Analysis
- user interaction
yes - max time kernel
610s - max time network
713s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
07/11/2026, 21:07
General
- Target http://google.com
- Sample261107-zyfjmsft4y
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 13 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 51 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 15 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 56 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc3840c188,0x7ffc3840c194,0x7ffc3840c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,16680363166886149721,6164991623610214774,524288 --field-trial-handle=2236,i,2522941880189441824,2556850586994342836,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,18240073252335764156,15992849287721273502,262144 --field-trial-handle=2236,i,2522941880189441824,2556850586994342836,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,10201952105865951001,9711582849779785497,524288 --field-trial-handle=2236,i,2522941880189441824,2556850586994342836,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3356,i,6986686880609169519,2912818634479645793,2097152 --field-trial-handle=2236,i,2522941880189441824,2556850586994342836,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3368,i,15897829366054927142,5807111341207731382,2097152 --field-trial-handle=2236,i,2522941880189441824,2556850586994342836,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4736,i,5255174956754077137,2817262220771376723,2097152 --field-trial-handle=2236,i,2522941880189441824,2556850586994342836,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc3840c188,0x7ffc3840c194,0x7ffc3840c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,636524666318423306,15429805523761645545,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,18027089704669843068,17342254251338464718,262144 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,4346262763444803794,11042269154897663711,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,5395016769660778780,10852924668813075049,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,8568015234087633326,10766035129192218382,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,10406992971800853810,2893758988705210244,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,10406992971800853810,2893758988705210244,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,2730901774266918050,10388636839775402938,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,15563487413906226249,15386067279048194782,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,6029786898839521054,16205752679880001176,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,11899554784898413727,6938389788453833531,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,7201617292800354547,11210877410460523288,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,15046088790220324133,4938223817324580312,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,12482403009524973923,6891198889942322930,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,16666986590361537279,8838249865811511009,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,11386968969195394365,10745734648329864302,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4972,i,14452418989306106234,1738702962677831717,262144 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,17784091871219057429,343089689666682372,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,16080541447979557995,17069270236233458196,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,3647359118206491063,16513839066254998450,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,7339289875985780386,813086561579010676,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,14926679761888205724,14385286829820484489,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,2758164175078234670,16369112537703844767,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,10783055021787410498,16972375787670402592,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,8508593028099821574,15693786987890227413,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,8389367348990741438,18283919138191129603,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=1032 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,15064336161491452978,16332769813090988359,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1580,i,1973726822582599762,6002660544976093609,524288 --field-trial-handle=2572,i,6681792045421879520,18299023972498109245,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {285d3a0f-660a-4901-a89b-84fd2468e3b8} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {0b7abe22-b30d-4f5d-ab86-e21c6b72d6e4} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3796 -prefsLen 27325 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 3804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {48b12b46-81eb-46fe-aa41-921009d6a5e4} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27325 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4104 -initialChannelId {19952c7c-0750-45db-84e2-12284af228b1} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4336 -prefsLen 34824 -prefMapHandle 4340 -prefMapSize 270279 -jsInitHandle 4344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4348 -initialChannelId {8ca178a4-6b2f-4902-af7e-426fc33f8af3} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4892 -prefsLen 35012 -prefMapHandle 4920 -prefMapSize 270279 -ipcHandle 4832 -initialChannelId {03588d6e-3723-4d91-9dbd-cd0665426f23} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 33031 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {66d6d816-8395-4394-a9f5-5f3fbabf5af4} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5228 -prefsLen 33031 -prefMapHandle 5232 -prefMapSize 270279 -jsInitHandle 5236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5244 -initialChannelId {43be5999-9840-4807-97eb-e6ae124fbb31} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 33031 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {fae40ab1-6a0a-4405-9ee9-0ca8fcf4d768} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6508 -prefsLen 33031 -prefMapHandle 6512 -prefMapSize 270279 -jsInitHandle 6516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6524 -initialChannelId {30686106-bd01-4f09-a43f-bbc36a9c5325} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6424 -prefsLen 33031 -prefMapHandle 6360 -prefMapSize 270279 -jsInitHandle 6364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6312 -initialChannelId {812299f4-cc66-4961-a5b2-b4404ba53c52} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6232 -prefsLen 35143 -prefMapHandle 6736 -prefMapSize 270279 -ipcHandle 4596 -initialChannelId {35bec335-b2e6-4997-9e04-2d9f40eda84e} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6424 -prefsLen 35160 -prefMapHandle 2944 -prefMapSize 270279 -ipcHandle 2744 -initialChannelId {61b805a9-7337-44e1-8eef-c179f7be1825} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5316 -prefsLen 33031 -prefMapHandle 5184 -prefMapSize 270279 -jsInitHandle 4872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5256 -initialChannelId {8d1bad04-7b53-4825-bafa-c7db840d0540} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 33031 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6960 -initialChannelId {8f37d07d-e482-407e-ba9a-f34df8c64687} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7304 -prefsLen 34570 -prefMapHandle 7512 -prefMapSize 270279 -jsInitHandle 7332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7532 -initialChannelId {5b6be4c6-4a1e-4d58-943c-79829e936e29} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7428 -prefsLen 34570 -prefMapHandle 7496 -prefMapSize 270279 -jsInitHandle 7516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7420 -initialChannelId {d6fe8a58-fcf3-485c-b241-1aed369a6444} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5804 -prefsLen 36845 -prefMapHandle 3692 -prefMapSize 270279 -jsInitHandle 3740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5808 -initialChannelId {59aa723d-b8f5-417f-a2c0-7065fb5d394c} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5636 -prefsLen 36932 -prefMapHandle 5656 -prefMapSize 270279 -jsInitHandle 6032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5964 -initialChannelId {ee2e3a67-2d3b-47fb-8942-81444f6bbbe8} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4632 -prefsLen 36932 -prefMapHandle 7340 -prefMapSize 270279 -jsInitHandle 7608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8252 -initialChannelId {80fd5403-f3f1-4c3d-9f8f-ca18d72ff4aa} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 36972 -prefMapHandle 5240 -prefMapSize 270279 -jsInitHandle 7024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6424 -initialChannelId {b4213edc-e7eb-4c70-9b00-fb9b6df6856b} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8148 -prefsLen 36972 -prefMapHandle 8144 -prefMapSize 270279 -jsInitHandle 8132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8644 -initialChannelId {4db97d04-c49b-4c5b-8b73-7af5810ac48b} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6988 -prefsLen 36972 -prefMapHandle 6168 -prefMapSize 270279 -jsInitHandle 6228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7752 -initialChannelId {a5cb9d77-2032-46b3-bf48-ceebe615a335} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1256 -prefsLen 37012 -prefMapHandle 3560 -prefMapSize 270279 -jsInitHandle 3564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6468 -initialChannelId {d12bbe6b-a5df-42be-9847-6033329b1832} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\Downloads\OBS-Studio-33.0.1-Windows-x64-Installer.exe"C:\Users\Admin\Downloads\OBS-Studio-33.0.1-Windows-x64-Installer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\nsv3ED7.tmp\check_for_64bit_visual_studio_2022_runtimes.exeC:\Users\Admin\AppData\Local\Temp\nsv3ED7.tmp\check_for_64bit_visual_studio_2022_runtimes.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\nsv3ED7.tmp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\nsv3ED7.tmp\VC_redist.x64.exe" /quiet /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\{F7522946-552E-486D-99D3-CC8CB9B62C5A}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{F7522946-552E-486D-99D3-CC8CB9B62C5A}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsv3ED7.tmp\VC_redist.x64.exe" -burn.filehandle.attached=712 -burn.filehandle.self=716 /quiet /norestart5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\{F0F58B22-79EE-4AE4-B815-7D1730B1689C}\.be\VC_redist.x64.exe"C:\Windows\Temp\{F0F58B22-79EE-4AE4-B815-7D1730B1689C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{3B0BEB9D-03A4-486A-A65D-AB356792079A} {5A478B0A-A2E3-4F52-9327-E51320F60D81} 46206⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1076 -burn.embedded BurnPipe.{1E4A8768-8C69-418B-B581-5AF92089AB83} {B036CA6C-152B-4AFA-B4A0-5898456662B8} 68247⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1076 -burn.embedded BurnPipe.{1E4A8768-8C69-418B-B581-5AF92089AB83} {B036CA6C-152B-4AFA-B4A0-5898456662B8} 68248⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7D5C1370-57B6-41C2-B4A2-C79197AF1DAB} {80F948E7-833A-4740-98A0-56663A0DCFA5} 41249⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\core\win-dshow\data\obs-virtualcam-module32.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\obs-studio\core\win-dshow\data\obs-virtualcam-module64.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\obs-studio\core\win-dshow\data\obs-virtualcam-module64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio.lnk"4⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5652 -prefsLen 37068 -prefMapHandle 8584 -prefMapSize 270279 -jsInitHandle 8732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7148 -initialChannelId {3ba84114-7303-410b-9340-17b1554c9631} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8812 -prefsLen 37550 -prefMapHandle 6052 -prefMapSize 270279 -jsInitHandle 6040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8740 -initialChannelId {8dd32407-f5d8-41aa-885b-621af84cb345} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8796 -prefsLen 37550 -prefMapHandle 12780 -prefMapSize 270279 -jsInitHandle 12928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14516 -initialChannelId {a579e484-6471-4096-b60b-f496646d903e} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17836 -prefsLen 37550 -prefMapHandle 17796 -prefMapSize 270279 -jsInitHandle 17840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8796 -initialChannelId {97c7ccb4-5579-412e-b987-4141905fb31c} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11908 -prefsLen 37550 -prefMapHandle 11928 -prefMapSize 270279 -jsInitHandle 11940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11900 -initialChannelId {8c9f150c-94f3-4c63-91ca-feb81a7b3881} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17788 -prefsLen 37550 -prefMapHandle 7896 -prefMapSize 270279 -jsInitHandle 12528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8696 -initialChannelId {491f79e8-db56-4bf0-a27c-312e5d6eb8b5} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17740 -prefsLen 37550 -prefMapHandle 17744 -prefMapSize 270279 -jsInitHandle 10080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12712 -initialChannelId {a4f28932-60b0-485c-bc21-51df8ecfc47f} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15904 -prefsLen 37550 -prefMapHandle 7040 -prefMapSize 270279 -jsInitHandle 15888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16012 -initialChannelId {6f224157-7173-4bb3-ad44-39e3009488a0} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13624 -prefsLen 37550 -prefMapHandle 15284 -prefMapSize 270279 -jsInitHandle 15228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14476 -initialChannelId {b1c6fba6-488e-4cc6-89bd-6bb415be83bb} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\65bf2513-6f93-4a28-8453-97e2467fc9cc.dmp"3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8572 -prefsLen 37599 -prefMapHandle 17776 -prefMapSize 270279 -jsInitHandle 11492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17772 -initialChannelId {673ee1c5-33ce-4ec3-94d1-ae1594588a17} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 37599 -prefMapHandle 5792 -prefMapSize 270279 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2712 -initialChannelId {979620fa-c902-461a-87b9-5aac8cbb3fc3} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8740 -prefsLen 37599 -prefMapHandle 9492 -prefMapSize 270279 -jsInitHandle 9284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10916 -initialChannelId {c96aca21-4c74-4476-a61b-40e4ab5bc2a4} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8200 -prefsLen 37599 -prefMapHandle 8112 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15500 -initialChannelId {68c56932-6fd3-4cb8-9c55-4fd44867ae3d} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11492 -prefsLen 37599 -prefMapHandle 8188 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {cb5153b0-6046-4552-869d-6bd2f3fb2dbf} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9692 -prefsLen 37599 -prefMapHandle 5728 -prefMapSize 270279 -jsInitHandle 4844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8596 -initialChannelId {93eb7cb5-abc7-4053-be41-6f6c44f3889e} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6168 -prefsLen 37599 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 7132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6024 -initialChannelId {c7107d69-e2a7-4fde-b61a-a4e057e2fbc4} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261107211319.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261107211319.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E8B464F2-7193-4E54-AA21-96F5D2280005} {28C0FB24-1264-4604-AC20-803FE2DEF8E0} 55204⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Program Files\obs-studio\bin\64bit\obs64.exe"C:\Program Files\obs-studio\bin\64bit\obs64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\obs-studio\bin\64bit\obs-qsv-test.exe"C:/Program Files/obs-studio/bin/64bit/obs-qsv-test.exe" 47ab 485d3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\obs-studio\core\win-capture\data\get-graphics-offsets64.exe"C:/Program Files/obs-studio/core/win-capture/data/get-graphics-offsets64.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\obs-studio\core\win-capture\data\get-graphics-offsets32.exe"C:/Program Files/obs-studio/core/win-capture/data/get-graphics-offsets32.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2e0 0x4281⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5e06ba.rbs
e5e06c6.rbs
e5e06cd.rbs
e5e06dc.rbs
auto_open_controller.js
edge_tracking_page_validator.js
product_page.js
shopping.html
shopping_fre.html
shopping_iframe_driver.js
crs.pb
ct_config.pb
kp_pinslist.pb
well_known_domains.dll
LICENSE
verified_contents.json
keys.json
deny_domains.list
deny_etld1_domains.list
deny_full_domains.list
Filtering Rules
Filtering Rules-AA
Filtering Rules-CA
LICENSE
Part-DE
Part-ES
Part-FR
Part-IT
Part-NL
Part-RU
Part-ZH
adblock_snippet.js
manifest.json
typosquatting_list.pb
crl-set
data.txt
obs64.exe
ar-SA.ini
az-AZ.ini
be-BY.ini
ca-ES.ini
cs-CZ.ini
de-DE.ini
en-US.ini
es-ES.ini
et-EE.ini
fa-IR.ini
fi-FI.ini
fr-FR.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hu-HU.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
ko-KR.ini
ms-MY.ini
nl-NL.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ru-RU.ini
sk-SK.ini
sv-SE.ini
th-TH.ini
tr-TR.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
az-AZ.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
is-IS.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-SP.ini
sv-SE.ini
th-TH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
ur-PK.ini
uz-UZ.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
af-ZA.ini
an-ES.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-US.ini
eo-UY.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
ur-PK.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
af-ZA.ini
an-ES.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
eo-UY.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
lt-LT.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
ur-PK.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
ar-SA.ini
az-AZ.ini
be-BY.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
fa-IR.ini
fi-FI.ini
fr-FR.ini
gl-ES.ini
he-IL.ini
hu-HU.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
ko-KR.ini
ms-MY.ini
nl-NL.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ru-RU.ini
sk-SK.ini
sv-SE.ini
th-TH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
clock-source.lua
dial.png
hour.png
minute.png
second.png
countdown.lua
instant-replay.lua
pause-scene.lua
url-text.py
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
lt-LT.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
oc-FR.ini
pa-IN.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
ur-PK.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
color.effect
ar-SA.ini
az-AZ.ini
be-BY.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
fa-IR.ini
fi-FI.ini
fr-FR.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
lv-LV.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ru-RU.ini
sk-SK.ini
sq-AL.ini
sr-SP.ini
sv-SE.ini
ta-IN.ini
th-TH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
rtx_blur.effect
rtx_greenscreen.effect
error.html
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
eo-UY.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
lt-LT.ini
lv-LV.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
oc-FR.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
ur-PK.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
am_FEMININE.pak
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
is-IS.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
lt-LT.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
oc-FR.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
ur-PK.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
black_and_white.png
grayscale.cube
grayscale.png
invert.png
original.cube
original.png
posterize.png
red_isolated.png
teal_lows_orange_highs.png
blend_add_filter.effect
blend_mul_filter.effect
blend_sub_filter.effect
chroma_key_filter.effect
chroma_key_filter_v2.effect
color_correction_filter.effect
color_grade_filter.effect
color_key_filter.effect
color_key_filter_v2.effect
crop_filter.effect
hdr_tonemap_filter.effect
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
eo-UY.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
luma_key_filter.effect
luma_key_filter_v2.effect
mask_alpha_filter.effect
mask_color_filter.effect
sdr_on_hdr_filter.effect
sharpness.effect
ar-SA.ini
az-AZ.ini
be-BY.ini
bg-BG.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
fa-IR.ini
fi-FI.ini
fr-FR.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
id-ID.ini
is-IS.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
sk-SK.ini
sr-SP.ini
sv-SE.ini
th-TH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
is-IS.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
ur-PK.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
is-IS.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
lt-LT.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
fade_to_color_transition.effect
fade_transition.effect
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
eo-UY.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
luma_wipe_transition.effect
barndoor-botleft.png
barndoor-h.png
barndoor-topleft.png
barndoor-v.png
blinds-h.png
box-botleft.png
box-botright.png
box-topleft.png
box-topright.png
burst.png
checkerboard-small.png
circles.png
clock.png
cloud.png
curtain.png
fan.png
fractal.png
iris.png
linear-h.png
linear-topleft.png
linear-topright.png
linear-v.png
parallel-zigzag-h.png
parallel-zigzag-v.png
sinus9.png
spiral.png
square.png
squares.png
stripes.png
strips-h.png
strips-v.png
watercolor.png
wipes.json
zigzag-h.png
zigzag-v.png
slide_transition.effect
stinger_matte_transition.effect
swipe_transition.effect
af-ZA.ini
an-ES.ini
ar-SA.ini
az-AZ.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
ug-CN.ini
uk-UA.ini
ur-PK.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
af-ZA.ini
ar-SA.ini
az-AZ.ini
be-BY.ini
bg-BG.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-US.ini
es-ES.ini
et-EE.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sr-SP.ini
sv-SE.ini
th-TH.ini
tr-TR.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
af-ZA.ini
ar-SA.ini
az-AZ.ini
be-BY.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-SP.ini
sv-SE.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
lv-LV.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
ur-PK.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
obs-x264.pdb
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
ur-PK.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
package.json
package-schema.json
service-schema-v5.json
services.json
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
eo-UY.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
lv-LV.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
text_default.effect
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
lt-LT.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
compatibility.json
get-graphics-offsets32.exe
get-graphics-offsets32.pdb
get-graphics-offsets64.exe
get-graphics-offsets64.pdb
graphics-hook32.dll
graphics-hook32.pdb
graphics-hook64.dll
graphics-hook64.pdb
inject-helper32.exe
inject-helper32.pdb
inject-helper64.exe
inject-helper64.pdb
af-ZA.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
is-IS.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
lt-LT.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
obs-vulkan32.json
obs-vulkan64.json
package.json
compatibility-schema-v1.json
af-ZA.ini
an-ES.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-GB.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
obs-virtualcam-module32.dll
obs-virtualcam-module32.pdb
obs-virtualcam-module64.dll
obs-virtualcam-module64.pdb
placeholder.png
virtualcam-install.bat
virtualcam-uninstall.bat
af-ZA.ini
an-ES.ini
ar-SA.ini
az-AZ.ini
ba-RU.ini
be-BY.ini
bg-BG.ini
bn-BD.ini
ca-ES.ini
cs-CZ.ini
da-DK.ini
de-DE.ini
el-GR.ini
en-US.ini
es-ES.ini
et-EE.ini
eu-ES.ini
fa-IR.ini
fi-FI.ini
fil-PH.ini
fr-FR.ini
gd-GB.ini
gl-ES.ini
he-IL.ini
hi-IN.ini
hr-HR.ini
hu-HU.ini
hy-AM.ini
id-ID.ini
is-IS.ini
it-IT.ini
ja-JP.ini
ka-GE.ini
kaa.ini
kab-KAB.ini
kmr-TR.ini
ko-KR.ini
lo-LA.ini
lt-LT.ini
mn-MN.ini
ms-MY.ini
nb-NO.ini
nl-NL.ini
nn-NO.ini
pl-PL.ini
pt-BR.ini
pt-PT.ini
ro-RO.ini
ru-RU.ini
si-LK.ini
sk-SK.ini
sl-SI.ini
sq-AL.ini
sr-CS.ini
sr-SP.ini
sv-SE.ini
szl-PL.ini
ta-IN.ini
th-TH.ini
tl-PH.ini
tr-TR.ini
tt-RU.ini
ug-CN.ini
uk-UA.ini
ur-PK.ini
uz-UZ.ini
vi-VN.ini
zh-CN.ini
zh-TW.ini
sizegrip.png
headphones.svg
media-pause.svg
media_play.svg
mute.svg
media-pause.svg
media_play.svg
checkbox_checked.png
vc_runtimeMinimum_x64.msi
1ab7aa1b854459a7.v2
4545d6ee7b176b7d.v2
62281a72182c4ba6.v2
6a755cdc9e6092ae.v2
7a6e3fecabdd460d.v2
7f0084f9c4106e16.v2
8d390f4ad08d5c53.v2
9ea4a251d7aa3c18.v2
cd9cfd09db70c3cd.v2
0ddb458a-22e0-4a9c-91c8-10b414885012.tmp
64683a88-a0fa-4f0f-b4e3-4c176f886bfe.tmp
manifest.json
settings.dat
settings.dat
settings.dat
436c9a45-8614-488e-a539-67a2d5812523.tmp
6d826617-f840-4d6d-9abf-e3262f2c523d.tmp
71c479c7-02e5-4c05-a827-f7724bc86d73.tmp
LOG
LOG.old
data_0
data_1
data_2
data_3
temp-index
the-real-index
data_1
d133edbe-c389-4981-932c-2591698412cb.tmp
LOG
000003.log
LOG
LOG
000003.log
LOG
dasherSettingSchema.json
Favicons
History
000003.log
LOG
04f520c7-4f82-4c47-a514-d2fed39e585f.tmp
52baeed4-9066-45fb-941a-7c972a7c5752.tmp
637d041a-951e-41dc-ac8e-064b236cea4e.tmp
Cookies
Reporting and NEL
TransportSecurity
bb101d63-c4c7-45d5-a506-37c7555b2f66.tmp
LOG
7f051cb45b5c1a75_0
temp-index
db
LOG
CURRENT
LOG
sync_diagnostic.log
MANIFEST-000001
Web Data
baa1a9db-5644-446a-a167-eb4e08db8ca5.tmp
bbfb7578-71d8-4a87-91cd-7e6bde80af5a.tmp
d12e036c-a2c7-4138-9c46-77cba685295c.tmp
da0ffde9-07e4-4409-a413-a503eee98946.tmp
default_cloud_config.json
fc041125-d2f3-4716-8dd8-52096d8fbcdb.tmp
000003.log
LOG
000003.log
LOG
manifest.json
manifest.json
data_1
Last Version
Local State
manifest.json
data_1
manifest.json
manifest.json
Variations
manifest.json
manifest.json
a2196509-1eb9-4871-aee3-965e4cb46aa0.tmp
c5241627-fae3-4911-b070-eb09b1009d18.tmp
07490752-c1e4-43a0-9d5a-222d8b3ec6ed.tmp
12259d8c-7133-4e96-aa36-7b0ba4eea900.tmp
3ea5d819-9757-4dd5-8ae7-f5ee15350796.tmp
76aaed8a-8104-4fdf-bad0-315127d7619e.tmp
807f703b-a902-44a7-b692-8e99740e6d4f.tmp
a4ac9f8f-0a43-4f96-a382-ebc926af99d5.tmp
a8efa50f-1814-4f3e-8a70-8fa441103b87.tmp
be632e72-a962-4a7c-970d-d11cbb2cb7a3.tmp
d01cd814-c5a9-4c5d-80ad-a492203b32f4.tmp
d280cde7-8413-48a0-b99b-42b021d2c32c.tmp
fde34348-2c0e-4d9c-beab-7294c4a95a65.tmp
first_party_sets.db
first_party_sets.db-journal
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
activity-stream.contile.json
activity-stream.discovery_stream.json
activity-stream.discovery_stream.json
11080
11188
13071
14554
15353
15366
1539
15755
17752
18143
18438
18973
19202
19289
19812
20413
20603
21534
22194
22548
22648
23935
24027
25527
2746
28389
28861
29019
29307
29367
29419
29547
30034
30325
30366
30444
30604
30719
30724
30725
30779
30909
3121
31527
32049
32764
3426
412
4186
63
7028
7311
7837
8007
834
9356
9485
9684
03D74D5ED346B6A425AA45C38A54C3F6BCFF5085
06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
0FCA17F52DDF3D4D2FA83C2DC0BD4196186FBC97
1015ACFFB60D1835AB0CB82E5FF9A156D1FFEAD1
10CD38E4DB0F96ACD75CD7EAF6E1DAE3497626BC
12FB1B42AC790F00958E74DF5D13B5B48F8E95F3
16B8F2AD507D73CE728484396F14A874647C6AE2
180C29366E7B559D438D5383CCA021CBF01118EF
193D8F83A8ECC40930C17BBEE45196D52D95B45B
19892868A5E571C03E40C89E694F62BA6DA641B3
2A56C3A8405C9A965DAD14A3C7D3AA9ED9ED424A
2AFCBD0CA7A38EF8780F9FFAC6C89B6FB9EA79DD
2BE58B8EAD7B25A1D218793F8B96AFA1703B687A
37A62BA5ACD181185F5DB17638E2607FD6971653
386D22EAB36C3C5C3713F931E60D7F8CA78D773F
3AC7384F48B21F8E60D74E5F9D6F847E015E76DF
3F4C2D74DF9E2F3736C62CA7ED8C3823CBD900CB
4383515C6CB89C0A648CCCE8D5F7D585C0E548B4
46E9DA61F479324A9F0FCF519E3D5AE08A2934D1
477CD268D30F61BC3EFC6423A3DFB3D77479797A
52ABF4B599D0C8EB8FD0AF0AA13E4A62E1FF49A2
58DB5685860CB348C492B72FAF1533F12D47B3BA
5D9346EFA1E48DAE701836DAFC58842D2F04154F
5EC98F93421E0158422A42FC529FB1D7296E91F5
5FBB20106CC4F62ACC58AA22E79C88563D206B29
658D824452DCE7B7E3D1F36746B96A2C2182ECAB
69FC75D4AD9947608DC9E965EF4331A046880A93
709E91C11BEBCF99DFDF0F2212C19FD2A416C6C1
7215ECF73C91D4CAF7BE94539029D9C3E9B07C8C
754922500B6317BCF565E86C033CB8CF40C83D34
776AA181024A40DE8AD4A2F91A344F61FDB88177
776D56F552D0FD633140BA2E994F5154A0D29A09
7B4F445F490D5D681950BFFE80B3932C951AB8B7
816185E95F06F52470EE4479A29154CDAE94CB50
85B74E16E695B1D2204651499486546D9FBB1218
880BB810441BB14D022B4EE0728DE49065A3E830
8827A12C9ECE7334FD41D0927E5E9628E5C2E387
8965E28385F9F95069FA2FCFBF1C48498D12F7F1
8E26FAA0B031F3E686180B0102BDD9655B00CB22
9238E097AD66CA7F80A94DDDF7B555F545B222FF
95C25C8C3091382DE2FF104CCEAF679A4E2332AF
975354F6E79369270E278A4BA2708225643DB55C
990B97F138650D1837E35E936BF12CC2F1C8F7B4
A231840454FC475D0096F631AD79A4561B290F90
A860063E597C01BF553601C8C27DC7B896800E3A
AC5C110C4D334B3E569022E7A14060E38EB2D79C
B1A805EE23BB8D714B7CCD6F1F25A7BE9D4157BC
B54361B3C0CFEEE97122573215091D4F924C3E66
BE9F01B3801472C249D4F82CD59E57F6FC8DCEF8
BEEB3E677239D22DBC3757B0698BAF80CF9BB944
BF6B22C72C3F86A211209216A22CB4491E7E73C7
C8AC4480FF2B0273D6CC034C45AB0F1361FFAD9D
C99248B96EC0ADDF29C9A1B783260AF523F3919B
D0B178597908BD2DBF7C83F73C859874C1D0BA47
D1EC22EA6351F93222D020A495DD60BC10A0DCEC
D58E8F3D5ABC6132A3AFD0CAAE082799CBCB12D9
DC1A43AA9DE85706315F9EE5C5B7AC7252DE842F
DE743DAF49052EC67A8891F80FA91B038A8C94F2
DF9C2F64DE858672749721C1F688EB8DC4D3B4F6
E0E8CB991AA3025405C6A6442A57D02BACC21CCF
E620A849C78A361F92539BC61FA34E4B08553B9A
E62BE3A28D3590ECE095C0734D9F5A429FB9476E
E66DE0B544FF762193FB8FF51E00CA473981CB87
E8C92DC6BF57A5D1F9592899C4FDF0DCC48EFC10
E9B35F75CE34B34DC6C74C106EA493776298EA73
EBBE039E8C0E030B9BE8B11E13EE1D6D584948E2
ED6CB058A0C2D43BC2A6A44682AD150F024562CF
F112407FE4CDE37FDDB1F3D448590BFE2F5D78A9
F6BBF2E6E2B1B169E9676D01A1557822018C4EBA
F84B96FFD81AC1C08BBC904C3D3256D44FCC86D3
F8EE775DCDBED84EF4700777DC4BFC3635361AA8
F9CCD46E7320E4475C02AD1FA5816186686363AC
FF4779B22995A43C8336370118F2B8AE9BDE5C38
a+jPDEeYPR8Ids_oEEd72XEaNVn7fmp3ZHTjxp_V7nk=.ico
webext.sc.lz4
webext.sc.lz4
microsoft.windows[1].xml
https___java_com_help
{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_PowerShell_ISE_exe
AppCache134385596339733534.txt.~tmp
02022b08-4009-4f5a-87ac-7035bffa69ef.zip
b45dfe27-f29c-4433-9e18-1e35cdda0405.tmp
InstallOptions.dll
OBSInstallerUtils.dll
System.dll
ioSpecial.ini
ioSpecial.ini
ioSpecial.ini
modern-wizard.bmp
content.js
f711c97d-45d8-4429-be6e-9a8722f0484a.tmp
messages.json
tmpaddon
tmpaddon
tmpaddon
5WK84SQIPFLZUXAM2LGM.temp
6824f4a902c78fbd.customDestinations-ms
AMUQJQL0DZLC44HXEZNW.temp
GABF8TOJFF60UQQTH7RF.temp
NLLR21D9VHC22T46GMOO.temp
65bf2513-6f93-4a28-8453-97e2467fc9cc.dmp
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
SiteSecurityServiceState.bin
addonStartup.json.lz4
broadcast-listeners.json
broadcast-listeners.json
store.json.mozlz4
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
events
3418806e-5d85-4e0b-b31d-e265bcb7ff34
795563d1-395d-4abb-b9fc-16393ff7521e
8b77b57b-dfb3-4b20-8222-305595d45e46
9c16363b-1edc-42c9-af46-3e1a61cbfe1c
ab0342cf-dd32-4d19-9173-ddaa194c50fe
c20bdc04-03bf-4e2c-886f-5c32050ef42a
d26b5a7f-75d4-49c7-b68d-2849116b7dc1
downloads.json
extension-preferences.json
extensions.json
gmpopenh264.dll
gmpopenh264.info
LICENSE
manifest.json
widevinecdm.dll
widevinecdm.dll.sig
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
serviceworker-1.txt
serviceworker.txt
sessionCheckpoints.json
sessionCheckpoints.json
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
{e0e8b29d-83b4-40da-a03f-0f5f94aa74b8}.final
{2df0d127-0f5e-4cc2-97a4-75a790d37a06}.final
2939851545meosea_bdaat.sqlite
usage
usage
usage
usage
{b5b90a39-70c5-496d-aa71-684f1a279ad5}.final
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
targeting.snapshot.json
xulstore.json
xulstore.json
xulstore.json
xulstore.json
basic.ini
basic.ini.tmp
basic.ini.tmp
Untitled.json
Untitled.json.tmp
Untitled.json.tmp
Untitled.json.tmp
Untitled.json.tmp
amazon_ivs_ingests.new.json
user.ini
user.ini.tmp
user.ini.tmp
OBS-Studio-33.0.1-Windows-x64-Installer.exe:Zone.Identifier
eUAwP9QH.exe.part
license.rtf
thm.wxl
thm.xml
BootstrapperApplicationData.xml
logo.png
wixstdba.dll
VC_redist.x64.exe
memory/1020-23590-0x00007FFC07870000-0x00007FFC07880000-memory.dmp
memory/1020-23588-0x00007FF7DA470000-0x00007FF7DA9E8000-memory.dmp
memory/1020-23587-0x00007FFC11DC0000-0x00007FFC12404000-memory.dmp
memory/1020-23589-0x00007FF7DA470000-0x00007FF7DA9E8000-memory.dmp
memory/1788-15427-0x00000000000D0000-0x0000000000147000-memory.dmp
memory/3528-1111-0x000001D9460F0000-0x000001D9470F0000-memory.dmp
memory/4124-15425-0x00000000000D0000-0x0000000000147000-memory.dmp
memory/5696-15412-0x00000000000D0000-0x0000000000147000-memory.dmp
memory/6624-2662-0x000001714EF00000-0x000001714EF20000-memory.dmp
memory/6624-2646-0x000001714EF40000-0x000001714EF60000-memory.dmp
memory/6624-2640-0x000001714DBD0000-0x000001714DCD0000-memory.dmp
memory/6624-2676-0x000001714F300000-0x000001714F320000-memory.dmp
memory/6624-2642-0x000001714DBD0000-0x000001714DCD0000-memory.dmp