4f84f90b0ffe12d74745e92941615614736414d581283c4ae57c7898666f1ea2

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29/06/2023, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install VALORANT (1).exe
Size

67.5MB
MD5

8626becee53bdcc44fa73c271231a0fb
SHA1

82620a84762aed14c0f7aa8072329b874a19dfbe
SHA256

4f84f90b0ffe12d74745e92941615614736414d581283c4ae57c7898666f1ea2
SHA512

ff0a690187ee6dc6803a3d00cacddb2b2239a22eb28a1497a55d0474427a44b5ba7fdf8ba033bf7a7dc4fb24b7b461c0286a50c8a3310b07d11d4eee805113e8
SSDEEP

1572864:NrNItDfUCSp8K0UNl/Ywrt9E7lzPF5KBBhDIVIbjUp1xD+:peDfUBp8KnAtqBBhDIVNji

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 16 IoCs

pid	Process
1600	RiotClientServices.exe
1816	RiotClientServices.exe
1996	RiotClientCrashHandler.exe
1364	RiotClientUx.exe
1568	RiotClientServices.exe
1300	RiotClientServices.exe
796	RiotClientCrashHandler.exe
2020	RiotClientServices.exe
1088	RiotClientServices.exe
1056	RiotClientServices.exe
2200	RiotClientCrashHandler.exe
2292	RiotClientCrashHandler.exe
2404	RiotClientCrashHandler.exe
2536	setup.exe
2700	RiotClientCrashHandler.exe
2872	installer.exe

Loads dropped DLL 26 IoCs

pid	Process
1200	Install VALORANT (1).exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1364	RiotClientUx.exe
1300	RiotClientServices.exe
1300	RiotClientServices.exe
1364	RiotClientUx.exe
1364	RiotClientUx.exe
1088	RiotClientServices.exe
1088	RiotClientServices.exe
2020	RiotClientServices.exe
2020	RiotClientServices.exe
1056	RiotClientServices.exe
1056	RiotClientServices.exe
1568	RiotClientServices.exe
2536	setup.exe
2872	installer.exe
3032	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	1568	WerFault.exe	35

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\shell\open\command\ = "\"C:\\Riot Games\\Riot Client\\RiotClientServices.exe\" --app-command=\"%1\""	Install VALORANT (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\ = "URL:Riot Games Protocol"	Install VALORANT (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\URL Protocol	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\DefaultIcon	Install VALORANT (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\DefaultIcon\ = "\"C:\\Riot Games\\Riot Client\\RiotClientServices.exe\",0"	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\shell\open\command	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\shell\open	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient	Install VALORANT (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riotclient\shell	Install VALORANT (1).exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1568	RiotClientServices.exe
1600	RiotClientServices.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1200	Install VALORANT (1).exe
Token: SeIncBasePriorityPrivilege	936	Install VALORANT (1).exe
Token: SeIncBasePriorityPrivilege	1600	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	1816	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	1600	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	1600	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	1568	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	1300	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	1300	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	1088	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	2020	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	1056	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	1088	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	1056	RiotClientServices.exe
Token: SeIncBasePriorityPrivilege	2020	RiotClientServices.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe
1600	RiotClientServices.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 936	1200	Install VALORANT (1).exe	27
PID 1200 wrote to memory of 936	1200	Install VALORANT (1).exe	27
PID 1200 wrote to memory of 936	1200	Install VALORANT (1).exe	27
PID 1200 wrote to memory of 936	1200	Install VALORANT (1).exe	27
PID 1200 wrote to memory of 936	1200	Install VALORANT (1).exe	27
PID 1200 wrote to memory of 936	1200	Install VALORANT (1).exe	27
PID 1200 wrote to memory of 936	1200	Install VALORANT (1).exe	27
PID 1200 wrote to memory of 1600	1200	Install VALORANT (1).exe	29
PID 1200 wrote to memory of 1600	1200	Install VALORANT (1).exe	29
PID 1200 wrote to memory of 1600	1200	Install VALORANT (1).exe	29
PID 1200 wrote to memory of 1600	1200	Install VALORANT (1).exe	29
PID 1600 wrote to memory of 1816	1600	RiotClientServices.exe	31
PID 1600 wrote to memory of 1816	1600	RiotClientServices.exe	31
PID 1600 wrote to memory of 1816	1600	RiotClientServices.exe	31
PID 1600 wrote to memory of 1816	1600	RiotClientServices.exe	31
PID 1600 wrote to memory of 1996	1600	RiotClientServices.exe	32
PID 1600 wrote to memory of 1996	1600	RiotClientServices.exe	32
PID 1600 wrote to memory of 1996	1600	RiotClientServices.exe	32
PID 1600 wrote to memory of 1996	1600	RiotClientServices.exe	32
PID 1600 wrote to memory of 1568	1600	RiotClientServices.exe	35
PID 1600 wrote to memory of 1568	1600	RiotClientServices.exe	35
PID 1600 wrote to memory of 1568	1600	RiotClientServices.exe	35
PID 1600 wrote to memory of 1568	1600	RiotClientServices.exe	35
PID 1300 wrote to memory of 796	1300	RiotClientServices.exe	36
PID 1300 wrote to memory of 796	1300	RiotClientServices.exe	36
PID 1300 wrote to memory of 796	1300	RiotClientServices.exe	36
PID 1300 wrote to memory of 796	1300	RiotClientServices.exe	36
PID 1088 wrote to memory of 2200	1088	RiotClientServices.exe	40
PID 1088 wrote to memory of 2200	1088	RiotClientServices.exe	40
PID 1088 wrote to memory of 2200	1088	RiotClientServices.exe	40
PID 1088 wrote to memory of 2200	1088	RiotClientServices.exe	40
PID 1056 wrote to memory of 2292	1056	RiotClientServices.exe	38
PID 1056 wrote to memory of 2292	1056	RiotClientServices.exe	38
PID 1056 wrote to memory of 2292	1056	RiotClientServices.exe	38
PID 1056 wrote to memory of 2292	1056	RiotClientServices.exe	38
PID 2020 wrote to memory of 2404	2020	RiotClientServices.exe	39
PID 2020 wrote to memory of 2404	2020	RiotClientServices.exe	39
PID 2020 wrote to memory of 2404	2020	RiotClientServices.exe	39
PID 2020 wrote to memory of 2404	2020	RiotClientServices.exe	39
PID 1568 wrote to memory of 2536	1568	RiotClientServices.exe	44
PID 1568 wrote to memory of 2536	1568	RiotClientServices.exe	44
PID 1568 wrote to memory of 2536	1568	RiotClientServices.exe	44
PID 1568 wrote to memory of 2536	1568	RiotClientServices.exe	44
PID 1568 wrote to memory of 2536	1568	RiotClientServices.exe	44
PID 1568 wrote to memory of 2536	1568	RiotClientServices.exe	44
PID 1568 wrote to memory of 2536	1568	RiotClientServices.exe	44
PID 1364 wrote to memory of 2700	1364	RiotClientUx.exe	45
PID 1364 wrote to memory of 2700	1364	RiotClientUx.exe	45
PID 1364 wrote to memory of 2700	1364	RiotClientUx.exe	45
PID 1364 wrote to memory of 2700	1364	RiotClientUx.exe	45
PID 2536 wrote to memory of 2872	2536	setup.exe	46
PID 2536 wrote to memory of 2872	2536	setup.exe	46
PID 2536 wrote to memory of 2872	2536	setup.exe	46
PID 2536 wrote to memory of 2872	2536	setup.exe	46
PID 1568 wrote to memory of 3032	1568	RiotClientServices.exe	47
PID 1568 wrote to memory of 3032	1568	RiotClientServices.exe	47
PID 1568 wrote to memory of 3032	1568	RiotClientServices.exe	47
PID 1568 wrote to memory of 3032	1568	RiotClientServices.exe	47

C:\Users\Admin\AppData\Local\Temp\Install VALORANT (1).exe
"C:\Users\Admin\AppData\Local\Temp\Install VALORANT (1).exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\Install VALORANT (1).exe
  "C:\Users\Admin\AppData\Local\Temp\Install VALORANT (1).exe" --agent --riotclient-app-port=49164 --riotclient-auth-token=Yl9eAEjL6cuApCWaZDPZqg --app-root=C:/Users/Admin/AppData/Local/Temp "--data-root=C:/ProgramData/Riot Games/Metadata" "--update-root=C:/ProgramData/Riot Games/Metadata/Install VALORANT (1)/Update" "--log-root=C:/Users/Admin/AppData/Local/Riot Games/Install VALORANT (1)/Logs" "--user-data-root=C:/Users/Admin/AppData/Local/Riot Games/Install VALORANT (1)" --session-id=43fdf2a1-aa38-9149-9c8d-179d335f79fe
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Riot Games\Riot Client\RiotClientServices.exe
  "C:/Riot Games/Riot Client/RiotClientServices.exe" --launch-product=valorant --launch-patchline=live --force-auto-patch --shard=valorant:live:eu --locale=en_US --session-id=43fdf2a1-aa38-9149-9c8d-179d335f79fe --install-flow
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Riot Games\Riot Client\RiotClientServices.exe
    "C:\Riot Games\Riot Client\RiotClientServices.exe" --agent --riotclient-app-port=49332 --riotclient-auth-token=XGLKzi0xG6TxcQ6LtqNqcQ "--app-root=C:/Riot Games/Riot Client" "--data-root=C:/ProgramData/Riot Games/Metadata" "--update-root=C:/ProgramData/Riot Games/Metadata/Riot Client/Update" "--log-root=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs" "--user-data-root=C:/Users/Admin/AppData/Local/Riot Games/Riot Client" --session-id=43fdf2a1-aa38-9149-9c8d-179d335f79fe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- - C:\Riot Games\Riot Client\RiotClientCrashHandler.exe
    "C:\Riot Games\Riot Client\RiotClientCrashHandler.exe" --no-rate-limit "--attachment=2023-06-29T20-23-26_1600_Riot_Client.0.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-26_1600_Riot Client.0.log" "--attachment=2023-06-29T20-23-26_1600_Riot_Client.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-26_1600_Riot Client.log" "--attachment=__sentry-breadcrumb1=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\0b080718-1d5c-4d4e-b2a3-47271ddd123e.run\__sentry-breadcrumb1" "--attachment=__sentry-breadcrumb2=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\0b080718-1d5c-4d4e-b2a3-47271ddd123e.run\__sentry-breadcrumb2" "--attachment=__sentry-event=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\0b080718-1d5c-4d4e-b2a3-47271ddd123e.run\__sentry-event" "--database=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" "--metrics-dir=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" --url=https://sentry.io:443/api/1339107/minidump/?sentry_key=dc54709324504ab18ddf517a83f99e1a --initial-client-data=0x21c,0x22c,0x230,0x1cc,0x234,0x74e3bc08,0x74e3bc18,0x74e3bc28
    3⤵
    - Executes dropped EXE
    PID:1996
- - C:\Riot Games\Riot Client\UX\RiotClientUx.exe
    "C:/Riot Games/Riot Client/UX/RiotClientUx.exe" --app-port=49386 --remoting-auth-token=oNgPGuKtA8Vt3XsUMF2TNg --app-pid=1600 "--log-dir=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs" "--user-data-root=C:/Users/Admin/AppData/Local/Riot Games/Riot Client" "--app-root=C:/Riot Games/Riot Client" --crashpad-environment=KeystoneFoundationLiveWin
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Riot Games\Riot Client\RiotClientCrashHandler.exe
      "C:\Riot Games\Riot Client\RiotClientCrashHandler.exe" --no-rate-limit "--attachment=2023-06-29T20-23-48_1364_RiotClientUx.0.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/2023-06-29T20-23-48_1364_RiotClientUx.0.log" "--attachment=2023-06-29T20-23-48_1364_RiotClientUx.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client UX Logs/2023-06-29T20-23-48_1364_RiotClientUx.log" "--attachment=__sentry-breadcrumb1=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx\166e8769-ec52-44f4-b5fe-5986062a223c.run\__sentry-breadcrumb1" "--attachment=__sentry-breadcrumb2=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx\166e8769-ec52-44f4-b5fe-5986062a223c.run\__sentry-breadcrumb2" "--attachment=__sentry-event=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx\166e8769-ec52-44f4-b5fe-5986062a223c.run\__sentry-event" "--database=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx" "--metrics-dir=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx" --url=https://sentry.io:443/api/1339107/minidump/?sentry_key=dc54709324504ab18ddf517a83f99e1a --initial-client-data=0x1f4,0x1f8,0x1fc,0x1c8,0x200,0xd0aff8,0xd0b008,0xd0b018
      4⤵
      Executes dropped EXE
      PID:2700
- - C:\Riot Games\Riot Client\RiotClientServices.exe
    "C:\Riot Games\Riot Client\RiotClientServices.exe" --agent --riotclient-app-port=49386 --riotclient-auth-token=dIIZVKbDG6vgz15rWK5vRw
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\ProgramData\Riot Games\Metadata\vanguard\setup.exe
      "C:/ProgramData/Riot Games/Metadata/vanguard/setup.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\7zD79A89E8\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zD79A89E8\installer.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 584
      4⤵
      Loads dropped DLL
      Program crash
      PID:3032

C:\Riot Games\Riot Client\RiotClientServices.exe
"C:\Riot Games\Riot Client\RiotClientServices.exe" --launch-product=valorant --launch-patchline=live
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Riot Games\Riot Client\RiotClientCrashHandler.exe
  "C:\Riot Games\Riot Client\RiotClientCrashHandler.exe" --no-rate-limit "--attachment=2023-06-29T20-23-35_1300_Riot_Client.0.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-35_1300_Riot Client.0.log" "--attachment=2023-06-29T20-23-35_1300_Riot_Client.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-35_1300_Riot Client.log" "--attachment=__sentry-breadcrumb1=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\841fbc5c-3fc7-4707-d59f-21c2eabe5dae.run\__sentry-breadcrumb1" "--attachment=__sentry-breadcrumb2=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\841fbc5c-3fc7-4707-d59f-21c2eabe5dae.run\__sentry-breadcrumb2" "--attachment=__sentry-event=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\841fbc5c-3fc7-4707-d59f-21c2eabe5dae.run\__sentry-event" "--database=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" "--metrics-dir=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" --url=https://sentry.io:443/api/1339107/minidump/?sentry_key=dc54709324504ab18ddf517a83f99e1a --initial-client-data=0x1c0,0x1c4,0x1c8,0x194,0x1cc,0x74e3bc08,0x74e3bc18,0x74e3bc28
  2⤵
  - Executes dropped EXE
  PID:796

C:\Riot Games\Riot Client\RiotClientServices.exe
"C:\Riot Games\Riot Client\RiotClientServices.exe" --launch-product=valorant --launch-patchline=live
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Riot Games\Riot Client\RiotClientCrashHandler.exe
  "C:\Riot Games\Riot Client\RiotClientCrashHandler.exe" --no-rate-limit "--attachment=2023-06-29T20-23-37_1088_Riot_Client.0.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-37_1088_Riot Client.0.log" "--attachment=2023-06-29T20-23-37_1088_Riot_Client.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-37_1088_Riot Client.log" "--attachment=__sentry-breadcrumb1=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\3cdfd994-ee57-4b84-f672-8e9424aa944f.run\__sentry-breadcrumb1" "--attachment=__sentry-breadcrumb2=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\3cdfd994-ee57-4b84-f672-8e9424aa944f.run\__sentry-breadcrumb2" "--attachment=__sentry-event=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\3cdfd994-ee57-4b84-f672-8e9424aa944f.run\__sentry-event" "--database=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" "--metrics-dir=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" --url=https://sentry.io:443/api/1339107/minidump/?sentry_key=dc54709324504ab18ddf517a83f99e1a --initial-client-data=0x23c,0x240,0x244,0x210,0x248,0x74e3bc08,0x74e3bc18,0x74e3bc28
  2⤵
  - Executes dropped EXE
  PID:2200

C:\Riot Games\Riot Client\RiotClientCrashHandler.exe
"C:\Riot Games\Riot Client\RiotClientCrashHandler.exe" --no-rate-limit "--attachment=2023-06-29T20-23-37_1056_Riot_Client.0.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-37_1056_Riot Client.0.log" "--attachment=2023-06-29T20-23-37_1056_Riot_Client.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-37_1056_Riot Client.log" "--attachment=__sentry-breadcrumb1=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\ddb89b55-47d2-4f67-f8aa-b77ee29f4854.run\__sentry-breadcrumb1" "--attachment=__sentry-breadcrumb2=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\ddb89b55-47d2-4f67-f8aa-b77ee29f4854.run\__sentry-breadcrumb2" "--attachment=__sentry-event=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\ddb89b55-47d2-4f67-f8aa-b77ee29f4854.run\__sentry-event" "--database=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" "--metrics-dir=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" --url=https://sentry.io:443/api/1339107/minidump/?sentry_key=dc54709324504ab18ddf517a83f99e1a --initial-client-data=0x1c0,0x1c4,0x1c8,0x194,0x1cc,0x74e3bc08,0x74e3bc18,0x74e3bc28
1⤵
- Executes dropped EXE
PID:2292

C:\Riot Games\Riot Client\RiotClientCrashHandler.exe
"C:\Riot Games\Riot Client\RiotClientCrashHandler.exe" --no-rate-limit "--attachment=2023-06-29T20-23-37_2020_Riot_Client.0.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-37_2020_Riot Client.0.log" "--attachment=2023-06-29T20-23-37_2020_Riot_Client.log=C:/Users/Admin/AppData/Local/Riot Games/Riot Client/Logs/Riot Client Logs/2023-06-29T20-23-37_2020_Riot Client.log" "--attachment=__sentry-breadcrumb1=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\2e3a1c56-90c6-4399-89a2-c4b37f73d5e4.run\__sentry-breadcrumb1" "--attachment=__sentry-breadcrumb2=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\2e3a1c56-90c6-4399-89a2-c4b37f73d5e4.run\__sentry-breadcrumb2" "--attachment=__sentry-event=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\2e3a1c56-90c6-4399-89a2-c4b37f73d5e4.run\__sentry-event" "--database=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" "--metrics-dir=C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client" --url=https://sentry.io:443/api/1339107/minidump/?sentry_key=dc54709324504ab18ddf517a83f99e1a --initial-client-data=0x1d8,0x1dc,0x1e0,0x1ac,0x1e4,0x74e3bc08,0x74e3bc18,0x74e3bc28
1⤵
- Executes dropped EXE
PID:2404

C:\Riot Games\Riot Client\RiotClientServices.exe
"C:\Riot Games\Riot Client\RiotClientServices.exe" --launch-product=valorant --launch-patchline=live
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056

C:\Riot Games\Riot Client\RiotClientServices.exe
"C:\Riot Games\Riot Client\RiotClientServices.exe" --launch-product=valorant --launch-patchline=live
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games\Riot Client.lnk

Filesize
1KB

MD5
daa4118d9e8a4a74a4673e4b600bc102

SHA1
39c9c808f87e246b09d041baa3f20b7dc556256c

SHA256
e710561f3183a605f7ad8ee2a13e4b11fbeeee63310180ee58000e26dbc91225

SHA512
c28ab873511280a6882da4c7ab2fd572e3fb6dd5411af12d85c09b91dfb11af0d44ebe4480ae846a3dfcf773198e5162493e166e73354f679f8358057b9628ba

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games\Riot Client.lnk

Filesize
1KB

MD5
daa4118d9e8a4a74a4673e4b600bc102

SHA1
39c9c808f87e246b09d041baa3f20b7dc556256c

SHA256
e710561f3183a605f7ad8ee2a13e4b11fbeeee63310180ee58000e26dbc91225

SHA512
c28ab873511280a6882da4c7ab2fd572e3fb6dd5411af12d85c09b91dfb11af0d44ebe4480ae846a3dfcf773198e5162493e166e73354f679f8358057b9628ba

Download Submit
C:\ProgramData\Riot Games\Metadata\Riot Client\Riot Client.db

Filesize
364KB

MD5
73cc31ff03a6a65c414af0350043c5e4

SHA1
954e9b18027c4a56a277102cb2c2f4def7c558a2

SHA256
4a54aa79c5e366b802f49050afe903c53e01e6af0ea38406aae2ff841ed86275

SHA512
4a4bfdb1fc6d119f9c07bd358bfd50edc70edb519a7b7863c0e0546310556423ed7439ae89444c216783503d76971191b6c12ef6de55b436ba0eb78371c9de29

Download Submit
C:\ProgramData\Riot Games\Metadata\Riot Client\Riot Client.ok

Filesize
97B

MD5
a25342f8274300b48134f5520a3c29cd

SHA1
9e7365ac912aa704164fd837adb9c7d0d678ca64

SHA256
a395a70e74b3d13625b7f27325a1f823c02c1038a18c94d610204900faa8b963

SHA512
df0f8f74a1b2dfa89181ac3ee4c9f2d74fc29d2531af0b00c3640d43cee1f3f9304de436a907d44d558e77979b50cb6e11b4a96291ccb160cf5e03762b839eb6

Download Submit
C:\ProgramData\Riot Games\Metadata\Riot Client\Riot Client.settings.yaml

Filesize
75B

MD5
446e4f36c65a197a8ff37d0afe160e2d

SHA1
cbd6553c69f6d8ef07ef879c45bce61ab2876ea2

SHA256
e9a8f102f0432fd8e4a4a32cafffdd5d6a7fcad156a48761b886ae96dc7e71b6

SHA512
0a6d39107e8c47702ec7c36c131154fbbc4310e46eef2ef1ee27ed43255e7ac1d515ea5351008345d607dc29a3f687839bb7d6556401b121168d02f0e2ba9417

Download Submit
C:\ProgramData\Riot Games\Metadata\valorant.live\valorant.live.ico

Filesize
90KB

MD5
53dc27f05bedcc1dcdb8f04f7b61c5a3

SHA1
3565108d120e92dfcb6a16ed9d62c8c21016fa4e

SHA256
249f3c8b39c364a9ddb2a9a02b4c4d565731066220d07aabc5e70720f6649d56

SHA512
3e4f82d490c221de57979cc13e677de6dfecf0ed2795e2888a9325d5d916f57754404465a0cb81bf2de2f8a858d06037daae250f7a50936fd788af02585942cb

Download Submit
C:\ProgramData\Riot Games\Metadata\valorant.live\valorant.live.product_settings.yaml

Filesize
504B

MD5
3d7bc226d7a1295243cb8cdb8447b435

SHA1
c56a2e66b366f32ad441a6cc53e0a06e68a0d443

SHA256
783ae44df1b08aa2759ba8838c1726482aec045f2d1f75d26a19c09a16a76730

SHA512
ebbbc2b573f1a22f45c2b5356d70b21fa00b3d22971683cb28067109ad9056ac6f86dd7aba90ac1d2b312996de824b87e083b088eca8475bf7e075bd44c50ef4

Download Submit
C:\ProgramData\Riot Games\RiotClientInstalls.json

Filesize
260B

MD5
80fb9bcc6067cc09fad09546e6b8886a

SHA1
0a0268ab8597b728ff412e4bb6097cab47d2622e

SHA256
deeb24b066fdd4845db21e6472cb06f19f61eb15be9f7a0172fcc17d8edfb766

SHA512
99ac4945e0dbf2bdf71f8ed7558c509a8b872c8ed67cbb0c6235227da8edcde1ea472a759f5d36d2a724ad4a047bed66dcd4f444276b7f1b3f80e9996e6879fa

Download Submit
C:\ProgramData\Riot Games\RiotClientInstalls.json

Filesize
260B

MD5
80fb9bcc6067cc09fad09546e6b8886a

SHA1
0a0268ab8597b728ff412e4bb6097cab47d2622e

SHA256
deeb24b066fdd4845db21e6472cb06f19f61eb15be9f7a0172fcc17d8edfb766

SHA512
99ac4945e0dbf2bdf71f8ed7558c509a8b872c8ed67cbb0c6235227da8edcde1ea472a759f5d36d2a724ad4a047bed66dcd4f444276b7f1b3f80e9996e6879fa

Download Submit
C:\ProgramData\Riot Games\RiotClientInstalls.json

Filesize
260B

MD5
80fb9bcc6067cc09fad09546e6b8886a

SHA1
0a0268ab8597b728ff412e4bb6097cab47d2622e

SHA256
deeb24b066fdd4845db21e6472cb06f19f61eb15be9f7a0172fcc17d8edfb766

SHA512
99ac4945e0dbf2bdf71f8ed7558c509a8b872c8ed67cbb0c6235227da8edcde1ea472a759f5d36d2a724ad4a047bed66dcd4f444276b7f1b3f80e9996e6879fa

Download Submit
C:\ProgramData\Riot Games\RiotClientInstalls.json

Filesize
260B

MD5
80fb9bcc6067cc09fad09546e6b8886a

SHA1
0a0268ab8597b728ff412e4bb6097cab47d2622e

SHA256
deeb24b066fdd4845db21e6472cb06f19f61eb15be9f7a0172fcc17d8edfb766

SHA512
99ac4945e0dbf2bdf71f8ed7558c509a8b872c8ed67cbb0c6235227da8edcde1ea472a759f5d36d2a724ad4a047bed66dcd4f444276b7f1b3f80e9996e6879fa

Download Submit
C:\ProgramData\Riot Games\RiotClientInstalls.json

Filesize
260B

MD5
80fb9bcc6067cc09fad09546e6b8886a

SHA1
0a0268ab8597b728ff412e4bb6097cab47d2622e

SHA256
deeb24b066fdd4845db21e6472cb06f19f61eb15be9f7a0172fcc17d8edfb766

SHA512
99ac4945e0dbf2bdf71f8ed7558c509a8b872c8ed67cbb0c6235227da8edcde1ea472a759f5d36d2a724ad4a047bed66dcd4f444276b7f1b3f80e9996e6879fa

Download Submit
C:\ProgramData\Riot Games\machine.cfg

Filesize
39B

MD5
c3f19b4fff8563b24288cd58801c44c4

SHA1
ad5ead25691df65257f0eed03e4eb8e522dad5db

SHA256
2b83ef1a6f2c3c4caf2f3a6f9da9957cd098cd06ad76fa65daed8f18918576ad

SHA512
b8ff85cfa7a77c0ceda050d34bd11ca474344cf2ffb46870a3bd09c70e7c0372c21e0127ac414d9e7ffaba6b66805a4c5a93d82cc94fbd77d552c6bcf4fa09f5

Download Submit
C:\Riot Games\Riot Client\RiotClientCrashHandler.exe

Filesize
1.9MB

MD5
e9022af4e5cf995c2f2a9d897af560e9

SHA1
f6a0e432af5a1f87492d936afcadc0fb671b3da2

SHA256
76d2ad3dfa217321475a92b2f7ddf497d69e3c8537b216f83e512e4fa91c332f

SHA512
4c48a505f1d37b319ffdafafef4ca4ac7eab103d32088c3c1dad40b37036f9b73c454d030a3a15c4bbbe4935b583f162434eb6952bee35f3442d471b45932278

Download Submit
C:\Riot Games\Riot Client\RiotClientCrashHandler.exe

Filesize
1.9MB

MD5
e9022af4e5cf995c2f2a9d897af560e9

SHA1
f6a0e432af5a1f87492d936afcadc0fb671b3da2

SHA256
76d2ad3dfa217321475a92b2f7ddf497d69e3c8537b216f83e512e4fa91c332f

SHA512
4c48a505f1d37b319ffdafafef4ca4ac7eab103d32088c3c1dad40b37036f9b73c454d030a3a15c4bbbe4935b583f162434eb6952bee35f3442d471b45932278

Download Submit
C:\Riot Games\Riot Client\RiotClientCrashHandler.exe

Filesize
1.9MB

MD5
e9022af4e5cf995c2f2a9d897af560e9

SHA1
f6a0e432af5a1f87492d936afcadc0fb671b3da2

SHA256
76d2ad3dfa217321475a92b2f7ddf497d69e3c8537b216f83e512e4fa91c332f

SHA512
4c48a505f1d37b319ffdafafef4ca4ac7eab103d32088c3c1dad40b37036f9b73c454d030a3a15c4bbbe4935b583f162434eb6952bee35f3442d471b45932278

Download Submit
C:\Riot Games\Riot Client\RiotClientCrashHandler.exe

Filesize
1.9MB

MD5
e9022af4e5cf995c2f2a9d897af560e9

SHA1
f6a0e432af5a1f87492d936afcadc0fb671b3da2

SHA256
76d2ad3dfa217321475a92b2f7ddf497d69e3c8537b216f83e512e4fa91c332f

SHA512
4c48a505f1d37b319ffdafafef4ca4ac7eab103d32088c3c1dad40b37036f9b73c454d030a3a15c4bbbe4935b583f162434eb6952bee35f3442d471b45932278

Download Submit
C:\Riot Games\Riot Client\RiotClientCrashHandler.exe

Filesize
1.9MB

MD5
e9022af4e5cf995c2f2a9d897af560e9

SHA1
f6a0e432af5a1f87492d936afcadc0fb671b3da2

SHA256
76d2ad3dfa217321475a92b2f7ddf497d69e3c8537b216f83e512e4fa91c332f

SHA512
4c48a505f1d37b319ffdafafef4ca4ac7eab103d32088c3c1dad40b37036f9b73c454d030a3a15c4bbbe4935b583f162434eb6952bee35f3442d471b45932278

Download Submit
C:\Riot Games\Riot Client\RiotClientCrashHandler.exe

Filesize
1.9MB

MD5
e9022af4e5cf995c2f2a9d897af560e9

SHA1
f6a0e432af5a1f87492d936afcadc0fb671b3da2

SHA256
76d2ad3dfa217321475a92b2f7ddf497d69e3c8537b216f83e512e4fa91c332f

SHA512
4c48a505f1d37b319ffdafafef4ca4ac7eab103d32088c3c1dad40b37036f9b73c454d030a3a15c4bbbe4935b583f162434eb6952bee35f3442d471b45932278

Download Submit
C:\Riot Games\Riot Client\RiotClientFoundation.dll

Filesize
11.4MB

MD5
e04eacfc209f114c97e81acb272243b7

SHA1
c3f4b29e21987d67495d77f2e9ae76faa554647d

SHA256
3af4543196bb2838d00dbc8921f3f92803270876d56d9b8a60915cd9f348fa7d

SHA512
62ee8dcc7dbcf2a9a985ab2bec529a2d637b1db3348eed8fa852970b780849bb8d43e7a73fa328a9232ce787ab2e842c15a22997ccf0f6a007859f8886fd25cb

Download Submit
C:\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
C:\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
C:\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
C:\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
C:\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
C:\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
C:\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
C:\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
C:\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
C:\Riot Games\Riot Client\RiotGamesApi.dll

Filesize
20.5MB

MD5
57e0622711fad5392858fabb46fc7695

SHA1
c2c42d86e56e828c9b317db998022aba43df2d30

SHA256
797ce3343699acf89204e7f10e118711f150168ed8f52db33886da887a1a9d75

SHA512
9de27d7f3ec0912d62157bfaf156ca2a639be6321f68eb6235f1fd4b6d318913b11626e30cd95105b877e0669e203b0e0f13720a201fb6445122557ff7b23e86

Download Submit
C:\Riot Games\Riot Client\UX\RiotClientUx.exe

Filesize
4.6MB

MD5
7a5784e86ef16466171420d774048526

SHA1
76f050c024173959af4897d9791ffe963e99de50

SHA256
c09aacadb3df0ef15e46f4fcd7255ce22cf4d0691ae3a9512ee26a71ae07df0a

SHA512
ec1c6c26e7498041da7d0d1e618f7ecca774f3f8735e45d312ba5156e01c31229b27dec8a5c24a9cd6bf4ef9cb3b3ed9b71d11e5f14a741e8da8645d35043a09

Download Submit
C:\Riot Games\Riot Client\UX\RiotClientUx.exe

Filesize
4.6MB

MD5
7a5784e86ef16466171420d774048526

SHA1
76f050c024173959af4897d9791ffe963e99de50

SHA256
c09aacadb3df0ef15e46f4fcd7255ce22cf4d0691ae3a9512ee26a71ae07df0a

SHA512
ec1c6c26e7498041da7d0d1e618f7ecca774f3f8735e45d312ba5156e01c31229b27dec8a5c24a9cd6bf4ef9cb3b3ed9b71d11e5f14a741e8da8645d35043a09

Download Submit
C:\Riot Games\Riot Client\UX\chrome_elf.dll

Filesize
690KB

MD5
4bc92038a76a457a1c36499bd843aa1a

SHA1
0ec0ab717f116231ee1f120e958aa1876845ffb0

SHA256
6084e9d7bf40c57c141e99fd061671abbf82dda61e8567dab22d4b5fdbc0cc29

SHA512
2ad8b1432bd79879d92e0d64ac0a5f14f554683a123e7fb86622a5263c3844c218d14495f60b4987add2e2d425348b3b63c1c398ae7ab5c59f11f22f7ef3e768

Download Submit
C:\Riot Games\Riot Client\UX\ffmpeg.dll

Filesize
1.2MB

MD5
eae2a95bb9404eda67360ebefeb32080

SHA1
a2ba1507a815c54a91f74f3f1965ff1cceb75e13

SHA256
ebdf82bf567ba506879352053d5d670b369a41cfe783f3c177010460146518d3

SHA512
f6a06c3d678195b5c9b091e89b4493cf4012f1cf1f820f2778d28236d9566ed115feacb07f237ec79a8b71ddba3453d57233c63e079a0b498ad09b561a0e472c

Download Submit
C:\Riot Games\Riot Client\UX\libcef.dll

Filesize
89.2MB

MD5
481df7f01a1b3a6d028790d20f2d97bb

SHA1
2d56b5244ad233e1c9ca727b502d5c54976ba431

SHA256
dc01fa5ca5c750c8c9ac807ae10cafb6edc3ded266d116dbf488c5bd67ee96cd

SHA512
630a7931f7bf23f27580c87dbd9093e78e26a322e708faca6dd79778640e624f7816c84114be28017fb26f53f49a56bba42ecfa96be06b901d6e24a087a4ecc6

Download Submit
C:\Riot Games\Riot Client\system.yaml

Filesize
16KB

MD5
050fc31c8fcddaed084965562f5dc2b8

SHA1
285a02a573c9359c77b4c8f9e127d331a289c091

SHA256
4f073ca28aacc0bc59b6cf2dd2ec3aa091af803f53174a5d7fcff75f2e9c9edb

SHA512
013b9a32a5f3406a54ddf766e741dbb20619a800a3adb02fb31245830add87f56e0dd5f33e683b373260ff8c217c97bcb7e650c2506243121e7f19e42c0bd695

Download Submit
C:\Riot Games\Riot Client\vgrl.dll

Filesize
3.4MB

MD5
15620a9f1936c028377523116e657b82

SHA1
be2d28d85af3c0e98884b6874f4668d361caf7c4

SHA256
786499d901e9b4f7d5f5d00847fd09ee6ddfebe7ef824c53b49e569a670d6e28

SHA512
1ae0c54dd997aeb9d95a5f78be98ebf66a022545ec6e61422fd8c754030ffec0485aabf3ffa7b9ca9feb7c6f638cde94c7335d56a17d9eb9fea2c179f2326f9a

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Config\RiotClientSettings.yaml

Filesize
1KB

MD5
e3a6e61828396070fdc15df4f6872646

SHA1
795a1442d409958cd81aacb5c9470949fcbe7a66

SHA256
8136bba1aa46a2f521867026151ec51b5b3522904b6ef2e8611f564b9a8477f2

SHA512
cdd406009838a58345959838574d40954960a21a631f95c8ade44e9d9133ec529ab38975763cc98867a3701ba9802eb236a5d345fcec3e35e5cb9e351f42f8c1

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Config\RiotClientSettings.yaml

Filesize
1KB

MD5
2b65c82c635b51c7fa9070e3b1d49569

SHA1
6a8873a60bc4e27f2962dd71535ca6ebf3791f2c

SHA256
a1ed019f8403380412936e09f52c67b71c46e987aa25cb0c84e0bc48df653e50

SHA512
09447588379d6f8e3393afeace5d4187362ef75f9040fdc7daa3f0192b543836c24f162263596734b7bfbd8ea421ad32463722dbd737549b515c12fdbc3c45b9

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Config\RiotClientSettings.yaml

Filesize
1KB

MD5
eb9f12437d00419996d0b176cb61f922

SHA1
d943335ef22c67afbc15ef8fcacaa391ac7dded3

SHA256
1e3fcee19eb3d895b11b21f4bb902c8297b7a719f1120f992f3e43cdb055fcfe

SHA512
d6c3d754853a3725576e4d86816aa80528070c195048569119bff11267a64e3b6b87bb630407ead4ae54a060e1d9d0a2f1be66adedbb8a6f36110f20896e1f27

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Config\RiotClientSettings.yaml

Filesize
1KB

MD5
55be801eaeb7dbdb772a10f1bedc83d2

SHA1
ea6c1c9671ecb2c878957a120d9692817927f926

SHA256
a95c977fbefdf54e1c663c027e14a8aef8daf2f91e8e71c1168f4a707458f217

SHA512
6fecd12548e22e7b85fc065748ec5b7323decdd307272745e93ad7ec8d320a1ec7a1c807c9a68b229cf4163905caf1abe4837d98906356f06ba4487c25fa4e29

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Config\lockfile

Filesize
51B

MD5
2e8c36a8a802b02cc3b22959f42870b9

SHA1
43a3ab6be4c6e8f81aab6ff93889a0df4bcbef29

SHA256
67fa7c36fb2f89636529071fad27686612b0f37136c260ef72d9f57a8247300c

SHA512
5333a5f2e8d337d42320125b8b054af4547ca2ef02f76f935e36970b6e8b7107a473ee8985e0f3ea53b67beb2ca323ad94ff92959b53c29c367cf4df9b7380bd

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\0b080718-1d5c-4d4e-b2a3-47271ddd123e.run\__sentry-event

Filesize
541B

MD5
23ccaead79d2f24ca050cf0cd764c012

SHA1
300acb96956afacadf7e1373034e59d6ed3368d1

SHA256
3ab1e4a39451c02274f9d81e0d64f4ff8a079f55364a5afbf0eb5c014a8774b8

SHA512
0554662e38d146bebfe8a101a7dc73c5d4c9aa5600ab496662ad1c542325d4c18abad7ac7ff5f7689d2c13f6051e57d1aebed95179f4f5d575eb99e52a8f326e

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\2e3a1c56-90c6-4399-89a2-c4b37f73d5e4.run\__sentry-event

Filesize
541B

MD5
ea87f094d620961e21daf13560b996c7

SHA1
fe958515d56cb4132db2d2c4f7add2904c0af5b6

SHA256
af98854b0f77eb96262a269c72576a9dae91d0cdeff2ea886dbe3cbf620bf761

SHA512
b0a123adad589745ef4d9e28595c1a65797fdf432e069ade351365e7bbd9c1566d39135fd558b68ce6f672b06b15d4389b8cf94e8b3acaece96af76acab67e0a

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\3cdfd994-ee57-4b84-f672-8e9424aa944f.run\__sentry-event

Filesize
541B

MD5
34341d285169cd7c5e39d2217bf1d6a1

SHA1
582abb1a810cd514fdf1135fa5987f67bb1567e3

SHA256
acb7a23e71995063b88b6668e8d7a5917699d79eef92a5eb978d6d5091267e80

SHA512
7fa45a9657cc6b59eda319ab6c8cea5fb1cdf737c45127fe0463b8dc078b5a88beacc2fedef379e0f9b6d27a7624aedf9f0398007ea710b4374603aa850e15de

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\841fbc5c-3fc7-4707-d59f-21c2eabe5dae.run\__sentry-event

Filesize
462B

MD5
58883a3779ed2352607f2036aa38c095

SHA1
3a139029329dc892551a2bbfd747ca4bace57603

SHA256
1481cec061cf8edd1708a91f135081135cc49c95ee25c8dfca889845755f7db5

SHA512
3da239ef719e62169eb48e10ead51c2554c2c179e156bd016741158371f986f98b868b1b2f5a398bd1b1c81025d7c3ab374a14d8f34575fb815aef6cb6f13054

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\ddb89b55-47d2-4f67-f8aa-b77ee29f4854.run\__sentry-event

Filesize
462B

MD5
b0f893830da72b78393f2053a2174e83

SHA1
f6c127f973cdae03de9eaf8163d054f304c84093

SHA256
1ea9b72b11553070dacb2592658c968e0c5eb8356ee31893484253d32cbcafb5

SHA512
b585144a7f22d50f5a5388fbc3f147818ac23c8e68a7549bd7de303f4c299a36e6c147a8b421a55a918fb81625f5aa436eb8d5be8576f2fec7446899ccc97ec2

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\settings.dat

Filesize
40B

MD5
f5dd10e81d025c1ad1b05f3bb48caeeb

SHA1
9dba9725193d660cff3d124eb59f45045f54a626

SHA256
699eadd40e4a58725f62a7de44aa649ccdd33cad36c1d82ae78b4c426bed89e7

SHA512
c6a9e4dfde15c36828c342f81706d1d194835cf77d9aad14b74449ec9a79361a5a7122f5ad1e9c3f1739db5cbb3439d5f092a60d90110e47110d359cc7761fc8

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\settings.dat

Filesize
40B

MD5
f5dd10e81d025c1ad1b05f3bb48caeeb

SHA1
9dba9725193d660cff3d124eb59f45045f54a626

SHA256
699eadd40e4a58725f62a7de44aa649ccdd33cad36c1d82ae78b4c426bed89e7

SHA512
c6a9e4dfde15c36828c342f81706d1d194835cf77d9aad14b74449ec9a79361a5a7122f5ad1e9c3f1739db5cbb3439d5f092a60d90110e47110d359cc7761fc8

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\settings.dat

Filesize
40B

MD5
f5dd10e81d025c1ad1b05f3bb48caeeb

SHA1
9dba9725193d660cff3d124eb59f45045f54a626

SHA256
699eadd40e4a58725f62a7de44aa649ccdd33cad36c1d82ae78b4c426bed89e7

SHA512
c6a9e4dfde15c36828c342f81706d1d194835cf77d9aad14b74449ec9a79361a5a7122f5ad1e9c3f1739db5cbb3439d5f092a60d90110e47110d359cc7761fc8

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\settings.dat

Filesize
40B

MD5
f5dd10e81d025c1ad1b05f3bb48caeeb

SHA1
9dba9725193d660cff3d124eb59f45045f54a626

SHA256
699eadd40e4a58725f62a7de44aa649ccdd33cad36c1d82ae78b4c426bed89e7

SHA512
c6a9e4dfde15c36828c342f81706d1d194835cf77d9aad14b74449ec9a79361a5a7122f5ad1e9c3f1739db5cbb3439d5f092a60d90110e47110d359cc7761fc8

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\Riot Client\settings.dat

Filesize
40B

MD5
f5dd10e81d025c1ad1b05f3bb48caeeb

SHA1
9dba9725193d660cff3d124eb59f45045f54a626

SHA256
699eadd40e4a58725f62a7de44aa649ccdd33cad36c1d82ae78b4c426bed89e7

SHA512
c6a9e4dfde15c36828c342f81706d1d194835cf77d9aad14b74449ec9a79361a5a7122f5ad1e9c3f1739db5cbb3439d5f092a60d90110e47110d359cc7761fc8

Download Submit
C:\Users\Admin\AppData\Local\Riot Games\Riot Client\Crashes\RiotClientUx\166e8769-ec52-44f4-b5fe-5986062a223c.run\__sentry-event

Filesize
464B

MD5
53c3d3cccbe642f05f9521a71f30412a

SHA1
903b579cca03a018de4d74b520de3e326cebc8fd

SHA256
00e9478f3b63fdfa5b11a9b10dcc2d062f137415f78d43be07dd99ad98adaab7

SHA512
b22da937004eae464038e8d80c678159408d2e0eed67bcf9f75fe4e5bb20750f0e529eae88133c1eb44ac512fe3ac1e8613668398e9fe07e402a928f35cf7a04

Download Submit
C:\Users\Public\Desktop\Riot Client.lnk

Filesize
1KB

MD5
daa4118d9e8a4a74a4673e4b600bc102

SHA1
39c9c808f87e246b09d041baa3f20b7dc556256c

SHA256
e710561f3183a605f7ad8ee2a13e4b11fbeeee63310180ee58000e26dbc91225

SHA512
c28ab873511280a6882da4c7ab2fd572e3fb6dd5411af12d85c09b91dfb11af0d44ebe4480ae846a3dfcf773198e5162493e166e73354f679f8358057b9628ba

Download Submit
C:\Users\Public\Desktop\Riot Client.lnk

Filesize
1KB

MD5
daa4118d9e8a4a74a4673e4b600bc102

SHA1
39c9c808f87e246b09d041baa3f20b7dc556256c

SHA256
e710561f3183a605f7ad8ee2a13e4b11fbeeee63310180ee58000e26dbc91225

SHA512
c28ab873511280a6882da4c7ab2fd572e3fb6dd5411af12d85c09b91dfb11af0d44ebe4480ae846a3dfcf773198e5162493e166e73354f679f8358057b9628ba

Download Submit
\ProgramData\Riot Games\Metadata\vanguard\setup.exe

Filesize
24.3MB

MD5
101e94cc3b8903106910ee9e35499035

SHA1
c1a853e0239c85ccb6db871ea9b1e3812ac0d14f

SHA256
b97ca096f4295a3d663f886ac267ca021acc7e61db7740143e75ffeeba897353

SHA512
da8c8a2a52d5f88b356fd0440c6999bab9b495a9702940cc9f5867f735b6acc05eeea307d9ae0d0e81c1e0ee793de183502e4509801482f4eb08b5d705561774

Download Submit
\Riot Games\Riot Client\RiotClientCrashHandler.exe

Filesize
1.9MB

MD5
e9022af4e5cf995c2f2a9d897af560e9

SHA1
f6a0e432af5a1f87492d936afcadc0fb671b3da2

SHA256
76d2ad3dfa217321475a92b2f7ddf497d69e3c8537b216f83e512e4fa91c332f

SHA512
4c48a505f1d37b319ffdafafef4ca4ac7eab103d32088c3c1dad40b37036f9b73c454d030a3a15c4bbbe4935b583f162434eb6952bee35f3442d471b45932278

Download Submit
\Riot Games\Riot Client\RiotClientFoundation.dll

Filesize
11.4MB

MD5
e04eacfc209f114c97e81acb272243b7

SHA1
c3f4b29e21987d67495d77f2e9ae76faa554647d

SHA256
3af4543196bb2838d00dbc8921f3f92803270876d56d9b8a60915cd9f348fa7d

SHA512
62ee8dcc7dbcf2a9a985ab2bec529a2d637b1db3348eed8fa852970b780849bb8d43e7a73fa328a9232ce787ab2e842c15a22997ccf0f6a007859f8886fd25cb

Download Submit
\Riot Games\Riot Client\RiotClientFoundation.dll

Filesize
11.4MB

MD5
e04eacfc209f114c97e81acb272243b7

SHA1
c3f4b29e21987d67495d77f2e9ae76faa554647d

SHA256
3af4543196bb2838d00dbc8921f3f92803270876d56d9b8a60915cd9f348fa7d

SHA512
62ee8dcc7dbcf2a9a985ab2bec529a2d637b1db3348eed8fa852970b780849bb8d43e7a73fa328a9232ce787ab2e842c15a22997ccf0f6a007859f8886fd25cb

Download Submit
\Riot Games\Riot Client\RiotClientFoundation.dll

Filesize
11.4MB

MD5
e04eacfc209f114c97e81acb272243b7

SHA1
c3f4b29e21987d67495d77f2e9ae76faa554647d

SHA256
3af4543196bb2838d00dbc8921f3f92803270876d56d9b8a60915cd9f348fa7d

SHA512
62ee8dcc7dbcf2a9a985ab2bec529a2d637b1db3348eed8fa852970b780849bb8d43e7a73fa328a9232ce787ab2e842c15a22997ccf0f6a007859f8886fd25cb

Download Submit
\Riot Games\Riot Client\RiotClientFoundation.dll

Filesize
11.4MB

MD5
e04eacfc209f114c97e81acb272243b7

SHA1
c3f4b29e21987d67495d77f2e9ae76faa554647d

SHA256
3af4543196bb2838d00dbc8921f3f92803270876d56d9b8a60915cd9f348fa7d

SHA512
62ee8dcc7dbcf2a9a985ab2bec529a2d637b1db3348eed8fa852970b780849bb8d43e7a73fa328a9232ce787ab2e842c15a22997ccf0f6a007859f8886fd25cb

Download Submit
\Riot Games\Riot Client\RiotClientFoundation.dll

Filesize
11.4MB

MD5
e04eacfc209f114c97e81acb272243b7

SHA1
c3f4b29e21987d67495d77f2e9ae76faa554647d

SHA256
3af4543196bb2838d00dbc8921f3f92803270876d56d9b8a60915cd9f348fa7d

SHA512
62ee8dcc7dbcf2a9a985ab2bec529a2d637b1db3348eed8fa852970b780849bb8d43e7a73fa328a9232ce787ab2e842c15a22997ccf0f6a007859f8886fd25cb

Download Submit
\Riot Games\Riot Client\RiotClientServices.exe

Filesize
67.5MB

MD5
1837a6d4c6b5235a900cf44766b1df8b

SHA1
7e02894626e56c77363cc792541549451b716cbc

SHA256
25a5d0df795e6b6c8cbcb854ac1613e0a8e46ca0241643d686da3d2c6850a63e

SHA512
2b380d7a48d08259d3f49c9eb3e5f5c201db6bf8c7e212c735073fa513eeb35436337b661a412c8c953e43101b8b13c7e35547c8f9fa2b29267e2054a730e2b9

Download Submit
\Riot Games\Riot Client\RiotGamesApi.dll

Filesize
20.5MB

MD5
57e0622711fad5392858fabb46fc7695

SHA1
c2c42d86e56e828c9b317db998022aba43df2d30

SHA256
797ce3343699acf89204e7f10e118711f150168ed8f52db33886da887a1a9d75

SHA512
9de27d7f3ec0912d62157bfaf156ca2a639be6321f68eb6235f1fd4b6d318913b11626e30cd95105b877e0669e203b0e0f13720a201fb6445122557ff7b23e86

Download Submit
\Riot Games\Riot Client\RiotGamesApi.dll

Filesize
20.5MB

MD5
57e0622711fad5392858fabb46fc7695

SHA1
c2c42d86e56e828c9b317db998022aba43df2d30

SHA256
797ce3343699acf89204e7f10e118711f150168ed8f52db33886da887a1a9d75

SHA512
9de27d7f3ec0912d62157bfaf156ca2a639be6321f68eb6235f1fd4b6d318913b11626e30cd95105b877e0669e203b0e0f13720a201fb6445122557ff7b23e86

Download Submit
\Riot Games\Riot Client\RiotGamesApi.dll

Filesize
20.5MB

MD5
57e0622711fad5392858fabb46fc7695

SHA1
c2c42d86e56e828c9b317db998022aba43df2d30

SHA256
797ce3343699acf89204e7f10e118711f150168ed8f52db33886da887a1a9d75

SHA512
9de27d7f3ec0912d62157bfaf156ca2a639be6321f68eb6235f1fd4b6d318913b11626e30cd95105b877e0669e203b0e0f13720a201fb6445122557ff7b23e86

Download Submit
\Riot Games\Riot Client\RiotGamesApi.dll

Filesize
20.5MB

MD5
57e0622711fad5392858fabb46fc7695

SHA1
c2c42d86e56e828c9b317db998022aba43df2d30

SHA256
797ce3343699acf89204e7f10e118711f150168ed8f52db33886da887a1a9d75

SHA512
9de27d7f3ec0912d62157bfaf156ca2a639be6321f68eb6235f1fd4b6d318913b11626e30cd95105b877e0669e203b0e0f13720a201fb6445122557ff7b23e86

Download Submit
\Riot Games\Riot Client\RiotGamesApi.dll

Filesize
20.5MB

MD5
57e0622711fad5392858fabb46fc7695

SHA1
c2c42d86e56e828c9b317db998022aba43df2d30

SHA256
797ce3343699acf89204e7f10e118711f150168ed8f52db33886da887a1a9d75

SHA512
9de27d7f3ec0912d62157bfaf156ca2a639be6321f68eb6235f1fd4b6d318913b11626e30cd95105b877e0669e203b0e0f13720a201fb6445122557ff7b23e86

Download Submit
\Riot Games\Riot Client\UX\RiotClientUx.exe

Filesize
4.6MB

MD5
7a5784e86ef16466171420d774048526

SHA1
76f050c024173959af4897d9791ffe963e99de50

SHA256
c09aacadb3df0ef15e46f4fcd7255ce22cf4d0691ae3a9512ee26a71ae07df0a

SHA512
ec1c6c26e7498041da7d0d1e618f7ecca774f3f8735e45d312ba5156e01c31229b27dec8a5c24a9cd6bf4ef9cb3b3ed9b71d11e5f14a741e8da8645d35043a09

Download Submit
\Riot Games\Riot Client\UX\chrome_elf.dll

Filesize
690KB

MD5
4bc92038a76a457a1c36499bd843aa1a

SHA1
0ec0ab717f116231ee1f120e958aa1876845ffb0

SHA256
6084e9d7bf40c57c141e99fd061671abbf82dda61e8567dab22d4b5fdbc0cc29

SHA512
2ad8b1432bd79879d92e0d64ac0a5f14f554683a123e7fb86622a5263c3844c218d14495f60b4987add2e2d425348b3b63c1c398ae7ab5c59f11f22f7ef3e768

Download Submit
\Riot Games\Riot Client\UX\ffmpeg.dll

Filesize
1.2MB

MD5
eae2a95bb9404eda67360ebefeb32080

SHA1
a2ba1507a815c54a91f74f3f1965ff1cceb75e13

SHA256
ebdf82bf567ba506879352053d5d670b369a41cfe783f3c177010460146518d3

SHA512
f6a06c3d678195b5c9b091e89b4493cf4012f1cf1f820f2778d28236d9566ed115feacb07f237ec79a8b71ddba3453d57233c63e079a0b498ad09b561a0e472c

Download Submit
\Riot Games\Riot Client\UX\libcef.dll

Filesize
89.2MB

MD5
481df7f01a1b3a6d028790d20f2d97bb

SHA1
2d56b5244ad233e1c9ca727b502d5c54976ba431

SHA256
dc01fa5ca5c750c8c9ac807ae10cafb6edc3ded266d116dbf488c5bd67ee96cd

SHA512
630a7931f7bf23f27580c87dbd9093e78e26a322e708faca6dd79778640e624f7816c84114be28017fb26f53f49a56bba42ecfa96be06b901d6e24a087a4ecc6

Download Submit
\Riot Games\Riot Client\vgrl.dll

Filesize
3.4MB

MD5
15620a9f1936c028377523116e657b82

SHA1
be2d28d85af3c0e98884b6874f4668d361caf7c4

SHA256
786499d901e9b4f7d5f5d00847fd09ee6ddfebe7ef824c53b49e569a670d6e28

SHA512
1ae0c54dd997aeb9d95a5f78be98ebf66a022545ec6e61422fd8c754030ffec0485aabf3ffa7b9ca9feb7c6f638cde94c7335d56a17d9eb9fea2c179f2326f9a

Download Submit
memory/1600-233-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1600-224-0x00000000723B0000-0x00000000728B7000-memory.dmp

Filesize
5.0MB

Download
memory/2872-380-0x000007FEF67A0000-0x000007FEF6C4E000-memory.dmp

Filesize
4.7MB

Download