Overview

overview

8

Static

static

3

ReShade_Se....3.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    25/04/2026, 16:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ReShade_Setup_6.7.3.exe
  • Size 3.8MB
  • Sample260425-t8a41sd131
  • SHA256 56791fd065358e899c581ebefe2ad871399b7c7ae83fb85e1154c08a75a44147
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 32 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.7.3.exe
    "C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.7.3.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:380
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3196
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb07e2c728,0x7ffb07e2c734,0x7ffb07e2c740
      2⤵
        PID:3228
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,7792030775896172641,16001638489289051016,262144 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1896 /prefetch:2
        2⤵
          PID:2120
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,10928913085252340571,9768706451840851607,524288 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2240 /prefetch:11
          2⤵
          • Downloads MZ/PE file
          • System Time Discovery
          PID:1716
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,10415351629455999568,1591704770924822488,524288 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2248 /prefetch:13
          2⤵
            PID:4860
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,943216305974244109,1445073181691946169,2097152 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3432 /prefetch:1
            2⤵
              PID:3660
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,1723855827076409762,10619513944219878050,2097152 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3512 /prefetch:1
              2⤵
                PID:3136
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4220,i,9278509649300547468,3759858460170730384,2097152 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4236 /prefetch:9
                2⤵
                  PID:3272
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4620,i,14229603574602468448,1859732803423506995,2097152 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4752 /prefetch:1
                  2⤵
                    PID:1068
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4944,i,13520745859136242043,17977472742050642021,2097152 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4952 /prefetch:1
                    2⤵
                      PID:2632
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,14300559380056899499,15311329830688847199,524288 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5576 /prefetch:14
                      2⤵
                        PID:3740
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5800,i,15928322823278381032,5826887289086196122,2097152 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5792 /prefetch:1
                        2⤵
                          PID:3144
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5928,i,3527174248824065949,14696001698314169646,2097152 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5956 /prefetch:1
                          2⤵
                            PID:4856
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,8601796544344942644,15569390734415178743,524288 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5604 /prefetch:14
                            2⤵
                              PID:5108
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5108,i,16039816176248311617,9455735087957082659,524288 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6076 /prefetch:14
                              2⤵
                                PID:1048
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,10288461297092619539,13652012443724045117,524288 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6116 /prefetch:14
                                2⤵
                                  PID:4744
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4344,i,2062739240044828843,6609491455697752893,2097152 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5436 /prefetch:1
                                  2⤵
                                    PID:4576
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,14525909723137017803,14179630805859077202,524288 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6092 /prefetch:14
                                    2⤵
                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                    • NTFS ADS
                                    PID:4844
                                  • C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Drops file in Program Files directory
                                    • System Location Discovery: System Language Discovery
                                    • Enumerates system info in registry
                                    • Modifies Internet Explorer settings
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:244
                                    • C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.exe
                                      "C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 244
                                      3⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4604
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7160,i,16654744588071004842,9566925158794064256,262144 --field-trial-handle=1900,i,2619269182430551214,15425689453204561337,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6824 /prefetch:10
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:196
                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                  1⤵
                                    PID:2264
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:3236
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                      1⤵
                                        PID:1256
                                      • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                        C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                        1⤵
                                        • Drops file in Windows directory
                                        PID:1900
                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                        1⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3864
                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                        1⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5448

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            RobloxStudioInstaller.exe
                                            • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                            • Size 9.4MB
                                            • SHA256 08fa8ed4fbdd8434832d198ef981ec953a719dd7abb2d6ea0c2985d57c542089
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            RobloxPlayerBeta.dll
                                            • Path C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.dll
                                            • Size 15.4MB
                                            • SHA256 f937e00724f5ed12a0b662e2b4b07ec1f61a6204a34fe047f3b57530a730d9fe
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            BookmarkMergedSurfaceOrdering
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                            • Size 6B
                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            BrowsingTopicsState
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                            • Size 414B
                                            • SHA256 e1d87bf96be4403f1d60e4dd3fc4d74c0ad8d1c076aece3572a51f458d0684f4
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            the-real-index
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                            • Size 6KB
                                            • SHA256 6efd28a0765b5ef977b2a0ad041a84e8da89af75b6400785bc1553524808bf37
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Network Persistent State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                            • Size 12KB
                                            • SHA256 448d5d47e536107dfd5f57c10f569fe958d105e851715c81b14886804dfe1229
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Network Persistent State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                            • Size 12KB
                                            • SHA256 8b791e50cfdd9d36bc4ff4b4e41378a5d9dbbe8da3f4eb14bcebb4e8be66a959
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            SCT Auditing Pending Reports
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                            • Size 2B
                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                            • Size 14KB
                                            • SHA256 71e5bc57bc242075ad2fca4ec1bfd8e04af51cda3a866e06e4cefcea0a0733d8
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                            • Size 12KB
                                            • SHA256 d82da2a16d28bbd3b05f1bc993f11cd4a1b2990c2e897fbe319fdb59bf95fcb5
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                            • Size 13KB
                                            • SHA256 6881e909227bfe45c6eead5f783559d8baebf73d855b2fac502df2d8279d6802
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Secure Preferences
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                            • Size 17KB
                                            • SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            temp-index
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
                                            • Size 120B
                                            • SHA256 556b2d31150628001f9a9148de39c42979a8b3fb746eeb98193db542d505b86e
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            the-real-index~RFe585e67.TMP
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585e67.TMP
                                            • Size 96B
                                            • SHA256 e6210d4ad1b7678d3c79b0a5cf1875c0753b33f57aa1cf8036f51592819166cf
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            index.txt
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
                                            • Size 150B
                                            • SHA256 4cfb91a5dbfd87d160a07e4d4c33aa8dccc89dce965c331ea8725e8c91e79c9e
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            index.txt~RFe5892e4.TMP
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5892e4.TMP
                                            • Size 157B
                                            • SHA256 636c59ea6d5a97b822a388bc8dfe37787c712097fd580c56ba1d4e453102e8db
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                            • Size 196KB
                                            • SHA256 c5d1a1d9c9911814f95b8663615dae8ed507ed8e6c67010d7422367c9a8b4194
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                            • Size 238KB
                                            • SHA256 b8795aecd98f3330f5a210cfc1251f2dcc8b76f9355f8950fdea5d58248ad616
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                            • Size 90KB
                                            • SHA256 47b4f9f76beccff2a2f714f1ce0fb12286cbb4c1de5f52d875995098b190bc91
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                            • Size 196KB
                                            • SHA256 f4eeaa5be53d83d290542bbd7c83eadca7e38a05b11e2355c521968dd858240e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            FileCoAuth-2026-4-25.1645.3864.1.odl
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-4-25.1645.3864.1.odl
                                            • Size 706B
                                            • SHA256 5b1b9bc2e9ebe5ff79a1362872976f7e3040576ea72ff07d4c1fb2c98cd1ffd2
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            RobloxPlayerInstaller.exe
                                            • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
                                            • Size 9.4MB
                                            • SHA256 b112a9fec58816f9ee176a31c0f52e3cf94b4dfec07975ed67ba9eb911fd951a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            RobloxPlayerInstaller.exe:Zone.Identifier
                                            • Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier
                                            • Size 171B
                                            • SHA256 243bb2214f020320abec2d97c888970cc4a46a466324cb5ef9278ebb8ced18c3
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            memory/244-1124-0x0000000001470000-0x00000000014BA000-memory.dmp
                                            Download

                                            memory/244-1054-0x0000000001470000-0x00000000014BA000-memory.dmp
                                            Download

                                            memory/380-0-0x0000021050E50000-0x0000021050E7A000-memory.dmp
                                            Download

                                            memory/380-2-0x0000021052C40000-0x0000021052C48000-memory.dmp
                                            Download

                                            memory/380-5-0x00000210512C0000-0x00000210512D0000-memory.dmp
                                            Download

                                            memory/380-1-0x00000210512C0000-0x00000210512D0000-memory.dmp
                                            Download

                                            memory/380-4-0x0000021052C50000-0x0000021052C5E000-memory.dmp
                                            Download

                                            memory/380-3-0x000002106B890000-0x000002106B8C8000-memory.dmp
                                            Download

                                            memory/380-9-0x0000021051280000-0x000002105128C000-memory.dmp
                                            Download

                                            memory/380-6-0x00000210512C0000-0x00000210512D0000-memory.dmp
                                            Download

                                            memory/380-8-0x000002106B330000-0x000002106B4CA000-memory.dmp
                                            Download

                                            memory/1900-1151-0x000001EE79100000-0x000001EE7929A000-memory.dmp
                                            Download

                                            memory/2264-23-0x00000238364A0000-0x000002383663A000-memory.dmp
                                            Download

                                            memory/3196-119-0x00000278CE570000-0x00000278CE70A000-memory.dmp
                                            Download

                                            memory/3864-1150-0x0000000000C90000-0x0000000000CDA000-memory.dmp
                                            Download

                                            memory/4604-1102-0x00000222607F0000-0x00000222607FC000-memory.dmp
                                            Download