAC8143FCEA2D7012E8DE83BD3D63D71A40916616E4F4582D937C1EB20B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
MD5 226a5983ae2cbbf0c1bda85d65948abc
SHA1 d0f131dcba0f0717c5dea4a9ca7f2e2ecf0ad1c3
SHA512 a1e6671091bd5b2f83bfaa8fcf47093026e354563f84559bd2b57d6e9fa1671eea27b4ed8493e9fdf4bde814074dc669de047b4272b2d14b4f928d25c4be819d
SSDEEP 192:xqWthW8WEXCVWQ4iWUAURDoSJj+iX01k9z3A0FCH1Whf:xqWthWH/DX+iR9zHFCMf
TLSH
T194A23BD68BBCC142F9DBAEB0529CDA437C3C57C71A10D16646A5F19828D33C4EF20A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
MD5 c2f8c03ecce9941492bfbe4b82f7d2d5
SHA1 909c66c6dfea5e0c74d3892d980918251bb08632
SHA512 7c6c85e390bbe903265574e0e7a074da2ce30d9376d7a91a121a3e0b1a8b0fffd5579f404d91836525d4400d2760cb74c9cb448f8c5ae9713385329612b074cf
SSDEEP 192:x3XmxD3TsWthWBWJWadJCsVWQ4iWozCCtvpGX01k9z3AtYF2LkQ9:x3X0sWthWgCsJZpGR9zMlkE
TLSH
T111A229D686BC8143F9AA6DB042D9DD433C3D6BC65E5150260AE9F1581C973C1EE24F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-fibers-l1-1-0.dll
Size 21KB
SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
MD5 b5e2760c5a46dbeb8ae18c75f335707e
SHA1 e71db44fc0e0c125de90a9a87ccb1461e72a9030
SHA512 c3400772d501c5356f873d96b95dc33428a34b6fcaad83234b6782b5f4bf087121e4fd84885b1abab202066da98eb424f93dd2eed19a0e2a9f6ff4a5cfd1e4f3
SSDEEP 192:xLWthW6WJWadJCsVWQ4KWeeLrp0KBQfX01k9z3A3WXa0Sr0:xLWthW3CsneRxB+R9zcWXJB
TLSH
T1B5A21A815A7C8187FDAB6D7042E9EA973C3D67C72E5090AA45D4F5582CD33C4AF20E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-1.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-fibers-l1-1-1.dll
Size 21KB
SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
MD5 050a30a687e7a2fa6f086a0db89aa131
SHA1 1484322caaf0d71cbb873a2b87bdd8d456da1a3b
SHA512 07a15aa3b0830f857b9b9ffeb57b6593ae40847a146c5041d38be9ce3410f58caa091a7d5671cc1bc7285b51d4547e3004cf0e634ae51fe3da0051e54d8759e1
SSDEEP 192:x8sWthWXWJWadJCsVWQ4KWqSY00pyEuX01k9z3AxzIsZ:xLWthWOCs4EpcR9zwpZ
TLSH
T130A23B829EBC4143FDABAE7043E5DA873C3D67C71D90A0A61594F59C1C973C4AB20A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
MD5 9f45a47ebfd9d0629f4935764243dd5a
SHA1 86a4a0ea205e31fb73f3bfcce24945bd6bea06c7
SHA512 8c1cdcad557bff1685a633d181fcf14ec512d322caeaeb9c937da8794c74694fe93528fc9578cb75098f50a2489ed4a5dedf8c8c2ac93eeb9c8f50e3dd690d5f
SSDEEP 192:xWwhDPvVr8rFTsvWthWoWEXCVWQ4KW7OcADB6ZX01k9z3A5tUQv/zf:x7JPvVrhWthWjncTR9z8SQv/zf
TLSH
T10EC22A93D9A4E24BFCCF9E7161A6D9836C3453C7041480CA57D8A75C3DE3386E3A8999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d
MD5 cc228ff8d86b608e73026b1e9960b2f8
SHA1 cef0705aee1e8702589524879a49e859505d6fe0
SHA512 17abd9e0ec20b7eb686e3c0f41b043d0742ab7f9501a423b2d2922d44af660379792d1cc6221effbd7e856575d5babf72657ae9127c87cc5cf678bd2ceb1228f
SSDEEP 192:xPEkMRmKjoRWthW5WEXCVWQ4OWiGfmKDUX01k9z3Alh1EwsPRj:xMKRWthW2XWmpR9zqgt
TLSH
T1FAA21A928A6C8143F9EB6D7052B8EE837C3C77C7195090665AE8F5981C833C5EF24B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-file-l2-1-0.dll
Size 21KB
SHA256 93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989
MD5 e368a236f5676a3da44e76870cd691c9
SHA1 e4f1d2c6f714a47f0dc29021855c632ef98b0a74
SHA512 f5126498a8b65ab20afaaf6b0f179ab5286810384d44638c35f3779f37e288a51c28bed3c3f8125d51feb2a0909329f3b21273cb33b3c30728b87318480a9ef8
SSDEEP 192:x+SWthWjWJWadJCsVWQ4iWKjTnKIjwX01k9z3A24haD:x+SWthW6CsVjTKHR9zp4haD
TLSH
T1BFA22C86DEAC9103FDAABD7042E9D9473C3E67C72940806717A9F45C1C973C5EB20A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-handle-l1-1-0.dll
Size 21KB
SHA256 39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9
MD5 416aa8314222db6cbb3760856be13d46
SHA1 5f28fe2d565378c033ef8eea874bc38f4b205327
SHA512 b16ed31dc3343caea47c771326810c040a082e0ab65d9ae69946498ceb6ae0dee0a570dbcd88090668a100b952c1ff88bade148811b913c90931aa0e657cd808
SSDEEP 192:xk1WthWUWEXCVWQ4iWNtu6OMI8HNsAX01k9z3AqMp42C8H:xk1WthW/OtTOMtHNsAR9zipbH
TLSH
T1B0A22BD2DA6C9143F9AB7EB002D8D9837C3C67C71A5094AA0699F5582CD33C5DB24B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-heap-l1-1-0.dll
Size 21KB
SHA256 8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9
MD5 344a09b4be069f86356a89482c156647
SHA1 2506ffeb157cb531195dd04d11d07c16e4429530
SHA512 4c1e616443576dc83200a4f98d122065926f23212b6647b601470806151ff15ea44996364674821afec492b29ba868f188a9d6119b1e1d378a268f1584ca5b29
SSDEEP 192:xV4xlRWthWKWJWadJCsVWQ4KWrNwwKUWX01k9z3A6weT4:xV4xlRWthWnCsm2R9zDw/
TLSH
T178A22A89CA788247F9AF9E7063E9DA873C3D67C61900906205D8F15D2CA33D1EB35B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-interlocked-l1-1-0.dll
Size 21KB
SHA256 53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606
MD5 86023497fa48ca2c7705d3f90b76ebc5
SHA1 835215d7954e57d33d9b34d8850e8dc82f6d09e8
SHA512 8f8370f4c0b27779d18529164fa40cbfddafa81a4300d9273713b13428d0367d50583271ea388d43c1a96fed5893448cd14711d5312da9dfa09b9893df333186
SSDEEP 192:xffW30WthWmWJWadJCsVWQ4OW8xNVAv+cQ0GX01k9z3A1tU:x230WthWjCsvxNbZR9zOtU
TLSH
T16CA219D28EBC9582F9FA6E7052F8DE837C3D67C61A4050660AE4E55C2D973C0EB20B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-kernel32-legacy-l1-1-1.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-kernel32-legacy-l1-1-1.dll
Size 21KB
SHA256 a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6
MD5 0c1cc0a54d4b38885e1b250b40a34a84
SHA1 24400f712bbe1dd260ed407d1eb24c35dcb2ecac
SHA512 71674e7ed8650cac26b6f11a05bfc12bd7332588d21cf81d827c1d22df5730a13c1e6b3ba797573bb05b3138f8d46091402e63c059650c7e33208d50973dde39
SSDEEP 192:x7BYlLWthW9jWEXCVWQ4WWss5INFPKBWX01k9z3AHVkswJhNRv:x7BiWthWuA58KER9zMVwhv
TLSH
T1B2A22BC796AC8143FDAA6DB012A9D5837C3867C71A50946617E8F59C2CD33C4EB30B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-libraryloader-l1-1-0.dll
Size 21KB
SHA256 7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c
MD5 5fbcb20d99e463259b4f15429010b9cd
SHA1 b16770f8bb53dc2bafcb309824d6fa7b57044d8a
SHA512 7ba1ac34b3ecfbfb8252f5875be381d8ef823b50dfe0e070222175ee51191f5ee6d541eeedd1445ed603a23d200ce9ce15914c8ed3fafe7e7f3591f51f896c58
SSDEEP 192:xZTvuBL3BBLSWthWMWEXCVWQ4qWOQyttuX01k9z3A2hpwA:xZTvuBL3BEWthW3Z1SR9z1hC
TLSH
T17DA21AC7D9ACA243FDDA6D7042A8D9436C3967C75D10D4BE46D9E29C2CA3381EB20F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc
MD5 5241df2e95e31e73ccfd6357ad309df0
SHA1 2644cc5e86dfad1ad2140181ab2ca79725f95411
SHA512 52cccd1dd237e764e34996c0c5f7a759a7f0eff29b61befeaf96a16d80df2ba9ee2c3615f875153198a145d68f275aea6d02187e6eee5a129e3e2ab81aaceb16
SSDEEP 384:x4naOMw3zdp3bwjGzue9/0jCRrndbwWthWJluDtdQ5R9zY/yOC:xpOMwBprwjGzue9/0jCRrndbj5ds9zYK
TLSH
T160A22A92C6E8D303F84DD970316AD9432C3C67CA0951D8A603E6FB1835E3399EB6076D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-memory-l1-1-0.dll
Size 21KB
SHA256 0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9
MD5 8d285430e8bda6d5c9b683579adcb180
SHA1 619dbbcff06c659e3fc48f03917a4dadbfc1c275
SHA512 38405dd85dd62f843abb55acea1b64d7d63bb601445bf1b32078cde5bbef4861dd99f26659281fe2aea86f58cfb1725d8c63d91fb539dcbf5d98cdbe783337fc
SSDEEP 192:xiVWthWZWEXCVWQ4OWO6xx6RMySX01k9z3Au1tQyIV:xiVWthWWn6yMR9zv1ta
TLSH
T1D6A24B8A99AC9503FCD66D7093E4DAC37C3E97C70D90946606A8F5492CD33D1EB30A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-namedpipe-l1-1-0.dll
Size 21KB
SHA256 c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273
MD5 4a28ca64f44b91f43945ee3971e0996a
SHA1 45b3d8584c58e8d6ae507fdbd772feeb1886c8b0
SHA512 862a0428f08d447cd1ee0431969e0fbcb182f4c46418c26d26fa33e586e686d9c093c1ca5781f544ce9276195ce973850719636e39e465f059607f455ecfdd93
SSDEEP 192:xeWthWlWJWadJCsVWQ4iWlWd9qLrRGhFKeX01k9z3Atos/orz3hj:xeWthWECsmWTu0R9zwpgfxj
TLSH
T1A0A22A9686AC8143F99EAE7002ECD5437C3D67CE5950842A57E9F89D1C933D0DB34B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-processenvironment-l1-1-0.dll
Size 21KB
SHA256 c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9
MD5 7fd4a71085783ccfe9c289c07bcf9b04
SHA1 bb6ffdb5c069dbba06998dc877d24f72dad6298d
SHA512 a96c5b90b8384b239be111d90caa3b947651ad73382ab9e5dbe4a4b6ad30921876545331d37c8d5a8f669e39d71bf60983c4ba39c479e23015c2f7579c5e55cd
SSDEEP 192:xq8Fg9WthW1WJWadJCsVWQ4OWXQM6Bm+0U8X01k9z3AfMeyujDqgjP:x1FKWthW0CszBBmo8R9zmyujWgj
TLSH
T12EA21AC68ABC6103FD9A6D70029DD6A73C3D67E71C40807546E8E65C2CE7391E720A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-processthreads-l1-1-0.dll
Size 21KB
SHA256 5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a
MD5 c123f2c161884fbff4f00ef1e1391266
SHA1 7db3055da53916bea2b85b159491a0772fb620ce
SHA512 dac5616320b9052254b5687959e67126c4a938e79173d8245675a9651674384c36cc856f996ef88ae621ec67afc6616626657585d92bb5d14602a7cc9fc0f669
SSDEEP 384:xock1JzNcKSI/WthWDCsmzxIPaR9zvfF8:xOcKSLNzxOW9z6
TLSH
T1D1A21AD285AC8283F88E6D302295DA532C3ED7961D25807206E4F29D3DEB3C1E62853E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-processthreads-l1-1-1.dll
Size 21KB
SHA256 4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e
MD5 385f562bdc391ccd4f81aca3719f3236
SHA1 f6633e1dac227ba3cd14d004748ef0c1c4135e67
SHA512 b72ed1a02d4a02791ca5490b35f7e2cb6cb988e4899eda78134a34fb28964ea573d3289b69d5db1aac2289d1f24fd0a432b8187f7ae8147656d38691ae923f27
SSDEEP 192:xVfDfIe+WthWeWJWadJCsVWQ4KWbJzLrp0KBQfX01k9z3A3WXywMCl:xVfDfIe+WthWbCsIzRxB+R9zcWXsCl
TLSH
T1A6A22B829A7C4183F9EB5DB052E5EA532C3E77C72A50806605E4F15C2DD73C1AB20A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-profile-l1-1-0.dll
Size 21KB
SHA256 7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61
MD5 7a629293eeb0bca5f9bdee8ade477c54
SHA1 a25bf8bac4fbfd9216ea827e71344ba07b1d463b
SHA512 1c58c547d1fe9b54ddf07e5407edaf3375c6425ca357aa81d09c76a001376c43487476a6f18c891065ab99680501b0f43a16a10ed8e0d5e87b9a9542098f45fe
SSDEEP 192:xTYY/beLWthWyxWEXCVWQ4iWZTc9qLrRGhFKeX01k9z3Atosrksq:xTYY/beLWthWyuw+u0R9zwprJq
TLSH
T143A23C92CBBC4043FDDB6D7042E8D9837C3D67CB5950956B06E9F49818933C4EB21A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 21KB
SHA256 9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1
MD5 3c5c7a3130b075b2def5c413c127173f
SHA1 f3d2b8ad93f3dc99c8410d34c871aec56c52e317
SHA512 46a52631e3dd49b0ae10afbdf50a08d6d6575f3093b3921b2fa744704e2d317f8b10a6d48ad7f922a7843731782521773032a6cc04833b00bd85e404c168ffe4
SSDEEP 192:xoSGeV2WthWvWJWadJCsVWQ4iWBGkT8I8HNsAX01k9z3AqMp4P:xoSGeV2WthWmCsxkwtHNsAR9zipe
TLSH
T1ABA22B86DA6C5103F9A77EB04399DA973C3E6BC71990802605E9E59C1CD33D4EF20A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-string-l1-1-0.dll
Size 21KB
SHA256 60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd
MD5 28005b20fbef6e1db10912d0fdd6471c
SHA1 47b83697677e08e4ebcff6fc41eca7ece120cc17
SHA512 45d6f860d7f7aefaa7a0a3b4b21b5c3234f442e39d6259e0a9e2083890533c275f07ddda93fddc7445928a55475b83c63253d3b08e41e5576f9029b205dfb36a
SSDEEP 192:xs6yMvr8WthWzWEXCVWQ4OWJZhKNVAv+cQ0GX01k9z3A1tU6pVQS:xs6yMvIWthWIOZ8NbZR9zOtU64S
TLSH
T128A23A929EAC9142FDDB2D7042E8EE83BC3C53C71A5091A656E4F9582D933C0FB24B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-synch-l1-1-0.dll
Size 21KB
SHA256 3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad
MD5 436ea0237ed040513ec887046418faaa
SHA1 44bafbbdb1b97d86505e16b8a5fcb42b2b771f91
SHA512 9f0dbfb538c05383ae9abfe95e55740530ecc12c1890d8862deacbc84212be0740d82afc9e81d529125221e00b2286cae0d4b3ca8dd3a6c57774d59f37933692
SSDEEP 384:x8xwidv3V0dfpkXc0vVapwWthWTEK3R/7R9z/0mm:xOHdv3VqpkXc0vVaJU/hF9zS
TLSH
T1C9A23A96E6E8A243F89FEDB042D6C9836C3867C74A10D47256D4F5583DE33C4EB3861A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-synch-l1-2-0.dll
Size 21KB
SHA256 efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb
MD5 8f107a7bc018227b181a0e7e76e9ca39
SHA1 ef57e24f29d2b1deeacefd82171873b971a3f606
SHA512 d8d8250aaf93fa99e9d1e4286b32579de0029c83867a787c0a765505a0f8cbd2dd076bb324509d5c4867423bc7dc8f00c8b8458e08e8cbfa8dd731d03dd1ae3f
SSDEEP 192:xUtZ3uWthW3WEXCVWQ4iWkguClXefqg7i1X01k9z3Anx5Tc2:xUtZ3uWthWsp1R7i1R9zax5Y2
TLSH
T185A24DB797AC8603FEDAAD7042E5D5433C3C57C60E50986616D9F16829E3381EA20F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-sysinfo-l1-1-0.dll
Size 21KB
SHA256 b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e
MD5 b65bf5ef316880fd8d21e1b34eb5c8a9
SHA1 3ab4674cb5c76e261fe042d6d0da8a20bfcbcbae
SHA512 4af3b0ef9a813ce1a93a35dd6869817910ae4b628f374477f60ea1831d2cc1aae7908262672e11954a4953bdff22bcc5fe23b4a736788e8e5ef4f8ac30eb24f8
SSDEEP 192:xxgdKIMF6mayWthWPWJWadJCsVWQ4OWXUc8RwX01k9z3Av80Z1:xO37yWthWGCsGUc9R9z4hZ1
TLSH
T135A22BA39A7CC103F99B9E7011D9D6832D3967C61914806A06E4F35C6DE33C5EB24A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-2-0.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\api-ms-win-core-sysinfo-l1-2-0.dll
Size 21KB
SHA256 2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0
MD5 fc9fc5f308ffc2d2d71814df8e2ae107
SHA1 24d7477f2a7dc2610eb701ed683108cd57eca966
SHA512 490fa6dc846e11c94cfe2f80a781c1bd1943cddd861d8907de8f05d9dc7a6364a777c6988c58059e435ac7e5d523218a597b2e9c69c9c34c50d82cac4400fe01
SSDEEP 192:xPNqWthWKWEXCVWQ4WWHcYl6d3RX01k9z3AQvjLXTa:xPNqWthWdpYlORR9zzPja
TLSH
T1DAA22A96DBAC8143FD9A2D7052A9DA833C3C53D75A10C06952E8F55C1DD33C9EF24A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\base_library.zip
Size 1.3MB
SHA256 993feb18a03c21e43f9288440a01bdcac425751863255eda2e116c46e8610dac
MD5 3b80e73d6939d3f5a0398de31544f493
SHA1 05863dff2f98fd3770829d43c1db2c0156c6d54c
SHA512 a454cc829bd93c4d9963f7dd031f9df80f0905efb1a0ece242e92b73f484955be49e81ef12a1678eca12e99b41edab833dbb5cc5b69a236e51d8679a6ab51e7e
SSDEEP 12288:euIva80201jwCVRDVoioSYFP6XdjdTWw3UK4iuwsEWtYzGN8TxWat+Gi2cPPdxhY:eadZWwpQw7SuTx+G5cPPdxhYB7WpoP
TLSH
T1DE651982B9527553FF64F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\pydantic-2.13.4.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

python3.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\python3.dll
Size 70KB
SHA256 16f109e8411bc08341497c87704b7cf0d22a2678f1e3a7dca416ea7bff995469
MD5 c460c13c3fa9038cf9c5e379b6d91281
SHA1 500df0f6ff1641983bf1abafd2829ce3c06912ff
SHA512 08eba88a8c9457568d201f6a64592ebeb037f33efe4cc081672a707a62fdc7cc5924520528386461c36a4ec5fdf16999ee0b99bc82f7ec6c2eabc0973f1289dc
SSDEEP 768:x+QEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxE:kotssyKcunV8PSlIFy0Ay1Ni9ifIkZE
TLSH
T113633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Banjul

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Africa\Banjul
Size 130B
SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
MD5 796a57137d718e4fa3db8ef611f18e61
SHA1 23f0868c618aee82234605f5a0002356042e9349
SHA512 64a8de7d9e2e612a6e9438f2de598b11fecc5252052d92278c96dd6019abe7465e11c995e009dfbc76362080217e9df9091114bdbd1431828842348390cb997b
TLSH
T15FC00289B7080942C45063B90D8723A8DF15C009D53153B338187208CCAA9D42E145C5
MD5 SHA1 SHA512 TLSH

Submit Download

Djibouti

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Africa\Djibouti
Size 191B
SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
MD5 fe54394a3dcf951bad3c293980109dd2
SHA1 4650b524081009959e8487ed97c07a331c13fd2d
SHA512 fe4cf1dd66ae0739f1051be91d729efebde5459967bbe41adbdd3330d84d167a7f8db6d4974225cb75e3b2d207480dfb3862f2b1dda717f33b9c11d33dcac418
TLSH
T105C02B886B10D0B0F08148348EF30606DE51C3B8032200F37C0C281003740602A460E0
MD5 SHA1 SHA512 TLSH

Submit Download

Kigali

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Africa\Kigali
Size 131B
SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
MD5 9c92339423e915befec45cc4752a75ce
SHA1 d336e337b0cafc1205ba041fac447b8ae3074dbe
SHA512 e5a3a1ab74a2620743964583ab960be126448ed013b57393eca6b397ac020de0be5763b6d40443b1976e0d3e6a533e8c46123fcb0428e5e233b076cf9ba69667
TLSH
T1D5C02200F30C882AC00003FA0BAF0300AC0BC200CB0022B328203008CCCA0802E003C0
MD5 SHA1 SHA512 TLSH

Submit Download

Lagos

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Africa\Lagos
Size 180B
SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
MD5 89de77d185e9a76612bd5f9fb043a9c2
SHA1 0c58600cb28c94c8642dedb01ac1c3ce84ee9acf
SHA512 e2fb974fa770639d56edc5f267306be7ee9b00b9b214a06739c0dad0403903d8432e1c7b9d4322a8c9c31bd1faa8083e262f9d851c29562883ca3933e01d018c
TLSH
T14FC012C073B00497CA50773C0FA32AD3DE018914CAAA37EB2954158C09790D07AAB9E8
MD5 SHA1 SHA512 TLSH

Submit Download

Curacao

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\America\Curacao
Size 177B
SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
MD5 92d3b867243120ea811c24c038e5b053
SHA1 ade39dfb24b20a67d3ac8cc7f59d364904934174
SHA512 1eee8298dffa70049439884f269f90c0babcc8e94c5ccb595f12c8cfe3ad12d52b2d82a5853d0ff4a0e4d6069458cc1517b7535278b2fdef145e024e3531daad
TLSH
T15AC01205BB415584E2E177B503F703D7CE1C80048C00DEABF907369508B88503FB0C80
MD5 SHA1 SHA512 TLSH

Submit Download

Panama

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\America\Panama
Size 149B
SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
MD5 595e67b4c97fda031a90e5ef80813e7d
SHA1 7194eb1a70c1acc1749c19617601595d910b9744
SHA512 27925a87379552403a0960c2ec191994610bc05b2d67fb1fbbeeb6086a16091bdc69449bce3426b31a2775f3845ed8cc07d1882f8b3b4e63f437775a2eea5d76
TLSH
T1C3C01214B7480A16C55132BA2A410100CC044300A12202B36C4C231804585C26630182
MD5 SHA1 SHA512 TLSH

Submit Download

Toronto

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\America\Toronto
Size 1KB
SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
MD5 3fa8a9428d799763fa7ea205c02deb93
SHA1 222b74b3605024b3d9ed133a3a7419986adcc977
SHA512 107a4dbb64107f781e3ed17b505baea28d4ca6683c2b49d146dda41c28ca3f9c307809ed938e4152011e199a7be6913de6f7b78cafe8ef300dc3034397945238
TLSH
T1143183969418B8DFDF0145B90560C03CCB6431C30B2B91C6C74D67402578F5D89A5DF6
MD5 SHA1 SHA512 TLSH

Submit Download

Shanghai

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Asia\Shanghai
Size 393B
SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
MD5 dff9cd919f10d25842d1381cdff9f7f7
SHA1 2aa2d896e8dde7bc74cb502cd8bff5a2a19b511f
SHA512 c6f4ef7e4961d9f5ae353a5a54d5263fea784255884f7c18728e05806d7c80247a2af5d9999d805f40b0cc86a580a3e2e81135fdd49d62876a15e1ab50e148b7
TLSH
T1EBE0C20C52681DCAD3ADF3FA265589A68B01E1838F52159B1446AA0DA57FB9618180F0
MD5 SHA1 SHA512 TLSH

Submit Download

UCT

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Etc\UCT
Size 111B
SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
MD5 51d8a0e68892ebf0854a1b4250ffb26b
SHA1 b3ea2db080cd92273d70a8795d1f6378ac1d2b74
SHA512 4d0def0cd33012754835b27078d64141503c8762e7fb0f74ac669b8e2768deeba14900feef6174f65b1c3dd2ea0ce9a73bba499275c1c75bcae91cd266262b78
MD5 SHA1 SHA512

Submit Download

Isle_of_Man

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Europe\Isle_of_Man
Size 1KB
SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
MD5 d111147703d04769072d1b824d0ddc0c
SHA1 0c99c01cad245400194d78f9023bd92ee511fbb1
SHA512 21502d194dfd89ac66f3df6610cb7725936f69faafb6597d4c22cec9d5e40965d05dd7111de9089bc119ec2b701fea664d3cb291b20ae04d59bcbd79e681d07a
TLSH
T17631710B85868B0AD0FC277A3AF3A3056D584588D3AE8161F4ECC3E896FA3095D6D8C0
MD5 SHA1 SHA512 TLSH

Submit Download

Luxembourg

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Europe\Luxembourg
Size 1KB
SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
MD5 7a350885dea1ebe1bf630eb4254e9abc
SHA1 5036277ce20a4d75d228cf82a07ed8e56c22e197
SHA512 524ed4fb0c158a1d526dd9071df7111fb78940d468e964bf63ba5418f9b551ec28c38fa1dc2711415aa31f926d8729eac63d6b1e2946b7942ce822f09d00c5ae
TLSH
T18B11001AA1138BFAF86C74B53A605DC24745368C98BF516DD52C53E951B4F5499024F0
MD5 SHA1 SHA512 TLSH

Submit Download

Oslo

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Europe\Oslo
Size 705B
SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
MD5 2577d6d2ba90616ca47c8ee8d9fbca20
SHA1 e8f7079796d21c70589f90d7682f730ed236afd4
SHA512 f228ca1ef2756f955566513d7480d779b10b74a8780f2c3f1768730a1a9ae54c5ac44890d0690b59df70c4194a414f276f59bb29389f6fa29719cb06cb946ceb
TLSH
T15E0120325142CA46D19C20F5077468D30F45168D4B9C02FF5739D12B77F03901D420D0
MD5 SHA1 SHA512 TLSH

Submit Download

Skopje

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Europe\Skopje
Size 478B
SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
MD5 a4ac1780d547f4e4c41cab4c6cf1d76d
SHA1 9033138c20102912b7078149abc940ea83268587
SHA512 7fd5c4598f9d61a3888b4831b0c256ac8c07a5ae28123f969549ae3085a77fece562a09805c44eab7973765d850f6c58f9fcf42582bdd7fd0cdba6cd3d432469
TLSH
T175F0267651228F48D11C94BA1718A91B4FA4530ECB8C03B226A9A91E527CBE4EE060E4
MD5 SHA1 SHA512 TLSH

Submit Download

Greenwich

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Greenwich
Size 111B
SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
MD5 e7577ad74319a942781e7153a97d7690
SHA1 91d9c2bf1cbb44214a808e923469d2153b3f9a3f
SHA512 b4bc0ddba238fcab00c99987ea7bd5d5fa15967eceba6a2455ecd1d81679b4c76182b5a9e10c004b55dc98abc68ce0912d4f42547b24a22b0f5f0f90117e2b55
MD5 SHA1 SHA512

Submit Download

Wallis

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Pacific\Wallis
Size 134B
SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
MD5 ba8d62a6ed66f462087e00ad76f7354d
SHA1 584a5063b3f9c2c1159cebea8ea2813e105f3173
SHA512 9c5dba4f7c71d5c753895cbfdb01e18b9195f7aad971948eb8e8817b7aca9b7531ca250cdce0e01a5b97ba42c1c9049fd93a2f1ed886ef9779a54babd969f761
TLSH
T146C00280F71818D3C455577E058F17949D57D6418D0287B7398A34CDFD983916B288D0
MD5 SHA1 SHA512 TLSH

Submit Download

Yap

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\Pacific\Yap
Size 154B
SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
MD5 bcf8aa818432d7ae244087c7306bcb23
SHA1 5a91d56826d9fc9bc84c408c581a12127690ed11
SHA512 d5721c5bf8e1df68fbe2c83bb5cd1edea331f8be7f2a7ef7a6c45f1c656857f2f981adb2c82d8b380c88b1ddea6abb20d692c45403f9562448908637d70fa221
TLSH
T10AC0120162E70C0AC660023505494793DD48D50180062BDB24041199F47D78136000C2
MD5 SHA1 SHA512 TLSH

Submit Download

Mountain

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\tzdata\zoneinfo\US\Mountain
Size 1KB
SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
MD5 c1b9655d5b1ce7fbc9ac213e921acc88
SHA1 064be7292142a188c73bf9438d382002c373c342
SHA512 2a188d7bcc48acc17b229e50e136b55dbc59058ae9be6ef217238cd1b6c0a59817954ab98817d2e2ff836a6f7d7461be5850ad73a9096d7a14ce9fd8c2a3c29a
TLSH
T1961120C9AAE1B575E15D543047B3D0800CAC48855F0FC98F20BEB52A8EF6B5936741A9
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\VideoSubtitleRemoverPro\_internal\vcruntime140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\VideoSubtitleRemoverPro\uninstall.exe
Size 52KB
SHA256 50ef211d5b4ad72c6e81718902bb40824b408913ce2543099dd98254596873e7
MD5 740f5bbbb6a5f0159b6acd11d8477a43
SHA1 00c5a0a878a8953d7b00a87bf01cab884e353ed5
SHA512 bedd4484668b89ee7741cc384f5f0449211a088ff09051eaab76434a25cae606c046722bf8893e79ef3d0b3cf498fc436293e882e40308a59e9fc776a567415f
SSDEEP 1536:nrlnJVfjAMrwIK6klYjak7uegdLeAyNxK7:rlnffjVrwUak7ueceAB7
TLSH
T1C3339C0173E0C8B3D9760B305DBA5BB76FF9A92111689B1B53406B5E7D32681DE0E3A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c3d943f003cdaf0d4982c6d94242d973292062ca7015349ea6fd0d0e634cb4d0
MD5 23fd32172a1292384e625a5abf4facaf
SHA1 a93bfd8980bccb605bc1959786cdeb73b2d04e0b
SHA512 68fb791b1e686a5d14f554869d4d4bf8139707ba168a95ee39345ce7a761c74165449d3e342b57db8927c7b4bf3c21cbc850162b2b76c21c7e63558956142fd5
TLSH
T198E022B9C921EC2B6CFE4B9AA0640746E70103073B41899F3B3E8208DFB0637569596C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 fdb33a3944aebbf1fce4778a912e0497a7656cd9fb8d415554f49f4b103bb8a5
MD5 fb875b04c9d24005b1bc51260251f8a6
SHA1 dfe29126eb960fd1106551901ce43f67986954f9
SHA512 ad43f528e1edba902e8f7a46d6f692a312e06f483bcbd40fe530139639d1b16b076d5dab0d7d4105df5d7293a739e7d06ad53a3871a974802990ede54f8d2e38
TLSH
T184513EC49F89E15CCFE90CB921E524D47B7223062553DE8BA3D12E79667FF994041883
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cf6f56632d8baec0116c3c0211693978311588cfad0c079c814544c9a3444858
MD5 ed9d8f7313a12adef8efb278af05957b
SHA1 9b6e5766a5305423bb71a30d5cf190a4732e2c75
SHA512 18bc739e63e7f67672832d31dec76cecd6ca59b659028608fbcb69b3682dd1b00c9c5b0eb2750c1b8e37efa3f1ed810fb41d10258724de4ab7a2b9e9b55e41a7
TLSH
T1274167F7C7E88A7D890092F8A7196E1FCE6D0E14536C3C56C8D4AE1B53E2971D20158E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 75110d22e23cd9a8292cc8da10e2d48cfc92bce0c260fbd7a1b22641c3f3a850
MD5 c9e568fc1a09c9e3b9e93500dc5ef93b
SHA1 9d8812d216e45d7535ce9574425bdf69b4a7caaa
SHA512 e6b4dce2166f354b6e64808554abbc36fe04e20945f25b488ce9e413f0cc77ec3594c7ba3634c0b39370408cdbd0b0b5637f36ba0a34b2d3281764ae0306ab96
TLSH
T199719AF743F5996D8A1296F0AB14AE1FCE290524431C386AC8E06E1BD3E3972E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dd6a62366914f5d39b7ca283621eeb4671103b45ec298766ee7d0e58e456de4a
MD5 97f2c4b2b259a0a56ec38f21036ebbae
SHA1 35301ba573645f74dc43ff8306bc99fb5a6d54b7
SHA512 9990181c6792dccee26b3f81484118848763a3a37dc0a8f0a227ddb8126dbbb87e00e719cf17072a42169fcd69fed2736c058b727b337a8c80bd1940504b79f9
SSDEEP 192:qRTp6ycgdD3v7lpAPRp21sV9+Hsb+WNnvh2l92yOK/ew54N5NXxvaP2VyIsnAUge:qRTpvfRUXX0w5W2tKh54N5NXdaWe
TLSH
T13642B67AEE10797B6CDBD21AFA267753E3F5102621D42E84EAFD892C04E79DC211704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 15acbf2a537a95923e1e9e19930f2cbeb269655682396b48e925bb39d6845237
MD5 fffb22f02ace768605bf1397a55a122f
SHA1 ef41d65a11b34c5b885589c3e7601cffd3933570
SHA512 0f4c8cd401c635cccd44657c64b509f1cf7d4d9293282153955d289c62c65bc524c71211ac82cbd69059dd841ad8656fc9b6c3421728f0ab0c8cf15c2aa36e18
SSDEEP 192:qRTZ6ycgdDnv7lpAPRp21sV9+Hsb+WNnvh2IIe6OK/ew54N5NXxvaPRVyIsnAUgE:qRTZvvRUXX0w5OeFKh54N5NXda/E
TLSH
T16F52C67AED10797B6CDBD21AFA167753E7F4102621C42E84EAFD892C11E79DC211B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 031dc00833674b692106a0be39106d54651ea9557a00bca0e4203c17e6cd72d1
MD5 c5078d3bf769ad482c283be0c3121787
SHA1 6e680458270447a9c600a8b5872e40ac26d5e591
SHA512 cec232d35df2d099abc2ee5e5a02ee4df54e0c17ab4510de3c3c8a6c68366863f77a9c372b8b921ac1f77da44d6b119b5edef9ce012bbfffe1e1ed777cbd9fb9
SSDEEP 192:qRTs6ycgdD3v7lpQPRpq1sV9+Hsb+WNnvh2IIetOK/ew54N5NXxvaPDVyIsnAUgE:qRTsvfRIXz0w5OeUKh54N5NXda9E
TLSH
T10252C67AED10797BACDBD21AFA157B53E3F4102621D02E84EAFD892C01E79DC211704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 13332ca7e1649e64440c36680a9718a83cea76a1b39974f6af64a1b392da68c9
MD5 a2fa9ad66761a452ead3e0b5e1064f6a
SHA1 61db56137d31ecfc840645580dcaa98d6e44a83d
SHA512 2759202d4bf0f70f1406096b252acc7edb46b1c0b80177c7d8e56998cf2430387ebfa83012f57a58eef1c4c9efa6477dc1b94b6970f08bce4e6bf49fb542a242
SSDEEP 192:qRTs6ycgdDnv7lpQPRpq1sV9+Hsb+WNnvh2IIetOK/ew54N5NXxvaPDVyIsnAUgE:qRTsvvRIXz0w5OeUKh54N5NXda9E
TLSH
T11C52C67AED10797BACDBD21AFA157B53E3F4102621D02E84EAFD892C01E79DC211700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 749979c2ab258528e29d190f824f4bd0826a4d3c452ccdef4ecbc46eaf0d425c
MD5 5657bcb083f04cbaa8732748ee6d5e14
SHA1 4e42a6b32b4ed86ed832f226923eface3ecd3bb4
SHA512 53347460676cd48628a61d136467463fbb43b47e7f48fa82ed0d2083c9124919a92bd3137f48077b38b79e3b7e8bb58bba51c9af111b34f69e6b95a52af32506
SSDEEP 192:qRTZ6ycgdDov7lpAPRp21sV9+Hsb+WNnvh2IIe6OK/ew54N5NXxvaPRVyIsnAUgE:qRTZv0RUXX0w5OeFKh54N5NXda/E
TLSH
T1BC52C67AED10797B6CDBD21AFA167753E7F4102621C02E84EAFD892C11E79DC211700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c9bbc0b524637706a19f88e2fc303f7424d254b841a587b1469e6fb9f991b097
MD5 72be54d31a0a0430e21561fe2c0c1e43
SHA1 769cecde7a19b507fbd9395151eb0209b48e9e04
SHA512 c145ab4ad5531bb3eb4237dc1cda07ceeca44af4abbbe42528a6a0c93b1b2fccf28e309b22277b2399a8098763f767abc39af21b218d6d88000e1d837e2a94f3
TLSH
T1A2B012508041D101C0D207B01546148C71286F15970E1B0193F87A62D8271618014172
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585270.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585270.TMP
Size 96B
SHA256 5b1105450f2a2ee37b791741c637d4451a39e0dadc4a13487bbefc54e6453da1
MD5 d10e98b51376f870f5efb68fbd00c5df
SHA1 e1f4531ec6254ee8e469d0931a5196f747cae033
SHA512 f2be64c36214308d3a2e20e3a1085dae0f602be325eb4e969e19529e22fe54b585cb0a3d401cd28c7662bf431189c921872155160ef56d896598f1f1fd5558c7
TLSH
T18CB00295C503A212C18207B035E599D871B0DF26C6031B1292E42B7ADD26A72C6755B2
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9a6a65a9b8e0ccb7173a7d77992a5916b1433f9286f07e87d3b2d44c49024324
MD5 bb5610de9d40b1832ff2f31c122be82a
SHA1 d2aa7fd424050cd9eac1fd8a6e05a32db361fc75
SHA512 0eb7d93b850d3e008ecd34c02851781dac26fbb2de379935e44c9b1dbb5c7459a27984445a25bbb77acaf84f1848c8417a9fa7bee82069cc5e1c4816252765ea
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:km7Rkm1tYpBeh2BAoa
TLSH
T159C312375D70E93759B9B75EB08E0B1F1EF14AB7D920DE92C8D85B0423EA6CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 637fb4d5c2276f8311065886fb462e7b0a0d6c783ece1c0150df22eef25c95af
MD5 f0b5720c3e83d25741967b6f04c31867
SHA1 c50426fbaf273399f5636300c74e69c5869ed5ab
SHA512 abb06f5d4cda4e0320c086b458c2c12484b3b6f494c046a8cb30202d1d79f3039287e012c4539a8f343aecb17bd5c3fa4a44113b48aaa458784c5f75e7be4af1
SSDEEP 3072:2Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Bm7Rkm1tYpBeh2BAoa
TLSH
T11BC312375E71A9775979BB4EB08E0B1F1EF149A2D920DE42C8D85B0437FA7CD0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6bee441bbbe3bf369331c616b0d780068f5bcd8f70c82c1b5bbe4f4e80471e8e
MD5 ecb8db6584d46452b611a7b083a25768
SHA1 8a9911aee2b8443d8f6edc691c95cc69bbc514cf
SHA512 6c9374da4a8d6600ca7ff26f0fffd85c6f207b871bc66152cab8b039f58c0eff7a1e6ac4bf502e331b85c4a7e4a058245f0d9e4a2502c37417638cac3bbea98d
SSDEEP 3072:uGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:pm7Rkm1tYpBeh2BAoa
TLSH
T1DCC312375D70A93759B9B75EB08E0B1F1EF14AA7C920DE92C8D85B0423EA6CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 70c6b6ce3c0d22a81677dd3fdb762cd78289c39b7152c48380026b0225f4ff38
MD5 da4deffc701410ab9ebb65d921f03ac6
SHA1 36ed0c286c7e32cb5bc1f8178844b4621b67a91e
SHA512 2a3e30cf5653796045317fa9ea8064f747459c50644733aed2b2c150472802a7e407ff2805a0c4ff8964bcab6b48be9c6da6efa104311ddb0381a7b68ef436d3
SSDEEP 3072:ZV/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:jum7Rkm1tYpBeh2BAoa
TLSH
T1C8C312375D64A8774DB9BB4EB08E0B1F1EF14AA7DD20EE52C8D85E0423F66CD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh93F.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsh93F.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh93F.tmp\nsDialogs.dll
Size 9KB
SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
MD5 cf0351a2ab9128838be6b54cea8238d3
SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
TLSH
T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VideoSubtitleRemoverPro-3.31.0-Setup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\VideoSubtitleRemoverPro-3.31.0-Setup.exe:Zone.Identifier
Size 1KB
SHA256 db32a8e714af86eebc081b41395b276452d17697f08a8245d2b9644372378449
MD5 c4be6e3e13f958b1debb78caac456a07
SHA1 88f8636d0a43005cd18b637516ce4279a99ce3e6
SHA512 c48efd79f1f18d594ee19381a3de169171a269a28aa3741e8bd5ef966c67182b4ed6e349bfe840d6fbcb360aab9df06131347e11b64d8b804496201aa54d6937
TLSH
T10811B5EA2C20DF5F4E03BAE7C9DD5A9C2032B8DBC745510C616BC00DC280475D1D68A7
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1476-3611-0x00000227FC5F0000-0x00000227FCDCA000-memory.dmp

Download

memory/3248-3612-0x00007FFFF60F0000-0x00007FFFF746E000-memory.dmp

Download