56791fd065358e899c581ebefe2ad871399b7c7ae83fb85e1154c08a75a44147

Analysis

user interaction
yes
max time kernel
209s
max time network
194s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ReShade_Setup_6.7.3.exe
Size 3.8MB
Sample260705-15fcwsf13z
SHA256 56791fd065358e899c581ebefe2ad871399b7c7ae83fb85e1154c08a75a44147
MD5 d1aade32886987db543fc171027b865d
SHA1 816cfb69d8f262a2c6073b5f8d28e1b56a147a6d
SHA512 788813cf2529cdc7c83726737887f453c2b681d6e7c8cb5bd1cf09e2bbd25cd50020a84340b45bf310927b7fdd0f03da5ec951f9f979bed42d5840a4a603d9d8
SSDEEP 98304:NSZN5qt2fPnfaf65RCfC3Xs89C3RWA1aGD34OpFLoTz2:NS35CY/faARV4gijI6Fe2
TLSH
T1B20633C702D91458EAF7AF39B4324A4285B3B8822631D69836DE388C5FF0798D5357B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
63	6384	chrome.exe

Executes dropped EXE 5 IoCs

pid	Process
6940	RobloxPlayerInstaller.exe
2064	RobloxPlayerBeta.exe
3892	RobloxPlayerBeta.exe
1780	RobloxPlayerBeta.exe
2548	RobloxPlayerBeta.exe

Loads dropped DLL 2 IoCs

pid	Process
3892	RobloxPlayerBeta.exe
2548	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3892	RobloxPlayerBeta.exe
3892	RobloxPlayerBeta.exe
3892	RobloxPlayerBeta.exe
2548	RobloxPlayerBeta.exe
2548	RobloxPlayerBeta.exe
2548	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\InGameMenu\TouchControls\backpack_slots.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\icons\ic-more-create.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\icons\GameDetails\contentRating\igrs-pending.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\sounds\action_footsteps_plastic.mp3	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Settings\Help\BButtonLight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\VoiceChat\Misc\Mute.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_3x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\configs\DateTimeLocaleConfigs\es-mx.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\account_over13.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\DefaultController\ButtonR1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\avatar\characterR15DynamicHead.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\icon_placeowner.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\AvatarExperience\SelectionRing.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\avatar\abilities\AbilityManagerActor_beta1.0.0.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\configs\DateTimeLocaleConfigs\zh-hans.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\xboxRT.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\DesignSystem\ButtonR1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\DesignSystem\Thumbstick2Directional.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\PlayStationController\PS4\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\whiteCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\ErrorPrompt\ShimmerOverlay.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\fonts\SourceSansPro-Light.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\sky\noisefb.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\AvatarEditorImages\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\StudioSharedUI\places.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Settings\Help\XboxController.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Settings\Slider\BarLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\models\MaterialManager\smooth_material_model.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Moments\Reactions\fire-small.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\PlayerList\FollowingIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\ImageSet\AE\img_set_1x_2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\configs\GameControllerConfigs\gamecontrollerdb_new.txt	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\smallWhiteCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\BottomRoundedRect8px.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\icons\ic-view-details20x20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\graphic\gr-game-border-24x24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\avatar\heads\headI.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\LegacyRbxGui\sandside.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Lobby\Buttons\more_nine_slice_button.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\VirtualCursor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\Input\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\LegacyRbxGui\configIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\PerformanceStats\BackgroundRounded.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\ui\TopBar\Round.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\ExtraContent\textures\ui\LuaApp\dropdown\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\content\textures\Cursors\Gamepad\Pointer.png	RobloxPlayerInstaller.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6384	chrome.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Control Panel\Colors	ReShade_Setup_6.7.3.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277633154451375"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	ReShade_Setup_6.7.3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\NotificationData	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	ReShade_Setup_6.7.3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-5cf2272675e145f5"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	ReShade_Setup_6.7.3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-8b44d8f2067642d8"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-5cf2272675e145f5\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	ReShade_Setup_6.7.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ReShade_Setup_6.7.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5cf2272675e145f5"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
7136	chrome.exe
7136	chrome.exe
6940	RobloxPlayerInstaller.exe
6940	RobloxPlayerInstaller.exe
3892	RobloxPlayerBeta.exe
7136	chrome.exe
7136	chrome.exe
2548	RobloxPlayerBeta.exe
5072	chrome.exe
5072	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	ReShade_Setup_6.7.3.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe
Token: SeCreatePagefilePrivilege	7136	chrome.exe
Token: SeShutdownPrivilege	7136	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe
7136	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2224	ReShade_Setup_6.7.3.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 7136 wrote to memory of 7064	7136	chrome.exe	91
PID 7136 wrote to memory of 2832	7136	chrome.exe	92
PID 7136 wrote to memory of 2832	7136	chrome.exe	92
PID 7136 wrote to memory of 6384	7136	chrome.exe	93
PID 7136 wrote to memory of 2860	7136	chrome.exe	95
PID 7136 wrote to memory of 2860	7136	chrome.exe	95
PID 7136 wrote to memory of 704	7136	chrome.exe	96
PID 7136 wrote to memory of 704	7136	chrome.exe	96
PID 7136 wrote to memory of 5212	7136	chrome.exe	97
PID 7136 wrote to memory of 5212	7136	chrome.exe	97
PID 7136 wrote to memory of 4344	7136	chrome.exe	98
PID 7136 wrote to memory of 4344	7136	chrome.exe	98
PID 7136 wrote to memory of 3028	7136	chrome.exe	99
PID 7136 wrote to memory of 3028	7136	chrome.exe	99
PID 7136 wrote to memory of 6504	7136	chrome.exe	100
PID 7136 wrote to memory of 6504	7136	chrome.exe	100
PID 7136 wrote to memory of 1392	7136	chrome.exe	101
PID 7136 wrote to memory of 1392	7136	chrome.exe	101
PID 7136 wrote to memory of 588	7136	chrome.exe	102
PID 7136 wrote to memory of 6460	7136	chrome.exe	103
PID 7136 wrote to memory of 6164	7136	chrome.exe	104
PID 7136 wrote to memory of 6460	7136	chrome.exe	103
PID 7136 wrote to memory of 6164	7136	chrome.exe	104
PID 7136 wrote to memory of 6708	7136	chrome.exe	108
PID 7136 wrote to memory of 6708	7136	chrome.exe	108
PID 7136 wrote to memory of 4744	7136	chrome.exe	110
PID 7136 wrote to memory of 4744	7136	chrome.exe	110
PID 7136 wrote to memory of 2248	7136	chrome.exe	109
PID 7136 wrote to memory of 2248	7136	chrome.exe	109
PID 7136 wrote to memory of 2732	7136	chrome.exe	111
PID 7136 wrote to memory of 2732	7136	chrome.exe	111
PID 7136 wrote to memory of 6748	7136	chrome.exe	112
PID 7136 wrote to memory of 6748	7136	chrome.exe	112
PID 7136 wrote to memory of 5036	7136	chrome.exe	113
PID 7136 wrote to memory of 5036	7136	chrome.exe	113
PID 7136 wrote to memory of 3956	7136	chrome.exe	114
PID 7136 wrote to memory of 3956	7136	chrome.exe	114
PID 7136 wrote to memory of 6700	7136	chrome.exe	115
PID 7136 wrote to memory of 6700	7136	chrome.exe	115
PID 7136 wrote to memory of 5452	7136	chrome.exe	116
PID 7136 wrote to memory of 5452	7136	chrome.exe	116
PID 7136 wrote to memory of 6360	7136	chrome.exe	118
PID 7136 wrote to memory of 6360	7136	chrome.exe	118
PID 7136 wrote to memory of 6652	7136	chrome.exe	117
PID 7136 wrote to memory of 6652	7136	chrome.exe	117
PID 7136 wrote to memory of 5548	7136	chrome.exe	119
PID 7136 wrote to memory of 5548	7136	chrome.exe	119
PID 7136 wrote to memory of 400	7136	chrome.exe	120
PID 7136 wrote to memory of 400	7136	chrome.exe	120
PID 7136 wrote to memory of 1968	7136	chrome.exe	121
PID 7136 wrote to memory of 1968	7136	chrome.exe	121
PID 7136 wrote to memory of 1660	7136	chrome.exe	122
PID 7136 wrote to memory of 6940	7136	chrome.exe	123
PID 7136 wrote to memory of 2728	7136	chrome.exe	125
PID 7136 wrote to memory of 1864	7136	chrome.exe	126
PID 7136 wrote to memory of 6908	7136	chrome.exe	127
PID 6940 wrote to memory of 3892	6940	RobloxPlayerInstaller.exe	130
PID 7136 wrote to memory of 5072	7136	chrome.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.7.3.exe
"C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.7.3.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:7136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7fff7fb0c728,0x7fff7fb0c734,0x7fff7fb0c740
  2⤵
  PID:7064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,8486777487183312574,9672711579378115764,262144 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,863690801667682219,12306927526510310550,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:6384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,13584638198779532901,15011261396541552066,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3328,i,12643502548356844629,3793852224479244441,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3300,i,14883332372189593167,7085988689415886407,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,6273375945500685545,2713918860825922472,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,6504567391561753701,12854057333993038167,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,6676775427371770418,1058237919599824614,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:6504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,17079573949370465891,11603433185782117268,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,6187027718175744353,1213263470621954468,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5464,i,9383104054055127627,5894671727579909496,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:6460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5476,i,6630110567517336876,18210071817509129510,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:6164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5792,i,13101410458851565072,3566332319324492873,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:6708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5756,i,17767023709710907325,5526388484398003051,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,801871050940533525,17848580470370855755,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6216,i,14275415118480296995,1641737187692049953,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6148,i,15589166976239224613,214562961855973989,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:6748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,7191331401997173649,1300014243375764010,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6060,i,349536795100187533,15099248890501752849,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,8514103124648462572,1471379111292095757,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
  2⤵
  PID:6700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6400,i,10343197231740245277,10895585343533803066,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4504,i,15526375527391928757,3444649768529931550,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:6652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6496,i,4764604550217719313,17669400139621964595,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:9
  2⤵
  PID:6360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6512,i,4899332479135579798,11424569310028322967,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3648,i,5380004461503894352,9821887447683730645,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4576,i,7835008080031170138,11686324109010626509,2097152 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,12860521911325502422,2628729503384279305,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
  2⤵
  PID:1660
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6940
- - C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6940
    3⤵
    - Executes dropped EXE
    PID:2064
- - C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6940
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,11380748861744480972,17633332390426364231,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6712,i,14132638901899699996,8496380425163533204,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3748,i,14159825638358342987,11717923585894382579,524288 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
  2⤵
  PID:6908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5492,i,10914240411618727174,4299236346681128437,262144 --field-trial-handle=1920,i,9478094236314471933,10168939147889705723,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:240

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:1780

C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1508

C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.7.3.exe
"C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.7.3.exe"
1⤵
PID:6476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 4fb6633176abb8d1be846cc49d65bf4a4a358af81b750bd2bca87604fdc98dd7
MD5 9336ac4d9169c399e889c1278c9fe0b0
SHA1 adca43997bf4725b6bca68f6f1cc157b038e34cc
SHA512 e1d5c466a1a6a7fa60860f72e42866e8bde5744195ed234906a876256360c23368eb46c746e527262e96eb225f7fee4b74e76cb1b7be531a0d98f88674fed3c8
SSDEEP 196608:POAyr3imdRaPKzLCl1IP0CmsxakQdtNuqmpEfBMJ:POHrWKKCmsxbQdjuqmpEK
TLSH
T1F3A6AE22B901C032E8D200B296BD5FFA993D5E341B3954D3A7C45DB95A705E33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-5cf2272675e145f5\RobloxPlayerBeta.dll
Size 21.1MB
SHA256 735aa9c8dde82f0d8aefd1aced464df2e0ca44b9b3bd23b15737f670d53bbbb7
MD5 8fe70396076af509d116005bf87d453e
SHA1 f8a400bde73531548434021f02a5c20610981a48
SHA512 a743ea85b1c40236e050cd164296dbe4dd1cabebfad32c6602c0f614bd0487705755d088f063ec2e1ad239b4044147524651e9709fc52a5a947d186df5496d1d
SSDEEP 196608:9zkzU1hTZdlkxex+Xtpi/KZFdCjI+IQTLc8VvK3HWPsZLs:9zkelyiUyKcVLDVi32P5
TLSH
T18C27BF4EB8E206E4C2725070D17F46E3DAA2704C19AC6AB746E5412036337DE665BFBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 86c6f165dda8542aa8295168d2b121d23519c51f2ba231a86ed2d62b5c436903
MD5 824cb2e590c443783949e5f1c958632d
SHA1 3f88a4b1e1db5c0030115661daa43467e43499bf
SHA512 5b509bc64c176119d86fe5ab68e6a7b1ff66d8670cef6ef98796c4eed23081908a568797a396df80ddc2cb37d0b2e7b3749e3b94d550ec71449dd7b25bc90b5a
TLSH
T10201522D22D605FBCF25123608CC3D70666C289CBC7CEFAB81A7849C9CB72F200498D6
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ef5746cc776b1b6fa619958f57352060af04794884feb0b42dabdf50d890b3db
MD5 5f2f2f78f3e48e6bba4b40239eb7305e
SHA1 d33e6e9b20cbd9d37bc3b2eb522299d2755e20ef
SHA512 4500afb1c93993bfeff1d5d2ecec50a1b5c964fd15dc0940149cc6631f4005f59ad8b258a78205e8b03b9dfe17ada48e201af595e6d0964891c1b9c4e1a3dd33
SSDEEP 192:Dlpw876IteKQRKtpjbNiRqQRNPuaP1fPoNHcHxLK:Dlpw876ItrQRKtpjbNiRqQRN2adfANHj
TLSH
T17DE17EF7C3D8C66DC91156F89B257F1ECE2A1A18431C3C26C8D4BE5B93E2472D21568E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d9c6dc20468abbfbc02e7a949178e7d2aadcc6a1c14b47e7b49c359fb7c29b04
MD5 d5a092ac3f90c1821ddd050ec83c49ca
SHA1 8d437fcee28f4533e3141e884595cc073474e137
SHA512 ab5ab6810d834aadb8bf9bb7505d9d164955645b6b4bd9be96038241a1e8e5213b163388e1dfd337e0d49909bb114f4724ad064c33ded294aa7318da799c9fd4
SSDEEP 192:gRhcBzYp6Hv7tAPRp2/hkQ9ZHsb+WNIEH04p22aleRpVyIsnAUge:gRhmzYYP8X2Lwqn2JPe
TLSH
T10242C82FA924253B5CDBD21AF9617B67D7F6113121D42E80EBFC8A2C06E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 941307939e3509608e56e0ecb9a4e7081eab744b9430f96423f64705101801c0
MD5 027e108ba04d98a1d4d2e76b72ca8923
SHA1 d3fd8d5cb17613db4005c88725148afed4b293d4
SHA512 0b747dadd7c7f6ffdece1345937826fbf968ab7287ee69d345a3b02caacfd945baa40217b05c0e99aed2b6c70d676f53151f73d7a829198182aa445dcc242a12
SSDEEP 192:gRhcBzUp6Hv7tAPRp2/hkQ9ZHsb+WNIEH04p22aleRpVyIsnAUge:gRhmzUYP8X2Lwqn2JPe
TLSH
T1EF42C72FA924253B5CDBD21AF9617B67D7F6113221D02E80EBFC8A2C06E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 303dcada070d8f127c0c6a265df19a6afbd51f054218cf58b7cb2cb2460c665f
MD5 54742eb59d4daa30983582cd015ea43e
SHA1 da2d17f285e2f7af97a929fe1a84d72ca4751713
SHA512 38ce4381c1f4705795a4b759135f9f16670adb1e2e1d5a3f7a02d6e0a0ef2a3bf17513fa8648920aa49bdd745949edc00cb2b1b9379331739876f78b46cae5ee
SSDEEP 192:gRhcBzUp6Hv7tPPRpz/hkQ9ZHsb+WNIEH04p2Dns23leSpVyIsnAUgE:gRhmzUYPtXvLwqnw2NPE
TLSH
T17E42C92BA92415776CD7D21AF9617F67D7F6113221D06E80EBFC8A2C06E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 5d87a3ba154c517e1c2c92bfa382e6cac097379936bbeb8e166117c51c053934
MD5 f8d55329771a37a7a2f6d399cf95a12b
SHA1 0d49854ed7c4574229132092929978aadc1f1d2d
SHA512 7ded2c286b63631ebcd2f946d7c6b30d24a314fe6bcb7b180da3531ec8109f157370b1780a727ad3b00f184aba774a91af968f2ea735e59c4ebaa0e075cd006b
SSDEEP 384:B7j1Y7KxkXqKf/pUZNCgVLH2HfgslOKXOD14+ErU3xpHGJdVS7mnw51:B31Y7KxkXqKf/pUZNCgVLH2Hfgs4YOZf
TLSH
T18B520767684C8A7B0F98D58CD8226F8FADF6015766B80D6497FB9C0803E57CB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e86ffdd85f888e3110fd2f0a20c5b9c725ce9ea6de0540422acd08a2369a935a
MD5 8dd6d2cf2c421e5ba167209fe3e4cfd0
SHA1 af357f2254af4acfa52fbf00d6572b9b894174c2
SHA512 32a86db64be35505a18a70ad1462d5bd88f32e3c0d35f8f19c7ca5766bc3630acbab16f37993977fb4cfcbb215d333e3809583ac032e2b6ce072ca894843cef3
TLSH
T103A0025C41C40526CD094B747073A671229558141E52CF975CD32D499EAF1C04511904
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59893b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59893b.TMP
Size 48B
SHA256 9848252e1c23c53379de1cea10d0d35708cc8ef87bbb9e58916d263f0a246024
MD5 8ca32b2065704db8230c16888f33b8a0
SHA1 8479f7714d37ed581e07f0a29efcec75d64536a1
SHA512 ce7f0b16f41813f467c65d41a6c3e3530f7b83890907be171cf2c663b360d1522001d4b814eab1d74a825778dd0a565b3db298d8a5450b37f666493ecaafe596
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 c2498aa33484e764702e82895b8f7d4f01bdf75c87ee146d81de4974bdea6610
MD5 7e64c1432bcdda80ad7c12e1e1398126
SHA1 8cf7e5c02b62c9ffad2ed425758bfb9d8ab23ccc
SHA512 f361ebad6eb390ac90a2c3336ee8c9bd05654f84c325f3f90c0db1320c05a09bc207169840d47f56ebee95f9953f7901d1a40c446fdfa3e368c2ab5b76988736
SSDEEP 3072:3XWvp9Ss8pYLCaMN8u5VPnnEFRFRTJw/A3BNxHRt:2BP8pYw80nubFS/sBNxv
TLSH
T1F2C312503C810F7FF6A9AD28BC022A5FCE154C59CA11FFE6AEC59FCDA06510D67884B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 97bcb0b9964b1a3ab2fb5872ae909c5c67c27a8cf0893f6e6c0488ebb68d22e2
MD5 dbc4a584c126c7a4f2df195cd5c82d1d
SHA1 b21cb06e457ce798be3ec55dc61affda9815fad2
SHA512 48b3a9cff26fed76f3d95ac04710b0323d620943de0c0ccadaf31b33619a4b7f21d703bc489db7154909c5fbfbf08e1ae68529e1d58c9ca755d0915874f2fe8a
SSDEEP 3072:EXWvp9Ss8pYLCaMN8u5VPnnEFRFRTJw/A3BNxHRt:7BP8pYw80nubFS/sBNxv
TLSH
T12CC312503C810F7FF6A9AD28BC022A5FCE154C59CA11FFE6AEC59FCDA06510D27884B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6250752866415659b4bfdd804f0da21f90460c43074ad47be6fac7304b48478b
MD5 fae49a7a0676f4caae360e286f63f479
SHA1 b17a3d6e56bf0c215899bf5357bf92ed6e6073a7
SHA512 4c0962f1f2d990bb327c4c577d0f9c40874d20dd3baa8f8aa0a33c4255b10789221b13a53acfbd8f40100c2fa790c6985bf2481255b045425ade04e99d49fdd0
SSDEEP 96:9C65d+ZjT58BXkvQxBBifvUM+RDotok56+sDtB6sGyvAay3PHEvbCTv4a:9C+ijUhPBSaDUDszEmy3PHEvbe
TLSH
T19BA11A3268698C7355B7D986B5963B13CFBC21A79691EE84ECED1E0C11EB5EC0342533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 dfaaba47e147caa6ae3b10d1528a349a5d5412d9fe45b7a4ea6e52ac049d24b2
MD5 7e865d5db3525a4120a57a655b435581
SHA1 8691d99d37afedc7df15dca1afc519487e88d719
SHA512 8efbc09a6a1df5692d8b440d1e232972c85594540acb21d60bad0c6a36474efb199e48af93e6ec400f66c1559aeca1011bb5c9d5dab7ff597fd1509e97ff767c
SSDEEP 3072:3X7p9Ss8pYLCaMN8u5VPnnEFRFRTJw/A3BNxHRt:1P8pYw80nubFS/sBNxv
TLSH
T146C312713C810EBFBAB5AC5878022E5FCD594C5BCE10FF99AEC49FCDA01510D66898B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 1f224481adf492da14de7f1a4db9da195134191e94f51d902569a43e6d3e7a73
MD5 94a256c9c441bd41726bcde6abad5db1
SHA1 90f26c72220f13f7e782098dc986c9b40b0e0dc6
SHA512 4d57d8a0a3e666060c89a2e9d2c5b3939d2c4ea0b63354ce06023d295f6da8ef972f679ea92ad85579186ca9b5550fcce10510dfaebba7ecb0257cf339ea0ef7
SSDEEP 96:TK7cZ6unLo0Fg2KC+z3bCYE2TlAyHPVjecXH+X2y4HV0h:TK7cZ6ucig2izmYEuZtycXZN6h
TLSH
T18BD25566F544EA06DE092C36EFEAD5EC23353E21CD8A032779C5B77F48B71C08969149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 d18fc9e4f40db80179d82533e132b74d690114673810f1ef46a239f417852a4b
MD5 0feb2e0ea9d69b3b48edfe791427ff46
SHA1 4170de4ee3bd02a4410627d7bc41acf255c9071d
SHA512 06a3bdaa1395fcb1693cee8c93e4dfa9465afa2edb8718b8d929f316f1cb2b082119f2e504c3f8195cf4d36c2ff37e94ce7ed9cea1429139a0ff80ab26da2e46
SSDEEP 96:hK7cZ6unLo0Fg2KC+z3bCYE2TlAyHPVjecXH+X2o4HV0h:hK7cZ6ucig2izmYEuZtycXZP6h
TLSH
T124D25566F544EA06DE092C32EFEAD5EC23313E21CD8A032779C5B77F48B71C08969189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7136_923148764\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 9.6MB
SHA256 c377f327acf6f974085678aeb267ef49caf229abcc290fcbcaa88d3c5b28d571
MD5 c2578522848004b668a214063b29b1d7
SHA1 f717839175b602b73fdc343397d7e1cbc25e385a
SHA512 ad4e7f003548b0c6b89ca7b23ed099dffbac5bc0a878c07a9e5d9a428701286f84a9a06bacbf0d5bf9c65319ee50b8129030f42a922850d9f6ea6a10315f9722
SSDEEP 196608:eb1PrdUXKZWafizCk6jsNZtzmsxL50W7ANVSXrlJBKJhDp:e7UXKwzmsx100ANVSblyDDp
TLSH
T144A6AE22B900C032F8D200B296BD5FFA993D9A345B7954D3A7D42DB959305D33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2224-13-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-6-0x000001B485B30000-0x000001B485B38000-memory.dmp

Download

memory/2224-11-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-9-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-0-0x00007FFF64F2F000-0x00007FFF64F30000-memory.dmp

Download

memory/2224-12-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-26-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-8-0x000001B49E4B0000-0x000001B49E4BE000-memory.dmp

Download

memory/2224-7-0x000001B49E4F0000-0x000001B49E52E000-memory.dmp

Download

memory/2224-10-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-5-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-4-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-3-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-14-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-15-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-2-0x00007FFF64DA0000-0x00007FFF65744000-memory.dmp

Download

memory/2224-1-0x000001B483E40000-0x000001B483E6A000-memory.dmp

Download