7850068460fa81c35ba0c3ff44d27cb09608a02cba76a396bbb128cf22fb8800

Resubmissions

11/03/2024, 20:34

240311-zce1zsff65 6

11/03/2024, 20:32

240311-zbapwade8s 1

Analysis

max time kernel
62s
max time network
70s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
11/03/2024, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ReShade_Setup_6.0.1_Addon.exe
Size

3.6MB
MD5

c22a0b21ff22af940d4f0b3121f65242
SHA1

03491a240db2866b068e1cdb998a3666182dee45
SHA256

7850068460fa81c35ba0c3ff44d27cb09608a02cba76a396bbb128cf22fb8800
SHA512

827d44a4d732602cc41fd9020be75cb07f95dcc3a58ffd4f52af955b6388d7098b46a18e47dfc255630307795b485735e272a077913fea83e7c736378a7b3d39
SSDEEP

98304:VsknlrflgCQzgUKadqVvBqohsFgI5+r7p1+:rnlbl1uzdqVvcdW4+Xn+

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
17	raw.githubusercontent.com

Drops file in Program Files directory 52 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Technicolor2.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\DisplayDepth.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Cartoon.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\FXAA.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Monochrome.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\SMAA.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Textures\SearchTex.png	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Macros.fxh	ReShade_Setup_6.0.1_Addon.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\ReShade.log	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\UIMask.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\ChromaticAberration.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\CRT.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\ReShade.ini	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Curves.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\ReShade.fxh	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Technicolor.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Daltonize.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\ColorMatrix.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Textures\AreaTex.png	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Textures\FontAtlas.png	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Deband.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Blending.fxh	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\FilmGrain.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Nostalgia.fx	ReShade_Setup_6.0.1_Addon.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Blending.fxh	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Textures\lut.png	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\DrawText.fxh	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\FakeHDR.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\FXAA.fxh	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Layer.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Levels.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\LiftGammaGain.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Splitscreen.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\dxgi.dll	ReShade_Setup_6.0.1_Addon.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\ReShade.ini	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\ASCII.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\SMAA.fxh	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Textures\Layer.png	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\ReShade.log	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\CAS.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\LumaSharpen.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Tonemap.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\ReShadeUI.fxh	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\TriDither.fxh	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Border.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Sepia.fx	ReShade_Setup_6.0.1_Addon.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\ReShadePreset.ini	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\LUT.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\DPX.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Vibrance.fx	ReShade_Setup_6.0.1_Addon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Vignette.fx	ReShade_Setup_6.0.1_Addon.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\dxgi.dll	ReShade_Setup_6.0.1_Addon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupView = "0"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByDirection = "1"	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "3"	ReShade_Setup_6.0.1_Addon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Music"	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4 = 19002f433a5c000000000000000000000000000000000000000000	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4\0\0\0\0	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	ReShade_Setup_6.0.1_Addon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4\0\0\0	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ReShade_Setup_6.0.1_Addon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96"	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4\0\0\MRUListEx = 00000000ffffffff	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	ReShade_Setup_6.0.1_Addon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Mode = "4"	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	ReShade_Setup_6.0.1_Addon.exe
Key created	\Registry\User\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\NotificationData	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000e950fc9bc664da01fd467b9ec664da011e3a09bfc664da0114000000	ReShade_Setup_6.0.1_Addon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\NodeSlot = "5"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616257"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4\0\0\0\0\NodeSlot = "6"	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\FFlags = "1"	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ReShade_Setup_6.0.1_Addon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 03000000010000000200000000000000ffffffff	ReShade_Setup_6.0.1_Addon.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	ReShade_Setup_6.0.1_Addon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ReShade_Setup_6.0.1_Addon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "4"	ReShade_Setup_6.0.1_Addon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a00000002e37a3569cced2119f0e006097c686f60700000028000000e0859ff2f94f6810ab9108002b27b3d902000000a00000002e37a3569cced2119f0e006097c686f602000000780000002e37a3569cced2119f0e006097c686f60400000088000000	ReShade_Setup_6.0.1_Addon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3184	ReShade_Setup_6.0.1_Addon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	ReShade_Setup_6.0.1_Addon.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3184	ReShade_Setup_6.0.1_Addon.exe

C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.0.1_Addon.exe
"C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.0.1_Addon.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\ReShade.ini

Filesize
433B

MD5
18a994ac5c12262e115a4432b4544ca8

SHA1
aa33965ee82e0a0575a7dce5392de9b40ab3ec6b

SHA256
73e400baa027b15a1a062a97d2607bcbf9dbe6b5d6d3e0cc548242f78f5c8f10

SHA512
2533192dadc698f9c8413ec57b181ed052d0a8d2ae430a56af01afe2a0d689a657f274581d53f5164b86189fee12d4637b842b488762651d27e7ae5a7213168c

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\ReShade.ini

Filesize
335B

MD5
213823256694926bdd16f7ea615f08ee

SHA1
c39d55b85371336ea8096cca28efcc969b69827b

SHA256
c9a56415c9e8e9c76809e98c4221fb04359206862c2cdd1d701cc358bbfbb90d

SHA512
52424b9da30893455e4dd46b3b0fa0a712881991e9a96ede997e3477452a8f1f0caac617049db08cc7110954c51c2a9b55b5933607cc321f62a364652a6d2cf6

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\Blending.fxh

Filesize
18KB

MD5
66720778a8178b7d690960d3d7fb248f

SHA1
735e9917130dbe2fe8d972f1a1d9f02bb68dc833

SHA256
1eab08b853014fd6aaaae6783c5052de2ec2a74792c149635e4ed44a58660ba3

SHA512
d00d5a830bb3ff4b4ec2a750c740a37c8483608631191eb88fb093702e41944ac9dac2b422954347bf1bd4a732bde2e1eb2cdbc5905cf0fa518cab8d5f031d5d

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\reshade-shaders\Shaders\LumaSharpen.fx

Filesize
8KB

MD5
24ad49eea207392eff0cec3327d8d64e

SHA1
ffac551f4ffdd4de8c07a1f11bdc3ee8397c01d1

SHA256
7b358ebbdaa7bc4c44ebf6e9d41afcb3f21ee3dde5c5f85bf40201d5c6044680

SHA512
1993021d4742513eb3e3fadd7a20f925bcde944641cc47e3993114dd21d2449031d34138e965a348d8a7b7c7ebdc179019f1c05d6409c9bcac2d5a33695bd776

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\ASCII.fx

Filesize
15KB

MD5
0ef114e3848e4ea141a61f8b7c6f6723

SHA1
31f3a67cdf6f03f8d666e4d2636cf7fa0ee7b3f8

SHA256
2a61173381663357ee2542f342b6650456c2cc77e80a762852de78d92ae719a2

SHA512
d01b9be7816ef73280daf1d0efebfc584fa97c95840c70bc8083977492248431d8c8cd40db8d5b79d0db534a5874c27d06bf0bc607353301cc8f7f3f07ef111f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Border.fx

Filesize
2KB

MD5
af6c2b03cd0f58c050886ac32362356d

SHA1
23f141810d96a045a1700a58992d6ac215b96860

SHA256
4dde98aa5c55ff354c9d98d545d30724bda4108049dcd5d6cbf1b9ba27d77d3b

SHA512
8966d6bc5a61234d0ea5d5c590f830617928a65dddbf01e15ab970616ce67ad6915b2b6fa3316520be35740f127a7dd36888ed6433b211bce493a207f3786521

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\CAS.fx

Filesize
6KB

MD5
157cc710acd3fc5467432062058bbcce

SHA1
adc0d72882721d86fb8404e3a9c8384f722ca342

SHA256
38a9990914daad286a2346cb2e879a29c44769ec0c5fb466542937aa743f763c

SHA512
4ec80612d7b3074f8cd47dce572316061623177b7873df6a57c2d05424636609127077eb1666ced94fee2c55a93f36baabf6f4283555dd3d5864e485bf7900c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\CRT.fx

Filesize
10KB

MD5
abad45dc03074605aea3b1608ee93d96

SHA1
eeb2a264bf2c2ccb69ea043d700c792628d7cda3

SHA256
0671a6d4369330299173ade6c9d9cb466248710b7f7a6fed60b14aeccd04187d

SHA512
95c9479fce09fc13fb41d226134d4bbc99499638be7a614a54053bcbc6e331fe60069b18a9967973c7d8ead97dcadeb93b0e98a7f426f5405772aa3142bea758

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Cartoon.fx

Filesize
1KB

MD5
086a1cdef767ccaa23dbb3072e95a99f

SHA1
94feb3a8a64143ac0ce6801d6e1d0dacce17f907

SHA256
5d90e1c72318a28255d268ff3ac3fcb64d1e9469f5ca1334a50fb7d1b1a005f4

SHA512
c2448a1beec96f8881fa33653c93166a6c122ad80cc80e0fa27fa3e5046a35a07f75e9862b65b7310411c4df2dfc7c00efb8d1a952acddfe4d6aea34b0dec9f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\ChromaticAberration.fx

Filesize
1KB

MD5
0455c4b78d88e4af9bd0fc4b03876752

SHA1
dd8e396b2b376d032e76949709ca4bb78efbca6f

SHA256
a6bfe5c0770c09be949b3548c4979dab1dd347478b7fa50108ef144c82beab72

SHA512
cc792e89185d47fa0baf26b2d04795424f9b72f24b1c8f33fd55c485d3f92a76f832471e46ede131473c494d0d72a52b527c5415876868df381bf3eec6f07bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\ColorMatrix.fx

Filesize
1KB

MD5
7708dfa6153f5a87564da9e397e076a0

SHA1
558b61966c2b1f3b3b70012fbf24791aa9d5f61c

SHA256
5162503f77e4d3af52e068ab74778226105d065199a25302c3583890fed75a3b

SHA512
b12bb545d44a5d3ecfdab066f990e47dcca46f41aa468918e3e4a1921dfbfae64c094a021b159d78cc786f4323756067596212d5dafcb2ff01e3cc26a005c418

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Curves.fx

Filesize
6KB

MD5
5b7a1af1a231a102901de08e5eed739f

SHA1
3214162f7dd3a126872635874ce1b480c9b9badb

SHA256
8368029d2254856505abf7dd789342024465403da49434dd776c6d1af4079a98

SHA512
6ca3392d44fd9ce1121a6bf065e15715be34406e64be8010dcf7cb0982915a49b763745307050a97e50b3cc849d3ea05fc0ea8458c7dc903808f06a6ee3fe39e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\DPX.fx

Filesize
1KB

MD5
a6ca99dacfd8e97fe8354962c5e2b0aa

SHA1
c5d3b695ec3f535cf9edde574a1858c2476f042e

SHA256
3dafebab5bfd6909dff9e4980af17c903f2c6b8cb573da2378de936ae57305ad

SHA512
639147c3bce58879d2f6a87820d28d96bc8264a7ded9086b82657a0bc0ae21277b3d91cbe852942e1a3cd21bf91f0f704ded7f94c39daf1a8db17f45a330ad01

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\FXAA.fx

Filesize
3KB

MD5
ffc0c88c63e320e3da7ae61f7d1378d0

SHA1
3cd1fadd62d7f249f87076d1bc9c7050d91f2768

SHA256
d16f9d987d4a556b89ff4ddc11b158bc2ded5b18b72778841225b2df45875380

SHA512
ec87c8a9c08ea95de36a1c62f6d08216f172e573fad57e216f307272b77b82b9ff828b5a03c974313e7b460afe5584b2c3e048deee9f2d31cf2039f3fa5c1f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\FXAA.fxh

Filesize
83KB

MD5
21329f400d0f311d4caa3d8f0743be4b

SHA1
1308c6634fbbd28c1d00e78f5fdc9b029a6cfabb

SHA256
26435f77adef392fd751ed6a648a05d375c57ac88d00bbad19653c75ac9c36fa

SHA512
6929f5e6900183d9d4b7ca5b4b1037b231a5024426d3fc016e2279308850048f1843da411f5a3516c26b5e6546109b0d9020e11900334d2f28c52429babc7f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\FakeHDR.fx

Filesize
2KB

MD5
9133acad998021840d78ccd357d60493

SHA1
8854bac6ccad579de90725ed736d5d6c05ab271f

SHA256
f6ca5ed2c4f0698695cca7fc0a2b917e1934b6cb34064a0bc7aa098051727cf9

SHA512
a76c2dc4b39575cd32cb02864c64ca27b6021251461dc828bddafa6fb84b22734f827613760b77a81f52c5256367348a85b249415eb61222249a5a781594a031

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\FilmGrain.fx

Filesize
3KB

MD5
fe71c1fc07cacd6d286d3a20de2e0114

SHA1
fa23a17857c6e40b759b6698837613e25f7f8c78

SHA256
520f0c40247c457a23a8f66a761c71eb43e5ca85db5f68a92f1fbf0700f37154

SHA512
5ef769f55133f6a9b9e9e39ba0db44e64c37584b154b600177564e71555329ac07f0e80e90975cc9278b272cc9535e0cb7adf6800695fe700768d1657dfd9a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Layer.fx

Filesize
2KB

MD5
f13b8a8821730cb2d0a493a25bf9f77e

SHA1
68954da2b39dfaed292d0748698c65c6a1da6248

SHA256
b7a39bc6bd4989f1e568880d1aace900f0f5a531322e61afdc51b248c51f10ea

SHA512
64b0143d4089fedc473544b3b0c2ca590423791cbeb0d244112d8718ce579713fb7cca6cd6528d989a568ed64dcc9935793f2d2c12944c94df4d21b3611ae58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Levels.fx

Filesize
2KB

MD5
99950d1967dc50e0827e43b83072f686

SHA1
7f1afb65c1b77f6fd0367697ddfc07ddad0beeb9

SHA256
c603d3ea12d6d5710f2246bb7dd446d19e561154656f1fa8d579ca7fbbeef70e

SHA512
e44b568f5bed0dcc0006f39efafadced65798938f4b7505bac441057f8f57576d7475a96ba5ba584fa2ec6ced315866a4ca7f579ee648939098222c982996bd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\LiftGammaGain.fx

Filesize
1KB

MD5
916b163b63e2764a65de7702c745587e

SHA1
687361ec1c9f98f29b36979db3a7e8e94ef89c99

SHA256
5a6b6c85d0e09ed4c507f3b5f1b3b2f4f0f1268e24bb0ec81edbd431e28566df

SHA512
80b3d45d570a301c1c12202dad1373ad6960732b20d00db9ecc57837ae25bbe7273af92f5f8048fa4dba46bfdaa52a11679bb36db6672efa0dce6766a5506caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Monochrome.fx

Filesize
3KB

MD5
c79549850ca6194e2b2c3389276dd07c

SHA1
8cfe9133d4e569130237f0ebabbb151f31fd3cc4

SHA256
36e0c42ce96f7ca61d44fdeedbdb2e2b859d3359b29ad1e5dc3f1772d3b2459e

SHA512
90884ed060239fdc2ef76d177557a597f7151ffc0dc43a7b9d72e5b35cc4e8317253c33b1e2ddaf1559157b9960d75d92e5e00deb57ab182c3be60019574a065

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Nostalgia.fx

Filesize
21KB

MD5
28674e3d4d9674b7c38b14ed24d4c0cc

SHA1
d1ee8bdc77ea89744a2bfa383d49bbb11d8d0d84

SHA256
7b4264e7b7bc9486f2555b11a159e3cd8f5c480c2a5d7c56816f60d44517508e

SHA512
ebb9998b500d5472a84d992cffbb782f36dadfd8029661db96c5c08ae5f203aaa832180e3f68d977ea9a2d0eed00db2a86372ce00869947dcc21233720f75fbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\SMAA.fx

Filesize
9KB

MD5
4f02b357d0bda58eb7164aea0f7a11d1

SHA1
1baf7f700acb7619edeaa77dbece73ff805faa58

SHA256
8fc7a50a5be19bedc75f30386dc1481547dbe292e6278d469330c2c62a3f64ab

SHA512
36902c8d1df7efe929d27038ed625f9ef23947e7f9acfa36abd16649918cf256f634b7b21df9abee2c325d1051890946c037f553423d2e2fe69481dabc721870

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\SMAA.fxh

Filesize
56KB

MD5
ee534d68c2208ca432a4fa843708c6b5

SHA1
81da04c6302c71f6479ac6552eb7372b6a794f43

SHA256
ee18b0f376585338cdb477a0900757cebac86d3c476ef99955348b55818c8310

SHA512
65d1b92de76e5abab798849e7c7eeb03d42eaeda1e7b20843c039a8f3ec3c6c52a027b0cd7655a32298cedc9974adbba100e99eca8f400956eba3a0f689ef178

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Sepia.fx

Filesize
549B

MD5
0241895db69a200b3a33e06912da1485

SHA1
e8874c739d19ad4208882c8798c3e5391e5f4aea

SHA256
4a4c7b4a3cc6cdf717aa96f0d3586b98c143a5584a29fd3a9d57aecd895b0bc6

SHA512
95996796b0616789193870c4d30b4a520a53666d219826a15478c390a38ea819a87a1df7dbbc8cba2829243a025e891e1f6d3a6155945a0a27fd9504ff45972c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Splitscreen.fx

Filesize
4KB

MD5
c8452c05a6ec2439113c197181743475

SHA1
a00bb11a42db7656ebaaa2268f64b707c127afa3

SHA256
5faeaa709bb333815d1927c4ab9b8bca9947177bf8127c517720bcf6483c5e0a

SHA512
dd5c65cab65dc23ae2f9a7434a9df829a963352ee50df05d6c2075b9d6b9cf615e7e3def88c824af85e02bf696a7fa4cbffadf0f1cc30c4fbcf7e5418216fc09

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Technicolor.fx

Filesize
1KB

MD5
bde25774e602daf5d030e761bfc9d1cf

SHA1
9f4d066016ffe3bccd3a534e7965774e72954587

SHA256
51169a82dde7929a500791417cedb96d7f1131c0d8d33289d30b5249796ac1d2

SHA512
dc5953546a169d3ee42db81f48802efcb29f55851e1d3d71d2c0dfb10a92662fa0b95376435ca3828dbf397dffb114ae6e781e43ef8d116c82ef3687f23e336d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Technicolor2.fx

Filesize
1KB

MD5
f054ab8c7fdf4829b959a3e5705823e7

SHA1
75fff1fff5125181a34f110407c30302c2dc1866

SHA256
eb54498ae1699144fead73284d047d8428eab77d515ea5ce136cb84c2b3098c3

SHA512
3122b76466572d5808a00dd4ddd3625ae6e0119f1a597471a6ec02ea283a7407c95d3df013fa5bbf23f2e4774df7ad8c11c829d6dde3ef4605a04d92e718bf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Tonemap.fx

Filesize
1KB

MD5
e3010c2b9e6b2f6cf73cc600b1208c7b

SHA1
c25bb9158d686114e59684c0d42f2617510ca08a

SHA256
bbe2e7eb8d6f9fb4316bad8c85b5bfd1d98f0903d2cd962fd5d4c0ebbde3c5f3

SHA512
874bb88a44d1ccc784f4bce50fd4d4aa8611df7e8b2f52542811f8e2db78df91cd7f45d5816aa84a6b3d95161b414ecbbbab30dfd35f6efddccb0ca197047970

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Vibrance.fx

Filesize
2KB

MD5
ea424849f8dbff3a29e23986eff5346d

SHA1
45af227013ced7bf66e425dae069f450f7a81b60

SHA256
b9189a28ca4a645a0e188f8396c81889d217e3c706e8900dfe6594d43e7c33eb

SHA512
1183c57d61049d39f982dde37c6978dc0fb7075edec45d23745977df4cb39a84ec1217be3d6348e7f68b8bf946bf4b29bc064b63b27dbfd17e090e50ee7d36e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Shaders\Vignette.fx

Filesize
3KB

MD5
3926055695f2c75f891e35547795647d

SHA1
c0c16df1cd317aa09f0a170deb56cf2276502a11

SHA256
a7358b592830fa74a0a50a842682c99db751e35666e49c229567daf9ea59afa2

SHA512
f464e24527ee330312c52608a92173b7bc5a38b9b411d16f96ef3e283e36779e2e915b8da20513e8b97c4a2cc66f6d3e7ccd56967779244703630906fad01502

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Textures\AreaTex.png

Filesize
29KB

MD5
b2207738f6c72500ec7a86158c344188

SHA1
32630350a08cff59505009902596c777fd923bba

SHA256
0044e6b420a8d98a9dc6a60bedbd43f75cd15ac6052fdedfb2f2f55d3077beed

SHA512
84c3aca6bd7b9e191acf8ce602e73bd063cf71fa5201a83cbf78d72623c85e70710e5950e90d94a0688ce2741b920a1e2b5b41951e52930e7505c592c8477163

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Textures\Layer.png

Filesize
9KB

MD5
4561dcc71ac061792d24c3b3cd4799ec

SHA1
8a9ff7b9c2097ed891fb4e0495bddf5faf365775

SHA256
c9dc422c85df2c9c1ed04dbfc0421f0b4a41bf736adf50d009d172e49b3c05fc

SHA512
a02dc94f831581db65dd5a7f0a2331478498b3cd910e6b3209369f0c59d2cab0df1f97e7ea219c6de2dbd7465d3924c8b7d440f4e12f7e47d8de5ed6dd1d4563

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\SweetFX-master\Textures\SearchTex.png

Filesize
126B

MD5
5844b2e42a8da64dfd3564adbe6e151d

SHA1
bccc32ab305b9473f00dfeed2e47ff2cf4ae20b9

SHA256
55a97853ab64174245701accf315ab63d41776c9cb2aa14c675e653684fd96f3

SHA512
71ee718b231daa77fad0a16a7f5b26482493627c57915d72b397cb7ad20539f442116e7e56bb8f70710618a135d878d07024a5afaca9a22edd15c631e40c793c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\Daltonize.fx

Filesize
2KB

MD5
f5871be80d0ca8f5edf4cc9d1b269ac5

SHA1
d0f61510e2d67cd8fb9e587bc7ad20eedbea4019

SHA256
ab6006e886db0f1fdb9845b892debe774eda9ec498182373aa6ade601d258d3f

SHA512
80bad11e2928c7b55dc936efd435c1db146f639f1d9b711b1689b976ca03ea8f910a37bea880a2e49d85bbd21979145584c3dba5c73346fcc4092538820bb95b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\Deband.fx

Filesize
9KB

MD5
4b48fad97630526702bc33c1f38a6497

SHA1
bd0395a866390a42849a6fa642ac81f689e9b0db

SHA256
8959ca995090bc89762cc0bf4ba3bb1ffcffdf143e9e0ddaf84f0e004b53dd29

SHA512
cda0a08c2fcf95c4a0b965e2386ca07d4d1f0d02d63fb0eb60b8c86176cd6ec365d09b2f455164bd6af2d0b2ded7988c9e4ed8da39997bb63edda4fd38311111

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\DisplayDepth.fx

Filesize
21KB

MD5
d4421758a6d4f205fff2af5ef8a768a8

SHA1
528981981c2f723786baaa250531d66a4553b01e

SHA256
e2266c47c75dcc30030c8ec68cf62cf16f2aebe1ecdecf0265d91ce65dbd7f32

SHA512
28ea0828b03be47acedcb81298c775eea5e145848d34e5594d3659e825ca990652a73c8092c42f8000d3fd497dfe0a80d8b7a91192a91607869d987ed2bcc45d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\DrawText.fxh

Filesize
9KB

MD5
fd33d6b47df4a4e69e3f4669e52be9d8

SHA1
1ca02d72eeff4c50202aaead4931a103847c36e6

SHA256
b79cc4dfb3e98bcf4c06193d00ea7631d74f467f73a4deeeee13e71336d3e680

SHA512
f50d4c54bac99e07496993255373a7500af1dfe6d30aaefec4ef86f012d319bf0cf00b5af4082ff6268a3385782626c70234d03a8618389704d0704a064a8c10

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\LUT.fx

Filesize
2KB

MD5
6d4b5d63ab0f440911a55903e5767076

SHA1
ffd43c2275d0acc73c69ae4a40a1de4565bdec0f

SHA256
e3179c023a599d1ebe0c73fa00084a64d0be66f4e5b43a45c1bb25c3c9df0363

SHA512
2828ecb2481bf8ccf0de037b300906f0b83275ca9a9d98d35e0f5682ea53fd930ed33239e385cbe5480547fdcb1e601050def7189a02908b85684d3f5501f25e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\Macros.fxh

Filesize
20KB

MD5
65662c5dda1e465942c159925f76fae3

SHA1
fa1b605f964595d5db3b19601958680d4dc8831e

SHA256
78d8974469b0e7bb2fdd5c6a98ee6304d03a614ffd2bc2a66985a54ff5f9b3a0

SHA512
cee7105d03bf8fb48703f5af9d3e0f677dd87985522bbbdf9ebd5ed72f75d2da543272adb50c9074443bdd50b539b4f351bcdc6e56caf7bf1e46c95a83936389

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\ReShade.fxh

Filesize
3KB

MD5
86719fb096599511c4e5b56af7ff614d

SHA1
7b7545d9ed7c76f24cbc3258e80199be2e0e0cae

SHA256
a8aae022868f5f68e5a39a23ac067982670788fb5f5c3de6fad1b468be567d6b

SHA512
c6b6b81f3fda4648be756df01c7c34a59b6cc9ae1dd5504a380c2256afb8225cc66a2def7d457f7a55d183827d29c0ee6f9f2071dcfb8cb2441c119705ec68b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\ReShadeUI.fxh

Filesize
9KB

MD5
a4851a3a31b433f7b608421200067dcf

SHA1
2d45356196b0383d3cf67a0c5ad48f102b42e38e

SHA256
78adf672df47460297eb9fe6dd238d2aafa24510b52b84feb1a745dff70eb901

SHA512
784f1a9dfa080d3ece722ef65f989c7371a214b31c545e5d6ca30b418ae6ee17817b0c2715de911ed4f6c0487bba93fa5e3d02eaef7192a4fcf6b960de6fc555

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\TriDither.fxh

Filesize
3KB

MD5
eda68c1a8aeb46c6fddb3ac8137de27a

SHA1
6d959d4a09632e85aeaa86efea9db35c102dce58

SHA256
d6f780996889c0ea2efebde26b515c4acc1ad4310e06affc3d5d42e2f325c42d

SHA512
2d64d2ec5f2ddb256c0350398ce316dcf545ab84643960675a96ca521fd7054270376cf56d6bfa78c36753ad6a982f4f930536689558e043ed8a618311a00712

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\UIMask.fx

Filesize
8KB

MD5
3a2cc5386bd2250cb4d1e30a3a4a1532

SHA1
005c5fad3f099e21bc1c80053be14072e195696b

SHA256
bcdcc03d96ac0467d73391c6ba1b18689f4559bc3250094069ed9522faf16301

SHA512
ed478a31185d399c28be89ebc341c58ed0e971dd8ccaafab97ebd683b02331a35021da3575cb4712dea6c78636376393218fcf90406c58610b3bd5dcf1698723

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Textures\FontAtlas.png

Filesize
14KB

MD5
cbd1c9d6989a60c54f41866e876ec0ca

SHA1
e4a2e21ea6b5812a3aaa9b5a78e4b116ff3b6c12

SHA256
11a711a8167d1c1606892e6fa6f661a477e749d6cbdb1ff700ac381842066ec3

SHA512
6076d1313af8370afe1a78769e7d4a2295fbc95a07647438588b1a14b5deb517db62ced8a662d6012886748a421f4d9d0b928091d198e21c88174b91362663cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Textures\lut.png

Filesize
273B

MD5
3e2ecbaccddecba4b57cab15b4dcf172

SHA1
7105cfbb7d641a81e87353f811fc7edd1953c193

SHA256
c81d61b0c7caa5cb8ff77b10183f2a00ffc5b4601ef328f7b9368e625fa9a214

SHA512
b83c0dcdab29781347830cc79a6ab879f86a3a9724c66a50801c85c9bbbaf2c8e68794ec5de258d869dc3834ba1a3e3dea841c913d228f7636616056777e6e69

Download Submit
memory/3184-6-0x000002884C210000-0x000002884C220000-memory.dmp

Filesize
64KB

Download
memory/3184-13-0x0000028869CD0000-0x0000028869CDA000-memory.dmp

Filesize
40KB

Download
memory/3184-8-0x00007FF9F73B0000-0x00007FF9F7E72000-memory.dmp

Filesize
10.8MB

Download
memory/3184-5-0x000002884DBA0000-0x000002884DBAE000-memory.dmp

Filesize
56KB

Download
memory/3184-3-0x000002884DB90000-0x000002884DB98000-memory.dmp

Filesize
32KB

Download
memory/3184-0-0x000002884BD40000-0x000002884BD7C000-memory.dmp

Filesize
240KB

Download
memory/3184-4-0x00000288663F0000-0x0000028866428000-memory.dmp

Filesize
224KB

Download
memory/3184-7-0x000002884C210000-0x000002884C220000-memory.dmp

Filesize
64KB

Download
memory/3184-9-0x000002884C210000-0x000002884C220000-memory.dmp

Filesize
64KB

Download
memory/3184-11-0x000002884C210000-0x000002884C220000-memory.dmp

Filesize
64KB

Download
memory/3184-12-0x000002886ACD0000-0x000002886ACE2000-memory.dmp

Filesize
72KB

Download
memory/3184-2-0x000002884C210000-0x000002884C220000-memory.dmp

Filesize
64KB

Download
memory/3184-1-0x00007FF9F73B0000-0x00007FF9F7E72000-memory.dmp

Filesize
10.8MB

Download
memory/3184-318-0x00007FF9F73B0000-0x00007FF9F7E72000-memory.dmp

Filesize
10.8MB

Download